This policy is only for the Android app Lantern published as app.lantern. It is not the policy for lantern.io, GetLantern, or “Lantern: Fast & Private VPN” (org.getlantern.lantern).
1. Who we are
Lantern is a device-local offline library, nearby mesh, and optional USB LoRa accessory app. Pages, files, chat, maps, and controls live on your phone. The developer does not operate an account system or a content server for this app.
Contact: lantern.mesh@gmail.com (also the address on the Google Play listing for app.lantern).
2. Short version
- No Lantern account. No sign-in with us.
- Library, files, chat, maps, and home controls stay on the phone unless you offer them on mesh or send them on LoRa.
- We do not run a backend that receives your library, messages, files, or location.
- Location is read on the device for mesh discovery, map pins, and locking LoRa to the legal band for where GPS says you are. Coordinates are not uploaded to us.
- The SIM / network country code is read on the device to check LoRa rules. It is not uploaded to us.
- Capture, weather, satellite scan, and optional AI keys talk to third parties you choose — not to a Lantern server.
- Google Play processes the optional yearly privacy plan. Home automation is included and is not a purchase in current builds.
- Paid Bluetooth hops can use AES-256-GCM. LoRa is ordinary radio (compact plaintext).
3. Information stored on your device
Kept in app storage (SQLite, files, SharedPreferences) until you delete it, burn, or uninstall.
| Data | What it is | Why |
|---|---|---|
| Captured pages | URL, title, site, excerpt, stored HTML/text, size, time, offer flag | Offline reading |
| Field pack | Bundled reference articles shipped in the APK | Offline reading with no network |
| Files (“drops”) | Name, type, size, bytes, offer flag, optional sender, optional password lock metadata | Keep, open, and optionally share files |
| Callsign and channel | Display name and shared mesh word (default circle) | Find the right nearby phones |
| Optional profile | Name, look, note — only broadcast while mesh is on and you opt in | Tell nearby people who you are in person |
| Friends | Callsigns you marked as friends | Direct message and map pins |
| Chat | Messages you send and receive, channel vs direct vs group | Mesh messaging |
| Maps | Cached map tiles, last GPS fix, custom legend keys, amenity pins, share-map flag | Offline map and friend location when you enable it |
| Home controls | Names, URLs, BLE payloads, and commands you typed | Local buttons you created |
| LoRa settings | Locked country ISO from GPS, attestation, waiver, prefer-LoRa, USB radio state | Stay on an unlicensed band for the country you are in |
| SIM / network ISO | Two-letter country from the telephony API, read when you use LoRa | Cross-check GPS country; not a phone number |
| Weather file | A text forecast written to Files at most once per 12 hours if you toggle it | Offline forecast when a network appears |
| Ask / Field AI keys | API tokens you paste (xAI, OpenAI, Groq, Anthropic, Gemini, or compatible) | Live answers when you turn that on. Keys never leave the phone except to the provider you chose |
| Statistics | Local counts of messages/files and last-seen callsigns; previous callsigns after Burn | On-device Statistics screen. See §9 for what Burn does not erase |
| Play entitlement cache | Timestamps that mesh_lock_yearly was last seen as active (~13 months) | Keep Bluetooth encryption and share-passwords working in a blackout |
Android backup (if enabled) may copy app files and preferences to your Google account. The developer does not receive that backup.
4. Information we do not collect
The developer does not collect, and the app does not send to a Lantern server:
- Name, email, or phone number as an account (we only see email if you write to us)
- Payment card details (Google Play handles payment)
- Address book or SMS
- Advertising IDs
- Analytics or crash-reporting SDKs in the production app
- A browsing history other than URLs you choose to capture, stored locally
Location, SIM country, chat, files, and keys stay on the device or go peer-to-peer / to a site or API you invoked. They are not a developer database.
5. Location and radio identifiers
Lantern requests approximate and precise location. That is used on the device for:
- Nearby Connections — Android requires location for Bluetooth / Wi-Fi peer discovery on many versions.
- Maps — your last fix for the map cursor and, if you enable it, a pin that mesh friends can see while your mesh is on.
- LoRa country lock — GPS (and a SIM/network country check) pick the unlicensed band. Mock locations are ignored. Without a recent GPS fix, LoRa will not transmit.
Coordinates are stored locally as the last fix. They are not uploaded to the developer. If you turn on map sharing and mesh, nearby Lantern friends on your channel can see an approximate position. You can turn that off.
Deny location and mesh discovery, maps, and LoRa TX will not work. Capture and reading still work.
USB host permission is used only to talk to a LoRa board you plug in. The app does not inventory other USB devices for us.
6. What leaves the phone
Capture
Saving a page requests that URL (HTTPS when the site supports it). The site, your ISP, and anyone on that path can see the fetch. The user-agent is a generic Android browser plus “Lantern”. Tracking query parameters are stripped from the stored URL when recognized. Tapping a live link opens your system browser.
Weather
If you enable weather in Settings, the app may request a forecast from a public weather endpoint when a network is up, at most once per 12 hours, and save a .txt file in Files. A local notification tells you it arrived.
Satellite kit scan
Optional Wi-Fi scan looks at nearby SSID names for common satellite-kit patterns. SSIDs stay on the device. Associating with a kit is your network, not ours.
Ask / Field AI
If you paste a provider API key and enable live Ask, your question is sent to that provider under their privacy policy. Offline Ask uses a bundled corpus and does not leave the phone. We never receive your keys.
Google Play Billing
Optional product mesh_lock_yearly ($12 / year): AES-256-GCM on Bluetooth mesh hops and optional share-password lock. Google processes the purchase under Google’s Privacy Policy. The app stores local entitlement timestamps (~13 months) so the plan still works without a live Play check. Home automation is included; current builds do not require home_unlock.
Google Play services — Nearby Connections
Start on Mesh advertises and discovers other Lantern phones on the same channel using Bluetooth, Wi-Fi, and Wi-Fi Direct. Nearby radios — not only Lantern users — may observe that a radio is advertising. Offered titles, files, chat, and optional profile/location go only over accepted links (and over LoRa if you connected a board — see below).
USB LoRa
If you connect a USB LoRa module, attest, and accept the radio disclaimer, compact mesh payloads (chat, hello, catalog, commands) are transmitted on the locked unlicensed band. That is broadcast radio. Anyone with a compatible receiver on that band can demodulate it. LoRa is not covered by the Play encryption plan. Files and full pages stay on Bluetooth.
Home controls
Buttons you create send HTTP or BLE payloads to addresses you typed (your LAN or a paired device). Those packets go to your equipment, not to us.
7. What other people can see
| Situation | Who can see it |
|---|---|
| Page or file, Offer off, mesh off | Only this phone |
| Offered item, mesh live, same channel | A linked Lantern phone can see the title and pull a copy |
| Chat on a channel | Phones on that channel that are linked (Bluetooth) or on the LoRa air |
| Direct / group chat | The people you addressed, plus anyone who can hear LoRa if it went over LoRa |
| Optional profile, mesh on | Nearby Lantern users on your channel |
| Map share on | Mesh friends can see an approximate pin |
Default channel circle | Any nearby Lantern user on circle can try to link. Change it. |
| Paid Bluetooth hop | Payload is AES-256-GCM between those two phones. Metadata that a radio is up can still be observed |
| LoRa hop | Treat as audible radio. Compact plaintext |
| Play subscription | Google, as your Play account holder |
Copies already pulled by someone else are theirs. We cannot erase a peer’s phone.
8. Children
Lantern is not directed at children under 13 (or the digital-consent age in your country). Mesh chat, files, location, and radio are not a children’s product. We do not knowingly collect personal information from children. Child-safety reports: lantern.mesh@gmail.com (do not email suspected CSAM as an attachment).
9. Retention, Burn, and your controls
- Delete a page in the reader; remove a file in Files.
- Stop offering on a page or file.
- Stop radios with Stop on Mesh; disconnect LoRa in Settings.
- Turn off map share, profile share, weather, Ask live in Settings.
- Cancel
mesh_lock_yearlyin Google Play. Bluetooth encryption stops when the local cache lapses. - Uninstall removes remaining app storage on that phone.
Burn on this device
Settings → Burn clears library pages, files, chat, friends, profile, map pins, legend, home controls, LoRa attestation, and the current callsign, then assigns a new random callsign.
Burn does not currently erase:
- Previous callsigns (kept so the on-device Statistics screen can still list them)
- Play entitlement timestamps (so a paid year is not lost)
- Tutorial “already seen” flags
Those leftovers stay on that phone only. They are not uploaded to us. If you need a full local wipe, uninstall the app after Burn. Copies already on other phones are unaffected.
10. Security — honest limits
Local storage uses the Android app sandbox; it is not extra at-rest encryption. Use a device lock screen. Paid Bluetooth mesh uses ECDH P-256 and AES-256-GCM per link. LoRa is not that. Capture is an ordinary web request. Cached pages do not hide later live visits. Optional share-passwords protect a payload only if both people know the phrase.
Do not treat Lantern as a VPN, Tor, Signal, Meshtastic, anonymity network, warrant-proof archive, or 911 replacement.
11. Legal bases (EEA / UK / similar)
Where those laws apply to processing that actually occurs on the device:
- Contract / requested service — storing what you save; mesh, LoRa, maps, and controls you turn on.
- Legitimate interests — local entitlement cache; on-device statistics; GPS/SIM lock so the radio stays on a listed unlicensed band.
- Consent — optional profile, map share, weather, live Ask, LoRa attestation and waiver.
- Legal obligation — if a lawful request is made about the developer; we hold no user library.
Google Play is an independent controller for your Google account and payments. Nearby Connections runs in Google Play services on the device. Weather, capture targets, and AI providers are independent controllers for the requests you send them.
12. International processing
The developer does not host user content. Capture, Play, weather, and optional AI providers may process data in other countries under their own terms.
13. Changes
We update this policy when data practices change and change the date above. Material changes are reflected at the Play listing privacy URL.
14. Play Data safety summary
Accurate answers for this build:
- Collected by the developer? No. No developer server for library, chat, or location.
- Location? Yes, processed and stored on device (mesh, maps, LoRa lock). Not sent to us. May be shared peer-to-peer if you enable map share.
- Device or other IDs? Callsign and channel are local. Previous callsigns may remain after Burn (on device).
- Photos / files? Only what you import. Stay on device unless you offer them.
- Web history? Only URLs you capture, on device.
- Sold / ads? No.
- Shared by the developer with third parties? No. Google Play, sites you capture, weather, and AI keys are services you contact.
- Encrypted in transit to developer servers? Not applicable. Capture uses HTTPS when the site does. Paid Bluetooth mesh uses AES-256-GCM. LoRa is not encrypted.
- Deletion? On-device delete / Burn / uninstall. The developer has no copy. Burn does not remove leftover callsigns or Play timestamps until uninstall.
15. Contact
Android application ID: app.lantern