Privacy Policy — Smart Security Camera

Last updated: 2026-10-04. Applies to the Windows app and the Android app (com.smartsecuritycamera). The same policy will govern the iOS app when it ships.

Short version: the app is a local security camera. Everything — video, detections, the event timeline — stays on your PC unless you personally switch on one of two optional features: upload to your own cloud account, or AI descriptions through an AI service of your own choosing with your own key (Anthropic's Claude, or any OpenAI-compatible service such as OpenAI or Google Gemini) — or a model running on your own PC, in which case nothing leaves it. There is no telemetry. Signing in is optional: it is needed only to watch from your phone, browse history there and get notifications, and then the Smart Security Camera sign-in and live-view service (smart-security-camera.com) holds your account (section 3a). It never holds your video.

1. Camera use

Video is captured only while recording is on: when you press Start, or — if you enable it in Settings → Power & startup — automatically when the Windows session locks or whenever the app runs. Windows shows its own camera-in-use indicator whenever the camera is active, and the app's tray icon shows a red dot while recording.

Audio is off by default. If you turn on Record audio in Settings → Recording, the microphone is captured only while recording is on and its sound is stored in the same recordings and event clips as the video — and therefore reaches your cloud account with them if cloud upload is on. Windows asks for microphone permission the first time and shows its microphone-in-use indicator. If the microphone is missing or blocked, video still records and the Live page says so.

2. What is stored on this PC

• Recordings — H.264 MP4 files in a folder you choose (default Videos\Security Camera), in one-minute segments (or per-event clips in events-only mode), inside a size cap you set. When the cap is reached the oldest recordings are deleted automatically, like a dash cam.
• Index (%LOCALAPPDATA%\SecurityCamera\index.db) — segment and event metadata, detection boxes, AI descriptions, upload queue, AI usage counts, and — if you enrol people — their names and encrypted face templates.
• Event stills (snapshots\) — one JPEG of the moment an event opened and one of the largest person seen (used for face matching), plus a copy of each with the detected objects' boxes and labels drawn on — and, for people you enrolled, their names (shown in the alert and the Events list; the drawn-on copies are never sent to an AI service); deleted after 30 days.
• Settings (settings.json) — your preferences and, if you use them, your rules text and its compiled form. Never secrets.
• Secrets — cloud sign-in tokens, the private-mode master key and your AI service keys live only in the Windows credential vault / DPAPI for your Windows user. They are never written to settings or logs, and the API key is never displayed again after you enter it.
• Logs (logs\app.log) — operational messages only. Every line is scrubbed before it is written: user-profile paths become ~, e-mail addresses, bearer tokens, OAuth codes and URL query strings are redacted.

Local detection — motion, people, pets, vehicles — runs entirely on this PC (ONNX Runtime, CPU). Nothing about it leaves the device.

3. What can leave this PC (all off by default)

Details that matter:

• Cloud scopes are minimal. Google: drive.file (only files this app created). Microsoft: Files.ReadWrite.AppFolder (only Apps/Security Camera). Dropbox: app-folder access. The app cannot see the rest of your drive. Sign-in uses the provider's own OAuth pages with PKCE; the app never sees your account password.
• Private mode (Settings → Cloud upload) encrypts every upload on this PC with AES-256-GCM before it leaves. Your cloud provider then stores only unreadable .enc files. The key is generated on this PC, kept in the vault, and shown to you once as a recovery phrase; without that phrase the files cannot be read anywhere else — including by us, because there is no us.
• AI never sees continuous video, only the handful of stills listed above, and only for events while the feature is on. The prompt instructs the model to describe activity, never to identify people or infer demographics. Calls stop automatically at the monthly budget and daily cap you set. Data sent to an AI service is governed by that service's API terms and privacy policy for your own account (Anthropic's for Claude, OpenAI's, Google's, or the terms of whichever OpenAI-compatible service you point the app at); the app stores no copy of it beyond the returned description. A model on your own PC sends nothing anywhere.
• Face data never leaves this PC. If you enrol people (Settings → People), what is stored for each is a name and a few numeric face templates — not photos — encrypted in the local index with a key held in the vault. Matching runs on this PC against the stills of your own events; a match relabels the event as someone you know, which is the only word about it your cloud folder ever sees. The AI service sees the same word unless you turn on Tell the AI who was recognised (Settings → AI): then the names you gave the people it recognised, and how many faces it did not know, go with the event's pictures — never a template, never a crop. A model running on your own PC always gets that line, since nothing leaves the PC. Forget deletes a person's templates at once; Forget everyone also replaces the key. This reduces false alarms; it is not access control (a printed photo could fool it).

3a. The sign-in and live-view service (optional)

When you sign in with Google, Microsoft or Apple, the provider only proves who you are: the app receives a signed token and hands it to the Smart Security Camera service, which verifies it. The service never sees your password or your provider tokens, and never exchanges codes with the provider. It keeps: your account (provider, a hashed subject, your e-mail and display name), the names of the devices you signed in on and their push tokens, your PCs and cameras by name and whether they are online, who you shared cameras with (as a viewer or as family, which cameras, until when), the invitations you sent (the e-mail you typed, until they are accepted, declined or expire), and your phones' public keys together with the camera keys wrapped to them, which it cannot open. It also keeps a 30-day activity record per PC for its owner: who watched which camera and for how long, who sounded the siren, moved a camera, started a recording, looked at a still, asked the assistant, and every sharing change — as ids and times, the names filled in only when the owner reads it. Your PC drains that record into its own audit log (section 3b) and the service drops rows after 30 days. If you ask for it, the service pushes "someone started watching" to your own phones. It never stores video, pictures, recordings or history; those stay on your PC and in your own cloud. Live video and sound are end-to-end encrypted: the PC encrypts every frame with a key it made itself and hands only to the phones allowed to watch, each copy wrapped to that phone's own key, so the relay forwards bytes it cannot read; removing a phone or a person replaces the key. When you pull down the phone's camera list, each PC that is recording sends one small still through the service to your phone; it is sealed under the same camera key, and the service keeps it in memory for at most a minute and never writes it to disk. Deleting your account (Settings → Account) removes everything above at once; signing out on a device removes that device's session. Logs hold hashed ids, never e-mails, names or tokens.

3b. The audit log (on your PC, and in your cloud by choice)

The PC keeps its own record of every access to its cameras — the service's activity record drained as it happens, plus what the PC sees itself — in a table beside the recording index, each row chained to the one before it so a changed or removed row shows up in Verify. It carries the display names of the people you shared with and their devices' names, never e-mails or a question's words. You choose how long it is kept (90 days by default, a year, or for ever) and you can export it as day files. With Keep a copy in my cloud folder switched on (off by default), each day's rows are written into your own cloud folder beside the clips (audit/‹day›.jsonl); your phone reads them there. The service keeps nothing of it beyond the 30-day record above.

4. Security features

• App lock (optional): Windows Hello is required to open the app after start or after Windows locks; the window is fully covered meanwhile. Recording is unaffected.
• Tamper evidence: encrypted uploads are authenticated per chunk; a modified, truncated or reordered file is rejected rather than decrypted.
• Cloud disconnect revokes the app's token with the provider where the provider supports it, and always removes the token from this PC.

5. Telemetry

None. No analytics, no crash reporting, no usage statistics. The only network traffic is the optional cloud and AI features above, and Windows' own update of the app.

6. Retention and deletion

• Local recordings roll over automatically at your size cap; delete the storage folder to remove everything at once.
• Cloud files follow the retention you set (age or size); you can also delete them from the app or in your cloud provider. OneDrive and Dropbox keep a recycle bin; Google Drive deletion via API is permanent.
• Signing out of a cloud account or removing the API key deletes the secret from this PC.
• Uninstalling the app removes settings, the index and logs. Recordings in your Videos folder stay until you delete them; the private-mode key stays in your Windows vault until you remove it (Credential Manager → SecurityCamera) so encrypted cloud files remain recoverable.

6a. Deleting your account

This applies to the optional Smart Security Camera account (sign-in with Google, Microsoft or Apple, section 3a). If you never signed in, there is no account and nothing to delete.

In the Android app: Settings → Account → Delete account, then confirm. On the PC: Settings → Account → Delete account. Either one deletes the account on the service immediately, without a waiting period, and signs out every device.

What is deleted: the account itself (provider, hashed subject, e-mail, display name), every device you signed in on and its session and push token, your PCs and cameras as registered on the service, the shares and invitations you made or received, the 30-day activity record of your PCs, and the wrapped camera keys and public keys the service held. Nothing is kept afterwards; the service's logs never carried your e-mail, name or tokens, only hashed ids.

What is not affected: your recordings, events, stills and clips. They were never on the service; they stay on your PC and, if you turned cloud upload on, in your own cloud account, until you delete them there (section 6). Face data enrolled on the PC stays on that PC.

Deleting some data without closing the account: signing out on a phone (Settings → Account → Sign out) or removing a device from the PC's list deletes that device's session, push token and keys; removing a person you shared a camera with — or one of their devices — deletes their access and rotates the camera key; removing a camera or a PC deletes its registration and its activity record. The audit log on your PC is yours to export or delete (Settings → Audit log; the cloud copy stays in your cloud until you delete it there). Recordings in your cloud are yours to delete at any time from the app or in the cloud provider.

If you cannot open the app, write to the contact address in section 8 from the e-mail of the account and ask for it to be deleted; it is done by hand within 7 days.

7. Children

The app is not directed at children and collects no personal data from anyone; it is a tool that runs entirely under your Windows account.

8. Changes and contact

This policy changes only when the app's data handling changes; the date at the top and the milestone log in docs/ARCHITECTURE.md record what changed.

The apps and the service are run by Siduron Apps. Questions, requests and anything you want corrected or deleted: siduron10@gmail.com.