Security you can inspect.

Beacon is self-hostable software. There is no central Beacon service and no telemetry endpoint. The operator of this deployment controls the database, the encryption keys, the email providers and the retention policy. The security of your data therefore depends on both the code and how this instance is operated.

The web application holds a session cookie and talks to a PostgreSQL database over TLS. The Android app holds a device-scoped bearer token, never your account password. Losing a device does not expose your dashboard password, and revoking a device does not sign out your browser sessions.

Account passwords are hashed with Argon2id. A successful password change and every new sign-in can produce a security email. Optional TOTP is the preferred second factor; email one-time codes exist as a fallback, and single-use recovery codes are issued when TOTP is enabled. Recovery codes are hashed before storage and are displayed exactly once.

Password reset tokens are random, single-use and short-lived. The reset flow does not reveal whether an address is registered. Sessions are opaque random tokens; the database stores only a keyed hash, so a database read does not yield a usable cookie.

Android is a hostile environment for always-on location work. Beacon uses the foreground-service and WorkManager APIs that Android permits, but manufacturers may still restrict background execution. A powered off, network-isolated or force-stopped device cannot upload. In that case the last received fix remains visible with its timestamp and is clearly marked stale; it is not presented as current.

Remote camera capture is best-effort and only possible while Android permits the app to use the camera in the foreground. Beacon does not attempt covert capture, does not bypass lock screens and cannot remotely enable GPS if the operating system has disabled it. SIM change and SMS fallback behaviour depend on carrier, device and Android version. Treat these as signals, not guarantees.

Beacon is not an emergency service and is not a substitute for Android's Find My Device, a carrier location service, or law enforcement. In an immediate emergency, contact local emergency services.

Location points contain coordinates, accuracy, timestamp, provider, battery state and a mocked-location flag. They are available to every signed-in session on the account and to paired devices through their scoped APIs. Geofences are evaluated on the server. Exports are generated only after an authenticated request and are not cached.

Map tiles are requested directly from OpenFreeMap, so the tile server learns the approximate map viewport and the client IP address. Beacon does not send your stored location history to the tile provider. See Privacy for the full data inventory.

Please report suspected vulnerabilities privately to business@kaveeshkrishna.in. Include the affected version or commit, a description, reproduction steps and any proof-of-concept material. Do not include real location data, account credentials or other people's personal information.

We aim to acknowledge reports within five working days, keep you informed while a fix is developed, and credit you if you want credit. Please do not access data that is not yours, disrupt other users, or test against a deployment you do not own. This is a volunteer open source project; there is no bounty programme.

A secure deployment uses TLS, a private database connection, unique high-entropy AUTH_SECRET and ENCRYPTION_KEY values, provider keys scoped to sending only, and least-privilege hosting accounts. Rotate credentials after any suspected exposure. The RELAY_API_INTEGRATION.md file used during development is intentionally not part of the repository.

Backups contain personal data. Encrypt them, restrict access, test restores, and document how long they persist after account deletion. Security headers and default rate limits are not a substitute for monitoring, dependency updates and an incident response plan.