🛰 Find My Deck — Privacy
The whole point of this project is that the server can't see where your Deck is. This page says exactly what is and isn't stored, in plain language. Last updated 2026-07-16.
The one-line version
Your Deck encrypts every location report on-device with a key derived from your password. That password never leaves your Deck or your browser. The server stores only ciphertext it cannot read, and it decrypts nowhere. Only your browser, with your password, can turn a report back into a location.
What the server cannot see
- Your password, your keys, or any seed. Enrollment sends public keys only.
- Your location: reports are sealed (X25519); the server holds opaque blobs.
- Your battery level and Wi-Fi scan details, all inside the sealed report.
- Your raw SteamID: stored only as
HMAC(pepper, steamid).
What the server does store
- Sealed report blobs: opaque ciphertext, kept 7 days then auto-deleted.
- Public keys, device names, timestamps (
last_seen, upload times).
- Source IP: used only for per-device rate limiting, rotated fast, never sold.
- Recovery-relay messages and the lost-mode message you set — these are plaintext by design (a finder has no key), so treat them as readable by the server. No contact details are exchanged either way.
- Connected Wi-Fi name (SSID): this rides inside the sealed report, so the server can't read it; only you see it on decrypt.
- Alert settings: your webhook URL (and email, if ever enabled), so alerts can be delivered.
Alerts
Alerts fire on metadata only: a finder message arrived, a Lost Deck checked in or went quiet. They never contain your location or battery. There is deliberately no "alert when it leaves home" geofence, because that would require the server to read a location it never holds.
Third parties
When you press Locate, your browser sends the Deck's decrypted Wi-Fi BSSIDs to a geolocation service (beacondb / Apple's keyless endpoint) to turn them into coordinates. This happens on demand, in your session, and is not stored or logged. If you configure a webhook, alert text is sent to whatever sink you chose (Discord/Slack/ntfy/etc.).
Deleting your data
In the dashboard, Delete account removes everything immediately: every device, all sealed reports, relay threads, commands, pending pair codes, and your alert settings. It's irreversible. Revoking a single device deletes just that device's token and reports.
Honest limits
- The password is unrecoverable by design: lose it and old reports stay sealed forever.
- Source IP is the one location signal that can't be sealed away; it's logged briefly for rate limiting only.
- This is open source — verify all of the above yourself: github.com/echohtp/findmydeck.
← Back to Find My Deck