Privacy Policy — Smart Security Camera

Last updated: 2026-09-02. Applies to the Windows app. The same policy will govern the Android and iOS apps when they ship.

Short version: the app is a local security camera. Everything — video, detections, the event timeline — stays on your PC unless you personally switch on one of two optional features: upload to your own cloud account, or AI descriptions through your own Anthropic API key. There is no telemetry. Signing in is optional: it is needed only to watch from your phone, browse history there and get notifications, and then the Smart Security Camera sign-in and live-view service (smart-security-camera.com) holds your account (section 3a). It never holds your video.

1. Camera use

Video is captured only while recording is on: when you press Start, or — if you enable it in Settings → Power & startup — automatically when the Windows session locks or whenever the app runs. Windows shows its own camera-in-use indicator whenever the camera is active, and the app's tray icon shows a red dot while recording.

Audio is off by default. If you turn on Record audio in Settings → Recording, the microphone is captured only while recording is on and its sound is stored in the same recordings and event clips as the video — and therefore reaches your cloud account with them if cloud upload is on. Windows asks for microphone permission the first time and shows its microphone-in-use indicator. If the microphone is missing or blocked, video still records and the Live page says so.

2. What is stored on this PC

• Recordings — H.264 MP4 files in a folder you choose (default Videos\Security Camera), in one-minute segments (or per-event clips in events-only mode), inside a size cap you set. When the cap is reached the oldest recordings are deleted automatically, like a dash cam.
• Index (%LOCALAPPDATA%\SecurityCamera\index.db) — segment and event metadata, detection boxes, AI descriptions, upload queue, AI usage counts, and — if you enrol people — their names and encrypted face templates.
• Event stills (snapshots\) — one JPEG of the moment an event opened (shown in the alert) and one of the largest person seen (used for face matching); deleted after 30 days.
• Settings (settings.json) — your preferences and, if you use them, your rules text and its compiled form. Never secrets.
• Secrets — cloud sign-in tokens, the private-mode master key and your Anthropic API key live only in the Windows credential vault / DPAPI for your Windows user. They are never written to settings or logs, and the API key is never displayed again after you enter it.
• Logs (logs\app.log) — operational messages only. Every line is scrubbed before it is written: user-profile paths become ~, e-mail addresses, bearer tokens, OAuth codes and URL query strings are redacted.

Local detection — motion, people, pets, vehicles — runs entirely on this PC (ONNX Runtime, CPU). Nothing about it leaves the device.

3. What can leave this PC (all off by default)

Details that matter:

• Cloud scopes are minimal. Google: drive.file (only files this app created). Microsoft: Files.ReadWrite.AppFolder (only Apps/Security Camera). Dropbox: app-folder access. The app cannot see the rest of your drive. Sign-in uses the provider's own OAuth pages with PKCE; the app never sees your account password.
• Private mode (Settings → Cloud upload) encrypts every upload on this PC with AES-256-GCM before it leaves. Your cloud provider then stores only unreadable .enc files. The key is generated on this PC, kept in the vault, and shown to you once as a recovery phrase; without that phrase the files cannot be read anywhere else — including by us, because there is no us.
• AI never sees continuous video, only the handful of stills listed above, and only for events while the feature is on. The prompt instructs the model to describe activity, never to identify people or infer demographics. Calls stop automatically at the monthly budget and daily cap you set. Data sent to Anthropic is governed by Anthropic's API terms and privacy policy for your own API account; the app stores no copy of it beyond the returned description.
• Face data never leaves this PC. If you enrol people (Settings → People), what is stored for each is a name and a few numeric face templates — not photos — encrypted in the local index with a key held in the vault. Matching runs on this PC against the stills of your own events; a match only relabels the event as someone you know, which is the only word about it the AI or your cloud folder ever sees. Forget deletes a person's templates at once; Forget everyone also replaces the key. This reduces false alarms; it is not access control (a printed photo could fool it).

3a. The sign-in and live-view service (optional)

When you sign in with Google, Microsoft or Apple, the provider only proves who you are: the app receives a signed token and hands it to the Smart Security Camera service, which verifies it. The service never sees your password or your provider tokens, and never exchanges codes with the provider. It keeps: your account (provider, a hashed subject, your e-mail and display name), the names of the devices you signed in on and their push tokens, your PCs and cameras by name and whether they are online, who you shared a camera with, and your phones' public keys together with the camera keys wrapped to them, which it cannot open. It never stores video, pictures, recordings or history; those stay on your PC and in your own cloud. Live video and sound are end-to-end encrypted: the PC encrypts every frame with a key it made itself and hands only to the phones allowed to watch, each copy wrapped to that phone's own key, so the relay forwards bytes it cannot read; removing a phone or a person replaces the key. When you pull down the phone's camera list, each PC that is recording sends one small still through the service to your phone; it is sealed under the same camera key, and the service keeps it in memory for at most a minute and never writes it to disk. Deleting your account (Settings → Account) removes everything above at once; signing out on a device removes that device's session. Logs hold hashed ids, never e-mails, names or tokens.

4. Security features

• App lock (optional): Windows Hello is required to open the app after start or after Windows locks; the window is fully covered meanwhile. Recording is unaffected.
• Tamper evidence: encrypted uploads are authenticated per chunk; a modified, truncated or reordered file is rejected rather than decrypted.
• Cloud disconnect revokes the app's token with the provider where the provider supports it, and always removes the token from this PC.

5. Telemetry

None. No analytics, no crash reporting, no usage statistics. The only network traffic is the optional cloud and AI features above, and Windows' own update of the app.

6. Retention and deletion

• Local recordings roll over automatically at your size cap; delete the storage folder to remove everything at once.
• Cloud files follow the retention you set (age or size); you can also delete them from the app or in your cloud provider. OneDrive and Dropbox keep a recycle bin; Google Drive deletion via API is permanent.
• Signing out of a cloud account or removing the API key deletes the secret from this PC.
• Uninstalling the app removes settings, the index and logs. Recordings in your Videos folder stay until you delete them; the private-mode key stays in your Windows vault until you remove it (Credential Manager → SecurityCamera) so encrypted cloud files remain recoverable.

7. Children

The app is not directed at children and collects no personal data from anyone; it is a tool that runs entirely under your Windows account.

8. Changes and contact

This policy changes only when the app's data handling changes; the date at the top and the milestone log in docs/ARCHITECTURE.md record what changed. Questions and requests: https://github.com/musados/SmartSecurityCamera/issues.