Tunnel is fine security wise. Keep the reverse proxy anyway and let the tunnel point at it. Routing, logs, etc. stay in one place this way.

Zero Trust with Google etc. is the way for family. Tailscale or Wireguard means installing a VPN client and making sure it keeps running, that’s too much for most people who just want to click a link.

There is a toggle next to it which enables it. A rework for the UI is already on the roadmap :D

Sorry, should have mentioned it when i refer to it. In “Settings > Tracking & Sync > Advanced Settings” See also https://colota.app/docs/configuration/gps-settings

A profile with “speed above 10 km/h” will kick in when the last 5 points average speed is above 10 km/h. The notification banner and dashboard will tell you if the profile is actually active.

If your interval for that profile is 5s, a new point will be requested every 5 seconds and with a 10m movement threshold every point closer than 10m to the last recorded point gets discarded.

So to get smoother tracks you can decrease the movement threshold. Personally I use a movement threshold of 2m with a tracking interval of 6 seconds which works very well for me.

Logging points every 10m without a time interval is not possible, because the app needs a location to determine you moved 10m and Android needs an interval. A workaround would be to decrease the interval to something like 3 sec and set the movement threshold to 10m. Then the app will request a new location every 3 seconds and checks if it is at least 10m apart from the last point. If it is it will be recorded, otherwise it will be discarded. That will use a lot more battery though.

You can read more about the tracking profiles in the docs: https://colota.app/docs/guides/tracking-profiles

For places where you stay frequently (home, work, etc.) geofences work better. The stationary profile is good for situations where you are somewhere temporarily for longer (restaurant, friends, etc.)

Edit: Small correction after doing the math and reformatting after writing that on the phone 😂

Lowering the movement threshold will not smooth out a driving track. 10m at a 5s interval works out to 7.2 km/h, so above that speed every fix is already more than 10m from the last one and the threshold throws nothing away. So the tracking interval is your lever here. 5s at 50 km/h is a point roughly every 70m and even at a realistic average of 30 km/h it is still one every 40m, which is what cuts the corners.

Out of the box Colota records every fix it gets by the device. So in case you haven’t already I would suggest to enable the accuracy filter and set it e.g. to 25m. This way all points with accuracy worse than 25m get filtered out. Also the movement threshold helps with the stationary drift

Colota dev here 👋 What do you want the profiles to do?

Profiles are an optional thing to finetune your tracking settings based on certain conditions, e.g. speed above or below x km/h, phone charging, Android Auto connected or being stationary. So you could raise the interval while charging, since that usually means you are not moving. To start with you could also make a pause zone at home and at work and turn on the WiFi pause. GPS stops completely while you are there and the app will consume much less battery. Tracking resumes when the WiFi drops.

I would add one at a time and see if it behaves like you want. When you create like 10 different tracking profiles with different priorities they can interfere with each other, so less is often more.

Edit: Also the accuracy filter is off by default so you probably want to enable it to reduce the noise

I use it to track travel times for work and sometimes create maps of trips. Also I personally just like to see oh I was there a few days/weeks/years ago which brings up memories

Owntracks can do that but it has a limit of how much locations can be stored locally. I think it was 100k, so depending on your tracking interval during the month you may hit the limit. Also it still tries to sync every few minutes even though the server is down. Colota (https://github.com/dietrichmax/colota) supports the same without a limit and you can use it in a offline mode and then export e.g. a geojson and import it into Dawarich or you set it to only sync it on a imaginary SSID like "abc " and then change it to the correct one when you actually want to sync. So it never even tries to sync until you really want it to. Disclosure: I’m the dev of Colota.

Thank you, really appreciate it! Glad to hear Colota is working well with Dawarich for you so far. Feedback and criticism are always welcome. Most of it has led to real improvements in the app. I think a casual forum thread is probably just not the best setting for deep technical discussions, where context shifts quickly, everyone has a different background and nuance gets lost.

Thanks for the kind words! Vehicle/trip categories (car, bike, train, walk) + per-vehicle tracking is a great idea and fits well with the profile concept. Personally, I also want to skip other (activity) tracking apps which is the reason I also would love to have these features. Added the feature requests to the backlog. Thanks for taking your time trying out the app and giving feedback!

That’s an interesting reading of what I said, but not what I said. I didn’t write that security doesn’t matter because the server is off. I wrote that when nothing leaves the device by default, there is no attack surface to secure. That is the definition of secure by default.

Secure by default means the default configuration is safe. By default, Colota stores location data locally and exposes none of it. If you believe that somehow fails the secure-by-default standard, I’d genuinely like to understand how.

If your actual concern is what happens once a user configures a server, that’s a fair discussion but it’s a different one. I already addressed that above and I’d be curious to hear a specific objection to that setup rather than a general claim that it’s insecure. Server compromise risk is inherent to every self-hosted service. That’s not a Colota flaw, that’s the model. And “users shouldn’t have to manage their own infrastructure” is a philosophical position, not a vulnerability. One that doesn’t really fit a tool explicitly built for people who want exactly that control.

So, where’s your VPS? In EU?

It’s a VPS hosted by netcup in germany (https://maps.mxd.codes/)

Which refers to a Home Assistant template that doesn’t exist on the app?

Yes, you are right. I have to update the docs there. I removed the HA template because it basically just added the tid which I think is quite easy to add manually.

You don’t have to. You just have the app encrypt the data before it’s backed up and exported.

I already explained several times why that’s not realistic for the selfhosted backends.

You could have just written at the beginning that you think it would be a good idea to implement (optional) encrypted backups Independent of the selfhosted backends. Then I would have answered, great idea!

But you continued to reply on a thread about end to end encryption where I specifically mentioned the selfhosted backends.

I understand the usecase but you’re acting like you don’t understand the purpose of encryption,

Have a good day!

Not an absurd question at all. The app uses vector data for the map. Public OpenStreetMap server’s only offer raster data which is not compatible and would need way more storage to cover the same area downloaded. Also downloading tiles from openstreetmap servers would violate their tile usage policy.

However there are alternatives e.g. https://openfreemap.org/. I actually had OpenFreemap used before for the app but it uses Cloudflare as CDN which doesn’t align with the privacy policy I want to offer for the app which is the reason I setup a own server (vps) which just directly serves the tiles (https://colota.app/docs/guides/tile-server). Also if I would use a external tile server which may go offline for whatever reason there would be nothing I could do about it.

Basically you could use any tile sever which provides mbtiles but I don’t know any other free options.

if I install your app on multiple devices, can Home Assistant distinguish between them? Ie does the data nclude a DeviceID of some kind?

Yes it either works with the Colota integration which needs a custom payload attribute to distinguish different devices (e.g. “tid”: “colota”) or you could use also the Owntracks integration (see https://colota.app/docs/integrations/home-assistant). The API format sent from colota is completly editable.

It’s not that I don’t want. I can’t implement it because I don’t offer a server. You would have to address this to the backend developers (Dawarich, GeoPulse or even yourself) who actually store the data.

but there’s no reason to come here pretending not to understand its purpose.

I am understanding your point, but apparently you are not understanding mine which is the actual use case of the app and it’s workflows and therefore make it look like it would miss basic security patterns. The whole “location history” ecosystem stores plaintext coordinates.

Encryption does not exist for third parties.

E2E encryption is specifically designed for the third-party problem. Encrypting so a middleman can’t read your data.

It exists to protect sensitive data from malicious or state actors who might hack your server and steal the information for various purposes

If a server gets hacked where a user sent data from Colota there is nothing the app can do about it or to prevent it. Also you can create a backend which encrypts the data. Again: Colota does not offer a backend.

Here in the US law enforcement is free to hack and steal and demand whatever they want

I don’t think it’s the job of an Android app to protect a server from government hacking attacks.

I would prefer single-party encryption vs. integration, personally. Could make it optional.

I understand the concern. The tradeoff is that backends like Dawarich or GeoPulse need to read the coordinates to build timelines, detect trips, display maps, etc. Encrypted blobs would make the server a simple backup at which point the local auto-export to Syncthing/Nextcloud achieves the same thing without the complexity. For pure backup, the offline + file export workflow already covers that use case. Also the app is offline-first. There is no server needed unless the user specifically configures that.

I appreciate your contributions but for me personally this is a dealbreaker.

Fair enough, thanks for the feedback.

FusedLocationProvider (GMS version) is generally better for most users. It combines GPS, WiFi, cell tower and sensor data for faster GPS fixes and better battery efficiency. The FOSS version uses raw LocationManager with GPS as primary and network as fallback. It works but GPS fixes can be slower, especially indoors. But if avoiding (sandboxed) Play Services is a priority, the FOSS version works fine too.

No worries.

I still don’t see a way to import data? Doesn’t do any good to back it up if I can’t import it back in?

Totally true. A import feature will be added with one of the upcoming releases.

The default setting is that everything stays on-device. The user then can change the config to fit their own threat model, e.g. by adding a server, choosing HTTP for LAN, etc.

No I understood the server is self-hosted…?

Colota is client-only. There is no Colota server software. When you add a server endpoint in the settings, you’re pointing it at your own existing server (Dawarich, Home Assistant, Traccar or any HTTP endpoint). Colota doesn’t provide or require any server component. It just sends data where you tell it to.

I see that but this should be an automatic backup process. Plus there’s no way I can see to IMPORT that data somewhere else. When I use an app like Fitotrack, it automatically makes a backup file periodically and then is automatically backed up to my server with Nextcloud or Syncthing. I don’t need a dedicated server for it.

Colota actually has automatic file export (Settings > Export Data > Auto-Export) that periodically exports to a directory on your device. From there Syncthing/Nextcloud can pick it up. Import is not yet available but is planned. There is no dedicated server needed and also not offered to setup. However you can create a webhook on your own server for the app if you want to. See e.g. https://colota.app/docs/integrations/custom-backend.

How can it do that when it didn’t ask me for an SSID? And what’s the point of the geofence if it doesn’t even use it anyway? I am cornfuse.

WiFi pause doesn’t use a specific SSID. It detects any unmetered network (WiFi/Ethernet) while you’re inside a geofence zone. The geofence defines where the pause should happen, the WiFi connection confirms you’re settled there and is used to detect when you leave it. Without the geofence, any WiFi connection would pause tracking everywhere.

How is motion recognized without GPS?

Motion detection uses the device’s hardware motion sensor (if available). It’s a low-power sensor that fires when physical movement is detected.