Gadgetbridge is a free and open-source Android application, hosted on Codeberg (a git-hosting platform maintained by the German nonprofit association Codeberg e.V.), that lets users pair and manage Bluetooth wearables — smart watches, fitness bands, and similar devices — without the vendor's closed-source companion app and without creating an account or transmitting data to the vendor's servers. Its source code is published under the GNU Affero General Public License version 3 (AGPLv3), its README names a four-person core team plus dozens of additional named contributors, and its F-Droid listing carries no anti-feature tags. A caveat the project itself discloses: some supported smartwatches still require installing the vendor's own app and connecting to the vendor's servers at least once, before Gadgetbridge can take over. No CVE record and no reported security or privacy incident involving Gadgetbridge was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
8 ON FILE
COLLECTION
Gadgetbridge's README, hosted in its Codeberg source repository, states the app lets users control Bluetooth wearables without the vendor's closed-source companion app and without creating an account or transmitting data to the vendor's servers.
Privacy Guides' Health and Wellness tools page describes Gadgetbridge as an open-source Android application that pairs and manages a Bluetooth device without relying on the vendor's application, and states that when paired with a compatible smartwatch it can mimic the watch's health and wellness functionality without third-party data collection.
Gadgetbridge is hosted on Codeberg, a git-hosting and CI/CD platform whose own about page states it is maintained by the registered non-profit association Codeberg e.V., based in Berlin, Germany — infrastructure-level transparency about the platform Gadgetbridge is developed on, distinct from Gadgetbridge's own project governance.
Gadgetbridge's repository publishes its complete source code under the GNU Affero General Public License version 3 (AGPLv3), the strictest of the common GPL-family copyleft licenses, letting anyone inspect, audit, or fork the actual running code.
Gadgetbridge's README names a four-person core team by order of first code contribution — Andreas Shimokawa, Carsten Pfeiffer, Daniele Gobbetti, and Petr Vaněk — and separately credits a long list of additional named contributors, each tied to a specific device or feature they added, plus public donation (Liberapay) and translation (Weblate) infrastructure.
Privacy Guides' listing discloses a real caveat to Gadgetbridge's no-vendor-server architecture: some supported smartwatches require the user to first download the vendor's own app and connect the smartwatch to the vendor's servers before Gadgetbridge can be installed and take over — meaning the underlying hardware, not Gadgetbridge itself, may still transmit data to the vendor for at least initial setup depending on which device a user owns.
A direct query of the U.S. National Vulnerability Database's public CVE 2.0 API for the keyword 'Gadgetbridge' returned zero results, indicating no CVE record exists for the project as of this research; no breach, regulatory action, or other reported trust-violation record involving Gadgetbridge was found either, though no recurring third-party security audit or funded bug-bounty program was found.
Gadgetbridge's F-Droid listing — F-Droid builds every published app directly from source and tags known anti-features such as tracking, ads, or non-free network dependencies — carries no anti-feature tags for Gadgetbridge and describes the app with the tagline shown on its listing page.