Skip to content

ADR 006: No request from the watch before consent on the watch

  • Status: Accepted
  • Date: 2026-10-19
  • Deciders: Owner
  • Technical Context: apps/garmin-watchapp, apps/android (Wear OS), apps/server; amends ADR 003 §2.1; rules in docs/specs/shared/privacy.md

Context

Garmin's store rules make the developer responsible for GDPR: consent before personal data is collected, information, access, erasure. Apps that use the Communications permission together with Positioning are named explicitly. Until 1.1.0 the watch apps sent a device registration (device ID, model, app version, and with it the IP address) at every app start, and a pairing request as soon as the pairing view opened, before the user had agreed to anything. ADR 003 called the registration "silent", and the CIQ SDK plan (finding 15) kept it under legitimate interest.

Decision

  • The watch sends nothing before consent. No registration, no pairing request, no upload. One gate in front of every request (Garmin: one helper around Comm.makeWebRequest; Wear OS: sync/Http.kt).
  • Consent is asked on the watch the first time pairing opens: "Send your trips to sailever.com?" with sailever.com/privacy, Yes / No.
  • Consent is a local gate. It is stored on the watch (with a version) and is not sent to or stored on the server. The account's consent to the privacy policy is stored on the web (version and time).
  • Unpair clears the pairing and the consent on the watch, keeps the queued tracks on the watch and sends nothing.
  • Watches already paired when the update arrives count as consented (two people, both known).
  • Registration stays (install and version counts) but runs only after consent.

Consequences

  • Install counts only include watches whose users agreed; installs that never open pairing are invisible.
  • The server cannot prove a watch consent; the proof is the web consent of the account the watch is paired to, plus the fact that the app cannot send without it.
  • Old app versions (1.0.x) still register before consent; the server deletes never-paired devices after 30 days.
  • The privacy policy URL shown on the watch, sailever.com/privacy, must keep working: during the beta the old app on www redirects it to beta.sailever.com/privacy.