KeepWatch Privacy Policy
The short version. KeepWatch finds the cameras on your own network and shows you what they see, with no account. Your cameras' addresses and sign-ins, what you watch, what the phone keeps to wind back through, the snapshots and clips you save and the movement it finds all stay on your phone. By default nothing leaves it but crash reports, which go to a server we run ourselves, and a request at launch to Google's Firebase for the app's remote settings; a report about a camera that will not connect leaves only when you send it, and anonymous usage reporting is off until you turn it on. If you sign in — with Apple, with Google or with a code sent to your email address — we hold your email address, with Google also your name and a link to your profile picture, and the records that keep you signed in. If you turn Relay on, the phone at home keeps the video of every one of its cameras, watched or not, on that phone alone, and sends us its list of cameras — their names, their addresses on your home network and their sign-ins, your zones and walls — sealed under a relay passphrase we cannot open, and video, snapshots and camera commands are sealed under the same passphrase from one of your phones to the other. Your phones try to connect to each other directly; when they cannot, that sealed traffic passes through our server in real time, without being stored, and we cannot read it there either. If you turn Sync on, your setup is kept on our server for your other phones, sealed under the same passphrase. Pro is bought from the App Store or Google Play, and nothing about the purchase reaches our servers; if you have turned usage reporting on, Google's Firebase counts it with the rest of that reporting, without tying it to you. We do not show ads, and we do not sell or share your personal information for advertising.
This policy explains what data the KeepWatch app ("the app") handles, what reaches HYPER C ("we", "us"), and what stays on your phone and your network. It applies to the app on iOS and Android, to the relay service behind it, and to the emails we send because of it. HYPER C is the trade name of 임중혁 (Joong Hyuk Im), a sole proprietor in the Republic of Korea, business registration number 494-01-04265; "we" and "us" mean 임중혁, trading as HYPER C. Questions go to [email protected]. This policy is written in English and also published in Spanish, Portuguese, French, Japanese, Simplified Chinese and Korean; the translations are offered for convenience, and if one differs from the English text, the English text prevails.
1. Data that stays on your phone
The app is complete without an account. Everything it needs lives on your phone:
- Your cameras — each camera's name, model and address on your network, the stream addresses saved with it and the user name the app signs in to it with, in the app's local database, together with your zones and walls. Each camera's password, and any stream address that has a sign-in in it, are kept apart from that database, in your phone's secure keystore (iOS Keychain / Android Keystore); on an iPhone they can be read only on that phone, and only once it has been unlocked after starting up. They are left out of the phone's cloud backup and out of a transfer to a new phone, so a phone restored from a backup comes back with your cameras but asks for each camera's password again. The app reads them back to sign in to your cameras, so anyone who can use your unlocked phone and the app can still use them.
- What you watch — a live picture comes straight from the camera to the phone over your own network. While a camera or a wall is on screen, what it plays is kept on the phone so that you can wind back through it, in the app's temporary storage and nowhere else. A phone with Relay on keeps more than what is watched on it: for as long as Relay is on, it keeps the video of every one of its cameras, whether or not anyone is watching, in the same storage on that phone, so that your other phones can wind back through it. It does so unless you turn off "Keep every camera", a switch on the Relay tab, under PLAYBACK, which is on until you turn it off; with it off, the phone keeps only what is watched on it. What has been kept stays there after you close the camera, and after you turn Relay or that switch off, and nothing is removed for being old. How much room it may take is yours to set in Settings, under "Room for playback": from 256 MB to 5 GB, and 1 GB unless you change it; what a phone keeps because Relay is on shares that room with what is watched on it. Once that room is full, the oldest goes to make way for the newest. Apart from that, everything kept goes when you turn "Keep what you watch" off or clear it in Settings, and while that switch is off nothing is kept at all, whether Relay is on or not; what is kept of a camera goes when you remove that camera from the app; and what is kept of cameras you watched through another of your phones, over Relay, goes when you sign out. Because this is temporary storage, the phone's own system may also empty it when the phone runs short of space. While it is there, another of your phones signed in to the same account can wind back through it over Relay, sealed from one phone to the other as live video is, and our server keeps none of it (section 4).
- Snapshots and clips — the stills you take and the clips you make from what the phone kept are saved in the app's own libraries on the phone, until you delete them.
- Events — movement is looked for on the phone, in the pictures that are on screen, and what it finds is written to the event feed with a still of that moment. Events are dropped after the number of days you choose in Settings. No camera is asked to report movement to us, and nothing the phone finds leaves it.
- Broadcast — if you turn the Broadcast tab on, the phone's camera and, with its Sound switch on, its microphone are served to devices on the same Wi-Fi that ask for them, the way a camera would serve them, without a password: any device on that Wi-Fi can watch. If Relay is on as well, the phone also offers its Broadcast to your other phones signed in to the same account, even when it has no Wi-Fi, through Relay and sealed like everything else Relay carries; it is offered only while the Broadcast is on, and it is never added to your cameras, so Sync does not copy it. While Relay is on, the phone also keeps what its Broadcast sends, as recordings, unless you have turned off "Keep every camera" on the Relay tab or "Keep what you watch" in Settings: the picture, and the sound too when the Sound switch is on. The recordings are kept on that phone only, in the app's own cache folder, in as much room again as you allow under "Room for playback", so with both the phone may hold up to twice that figure, and the oldest goes first. You can drop one recording or all of them on the Broadcast tab, under RECORDING, in "Kept now", and they all go when you turn "Keep what you watch" off; clearing what is kept in Settings removes the video kept of your cameras and leaves a Broadcast's recordings where they are. Whatever can watch the Broadcast can wind back through its recordings in the same way: any device on that Wi-Fi, without a password, and your other phones through Relay, and our server keeps none of it. Apart from that, a recording leaves the app only when you share it or save it to Photos, as a video, from that page. With Relay off, or with "Keep every camera" off, a Broadcast keeps nothing new; what it kept before, recordings made by an earlier version of the app included, stays until the room is needed or you drop it. The camera and microphone are used for nothing else, and neither is touched until you turn the switch on.
- Setup files — a setup file you export holds your cameras' names, addresses and streams, your zones and walls, each camera's motion area and your settings. Camera sign-ins go in only if you seal the file with a passphrase, and then only sealed. The file goes only where you send it.
- App settings and your answers — the theme, the language, your streaming, playback, motion and alert settings, whether you said yes to usage reporting, kept so you are not asked again, and what the App Store or Google Play last said about Pro.
- Your account and relay keys — if you sign in, the tokens that keep you signed in are kept in your phone's secure keystore (iOS Keychain / Android Keystore). If you set a relay passphrase, the phone keeps a key derived from it there, never the passphrase itself; a phone that watches through Relay, or syncs a setup another phone sealed, keeps the key it derived when you typed the passphrase on it. None of these ever reaches us.
Permissions follow the same lines. On an iPhone, the local network permission is what lets the app find your cameras and talk to them; the camera and microphone are used only by Broadcast; and Photos is asked for add-only access, so the app can put a snapshot, a clip or a recording there and cannot see what is already in it.
2. What leaves your phone by default
Without an account, these are the only things that leave the phone: three on their own, and a fourth only when you send it.
- Crash and error reports — sent to an error-tracking server we run ourselves (GlitchTip, Sentry-compatible), not to a third party. A report contains the error, the app version, the device model and the OS version, and it can name a camera's address on your network. Camera passwords, the sign-in part of any stream address and, if you have an account, your email address and tokens are removed from every report before it is sent. Personally identifying fields and screenshots are disabled in the reporting client: a screenshot of this app would be a picture of the inside of your home.
- A camera problem report, only if you send one — when a camera will not show up in the scan or will not connect, the steps for adding a camera and a saved camera's page offer "Still not there? Send us a report" or "Still not connecting? Send us a report". Nothing is sent until you tap Send on the sheet that opens, which says what goes. The report goes as an event of its own to the same error-tracking server as crash reports, and carries the step you were at, the note you write if you write one, the addresses and models of the cameras involved and what each one answered, up to 200 lines of the app's recent log, and the app version, device model and OS version a crash report carries. It never includes a password: what you typed into the password field, and the sign-in part of any address, are taken out of everything in it before it is sent. The app's Privacy & data screen lists it as "A report you send us".
- Usage reporting is off until you turn it on. The app uses Google Analytics for Firebase to count which screens are opened and which steps are taken — a camera added, a stream opened, a clip saved — together with a few coarse facts about how the app is set up, such as whether it has one camera or several, never the number. While it is on, the Firebase SDK also measures purchases made in the app through the App Store or Google Play on its own — which product was bought, its name and its price — as events like the others (section 6). Collection is disabled in the app's build settings and stays off until you tick the box at the end of the first-run tour or turn on the switch in Settings → Your data. When it is on, events are keyed to an anonymous app-instance identifier, never to an account, and the app is built so that no event can carry a camera's name, its address, a user name or password, a zone or wall name, or a picture. Advertising-related consents are denied to the SDK whatever you choose. Turning reporting off also asks Google to delete the anonymous identifier, so earlier events are orphaned rather than kept waiting for the rest of a profile.
- The app's remote settings — at each launch the app asks Google's Firebase Remote Config for the few settings we change from there, such as whether Pro is on sale. The request carries an identifier Firebase makes for this installation of the app, which is not tied to your account or to your phone's hardware, with the app's version and the phone's OS version, language, region setting and time zone, which Firebase uses to choose the settings to send. It carries nothing about your cameras, and it is made whether or not usage reporting is on.
Your cameras' pictures never leave the phone this way, and nothing that does says more about where you live than the region and time zone your phone is set to.
3. Data we receive if you sign in
Signing in is optional. It exists so that Relay and Sync can join the phones that belong to the same person. You sign in with Apple, with Google, or with an email address that receives a six-digit code; there is no password to set with us. Each way of signing in leads to an account of its own: we never join accounts by email address, so signing in with Apple and later with a code sent to the same address gives you two separate accounts.
- Account identity — your email address, and the language your phone uses, so that we can write to you in it.
- Apple or Google — if you sign in with Apple or Google, we receive the identifier Apple or Google gives us for your account, which is how we recognise you next time, and your email address: from Apple, the one you chose to share, which can be a private relay address that Apple forwards to your own; from Google, your address if Google has verified it. Google's sign-in also carries the name on your Google account and a link to its profile picture, which we keep: the name only to address you in the emails we send, the link as it comes, without fetching the picture. The app does not ask Apple for your name. From Apple we also keep, encrypted, a token whose one use is to revoke KeepWatch's access to your Apple account when you delete your KeepWatch account, as Apple requires. Apple tells us if you stop using your Apple account with KeepWatch, delete that Apple account or turn off forwarding to a private relay address, and we then end your sessions; remove that way of signing in, scheduling your account for deletion if it was the only one; or stop writing to that address. We never see your Apple or Google password.
- Sign-in codes — for an email sign-in, we keep a hashed copy of each code, together with the address it was sent to, which app asked for it and a truncated network address, so codes can be limited and abuse spotted. A code expires within minutes and is spent after a few wrong guesses; its record never holds the code in readable form and is not tied to your account.
- Sessions — a hashed refresh token per signed-in phone, the phone's name, the app identifier and a truncated network address. A refresh token expires after 60 days, and a phone whose token has expired has to sign in again; signing out ends a session at once. The record of an ended session stays, marked ended, until your account is deleted.
- Phone records — each phone you sign in on registers itself with an installation identifier the app made up for Relay (a random number, not your phone's hardware identifier), the name you give the phone, whether it is an iPhone or an Android phone, the version of the app it runs, whether Relay is turned on on it, and when it was last connected.
- Audit records — a log of significant actions on your account, such as sign-ins and deletion, with a truncated network address, kept for security and to answer disputes.
Network addresses are truncated before they are stored in our database — to /24 for IPv4 and /48 for IPv6 — so what we keep there identifies a neighbourhood, not a device. Our servers' request logs, kept for a limited time, can carry the full address a request came from.
4. Data we receive if you turn Relay or Sync on
Relay lets you watch the cameras at home from another phone signed in to the same account. The phone at home keeps a connection to our server open while the app is in front, the phone away from home connects to the same server, and our server joins the two: it helps them connect to each other directly, and carries the traffic between them itself when they cannot. For that, three kinds of data pass through us:
- Your camera library, sealed — so that the other phone can show the same grid, the phone at home publishes a description of what it watches: each camera's name, model and address on your home network, the stream addresses and the user name and password saved with it, and your zones and walls, and, while its own Broadcast is on, the phone itself, so that your other phones can watch it too. All of it is sealed before it leaves the phone at home: it is encrypted with a key derived from a relay passphrase you choose, and only a phone on which you have typed that passphrase can open it, which is why Relay does not work until you set one. We store the sealed copy, which we have no key for, with a short header that says only which versions of the setup format and of Relay's sealing the phone uses. It is sent again whenever something changes, and the newest copy is stored on our servers until the phone is removed from the account or the account is deleted. We can see how large the sealed copy is and when it changes, never what is in it, and we cannot change what is in it without your other phones refusing it; what we could do is fail to pass on a new copy, or pass on an older one. If you forget the passphrase, we cannot recover it; you set a new one on the phone at home and type it again on the others.
- Connection details — so that your phones can try to connect to each other directly, our server passes each one's connection details to the other while they connect: WebRTC session descriptions and network candidates, which contain the phones' IP addresses and ports. It passes them on and does not store them.
- Relayed traffic, sealed — when your phones cannot connect to each other directly, the live picture and sound — a phone's own Broadcast among them — snapshots, pan, tilt and zoom and other camera commands, listings of recordings, and the video the phone at home kept all pass through our server between your phones, in real time. All of it is sealed end to end, from one of your phones to the other, under the same key as your camera library, and so is the address of the camera each part of it is for: our server cannot read any of it, and anything changed, dropped or replayed on the way fails to open on your phone and goes no further. The server sees only what it needs to pass the traffic on — what kind of message each piece is, which of your connections it belongs to, how long it is and when it passes — so it can tell how much passes between your phones and when, but not what. It forwards the traffic and keeps nothing: none of it is stored. What our logs record is when each of your phones' connection to the relay came up and went down, and nothing about what passed through it. Around the seal, the connection between each phone and our server is encrypted as well.
When your phones do connect directly, the camera traffic does not pass through us. To find a route between them, each phone asks a public STUN server — by default Google's (stun.l.google.com) and Cloudflare's (stun.cloudflare.com) — for its public IP address and port, and the two then connect to each other with WebRTC. Once they are connected, camera video, the sign-ins used with your cameras and the rest of the camera traffic travel from one of your phones to the other sealed under the key from your relay passphrase, just as relayed traffic is, and inside WebRTC's own encryption (DTLS) as well; our server does not see them. Each of your phones therefore learns the other's IP address. The connection joins only your own phones, and nothing is shared with other users.
While Relay is on we also know whether the phone at home is connected and how many of your phones are watching through it, which is what the app shows you; that is not kept once the connection ends.
Relay works only between phones signed in to the same account. Nobody else can be given access to your cameras through it, and we have no view of them ourselves.
Sync keeps your setup the same on every phone signed in to your account that has the Sync switch on, at the top of Settings; it is off until you turn it on. What it keeps on our server is one copy per account of what a setup file holds: your cameras' names, addresses and streams with their sign-ins, your zones and walls, each camera's motion area and your settings. All of it is sealed on the phone before it leaves, under the same relay passphrase as Relay and bound to your account, so we cannot read it and a copy moved to another account will not open; beside it we store only a header that says which version of the setup format it uses. As with Relay, we can see how large the copy is and when it changes, never what is in it, and what we could do is fail to store a new copy or hand back an older one. Events, snapshots, clips, kept video and Broadcast recordings never go to Sync: they stay on the phone that made them.
Turning Sync off on a phone stops that phone syncing and leaves the account's copy for your other phones; the copy is deleted with your account. If you forget the passphrase, we cannot recover it or open the copy: set a new one on one of your phones, which seals the copy again under it, and type it on the others.
5. Emails we send
We send email only because of something you did: a sign-in code, and notices that your account's deletion has been scheduled or completed. If you signed in with Apple and chose to hide your address, that mail goes to the private relay address Apple gave us, and Apple forwards it. Mail is delivered by Amazon Simple Email Service, operated by Amazon Web Services in the United States. We keep a record of the account notices we sent and to whom — a sign-in code is sent at once and leaves no such record — and a list of addresses that bounced or asked us to stop, so that we do not keep writing to them.
6. Purchases
KeepWatch Pro is a subscription you buy through the App Store or Google Play. Apple or Google takes the payment, under its own terms and privacy policy, and our servers never receive your card number, your billing details or anything else about the purchase — not even a receipt or a confirmation that it is active. The app asks the store on your phone, at each launch and when you come back to the app, whether your Apple ID or Google account holds Pro, and keeps the store's last answer on the phone so that Pro works without a signal. The app itself sends a purchase nowhere, and we use no purchase service, our own or anyone else's. The one exception is usage reporting: if you have turned it on, Google Analytics for Firebase, which the app uses for that reporting, notices purchases made in the app through the App Store or Google Play and records which product was bought, its name and its price, keyed to the same anonymous app-instance identifier as the other usage events and never to your KeepWatch account or your store account. With usage reporting off, it records nothing about a purchase. Pro belongs to the store account that bought it, not to your KeepWatch account: it works without signing in, and it does not follow you to a phone that uses the other store.
7. What we don't do
We do not sell your personal information, share it for cross-context behavioral advertising, or show ads. The app carries no advertising SDK and does not request the advertising-identifier permission. We do not watch your cameras, and we cannot: without Relay nothing of them reaches us, and with it the pictures travel sealed from one of your phones to the other, directly or, when the phones cannot connect directly, through our server, which cannot open them and stores nothing of them. We cannot read your camera library or your synced setup — your cameras' names, addresses and passwords — which reach us only sealed. We do not collect your contacts, location, photos, or anything else outside what this policy lists.
8. Retention and deletion
- On your phone — kept video, what a phone with Relay on keeps of every one of its cameras included, is not removed for being old: it stays until the room for playback is full, when the oldest goes to make way for the newest, and it goes sooner if you turn "Keep what you watch" off, remove its camera from the app or, for cameras watched through another of your phones, sign out (section 1); it can be cleared at any time in Settings. Turning Relay or "Keep every camera" off stops more being kept and removes nothing that is already kept. Events go after the days you set. Snapshots and clips stay until you delete them. A Broadcast's recordings stay until their room is full, when the oldest goes first, or until you drop them on the Broadcast tab or turn "Keep what you watch" off; clearing what is kept in Settings does not remove them, and those made by an earlier version of the app stay in the same way. Uninstalling the app removes all local data, subject to your OS backup settings.
- Your account — you can delete it from inside the app — tap Account on the card at the top of Settings, then Delete account — or by asking us. Deletion has a grace period of 14 days, shown when you request it; signing back in before it ends cancels the request. After it, your account, your phone records, your sealed camera library, your sealed synced setup and your sessions are permanently removed from our servers, and if you signed in with Apple we ask Apple to revoke KeepWatch's access to your Apple account. Audit entries lose their link to you at the same time.
- A phone you remove — removing a phone from your account in the app deletes its record and the library it published at once. Turning Relay off on the phone at home closes its connection, and nothing is relayed until you turn it back on.
- Sign-in codes and sessions — codes expire within minutes and are never kept in readable form; sessions end when you sign out, when their token expires or when the account is deleted, and their records go with the account.
- Relayed traffic and connection details — neither is stored, so there is nothing to delete, and what travels directly between your phones never reaches us. The log lines about connections, like our other server logs, are kept for a limited time for operating and securing the service, then deleted.
- Backups — our database is backed up on a schedule. Backups are encrypted before they leave our infrastructure and are kept on a rolling basis, so a deleted account persists in a backup for a limited time after deletion and then ages out.
- Crash reports, problem reports and usage events — kept only as long as needed for debugging, for working on support for cameras and for product decisions, then deleted according to the retention settings of our error tracker and of Firebase. Firebase deletes the installation identifier behind the app's remote settings once it has gone unused for a long period.
9. Legal bases
Where the GDPR or the UK GDPR applies, we process your data on these bases: performance of a contract for the account, Relay and Sync you asked for; legitimate interests for crash reporting, the camera problem reports you choose to send, the app's remote settings, security, abuse prevention, the audit records and our server logs; and consent for usage reporting and for anything else the law requires it for. Where the Personal Information Protection Act of Korea applies, usage reporting is an optional consent item and refusing it does not limit the service.
We do not use your data for automated decision-making with legal effects.
10. Your rights
If you are in the EU, EEA or UK, you have the right to access, correct, delete and receive a copy of your personal data, to object to or restrict processing, and to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority.
If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as defined by the CCPA/CPRA, and we do not discriminate against you for exercising your rights.
If you are in Korea, you have the rights the Personal Information Protection Act gives you to access, correct, delete and suspend the processing of your personal information, and to withdraw consent.
The fastest way to exercise most rights is in the app itself: usage reporting is a switch, and account deletion is built in. For anything else, including a copy of your data, email [email protected]; we respond within the timelines the applicable law requires. Your camera library and your synced setup reach us only sealed, so a copy can cover them only as ciphertext, and relayed video is not kept, so there is nothing of it to copy.
11. International transfers
Our servers may be located outside your country, and two of our processors are in the United States: Amazon Web Services for email delivery and encrypted backups, and Google for usage reporting and the app's remote settings. Where data protection law requires it, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision. The Republic of Korea is covered by an EU adequacy decision.
12. Children
KeepWatch accounts are for people aged 14 and over, or older where the law where you live sets a higher minimum age for consent to data processing. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
13. Security
Your camera library and your synced setup, sign-ins included, are sealed on your phone before they reach us, and what Relay carries is sealed from one of your phones to the other, under a passphrase we never see. On the phone itself, camera passwords are kept in its secure keystore and out of its backups. Everything between the app and our servers travels over encrypted connections, and so does what your phones send each other over a direct connection (DTLS). Session tokens are stored hashed and the token Apple gives us encrypted, network addresses are truncated before they are stored in our database, relayed traffic is forwarded without being stored, and error tracking runs on our own server with identifying fields disabled and camera passwords scrubbed. Your cameras' own security — their passwords, their firmware, who else is on your network — is yours, and so is the choice to make your phone a camera for everyone on your Wi-Fi with Broadcast. If you find a security problem, please tell us at [email protected] rather than publishing it; we would rather hear about it early and in private.
14. Processors and third parties
We use a small number of processors, each receiving only what its role requires:
- Google Firebase — the app's remote settings, and usage reporting, with its measurement of store purchases, only if you turn it on.
- Amazon Web Services — email delivery, and encrypted storage of our backups.
- Our own hosting — the relay service, its database, and the error-tracking server.
Your cameras are not our processors: the app talks to them on your behalf, on your network, and their makers learn nothing from us.
Apple and Google are not our processors when you sign in with them or buy Pro from their stores: you deal with them directly, under their own privacy policies, and what reaches us from a sign-in is what section 3 lists.
The public STUN servers your phones ask for their address when Relay connects them directly — Google's and Cloudflare's by default — are not our processors either: each phone asks one itself, that server sees the phone's public IP address and port, and we send it nothing.
15. Changes to this policy
If we change this policy in a way that matters, we will update the date above and, for material changes affecting signed-in users, tell you in the app. Continued use after a change means the updated policy applies.
16. Contact
임중혁(HYPER C)
Privacy officer under the Personal Information Protection Act of Korea: 임중혁
[email protected] for anything about your data
[email protected] for security problems