Privacy Policy

Overview

This Privacy Policy applies to all applications developed and published by brokoz, currently including .mpx, Zynth, Inviz, and REZ for Android. It describes what information each app accesses, why it needs it, and how it is used.

By installing and using any brokoz app, you agree to the terms described in this policy.

Data We Collect

This section describes .mpx, Zynth and Inviz, which do not collect, store, or transmit any personal information to us or any third party. REZ works differently and is covered in its own section below.

Any data generated by your use of our apps - preferences, configurations, playback history - is stored exclusively on your device and never leaves it. The one deliberate exception is messaging: when you send a message in Inviz, it travels directly to the recipients around you over Bluetooth - device to device, end-to-end encrypted for direct messages, and never through brokoz or any server.

• No accounts required. No sign-in, no profile, no registration.
• No analytics. No usage tracking, telemetry, or behavioural data of any kind.
• No advertising. No ads, no advertising identifiers, no ad SDKs.
• No crash reporting services. No data is sent to remote servers in the event of an error.
• No internet connection required. .mpx, Zynth and Inviz function entirely offline.
• No audio recording. Where audio permissions are declared, they are used solely for on-device processing - nothing is captured, stored externally, or transmitted.
• Local files stay local. Files saved by our apps (such as Zynth's .wav exports and .json configurations) are written to your device only, at your explicit request, and are never accessed by brokoz.

REZ The connected exception

REZ is a camera with a shared feed, and a feed needs somewhere to put the photographs. Unlike our other apps, REZ therefore has an account, a server behind it, and content that other people can see. We would rather state that plainly than bury it.

In outline, this means REZ:

• Has accounts. You choose a handle, and that handle is visible to other people on photographs you post.
• Stores what you post. Photographs you publish to the feed, and the palette you create, are stored so that other people can see them.
• Uses Google Firebase as its backend, rather than infrastructure we run ourselves.
• Still has no algorithm. The feed is chronological, nothing is ranked or suggested, and nothing is recorded about what you look at.
• Still has no ads and no analytics SDKs. That part does not change between our apps.
• Can be deleted. You can remove your account and its contents from inside the app.

Because REZ handles data that the other apps simply do not, it has its own detailed policy rather than being squeezed into this one. Please read it if you use REZ:

• REZ Privacy Policy
• REZ Terms of Use
• Deleting your REZ account

App Permissions

Each app requests only the permissions strictly necessary for it to function. The full list per app is below.

.mpx Audio Player

Permission	Purpose
READ_MEDIA_AUDIO	Read audio files from device storage to display and play your music library. Required on Android 13+. No files are copied, uploaded, or shared.
READ_EXTERNAL_STORAGE	Access audio files on devices running Android 12 or earlier. Same scope - local playback only.
RECORD_AUDIO	Required by Android's Visualizer API to read real-time waveform and frequency data from the active audio session. Used solely to power the in-app visualizer - no audio is ever recorded, stored, or transmitted.
FOREGROUND_SERVICE	Keeps music playing in the background while you use other apps and displays the persistent playback notification.
RECEIVE_BOOT_COMPLETED	Allows the app to restore any active playback session after your device restarts.

Zynth Sound Effect Generator

Zynth can save and load files on your device:

• .wav files - audio exports you generate are saved to your device's Downloads folder.
• .json files - synth configurations you save can be exported to Downloads and loaded back into the app at any time.

On Android 10 and above, apps can write to and read their own files from the Downloads folder using Android's standard MediaStore API without requiring a declared storage permission. These files are created entirely at your request, stored locally on your device, and are never uploaded, transmitted, or accessed by brokoz. You can manage or delete them at any time through your device's file manager.

Inviz Off-Grid Messenger

Inviz is a serverless messenger: messages travel directly between nearby phones over a Bluetooth Low Energy mesh. There is no internet permission in the app's core messaging path - nothing you write can reach brokoz or any server, because there is no server. The permissions below exist solely to run the Bluetooth radio and keep the mesh alive.

Permission	Purpose
BLUETOOTH_SCAN	Discover nearby Inviz users. Declared with Android's neverForLocation flag - scan results are never used to derive your physical location.
BLUETOOTH_ADVERTISE	Make your device discoverable to other Inviz users nearby, so they can message you and the mesh can relay through you.
BLUETOOTH_CONNECT	Open the device-to-device Bluetooth connections that actually carry your messages.
FOREGROUND_SERVICE	Keeps the mesh running while you use other apps, with a persistent notification that honestly reports what the radio is doing and includes a Stop action.
POST_NOTIFICATIONS	Show incoming-message notifications and the ongoing mesh-status notification on Android 13+.
RECEIVE_BOOT_COMPLETED	Restart the mesh after your device reboots, if you had it enabled.
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	Lets you optionally exempt Inviz from battery optimisation so the mesh isn't silently killed in the background. Requested with your explicit approval via the system dialog.

How your Inviz data is handled:

• Messages travel peer-to-peer only. Direct messages are end-to-end encrypted (Noise protocol); devices that relay a message for you carry only ciphertext and cannot read it. The public Broadcast channel is unencrypted by design and clearly labelled as such in the app.
• Encryption keys never leave your device. Your identity key is generated on-device and protected by the Android Keystore (hardware-backed where the device supports it).
• Local storage is encrypted at rest and excluded from Android cloud backups (allowBackup=false), so messages and keys are never uploaded by the OS backup system.
• Panic wipe. A single in-app action permanently erases your identity, contacts, and message history. This is irreversible by design.
• Abuse reports are user-sent. "Report & block" composes an email on your device that only you can choose to send, from your own mail app. Nothing is reported automatically - blocking works locally regardless.

Third Parties

.mpx, Zynth and Inviz do not integrate any third-party SDKs, services, or APIs that would result in your data being shared with or accessible by any outside party. REZ uses Google Firebase as its backend, which is set out in the REZ Privacy Policy.

There are no advertising networks or analytics providers in any brokoz app.

The other external parties relevant to your use of our apps are:

• Google Play Store - the platform through which you download and update brokoz apps. Google's own privacy policy governs their handling of data related to app installation and updates.
• Your device manufacturer / Android OS - standard Android platform behaviour applies, independent of brokoz apps.
• Nearby Inviz users - by design, Inviz messages may be relayed through other users' devices to reach their recipient. Relayed direct messages are end-to-end encrypted: a relaying device carries only ciphertext and can never read, alter, or store your conversation in readable form.

Children's Privacy

.mpx and Zynth do not knowingly collect any personal information from anyone, including children under the age of 13. Since no data is collected at all, they are safe for use by people of any age from a data privacy standpoint.

Inviz and REZ are intended for adults. Inviz is an 18+ application, covered by our Child Safety Standards. REZ has accounts and a public feed, and its age requirements are set out in the REZ Terms of Use.

If you have any concerns regarding a child's use of a brokoz app, please contact us using the details below.

Your Rights

Because .mpx, Zynth and Inviz do not collect or store your personal data on any of our systems, there is no personal data held by brokoz in connection with those apps for you to access, correct, export, or delete.

All data stored by those apps lives on your device and is entirely under your control. You can clear any app's local data at any time via Settings > Apps > [App name] > Storage > Clear Data, or by uninstalling the app.

REZ is different, because it does hold an account and the photographs you have posted. Your rights over that data, and how to exercise them, are set out in the REZ Privacy Policy; you can delete your account and its contents at any time, as described in Deleting your REZ account.

Residents of the European Economic Area, United Kingdom, California, and other regions with data protection regulations retain all rights afforded by applicable law.

Policy Changes

We may update this Privacy Policy from time to time - for example, when a new app is released or an existing app gains a feature that changes its data handling. When we do, we will update the "Last updated" date at the top of this page.

We encourage you to review this page periodically. Continued use of any brokoz app after changes are posted constitutes acceptance of the updated policy.

Contact Us

Questions or concerns about this policy or any brokoz app? We read every message.