Browser
You sign in, accept policy, and request a bounded test. The client bundle has no Gateway secret.
A click does not prove the iPhone is online.
Trust Center
Is installing the Profile and VPN safe?
WLOC is an authorized iOS location-testing control plane. The Profile changes trust and network settings on a device you own or are authorized to test. This page explains the payload, the VPN row, the traffic split, the data boundary, and the recovery path in plain language.
This page is a product explanation. It is not a legal document, security certification, or availability SLA. The effective Privacy Policy is the notice at /privacy.
System model
Four layers, four separate facts
The browser never talks to the Gateway. Passing one layer never upgrades the evidence produced by the next.- 01Browser
- 02API Worker
- 03Device coordinator
- 04Gateway and iPhone
- 01A click does not prove the iPhone is online.
- 02Authorization is not a location result.
- 03A queued command is not device confirmation.
- 04Gateway target synced is not device online.
About 60 seconds
The short version
Six beats. Read them in order. Nothing here is a filmed video; the explanation is the text and diagrams on this page.
- 00:00
The Profile is a testing configuration
It includes a CA certificate, an IKEv2 VPN payload, EAP credentials, and DNS match domains for Apple wireless-location hosts. You can delete it from iOS Settings at any time.
- 00:10
The VPN row is not a privacy VPN
iOS uses the system VPN UI to carry IKEv2. WLOC uses that tunnel for a bounded location-test path. It is not a consumer privacy VPN, accelerator, or 0.0.0.0/0 proxy.
- 00:20
Only location-service hosts go through WLOC
The tunnel overlay is 10.66.0.0/16. DNS match domains send gs-loc.apple.com and gs-loc-cn.apple.com into that path. Other HTTPS stays on the phone's own resolver and link.
- 00:30
Sensitive bytes are not retained
Profile XML and the EAP password transit memory for one explicit no-store download. They are not kept in control-plane databases, queues, analytics, or logs. Precise coordinates are excluded from Google Analytics.
- 00:40
Restore stays reachable
Sign in and use the Control Restore banner. A submitted Restore is not a device-restored claim. Unpaid, refunded, frozen, restricted, and pending-deletion states do not turn Restore off.
- 00:50
If WLOC is unreachable, delete the Profile
On the iPhone, open Settings → General → VPN & Device Management and remove the testing Profile. That local step does not depend on the website.
System model
Four layers, four separate facts
The browser never talks to the Gateway. Passing one layer never upgrades the evidence produced by the next.
API Worker
The control plane checks session, workspace, device, entitlement, and mutation safety together.
Authorization is not a location result.
Device coordinator
One device runs provision, apply, restore, revoke, and emergency stop in order.
A queued command is not device confirmation.
Gateway and iPhone
strongSwan terminates IKEv2. The Profile on the authorized iPhone applies the test path. You confirm the target app.
Gateway target synced is not device online.
Payload
What the Profile contains
Install only on an iPhone you own or are authorized to test. This site never hosts the download.
CA root certificate
Needed so the phone can inspect the wireless-location hosts listed below. It is not a license to inspect every HTTPS site.
IKEv2 VPN payload
Creates the iOS VPN row and the overlay used for those location-service queries.
EAP credentials
Streamed once in an explicit no-store download. WLOC does not retain them in the control plane.
DNS SupplementalMatchDomains
gs-loc.apple.com and gs-loc-cn.apple.com. Replacing a Profile is required if that split ever changes.
Until CMS signature verification is proven, WLOC does not call this a signed Profile. Device-specific credentials are not described as hardware-bound.
iOS Settings
Why a VPN appears
Apple surfaces IKEv2 as a VPN configuration. That system label is why testers see a VPN switch after install.
What it is for
Carry the bounded location-test overlay so Apple wireless-location queries can be answered for an authorized test.
What it is not
Not a privacy VPN, ad blocker, browsing proxy, or full-tunnel 0.0.0.0/0 route. Not Apple CDN traffic.
Split tunnel
Which traffic goes through WLOC
The tunnel carries overlay 10.66.0.0/16. That is not the public Internet, and it is not every app on the phone.
Through the WLOC path
- gs-loc.apple.com wireless-location queries
- gs-loc-cn.apple.com wireless-location queries
- TLS inspection limited to those location-service hostnames
Not through WLOC
- Safari and other app HTTPS in general
- Browsing history, full URLs, or request/response bodies
- Raw VPN traffic retained as a capture
- Mail, payments, identity, or unrelated APIs
Kept
What WLOC stores
Account and Portal records
Email for OTP sign-in; session data; workspace, device, policy, entitlement, and security-event metadata.
Authorized test records
Target coordinates, Restore state, diagnostics, and Activity needed to run and explain a test. Precise coordinates stay out of Google Analytics.
Billing references
Apple identifiers for App Store purchases, plus retained Stripe identifiers for historical billing records, needed for fulfillment, reconciliation, tax, and audit. Payment cards stay with the processor.
Optional browser analytics
Only after you choose Allow analytics. Coarse page class, allowlisted events, and ordinary connection metadata. No Google tag loads before that choice.
Not retained
What WLOC does not keep
Profile XML and EAP password
Transit Worker and Gateway memory for one no-store download. Not stored in D1, KV, R2, Durable Objects, queues, analytics, structured logs, or fixtures.
Control-plane secrets
Gateway or Access secrets, CA private keys, and session or OTP peppers are not written to product storage or this website.
Raw VPN traffic
Not retained in control-plane databases or structured application logs.
Google Analytics exclusions
No precise coordinates, location-search terms, account email, WLOC account/workspace/device identifiers, Profile data, credentials, App Store purchase references, arbitrary titles, raw query strings, or raw VPN traffic.
Visible Activity history is not proof of storage deletion. WLOC does not currently promise that every operational record is purged after a fixed period.
Recovery
How to Restore immediately
Restore, Revoke, Emergency Stop, Export, and Delete Account remain reachable under unpaid, refunded, frozen, restricted, and pending-deletion states.
In the Portal
Sign in and use the Control Restore banner on the authorized device. Repeat calls are idempotent. A submitted Restore is not Gateway readback and is not a device-side result.
What WLOC will say
Restore submitted or Restore unconfirmed until independent evidence exists. WLOC does not label a submitted command as Restored successfully on this path.
How to Revoke
Revoke from the Portal device settings. That invalidates the Gateway identity. Remove the Profile on the iPhone as well; Revoke does not physically wipe Settings for you.
Emergency Stop when the service is abnormal
In the Portal, Emergency Stop lives on Settings → Security and on the Restore banner. It asks the Gateway to terminate the tunnel. Acceptance is not automatic proof that the iPhone already looks normal.
If WLOC cannot be reached
On the iPhone: Settings → General → VPN & Device Management → remove the WLOC testing Profile. That local removal is the recovery step that does not depend on Portal, billing, or this website.
Components
Open-source components and licenses
Material third-party components that testers often ask about. This is not a complete software bill of materials.
| Component | License | Role |
|---|---|---|
| strongSwan | GPL-2.0-or-later | IKEv2 data-plane termination on the Gateway |
| Astro | MIT | Public website rendering |
| Hono | MIT | HTTP routing in Workers |
Listing a component does not make WLOC open source. WLOC application code is not published as an open-source product on this page.
Availability
Service status
Service status
WLOC is designed to publish a separate status surface for API, Portal, Gateway control-plane, billing webhook, and Restore pipeline availability. That page reports whether a service works. It does not reveal Gateway hostnames, user counts, or device data. A public live status host is not linked here until it is reliable.
Report a security concern
Email support@wloc.app with a reproducible description and redacted timestamps. No response-time SLA, bug bounty, or external certification is claimed here. support@wloc.app
Do not email Profile XML, EAP passwords, tokens, private keys, raw traffic, or unnecessary personal data.
Trust Center
How to Restore immediately
Restore, Revoke, Emergency Stop, Export, and Delete Account remain reachable under unpaid, refunded, frozen, restricted, and pending-deletion states.