N6YYO Remote Base privacy policy

N6YYO Remote Base lets an amateur radio operator use their own station from a phone, tablet or computer. The apps talk to your station. We do not run analytics or advertising, and we do not sell or share anything about you. The only account with us is the optional Mission Control account for your licenses, described below.

Effective November 6, 2026. Applies to the N6YYO Remote Base apps for iPhone, iPad, Mac, Android and Windows, the station software, and this website.

What the apps send, and to whom

The apps connect only to the station address you enter or scan. That station is yours: it runs on your own computer, next to your radio. What the app sends goes to it:

Your callsign and password, or the device key this device was given when you paired it, to sign in.
Your voice, only while you hold PTT (or VOX is on and you choose to transmit). The microphone is not used at any other time.
Radio commands you make: frequency, mode, filters, logbook entries and the like.

The station keeps its own records on your computer: operator accounts (passwords stored only as scrypt hashes), approved devices, an audit log of sign-ins and transmissions with the address each came from, and your logbook. Those records stay on your station. We cannot see them.

On iPhone and iPad the camera is used only to read the pairing code your station shows. The image is read on the device and is never sent or saved.

What reaches us

Update check. The apps read a public file from this website (version.json) to learn whether a newer version exists. It carries no information about you. Our host, Vercel, logs the request's internet address and time like any web server.
Station address and support heartbeat. A station that uses an N6YYO Remote Base station key gets its internet address through our Cloudflare tunnel service. To register that address, the station sends its station key to this website over HTTPS when it starts and whenever the address needs renewing. Every few minutes, and when its radio or tunnel state changes, the station also reports to this website its callsign, software version, radio and tunnel state (with its tunnel address and the last tunnel error, with secrets removed), the radio models it detects on USB, and whether remote support access is turned on, so we can help when it cannot be reached. This report proves which station sent it without sending the key itself. It sends no logs, settings, audio or passwords. Your station's traffic passes through Cloudflare's network on its way to your app, encrypted with TLS.
License check-in with Mission Control. Your station's license is kept by Mission Control, our license service at n6yyo-remote-base.vercel.app, run by Circuit Coders on Vercel and Supabase in the United States. A station that uses a station key checks in with it about every 6 hours, and hourly while remote access is off. When a check-in gets no answer, or Mission Control is busy, the station tries again after 5 minutes, then 10, then 20 and so on, never longer apart than that schedule; if the license file it keeps goes missing after Mission Control has answered, it asks again every 5 minutes until it has one. Each check-in sends Mission Control, over HTTPS: the station's software version; the radios it is set up with (maker, model, how each connects, such as USB, serial, network or demo, and which one is active, never a serial number, address or port); and whether it is transmitting at that moment. It signs in with its station key, which Mission Control keeps only as a one-way hash, along with the callsign, key ID and issue date the key carries. Mission Control answers with a signed license file that the station keeps on your computer. The first check-in, or the first time the station registers its internet address, creates your station's record there and starts its trial. The station does not send its usage (hours used or contacts logged from away), logs, settings, audio or passwords.
License check at registration. When the station registers its address, this website forwards the station key to Mission Control over HTTPS to ask whether remote access is allowed. If it is not, the station's internet address is switched off until it is. If Mission Control does not answer within a few seconds, the address is registered as usual.
Sign-in code by email. If a station owner sets a recovery email and later asks for a sign-in code, the station asks our mail service to send that code to that address. We log the callsign and a masked address (for example j***@g***.com), never the code. The message is sent from our support mailbox, which keeps a copy of what it sent.
Mission Control account. If you buy a license or manage your stations online, you have an account with Mission Control: your email address, your stations' callsigns, and the licenses and purchases linked to them. You sign in with a one-time code sent to your email; there is no password. Mission Control's own privacy policy covers that account, payments and support.
Email you send us. If you write to us, we keep your message to answer it.

We do not collect anything else. There are no analytics, no advertising identifiers, no tracking and no third-party SDKs in the apps.

Services your station uses for you

If you turn them on at your station, it talks to amateur radio services on your behalf, using your own credentials: DX cluster nodes for spots, QRZ.com for callsign lookups, and logbook and QSL services such as Logbook of The World, eQSL and Club Log. Those services' own privacy policies apply to what you send them.

The public demo station

The iPhone, iPad and Mac app offers a demo station we run, with a simulated radio: nothing it does reaches the air. Like any station, it keeps an audit log of sign-ins and transmissions with the internet address each came from, and holds the last transmission in memory (never on disk) so the demo account can play it back. Everyone who tries the demo shares one account, so other demo users can hear what you say on it.

Children

N6YYO Remote Base is made for licensed amateur radio operators. It is not directed at children, and we do not knowingly collect information from children.

Keeping and deleting

Hosting logs are kept by Vercel for a short period under its own retention rules. To have any email you sent us deleted, or to ask what we hold about you, write to the address below. Everything else lives on your own station, and you can delete it there: an administrator can remove an operator account or a device under Settings > Operators, and uninstalling the station software removes its data.

Changes and contact

If this policy changes, the new version will be posted here with a new effective date.

Questions: leo.lebel@gmail.com. N6YYO Remote Base is published by Leo Lebel.