Data Usage Tracker 3.5.0

Phones can now report from any network, even while the PC is off, through an optional encrypted cloud inbox. The Android app also has a redesigned screen.

Added

• A cloud inbox, so a phone can report from anywhere. On its own, the phone posts straight to the dashboard, so it must be on the PC's network, the PC must be on, and the address changes whenever the router hands the PC a new one. With the inbox, the app posts to a fixed https:// address on any network, and the PC collects whatever is waiting when it next runs. It is optional and off unless inbox is set in config/collector.json.
• The inbox cannot read what it holds. The app encrypts each upload to a key only the PC has (P-256 ECDH, HKDF-SHA256, AES-256-GCM), with your ingest token mixed into the key derivation, so the inbox cannot forge an upload either. It sees an upload's size, its time and the phone's random device id.
• It runs on Supabase's free tier: one Edge Function and two tables, in supabase/. Setup is in the README, under Optional: a cloud inbox. In short: deploy the function, set inbox in config, then npm run inbox -- keygen, drain-token and sql. On each phone, at home, press Set up from the dashboard, which fetches the inbox address and the PC's key from the dashboard over your network, never from the inbox.
• The hourly collector empties the inbox at the end of each run; npm run inbox -- drain does it by hand.

Changed

• Android app 1.5 has a redesigned screen. A status card at the top answers "is it working?": green when synced, amber after three days without a sync, red with the reason when a sync fails. Below it: when the data runs to, where it is sent, the interval Android actually accepted, and the last attempt. The dashboard, cloud inbox, background sync and full resync each get a card. Permissions appear only while one is missing. Turning the inbox off and re-sending everything ask first.
• The phone's Sync Status page marks an upload that came through the inbox with when it reached the database, and lists uploads by when the phone sent them.

Fixed

• The app showed the ingest token in plain text. Every earlier build made the token field single-line after making it a password field, which silently removed the masking. It is masked now, with Show / Hide. If anyone has seen the app's screen, consider changing the token.

Upgrading

Pull, then npm install and npm run build, and restart the dashboard. The database gains one column (android_sync_log.landed_at), added automatically the first time it is written.

On each phone running 1.3 or later, install data-usage-reporter-1.5.apk over it; settings and sync state are kept. On Xiaomi phones adb install is refused unless Developer options → Install via USB is on, so download the APK on the phone and open it from the file manager instead. A phone still on 1.2 has to uninstall it first; see the 3.4.0 notes.

Without an inbox configured, nothing changes: the app keeps posting to the dashboard address.

Android app

data-usage-reporter-1.5.apk is Data Usage Reporter 1.5 (versionCode 7, Android 8.0+), built from this release's android/ source and signed with the project's release key:

CN=Data Usage Tracker
SHA-256 ab:34:f0:77:4f:3d:c5:0b:7e:0d:e7:c0:04:7e:ee:ce:82:01:89:1a:a4:da:37:73:ca:b1:52:19:06:13:4f:a1