GlobalPlatform Mobile manages the applets on JavaCard smart cards and NFC implants from your phone, including Dangerous Things flexSecure and other GlobalPlatform cards. Hold your card to the back of your phone to see what it is, what is installed on it, and how much room is left, then add or remove applets without a computer or a desktop reader.
READ YOUR CARD
• Identify the chip, its GlobalPlatform version and its manufacturing data (CPLC)
• See free storage and memory, measured against a bare card of the same chip
• View the card’s keysets, historical bytes and raw tag data
UNLOCK AND MANAGE
• Open a secure channel with your card key, using SCP02 or SCP03
• List every applet on the card by name and version, with the AIDs behind a tap
• Remove applets you no longer need
• Change your card’s key
INSTALL APPLETS
• Install from Dangerous Things’ open-source applet releases, including NDEF, VivoKey OTP, YubiKey HMAC, U2F, SmartPGP, Satochip, SeedKeeper and JavaCard Memory
• Or install your own CAP file straight from your phone
• Checks free space before it starts and shows install progress block by block
• If the card slips out of range mid-install, the App picks up on the next tap and cleans up what the interrupted attempt left behind
Privacy Policy
# Privacy Policy
## GlobalPlatform Mobile
**Last Updated: September 2026**
## Overview
GlobalPlatform Mobile (“the App”) is an application developed by Dangerous Things (“we”, “us”, or “our”) for reading and managing applets on GlobalPlatform smart cards and implants over NFC. We are committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.
**The short version:** Your data stays on your device. We cannot access your cards, your card keys or anything the App reads. The only requests the App makes on its own are a check for app updates and a check for the latest applet release on GitHub, neither of which carries personal information.
## Information We Collect
### Information Stored Locally (On Your Device Only)
The following data is stored exclusively on your device and is never transmitted to us:
- **Card Readings** - The details the App reads from a card, including its chip identifiers (CPLC), serial numbers, UID, free memory, key information and the list of installed applets. These are held in memory only and are cleared when the App restarts.
- **Card Keys** - If you choose to remember a card’s key, it is saved on your device encrypted with a key held in the Android Keystore. That key cannot be copied off your device, so a remembered card key cannot be restored on another device. Keys you do not choose to remember are used for the current session only.
- **Card Records** - Alongside a remembered key, the App keeps the name you give the card, an identifier derived from the card’s chip data so the key is only ever offered to the same card, and a count of failed authentication attempts. The failure count protects your card: repeated failures can permanently lock a GlobalPlatform card, so the App stops offering a key that keeps being rejected.
- **Appearance Settings** - Your theme, colour-vision palette, animation speed and still-image preference.
We cannot access this data. It remains entirely on your device.
### Information Transmitted by the App
**App Updates** - Each time the App starts, it checks with our update provider, Expo (expo.dev), for a newer version of the App. The request includes a random installation identifier created by the App, the platform, the App’s version details, and identifiers of the update currently installed. Like any internet request, it also reveals your IP address to Expo. It contains no card data, keys, or account information. Expo uses it to deliver updates and may provide us with aggregate statistics, such as how many installations have received an update. Expo’s handling of this data is described in its privacy policy at Privacy policy — Expo.
**Applet Releases** - When the App starts, it asks GitHub for the latest release of Dangerous Things’ open-source applets (GitHub - DangerousThings/flexsecure-applets: Collection of JavaCard applets for the FlexSecure, as well as build and testing scripts, and documentation. · GitHub), so it can show which applets are available and how large they are. When you install one of these applets, the App downloads its file from the same release. These requests contain no card data, keys or account information. Like any internet request, they reveal your IP address to GitHub, whose handling of that data is described in its privacy statement at GitHub General Privacy Statement - GitHub Docs.
**Your Card** - Commands the App sends to your card, including keys used to authenticate and applets you choose to install, go directly from your phone to the card over NFC. They never pass through Dangerous Things or any other server.
**Dangerous Things Website** - When you tap a link to our website, the URL includes UTM parameters (source, medium and campaign) that identify the visit as coming from this app and which link was tapped. This lets us measure how often the app sends visits to our website. No personal data, device identifiers, or account information is included in these parameters.
### Information We Do NOT Collect
- We do not collect location data
- We do not collect contacts, call logs, or messages
- We do not collect your card details, card keys or the applets on your card
- We do not use third-party analytics, crash reporting, or advertising SDKs
## How We Use Information
### Local Data
- Card readings are used to show you what is on your card, and are cleared when the App restarts.
- Remembered keys are used to unlock the same card again without typing the key, and only when the card’s chip data matches the card the key was saved for.
- The failure count is used to stop the App from retrying a key the card has rejected.
- When you use **Install from file**, the App reads only the CAP file you select, in order to load it onto your card.
- Appearance settings are saved so the App looks the same after a restart.
## Data Storage and Security
### Local Storage
- Card keys are encrypted with a key held in the Android Keystore, which cannot be copied off your device
- All data is protected by Android’s application sandboxing
### Data Sharing
We do not sell, trade, or share your personal information with third parties.
The only external communication is:
- **App Updates** - The automatic update check with Expo, our update provider, described above.
- **Applet Releases** - The request to GitHub for the latest applet release, and downloads of applets you choose to install, described above.
- **Dangerous Things Website** - When you choose to open our website.
## Data Retention
### Local Data
Card readings remain until you restart the App. Remembered keys, card records, appearance settings and the update installation identifier remain on your device until you:
- Clear app data
- Uninstall the App
**Please keep your own copy of any card key you change or remember.** Clearing app data or uninstalling the App deletes remembered keys permanently, and we have no copy from which to restore them. A GlobalPlatform card cannot be managed without its key.
## Your Rights
You have complete control over your data:
- **Access** - All your data is stored locally on your device, and card details are shown in the App
- **Deletion** - Remove everything by clearing app data or uninstalling the App
- **Control** - The App only communicates with a card while you hold it to your phone after starting a read, and it only remembers a key when you choose to
## Children’s Privacy
GlobalPlatform Mobile is not directed at children under 13. We do not knowingly collect information from children under 13. Dangerous Things implants require a minor surgery and are intended for adults.
## Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by:
- Updating the “Last Updated” date at the top of this policy
- Posting the new policy in the App and on our website
Your continued use of the App after changes constitutes acceptance of the updated policy.
## Permissions Explained
GlobalPlatform Mobile requests the following Android permissions:
| Permission | Purpose |
|—|—|
| NFC | Required to communicate with smart cards and implants |
| Internet | Used to check for App updates, to fetch the latest applet release from GitHub, and to download applets you choose to install |
| Network state | Used to check whether a connection is available before looking for updates |
| Vibrate | Declared by the App’s interface library, for haptic feedback |
| Biometric / fingerprint | Declared by the App’s secure-storage library. The App does not ask for your fingerprint or face, and does not use biometrics |
| Display over other apps | Declared by the App’s framework. The App never draws over other apps |
| Storage (Android 12 and earlier only) | Declared by the App’s file library; the App reads only files you choose |
We do not request permissions for camera, microphone, contacts, or location.
## Contact Us
If you have questions about this Privacy Policy or our privacy practices, please contact us:
**Dangerous Things**
- Email: privacy@dangerousthings.com
- Website: https://dangerousthings.com
- Support: support@dangerousthings.com
## Summary
| What | Collected? | Shared? |
|—|—|—|
| Card details and applet lists | No | No |
| Card keys | No | No |
| App update check* | Yes | With Expo only |
| Applet release check‡ | Yes | With GitHub only |
| Analytics/usage data† | Yes | No |
| Advertising data | No | No |
| Device identifiers | No | No |
| Location | No | No |
**Your data. Your device. Your privacy.**
\* A random installation identifier and version details, sent to Expo when the App checks for updates. It contains no personal information, and it is reset when you clear the App’s data or reinstall it.
‡ An ordinary request for the latest applet release, which reveals your IP address to GitHub. It contains no card data, keys or personal information.
† Links to our website are tagged with UTM parameters so we can measure how often the App sends visits there.
As usual, here is an APK until it lands on the PlayStore:
gp-mobile-preview.apk (97.7 MB)
