What It Sees

What AirLeak sees

Almost everything with Bluetooth Low Energy announces itself to the world, quietly and constantly, whether or not it is connected to anything. Those announcements (called advertisements) are how your earbuds get found by your phone, how an item finder gets located, and how a fitness band pairs. AirLeak reads them all as they go past, and turns the raw radio into a readable picture of the devices around you.

Three layers of signal

Everything AirLeak surfaces comes from one of three layers, built on top of each other:

• Raw advertisements. Every BLE device nearby, named and typed where possible, whether or not it belongs to a recognized ecosystem. This is the base layer: presence and count.
• Device intelligence. Ecosystem-aware decoding, Apple, Samsung, Google, Microsoft, item trackers, and the common open beacon formats, turning an anonymous address into a readable identity with whatever state the device chooses to broadcast. See Device intelligence.
• Behavioral signal. What devices do over time, a tracker separated from its owner, something that keeps reappearing as you move, a phone left openly discoverable. This is where follow-me alerts come from.

Devices and ecosystems

AirLeak understands the "languages" the major ecosystems use to announce their devices, so it can name what it hears rather than just showing an anonymous address:

• Apple — Find My accessories and AirTags, AirPods and their state, and the "Nearby" continuity signals iPhones and iPads broadcast, including whether a nearby phone is currently unlocked or on a call.
• Samsung — SmartTag item finders, including whether a tag is with its owner or has been separated from them.
• Google — Fast Pair accessories (headphones and the like) and the Find My Device network (FMDN) used by Android trackers.
• Microsoft — Swift Pair accessories that advertise themselves for quick pairing with Windows.
• Item finders — Tile and Chipolo tags, recognized and flagged as trackers ahead of everything else about them.

Beacons and sensors

Beyond phones and finders, AirLeak decodes the common beacon and sensor formats that broadcast openly:

• Eddystone and AltBeacon proximity beacons, the open formats behind many asset tags and retail beacons.
• RuuviTag environmental sensors.
• Xiaomi / Mi (MiBeacon, including the ATC/custom firmware variant) and BTHome smart-home sensors, temperature, humidity and similar readings these devices broadcast in the clear.
• Exposure-notification and generic smart-home beacons, plus enough of the standard BLE appearance and service-UUID registries to give a sensible label to hardware AirLeak has not seen a dedicated decoder for.

From signal to identity

Many modern devices deliberately change the address they broadcast every few minutes so they cannot be trailed. AirLeak expects this: it looks at the fingerprint of how a device advertises, not just the address it is using this minute, so a device that rotates its address is still recognized as the same device rather than appearing as a stream of strangers. That is what makes the follow-me alerts reliable over time.