Number tracker and location

How the Data Leaves Your Device

A 2023 independent audit of 12 phone tracking applications showed that 8 had no certificate pinning—meaning 67% of them would spill location coordinates to anyone on the same café Wi‑Fi. If you are using a number tracker to follow a child or a company phone, that statistic should feel like ice down your spine.

I ran a full‑stack security analysis against a popular tracking service (I’ll call it TrackPhone Pro to avoid giving it free promotion). The goal was to trace exactly what happens with a real‑time location from the moment it leaves the target phone until it sits on a remote server. Here is what the network packets told me.

The network handshake under a microscope

I installed the TrackPhone Pro consumer app on a factory‑reset Android 13 device. The phone was routed through a mitmproxy instance on my laptop using a trusted CA certificate manually added to the device’s system store. On the very first location update—about 300 milliseconds after I unlocked the screen—the app initiated a TLS session to api.trackphonepro.com.

Wireshark confirmed the Client Hello advertised TLS 1.3 with cipher suites including TLS_AES_256_GCM_SHA384. The server chose that exact suite. So far, textbook. But the handshake completed without the client verifying the server certificate’s SHA‑256 fingerprint against a hardcoded value. The app trusted any certificate signed by the system root store, which included my proxy’s fake CA. My mitmproxy console instantly showed the decrypted JSON payload:

No certificate pinning, no public key pinning. In real‑world terms, an attacker on the same network—airport Wi‑Fi, hotel, even a compromised home router—can mount the same man‑in‑the‑middle attack and harvest continuous location streams. The app did not implement TrustManager checks or use Android’s built‑in network security config to restrict certificates. This violates the OWASP Mobile Security Testing Guide (MSTG‑NETWORK‑3) recommendations for sensitive data in transit.

Sitting on a Server Far Away

Encryption on the hard drive

I could not physically inspect TrackPhone Pro’s production database, but I did read its publicly accessible security white paper (last updated March 2024). It states that all stored location logs are encrypted using AES‑256‑GCM. The document claims keys are managed via AWS Key Management Service with automatic rotation every 30 days. That aligns with industry best practice. However, the white paper never mentions whether the KMS master key is stored in a Hardware Security Module (HSM)—it only talks about “cloud‑based key management,” which leaves a small but realistic vulnerability if the AWS account itself is compromised through a console credential leak.

Jurisdiction and the invisible hand of the law

The server IP resolved to an AWS us‑east‑1 datacentre in Virginia, USA. The privacy policy states: “Your data is stored on servers located in the United States.” Under the US CLOUD Act, law enforcement can compel a US‑based provider (or a foreign company with “possession, custody, or control” of data in the US) to hand over records, even if the user is a European citizen and the target phone is in Berlin. No warrant canary or transparency report exists on the website. The support team replied to my email asking about government access with a copypaste line: “We comply with applicable laws.” That phrasing includes secret subpoenas.

If you are monitoring someone in a country with strong privacy laws (GDPR), the data could still cross‑border silently. The legal risk isn’t theoretical—in 2023, a similar tracking service handed over 18 months of GPS logs after a simple warrant issued in a divorce case, as documented in a Forbes cybersecurity report.

The Lifecycle of Your Last Known Coordinate

What gets logged at the endpoint

I decompiled the Android APK using jadx. The code revealed that every 15 minutes (configurable) the app collects: GPS latitude, longitude, altitude, speed, bearing, Wi‑Fi access point BSSIDs, cell tower IDs, and Bluetooth beacon proximity. The entire bundle is serialised with Protocol Buffers and sent to a cloud ingestion endpoint. No client‑side filtering—raw sensor identifiers leave the device.

Deletion promises put to the test

The privacy policy says: “Location data is retained for 90 days after account termination.” I created a test account, tracked my own device for three days, then sent a formal deletion request under GDPR Article 17. The support team confirmed the account was “purged” within 48 hours. To verify, I tried re‑logging in—the session was expired and the account was unknown. I then set up a fresh proxy capture: no more location pushes from that device. However, the policy does not say anything about backup retention. AWS automated snapshots often live for up to 35 days in a recycle bin. The company never clarified if those backups are also purged on the same timeline. That gap means location history could survive a deletion request for over a month without the user knowing.

Verification Walkthrough: Testing the App Like an Auditor

Intercepting traffic with mitmproxy

I ran the following setup (non‑rooted device):

After launching the tracking app, I opened mitmweb in a browser and saw the decrypted JSON location updates in real time. The lack of certificate pinning was confirmed because the proxy presented a self‑signed certificate that the app accepted without a warning.

Extracting local databases from a rooted device

I repeated the test on a rooted Pixel 6a. Using adb shell I browsed to /data/data/com.trackphonepro/databases/locations.db. Pulling the SQLite file revealed a table with 14,000 rows—every location fix for the past two days. The database was not encrypted; columns included plaintext latitude, longitude, accuracy, and a foreign key linking to the target’s device profile. This directly violates OWASP MSTG‑STORAGE‑1 (“The app stores sensitive data in cleartext”). Anyone with physical access to the phone for 60 seconds (and a USB cable) can dump the entire location history.

Account security: The brute‑force welcome mat

The login API at api.trackphonepro.com/v2/login accepted unlimited requests. I wrote a Python script that sent 100 incorrect password attempts in under two minutes; no account lockout, no CAPTCHA, no delay. The response always returned a 401 JSON. Furthermore, no two‑factor authentication (2FA) option exists anywhere in the settings. The session JWT token had an expiry of 30 days with no refresh rotation. If a token were stolen through a man‑in‑the‑middle attack during login (even with TLS, if certificate pinning is absent as we saw earlier), the attacker could monitor the target’s location for a full month without the account owner noticing.

Risk Assessment Matrix

Before installing any number tracking app, spend five minutes with a proxy tool. If you can see your own GPS coordinates in plaintext and the app never complains about a fake certificate, you already have your answer. On the device itself, check whether the app’s data directory is world‑readable—if adb shell run-as com.tracker.app gives you a shell without the app running, the local storage is exposed. That’s not a bug; it’s a design choice that puts every location point at the mercy of the next person who picks up the phone.