Follow-Me Alerts

Follow-me alerts

This is AirLeak's headline privacy feature. Instead of just listing what is nearby right now, AirLeak watches how devices come and go over time and raises an alert when something looks like it is following you, the "is someone tracking me?" question, answered automatically in the background.

How a follow-me alert happens

A single sighting of a tracker means little, you pass hundreds of Bluetooth devices in a day. What matters is persistence: a device that keeps reappearing as you move from place to place, over minutes and hours, when it has no reason to. AirLeak keeps a running memory of what it has seen, evaluated continuously against a set of detection rules, and when a tracker or device stays with you long enough to be suspicious, it raises an alert on your phone.

Because AirLeak recognizes devices by their pattern rather than their momentary address (see how), a tracker that rotates its identity to hide cannot simply "reset" to escape notice, AirLeak still sees it as the same follower.

The detection rule set

AirLeak runs a set of follow-me detection rules, roughly two dozen, each watching for a specific situation worth knowing about. They fall into a few groups:

• Tracker-specific rules. A Find My accessory or SmartTag reporting itself as separated from its owner; an unrecognized or unlicensed tracker sitting near you with no obvious reason to be there.
• Persistence rules. Any device, tracker or not, that keeps reappearing around you across a long enough stretch of time, the multi-hour follower case, the strongest and least ambiguous signal that something is deliberately with you.
• Exposure rules. Devices broadcasting more than a privacy-conscious user would want, for example a phone left openly discoverable for Apple's AirDrop, or a nearby device signalling that it is actively on a call.
• Composite scoring. Sightings feed a leakage-score that combines how identifiable a device is with how it is behaving, so a device that is both easy to fingerprint and persistent surfaces as a higher-priority alert than either factor alone.

In plain terms, the situations you will actually see flagged include:

• An unknown tracker is near you — a tracker you do not own has turned up.
• A tracker has been travelling with you for hours — the classic multi-hour follower.
• A separated tracker is present — an AirTag or SmartTag that is away from its owner (see tracker detection).
• A device is broadcasting more than it should — a phone left openly discoverable for AirDrop, or otherwise signalling more than a privacy-conscious user would want, including active call/audio state where a device exposes it.
• A device is unusually identifiable — one whose combination of signals gives it a high leakage score, worth a look even outside the tracker categories above.

Each alert tells you what was seen and why it was flagged, so you can decide whether it is your own forgotten earbuds or something that deserves a closer look.

Tuning what you hear

You do not get all rules at full volume by default. From the app you can turn individual kinds of warning on or off and adjust how sensitive scanning is overall, see Settings, so you can, for example, keep the multi-hour follower warning always on while silencing more routine exposure notices in a busy area.

Running in the background

Follow-me detection is at its most useful when it is always on. With the ZeroTrace app watching your AirLeak, alerts can reach you while you go about your day rather than only when you are staring at the live view. See App integration for how the phone and board work together, and Swarm for widening the area AirLeak can watch.