What this demo collects

This page is a live security-awareness demo during a conference talk. It shows how much a website learns about your phone the moment you open it.

The data controller is the organiser of the talk this demo is part of.

Automatically, like every website

• IP address, which every server sees. We use it once, with an offline database, to look up your approximate city and network provider. It is stored only in masked form (e.g. 83.24.x.x); the full address is shown back only to you.
• Browser & device details your browser sends to any site: browser and system version, phone model (Android only), language, time zone, screen size, dark mode, CPU cores, memory class, graphics chip, battery level (some Android browsers), storage quota and network type.

Only if you say yes

• Your location (GPS), only after you tap SHOW ME, then Share my location, and then allow it in your phone's prompt. It appears on the presenter's screen. If you are more than a few km from the venue, it is rounded to a ~1 km area before it is stored or shown.

What we don't do

• No cookies, no ads, no analytics, no cross-site tracking.
• No fingerprinting to recognise you later. We don't try to find out who you are.
• No camera, no microphone, no contacts, no files.
• No third-party requests from your phone: even map tiles are served by our own server.
• Nothing is sold or shared.

How long

• A random session number lives in this browser tab only and disappears when you close it.
• Demo data is kept in memory on our own server and deleted automatically after 12 hours at the latest. The presenter wipes it after the session. Web server access logs are switched off.
• After the event we keep only aggregated, anonymous statistics (e.g. the share of iPhones or the average battery level in the room), with no IP addresses, locations or per-device data. They may appear in a summary or article about the event.
• Depending on the address you used, traffic may pass through Cloudflare (DDoS protection / TLS).

Your rights

Technical data is processed for security-awareness education (legitimate interest, GDPR Art. 6(1)(f)); location only with your consent (Art. 6(1)(a)), which you can refuse or withdraw by closing the page. Because we don't identify you, we usually can't link data to you, but you can ask the presenter to delete it at any time.

IP geolocation by DB-IP (CC BY 4.0). Map data © OpenStreetMap contributors. Map library: Leaflet.

← back to the demo · Wersja polska