🐢

Privacy & Trust

Plain English. No legal jargon. Last updated October 2026.

What your Turtle device can and cannot do

What it does

Measures how fast external websites load
Sends its own public IP address to us
Reports whether it's online every 5 minutes
Monitors only the URLs you approved

What it never does

Scan your home network or other devices
Access your router, cameras, or smart home
Read your browsing history or traffic
Capture packets or sniff WiFi
Store passwords or access tokens on disk
Monitor internal/local URLs

Why it physically can't snoop — not just "we promise"

The device has firewall rules baked in that block it from initiating any connection to your local network (192.168.x.x, 10.x.x.x, 172.16.x.x). These rules are applied at install time and persist across reboots.

Verify on your Pi anytime:

sudo iptables -L OUTPUT -n --line-numbers

Verify from your router — you'll only see traffic to these destinations:

*.iot.us-east-1.amazonaws.com (port 8883): AWS IoT, for results, heartbeats and settings
turtle-releases-poc.s3.amazonaws.com (443): software updates
api.ipify.org (443): checks its own public IP
*.credentials.iot… and secretsmanager… (443): only for checks that need a stored login, which is held in memory
www.amazontrust.com (443): once, during setup
deb.debian.org and archive.raspberrypi.com (443/80): operating-system security updates, checked daily
The websites it's testing (443)
DNS (53) and time sync (123), as any computer does

Read the exact code running on your device. It's plain Python on the Pi itself:

ls /home/turtle/*.py

Exactly what data we collect

Data point	Why	Stored
Device public IP address	Know which city the measurement came from	Yes
DNS response time (ms)	Core monitoring metric	Yes
TCP connect time (ms)	Core monitoring metric	Yes
TLS handshake time (ms)	Core monitoring metric	Yes
HTTP response time (ms)	Core monitoring metric	Yes
HTTP status code	Was the site up or down	Yes
Device heartbeat (online/offline)	Know which devices are active	Yes
CPU / memory usage, hostname, software version	Device health monitoring	Yes
The device's own software logs (e.g. "check failed: timeout")	Troubleshooting	Yes
Your home network traffic	—	Never
Other devices on your WiFi	—	Never
Your browsing history	—	Never
WiFi password	—	Never

This website

The turtlechai.com home page doesn't use cookies or accounts. In the satellite pass finder, the place name you type is sent to the Open-Meteo geocoding service to look up coordinates. Orbit data comes from CelesTrak: we copy it to turtlechai.com once a day, and your browser fetches it from CelesTrak directly (or a public TLE mirror) only if our copy is unavailable. Your coordinates and "Use my location" stay in your browser. The orbit calculator library is hosted on turtlechai.com itself.

Can I see the code?

Our source code isn't public yet. But nothing on the device is hidden: the software it runs is plain, readable Python installed in /home/turtle/, so anyone with the Pi's login can read every line, and the firewall rules above can be checked at any time. If you host a device, we're happy to walk you through it.

Questions

Questions about your device or your data? Contact the TurtleChai team member who set up your device. A dedicated privacy contact address is coming soon.