Effective 2026-09-03 · applies to the Retro Ping iOS app and the ingest service at ping.benobi.one.
Sharing is opt-in and the app defaults to off. Nothing is uploaded unless you tap SHARE ANONYMOUS STATS (or later turn the setting on). You can turn it off again in Settings.
If you opt in, the app may send session rollups (radio type, ping target, transport, sample counts, loss, min/avg/max RTT) and Diagnose summaries (zone, headline, hop names with RTT or timeout — no host addresses). Hop names are fixed labels: ROUTER, CLOUDFLARE, GOOGLE DNS, GOOGLE.COM, SIGN-IN.
We do not collect a device id, IDFA, account, SSID, or your public IP from the app. The worker reads Cloudflare’s connecting IP and stores only a coarse prefix: IPv4 /24 (not the host address) or IPv6 /48. Example: 73.162.11.44 is stored as 73.162.11.0.
While the race is on screen, Retro Ping checks every 30 seconds whether the connection is actually usable rather than merely fast. Each check resolves one hostname — rotating between google.com, cloudflare.com and apple.com — and requests http://captive.apple.com/hotspot-detect.html, the same page iOS itself loads to notice a Wi-Fi sign-in page. Diagnose runs the same two checks on demand.
Those requests go to your DNS resolver and to Apple, not to us. They carry no identifier, no account and no cookies, and they happen whether or not you have opted into stats. If you have opted in, a Diagnose upload may include the result as a hop named SIGN-IN with no address, and a zone of captive.
Location permission is optional. Location is used only for the local SSID (Wi-Fi network name) on the device, shown in History. SSID is never uploaded.
History on the phone is kept for 90-day local retention, then deleted. You can clear history in Settings at any time.
No sale of data. No ads. There are no advertising SDKs and no third-party analytics SDKs.
Questions: nobi at benobi.one. Policy URL: https://ping.benobi.one/privacy