APD Defense, LLC

Privacy Policy

One policy, covering three Android apps: PulseLink, CommandLink and TerraLink.

Effective date: October 5, 2026 · Version 1.1.2

In short

These three Android apps are companions to an APD Defense encrypted mesh radio. They are built to work with no cell service and no internet.

We do not collect your records. Nothing you record in the apps — casualties, messages, positions, rosters, keys — is sent to us. We cannot see it.
The one exception is a problem report you choose to send. If you tap Report a Problem, you see the whole report first, and nothing is sent unless you tap Send. It goes to APD Defense over the internet. See Problem reports.
There are no ads, no analytics, no trackers and no automatic crash reporting. We checked the code, not just our intentions: there is no advertising library, no analytics library, no crash reporting library and no Google Play Services dependency in any of the three apps.
You need no account. There is nothing to sign up for and no login.
Your records stay on your phone, in each app's private storage, which other apps on the phone cannot read.
What leaves the phone goes over your radio, to the other radios on your own net, encrypted and authenticated by the radio hardware — and only when you send it, or when you have left position sharing on (see Location).
These apps are prototypes. They are not FDA cleared, and they are not certified or approved for any purpose.

The rest of this policy says exactly what each app holds, where it holds it, and what can leave.

Who we are
The apps this policy covers
What each app stores, and where
Health information in PulseLink
Location
Permissions, and why each one exists
Analytics, advertising and third-party code
Problem reports
Working offline
Security
How long we keep things, and how you delete them
Children
Changes to this policy
Contact

Who we are

APD Defense, LLC
Idaho, United States
Email: support@apddefense.com
Web: apddefense.com

For any privacy question, or to ask us anything about this policy, email the address above.

The apps this policy covers

App	Package name	Who it is for
PulseLink	`com.apddefense.pulselink`	A medic. Casualty triage records, MARCH treatment notes, the 9-line MEDEVAC request, a mission archive.
CommandLink	`com.apddefense.tacticalradio`	A leader or radio administrator. Radio link and diagnostics, messaging, map, network key management, radio firmware updates.
TerraLink	`com.apddefense.civ`	A handheld radio user, civilian or general government. Messaging, who is on the net, maps, network keys for the user's own radio.

All three connect to an APD Defense radio over a USB cable. CommandLink can also connect over Bluetooth Low Energy. All three also run without any radio attached, in Training Mode, where everything on screen is made up.

What each app stores, and where

Everything listed here is stored in the app's own private storage on your phone — the area Android gives each app and keeps other apps out of. It is protected by your phone's own encryption and your lock screen. None of it is uploaded anywhere. The one thing an app can send over the internet is a problem report you choose to send, and none of the records below go into one, apart from the technical part of the last crash record, as its row says.

PulseLink

What	Where it is kept	Notes
Mission setup: your call sign, mission name, MEDEVAC frequency, receiving station call sign, map sheet, grid zone, magnetic declination, free-text notes	App-private preferences	Typed by you
Squad roster: names and call signs you enter	App-private preferences	Typed by you; used to put names on cards instead of radio numbers
Radios you have registered, and radios you have marked lost	App-private preferences	Radio labels, scanned or typed
Mission archive: one file per finished mission — casualty names and call signs, triage category, the MARCH checklist, tourniquet times, what treatment you recorded, dispositions, and the positions that were reported	App-private files	Capped at 10 missions and 30 days. Older or surplus missions are deleted automatically, both at app start and after every write. Records are never edited, only added or deleted.
Readings received from radios	In memory while the app runs; written into the archive when a mission ends	See Vital signs
A 4-character random tag generated once per install	App-private preferences	Used to make each 9-line request uniquely identifiable so a re-send updates one marker instead of creating a second. It is not a device identifier and is not derived from your phone.
Your unit preference (feet/miles or meters/kilometers), map and display settings	App-private preferences
A record of the last app crash, if one ever happened: the time and the technical stack trace	One app-private file	Shown in Settings as a time. Only the most recent one is kept. Never sent automatically. It leaves the phone only inside a problem report you send with the diagnostic log switched on, and then with the error message text removed (see Problem reports).
Problem reports you sent that have not reached us yet	App-private files	Deleted from the phone as soon as our relay accepts them. A report the relay refuses outright stays on the phone, marked NOT ACCEPTED.
Offline map files you downloaded	App-private files	See map downloads

Training Mode is never saved. The app always starts live, and training missions are never written to the archive.

CommandLink

What	Where it is kept	Notes
Your call sign, and a random app-generated identifier (`APD-` plus 8 characters)	App-private preferences	The identifier goes over the radio inside your position and message reports so receivers can tell reports apart. It is randomly generated by the app. It is not your phone's advertising ID, IMEI, MAC address or serial number, and we do not read any of those.
Your radio inventory: the radios you have registered, and who you noted is carrying them	App-private preferences
Network keys for the radio net, if you generate or scan any	App-private preferences, each key encrypted with AES-256-GCM under a key held in the Android hardware key store	Shown only after your phone's own unlock. Never logged, never copyable to the clipboard. A key leaves the phone only when you choose Load To Radio, and then only to the radio on the USB cable (never over Bluetooth, never to us). Delete All Keys destroys the hardware key store key as well, so any remaining bytes are unreadable.
A key scanned for Fill Radio	In memory only, for at most 5 minutes	Never stored. Wiped when the radio reports it loaded, on Done or Discard, or when you leave the screen.
The hardware IDs of radios this phone has seen with an owner lock	App-private preferences	Used to warn you if such a radio later claims to be factory-fresh. Not secret: the IDs are printed on the radios' labels.
An administrator PIN, if you set one	Stored only as a salted PBKDF2-HMAC-SHA256 hash, itself encrypted under a hardware key store key	The digits are never stored. Wrong entries are counted and lock the screen for a while.
Leader mission archive: one file per finished mission — the 9-line MEDEVAC requests received (kept exactly as they arrived), roster pushes received, messages you sent, and the radio list	App-private files	Capped at 10 missions and 30 days, pruned automatically. The in-progress mission is also written so a phone restart does not lose it. Received 9-lines can contain casualty information sent by a medic.
Messages received over the radio	In memory only, most recent 500, for the session	Not written to disk. Messages you send are recorded in the mission file above.
Map, alert-sound, ATAK bridge and USB settings	App-private preferences
A record of the last app crash	One app-private file	As PulseLink, above: never sent automatically.
Problem reports not yet sent	App-private files	As PulseLink, above
Offline map files you downloaded	App-private files

CommandLink excludes all of its data from Android cloud backup and from device-to-device transfer, so a key store or a mission record cannot leave the phone that way.

TerraLink

What	Where it is kept	Notes
Your name on the net, and a random app-generated identifier (`CIV-` plus 8 characters)	App-private preferences	Same kind of identifier as CommandLink's, above
Your radio list	App-private preferences
Network keys, if you generate or scan any	App-private preferences, each key encrypted with AES-256-GCM under a key held in the Android hardware key store	The same implementation as CommandLink's, above: shown only after your phone's own unlock, and sent only to the radio on the USB cable when you choose Load To Radio.
A key scanned for Fill Radio, and the hardware IDs of radios seen with an owner lock	As CommandLink, above	As CommandLink, above
Whether you are sharing your position on the net (on by default; there is a switch in Settings)	App-private preferences
Map and USB settings	App-private preferences
Messages received over the radio	In memory only, for the session	Not written to disk
A record of the last app crash	One app-private file	Never sent automatically; as PulseLink, above
Problem reports not yet sent	App-private files	As PulseLink, above
Offline map files you downloaded	App-private files

TerraLink holds no casualty records, no triage and no 9-line. Those belong to PulseLink and CommandLink. TerraLink excludes all of its data from Android cloud backup and from device-to-device transfer, as CommandLink does.

Health information in PulseLink

This is the most sensitive information any of the three apps handles, so it gets its own section.

What PulseLink holds. Casualty records you create: a name and call sign from the roster you typed, the triage category shown for that person, the MARCH checklist and tourniquet times you recorded, what treatment you noted, the disposition you set, the last position reported for them, and any readings that arrived from their radio.

Where it lives. On your phone, in PulseLink's private storage. One file per mission. Capped at 10 missions and 30 days and pruned automatically. No other app on the phone can read it. PulseLink's records are excluded from Android cloud backup.

Where it can go. Every route is started by you.

A 9-line MEDEVAC request you write and send. You fill it in, you review it against what the app read back to you, and you press send. It goes out over the radio as a broadcast to every radio on your net; a leader running CommandLink sees it as a 9-line. The radio encrypts and authenticates it with the network key before it goes on the air.
A roster push you choose to send, so a leader's app can show who is carrying which radio. This sends call signs only unless you explicitly ask for names each time — the app defaults to call signs and requires you to opt in to names on every push.
A casualty card handed to another medic by QR code, from your screen to their camera. It does not use the radio or the internet, and it is not encrypted: anyone who can see or photograph your screen while it is showing can read it. It carries the casualty ID; the name is included only if you switch on Include Name for that handoff.
Android's share sheet or print service, when you choose them. PulseLink can hand a 9-line, a MIST report or a finished mission's text to another app you pick (a messaging app, email, notes), copy a 9-line to the clipboard, or send a casualty card to the phone's print service (including “Save as PDF”). Once it is in the other app, printer or file, it is under that app's or that service's rules, not ours, and it may leave the phone through them. Other apps on some Android versions can read the clipboard.

No route sends health information over the internet. PulseLink does contain network code, for two things only: downloading map images (see map downloads) and sending a problem report you chose to send. The map downloader has no access to the casualty board, the roster or a 9-line. A problem report is built from a fixed list of facts about the app, the phone and the radio, and it has no field that can hold a casualty, a card, a name, a call sign or a position; the only free text in it is what you type in the description. The part of the shared code that could relay a casualty over a network is wired, in PulseLink, to an implementation that does nothing.

No casualty record goes to APD Defense. Please don't type casualty details into a problem report's description: that text is sent as you typed it.

Vital signs — read this before you expect any

Important

The APD radios carry no vital-sign sensors. There is no pulse sensor, no oxygen sensor and no thermometer on the radio hardware. A live radio therefore reports no vitals at all, and the app shows dashes where a reading would go.

The apps are built so they never invent a value. “No reading” is carried as a specific value that means “nothing was reported”, kept deliberately distinct from a real measurement of zero, and shown on screen as dashes. A radio can report a motion state — moving, still, or immobile long enough that the radio itself flags it — and that is the only body-related reading the fielded hardware sends.

Made-up readings appear on screen in exactly one situation: Training Mode, which paints every screen magenta, marks every card SIM, and is never saved and never archived.

The medic decides

PulseLink is a prototype and a record-keeping aid for a trained medic.

It has no FDA clearance or approval, and has not been clinically validated.
It must not be relied on for medical care, for patient monitoring, or for any decision on which someone's safety depends.
The medic decides. The app shows what arrived, what the medic entered and any triage category it suggests. A suggested category counts nowhere until the medic confirms it, and the assessment of the person on the ground overrides the app in every case.

CommandLink and TerraLink are prototypes on the same terms.

Location

What is collected. Your phone's own position, from the Android platform location service, using the GPS provider and the network provider when one is available. The apps do not use Google Play Services' fused location provider and do not depend on Play Services at all.

When. Only while a screen that needs it is open, and only after you grant the location permission. Location is reference-counted: the Map screen and the 9-line form each turn it on while they are showing and turn it off when they close, so the GPS is not left running in your pocket. No app has background location permission, and none of them tracks you when you are not using them.

Where it goes.

App	What happens to your position
PulseLink	Stays on the phone. It centers the map, and it can fill line 1 of a 9-line when you tap USE MY POSITION — which is the only way it leaves, inside a request you send.
CommandLink	Sent over the radio to the other radios on your net when the phone decides you have moved (roughly 15 m on foot, 100 m in a vehicle, or a turn), rate-limited by the radio, with a periodic heartbeat. There is a Sharing switch in Settings, and it is on by default. Your choice is remembered across app restarts.
TerraLink	Same as CommandLink: shared on the net so other people can see where you are. On by default, with a switch in Settings that is remembered.

What is never done. Your position is never guessed, never inferred from Bluetooth, never sent to us, and never sent to any advertising or analytics service. When the phone does not know where it is, the apps say NO POSITION or NO FIX rather than showing a plausible-looking wrong place. A person whose position has not been reported is listed as unknown and is never drawn at a guessed point on the map.

Every time on screen is marked L (local) or Z (Zulu). You choose which in PulseLink's mission setup, or in Settings in CommandLink and TerraLink; local is the default. Times that go inside ATAK Cursor-on-Target messages are UTC, because that is what the format requires.

Permissions, and why each one exists

We ask for as little as we can, we ask at the moment the feature is used rather than at install, and every app keeps working if you say no — with the feature that needed it turned off.

Permission	Which apps	Why	If you refuse
Precise and approximate location	All three	Your own position on the map; line 1 of a 9-line; position sharing on the net	Map is north-up with no marker for you; the app says NO POSITION; you can still type a grid into a 9-line
Camera	All three	Scanning the QR code on a radio's label, and network key QR codes in CommandLink. Decoded on the phone by an on-device library. No image is ever uploaded, and camera frames are decoded in memory and discarded.	Type the radio's 8-digit code instead
Internet / network state	All three	Three things only: (1) downloading map tiles on Settings → Map Data, and only while Map Downloads is switched on — it is off by default; (2) sending a problem report you chose to send; (3) CommandLink and TerraLink talk to ATAK on the same phone over loopback, and Android requires this permission even for 127.0.0.1.	Map downloads, problem reports and the ATAK bridge do not work (a report waits on the phone). Everything else is unaffected.
Notifications	All three	Critical alarms (for example a received 9-line), message notifications, the persistent notification of the background services below, and a quiet notice when a problem report you sent has been delivered	Alarms and messages still arrive inside the app, but Android may not show them when the app is not in front; the services still work
Full-screen alerts and vibration	All three	Showing a critical alarm over the lock screen and vibrating for it	The alarm arrives as an ordinary notification
Do Not Disturb access	All three	Letting a critical alarm sound while the phone is in Do Not Disturb. Granted by you on Android's own settings screen, never automatically.	Alarms follow your Do Not Disturb settings
Foreground service (connected device)	All three	Holding the radio link alive while you use another app or the phone is locked, so an alarm can still reach you; and, in CommandLink and TerraLink, running the ATAK bridge while ATAK is in front. The radio link service starts only when a real radio is connected (never in Training Mode), or the bridge when you turn it on. In CommandLink it is stopped by Disconnect, by unplugging, or by the notification's Stop. In PulseLink it stops when you close the app, and in TerraLink when you tap Disconnect; if the radio is unplugged first, its notification says NO RADIO LINKED until then. Never starts at boot. The radio link service never restarts itself. The ATAK bridge can: if Android stops it while it is running, Android may start it again on its own. It then shows its notification again and waits for ATAK on this phone, but it does not reconnect the radio, so nothing passes between ATAK and the radio until you connect one. Stop in its notification ends it.	n/a (not a runtime prompt)
Run at startup and keep the phone awake	All three	Used only by Android's standard background-job library (WorkManager) to send a problem report you already chose to send, if the phone restarted before it got out. Nothing else runs at startup.	n/a (not a runtime prompt)
Change Wi-Fi multicast state	CommandLink, TerraLink	Only if you switch on the optional situational-awareness multicast output to the local network; the lock is taken then and released when the bridge stops	The optional multicast output does not work
Bluetooth scan / connect	CommandLink only	Connecting to a radio over Bluetooth Low Energy. Declared as never used for location — we do not derive your position from Bluetooth.	Use the USB cable instead
USB host	All three	Reaching the radio over the cable. This needs no manifest permission at all: Android asks you per device with its own dialog, and plugging a known radio in can launch the app.	Use Training Mode, or Bluetooth on CommandLink
Map pack sharing (`com.apddefense.permission.MAP_PACKS`)	All three	Lets the three APD apps read each other's downloaded maps, read-only, so a map downloaded once serves all three. It is a signature permission: Android grants it only to apps signed with the same key, so no other app can use it.	n/a

Permissions we deliberately do not have: no storage or photo/media permission, no contacts, no microphone, no SMS, no call log, no calendar, no background location, no “query all packages”, no advertising identifier. Where an app needs to open or save a file — a firmware image in CommandLink, or an imported map file — it uses Android's own document picker, which grants access to that one file you chose and nothing else.

Analytics, advertising and third-party code

There are none. No advertising SDK, no analytics SDK, no crash-reporting service, no attribution or marketing SDK, no Google Play Services, no Firebase, no push service, no A/B testing service, no remote configuration and no license check. The only APD Defense service the apps ever contact is the problem-report relay, and only to deliver a report you chose to send (see Problem reports).

The third-party code the apps do include is open-source library code that runs entirely on your phone and sends nothing anywhere:

AndroidX and Jetpack Compose (Google) — the user interface, camera plumbing, and WorkManager, which schedules the sending of a problem report you queued.
Kotlin coroutines (JetBrains) — background work.
ZXing core — decoding and drawing QR codes, on the device.
usb-serial-for-android — talking to the radio over the USB cable.

Map downloads

If, and only if, you switch on Map Downloads and choose an area, the app fetches map tiles from the United States Geological Survey's The National Map service (basemap.nationalmap.gov). What it sends is the coordinates of the tiles you asked for and a user-agent string that identifies the app and nothing about you; USGS will see your IP address, as any web server does. The app only fetches — it uploads nothing, and the downloader has no access to your records, your roster or your messages. A short list of map hosts is hard-coded; the app cannot be pointed at an arbitrary server. USGS map data is public domain, and the license and credit line are written into each map file.

No map host is contacted while you are on a mission. Maps are downloaded before you go.

Problem reports

Each app has a Report a Problem screen. It is the only way anything from the apps reaches APD Defense, and it only happens when you choose to send a report.

What is sent, and only when you choose

The screen shows you the whole report before anything leaves the phone. Nothing is sent unless you tap Send. A report contains only what the preview shows:

a report ID (8 random characters, new for each report, not linked to you, your phone or any record) and the time the report was written;
the description you type (up to 4,000 characters);
the app's name, version and build;
your phone's maker and model, and its Android version;
only if Include Diagnostic Log is on (it is on by default, and you can switch it off before sending): more build details (the app's source version, build date, package name, install and update dates, and a short fingerprint of its signing certificate), your phone's time zone and language/region setting, free storage, whether the app is exempt from battery optimization, whether Training Mode is on (PulseLink), how the radio is linked (USB, Bluetooth, simulated or none), whether saved data is newer than the app (PulseLink and CommandLink), the connected radio's firmware version and build, its status counters, its emission-control setting, and whether a network key is loaded in it (never the key itself or its fingerprint), and the most recent app crash (the technical stack only, with the error message text removed, because an error message can quote something you typed).

A report never includes your location, any casualty or medical information, messages, rosters, names, call signs, mission details, network keys, the radio's label code, or your email address or phone number. This is built in, not a filter: the report is assembled from a fixed list of facts about the app, the phone and the radio, and there is no place in it to put anything else. The one exception is the description you type, which is sent exactly as you wrote it, so please don't type casualty or personal details into it.

Because a report carries no contact details, we cannot reply to it. If you want an answer, email support@apddefense.com and quote the report ID.

How it travels, and where it goes

On your phone first. Tapping Send saves the report in the app's private storage. If you are offline, it waits there and goes out the next time the phone has an internet connection, even after a restart. The Report a Problem screen lists any report still waiting. It is deleted from the phone as soon as our relay accepts it. A report the relay refuses outright stays on the phone, marked NOT ACCEPTED.
To APD Defense's relay, a small program APD Defense runs on Cloudflare, sent encrypted in transit (HTTPS). The relay checks the report's format and passes it on. It does not store the report.
Into APD Defense's issue tracker on GitHub (GitHub is owned by Microsoft). Each report becomes an issue in a private repository that only APD Defense can open. APD Defense is one person, so in practice that is the company's owner.
By email, only as a fallback. If the relay cannot file the report on GitHub, it emails the report instead, from reports@apddefense.com to support@apddefense.com, which are APD Defense mailboxes hosted by Microsoft 365.

Who can see it

APD Defense, to find and fix the problem.
An automated sorting job. APD Defense uses an AI assistant, Claude from Anthropic, which reads new reports in the issue tracker to label and sort them, and may draft a fix that APD Defense has approved, for APD Defense to review. It is instructed to treat a report's text as data, not as instructions.
The service providers that carry or hold it (Cloudflare, GitHub, Anthropic and, for the email fallback, Microsoft 365), under their own terms, as for any data kept with them.

No one else. We do not sell reports, share them with anyone else, or use them for advertising, analytics or anything other than fixing problems in the apps and the radio.

What the relay keeps

The relay keeps no copy of the report. To stop duplicate and spam submissions it keeps three small records, and deletes each one automatically:

the report ID, marked sent or pending, for 24 hours, so a retried report is not filed twice;
a one-way hash of your internet (IP) address with the times of your recent reports, until about 2 hours after your last report, to limit how many reports one address can send in an hour. A hash is not strong anonymization: there are few enough IP addresses that one could be recovered from its hash by trying them all;
the times of all reports in the last day, with nothing attached to them, until about 2 days after the most recent report, to cap the total.

The relay's stored logging is switched off. The only lines it writes are event names and error codes, which never include the report, its ID or your IP address. Cloudflare, which hosts the relay, handles your phone's connection to it, including your IP address, and may process that connection data under its own terms.

How long we keep a report

We keep a report while the problem it describes is open, and delete it 12 months after the issue is closed. An emailed copy is deleted on the same schedule.

Asking for deletion

Email support@apddefense.com with the report ID (it is at the top of the report, and on the Report a Problem screen while the report is waiting on your phone). We will delete the issue, and any emailed copy, and confirm by reply. A report that has not left your phone yet (waiting to send, or refused by our relay) can be deleted on the Report a Problem screen: tap DELETE next to it, then confirm.

Working offline

These apps are offline-capable by design, not offline-restricted. Everything they do works with no cell service, no Wi-Fi and no internet at all, because the radio net is the point. The apps reach the internet for only two optional things, downloading maps and sending a problem report you chose to send; with no connection, every app is fully functional, and a report simply waits on the phone.

Security

Over the air: the radio, not the phone, is the encryption endpoint. Traffic on the mesh is encrypted and authenticated by the radio hardware with a network key. PulseLink holds no keys at all. CommandLink and TerraLink can hold keys, under the phone's hardware key store, as described above.
On the phone: app-private storage, under the phone's own encryption. Keys and the admin PIN get the extra hardware-backed layer described above. Use a lock screen — key material is bound to it.
Problem reports travel to our relay encrypted in transit (HTTPS). Once there, they are held by the service providers named under Problem reports, under those providers' own security.
Backups: all three apps are excluded from Android cloud backup. CommandLink and TerraLink additionally exclude themselves from device-to-device transfer. Being precise, because this policy should not overclaim: PulseLink currently disables cloud backup but does not carry the separate device-transfer exclusion rules that the other two do. We are reviewing that.
The cable is not encrypted. The USB link between phone and radio carries plain data. Keep the radio with you. When CommandLink or TerraLink loads a key into a radio that already has an owner, the key crosses the cable wrapped under that radio's owner secret; the first key loaded into a radio with no owner crosses it unwrapped.
The radio's debug port is open on current prototype hardware, so someone with physical possession of a radio and the right tools can read its network key. Treat a lost radio as a lost key: the fleet should be re-keyed. Treat this hardware as unclassified.
The app and the radio update differently. An app installed from Google Play may be updated by Google Play according to your phone's own update settings; the app cannot override them. If you want no automatic app updates on a phone (for example a mission phone), turn off auto-update for it in Google Play. Radio firmware never updates without your explicit consent: CommandLink shows you what will happen and how long it will take, and asks you to choose Update Now or Later — Later is the default, and an update can be declined or postponed freely.

How long we keep things, and how you delete them

The only thing we ever receive is a problem report you chose to send; how long we keep it, and how to ask us to delete it, is under Problem reports. Everything below is on your phone and under your control.

What	How long	How to delete it
PulseLink mission archive	Automatically: newest 10 missions, nothing older than 30 days	Settings → Mission Archive deletes one mission, or DELETE ALL ARCHIVES
CommandLink mission archive	Same: 10 missions, 30 days	The Missions screen deletes one, or DELETE ALL ARCHIVES
Network keys (CommandLink, TerraLink)	Until you delete them	Delete All Keys On This Phone, which also destroys the hardware key that protected them
Admin PIN (CommandLink)	Until you change it	Changed on the PIN screen; removed with the app
Mission brief, roster, radio list, settings	Until you change them or remove the app	Edit or clear the fields; or remove the app
Received messages	Held in memory only, and gone when the app closes	Close the app
Crash record	Only the most recent one	Removed with the app
Offline maps	Until you delete them	Settings → Map Data
Problem reports not yet sent	Until our relay accepts them	Clear the app's storage in Android's settings, or remove the app

To delete everything on the phone, uninstall the app. Android removes its private storage with it, which is every record, every setting, every key blob, every queued problem report and every map pack that app downloaded. Uninstalling does not remove a problem report we have already received; to have that deleted, email us as described under Problem reports.

Because there is no account, the only data of yours we can ever hold is a problem report you sent. If you have never sent one, a “please delete my data” request has nothing on our side to act on. If you would like us to confirm that in writing, email support@apddefense.com and we will.

Children

These apps are not directed at children and are not designed or marketed for anyone under 13. They are professional tools for radio operators, team leaders and medics, and they need APD Defense radio hardware to do anything real. We do not knowingly collect information from children; the only thing we ever receive from anyone is a problem report they chose to send. If you believe a child has used one of these apps in a way you are concerned about, email us and we will help you clear the phone, and delete any report they sent.

Changes to this policy

If we change what an app stores or what can leave your phone, we will update this policy, change the effective date at the top, and keep a short note of what changed. Material changes will be announced in the app's release notes on Google Play and on apddefense.com. Because we hold no contact details for you, we cannot email you — the date at the top of this page is the thing to check.

Version 1.1.2 (October 5, 2026) describes PulseLink accurately: it may suggest a triage category, which counts nowhere until the medic confirms it, and the medic makes every care decision. It removes the earlier statements that the apps are not medical devices and do not diagnose. The apps remain prototypes with no FDA clearance, and they have not been clinically validated. What the apps store and what can leave your phone are unchanged.

Version 1.1.1 (October 2, 2026) corrects statements in version 1.1 that were not true of the released apps:

Problem reports. Version 1.1 said APD Defense runs no server for these apps and receives nothing from them. In fact all three apps have a Report a Problem screen that sends a report you choose to send to APD Defense over the internet. We added Problem reports, which says what a report contains, that it is sent only when you tap Send, where it goes (APD Defense's relay on Cloudflare, then a private GitHub issue tracker, with Microsoft 365 email as a fallback), who can see it (including Claude, an AI assistant from Anthropic, which sorts reports), how long it is kept and how to ask for deletion. The summary, the page description, the storage tables, the crash-record rows, the internet permission, third-party code, working offline, security, retention and children sections now say the same thing.
Permissions. The table now lists permissions the released apps hold that version 1.1 left out or assigned to the wrong apps: notifications and the radio link service in all three apps, full-screen alerts, vibration and Do Not Disturb access for critical alarms, and the startup and wake permissions used only to send a queued problem report.
PulseLink health information. Version 1.1 said there were exactly two routes and that PulseLink has no network code; the app also lets you hand a casualty card over by QR code and share, copy or print reports, and it contains network code for map downloads and problem reports. No health information is sent over the internet.

Contact

APD Defense, LLC
Idaho, United States
support@apddefense.com
apddefense.com

A note on what this policy is derived from

Every factual claim above was taken from the apps' source code as it stands on the effective date — the manifests, the storage classes, the dependency lists and the network code — and, for problem reports, from the relay's own source code, rather than from intent or from marketing material. If you find a place where the apps behave differently from what this page says, tell us: the code is the thing that is meant to be true, and the page is what we will fix.