Español

CamPhone

Summary: CamPhone turns one phone into a camera and another into a viewer, linked with a code. Video and sound travel directly from one phone to the other, encrypted, and are not stored on any server. Recordings stay on the camera phone and you delete them from the app. With motion watch on, the camera detects motion inside the device itself, records a clip on it and, if the viewer asked for it, notifies the viewer. No image is sent to a server to be analysed, and clips don't leave the camera unless a viewer watches them from it. On iPhone and iPad with LiDAR you can also turn on detection with the depth sensor (it is off by default), and “Ignore pets” uses Apple's Vision framework to tell people from dogs and cats: both happen on the phone itself, with no servers, and neither images nor depth maps are stored or sent. There are no accounts or sign-up. Google ads are only personalized if you give your consent, and usage analytics (without the advertising identifier) only turns on if you accept it in Google's form.

Who is responsible

Gabriel Micó Victoria, developer of CamPhone. For any question about data, or to exercise your rights, write to gabrielmicovictoria@gmail.com.

Responsible use: tell the people who appear

CamPhone is meant for keeping an eye on your home, your business or your pets, with the knowledge of the people who may appear on camera. It is not for recording anyone without their knowledge, for spying on another person, or for recording where people reasonably expect privacy (bathrooms, other people's bedrooms, changing rooms…).

The camera shows its status on screen (“Watching”, “Recording motion”, “Motion watch turned off…”, “Streaming to the viewer”, “Recording”) next to a fixed responsible-use notice; after a few seconds without touch the screen dims, but it never turns off. With motion watch on, the device's camera is on and iOS shows its usage indicator; this also holds while LiDAR is watching, because ARKit, Apple's framework for that sensor, uses the system camera (CamPhone neither records nor streams that picture). The microphone is not opened for watching: it is only used while recording or when a viewer watches live. Motion watch can be turned off on the camera itself or from the viewer; the sensor then stays closed and only opens when a viewer connects or someone records by hand. Whoever installs and uses the camera is responsible for following the law in their country (giving notice with a sign or in person, respecting neighbors, employees and visitors, and not recording public spaces beyond what the law allows).

How it works and what leaves your phone

One phone is set to camera mode and shows a 10-character link code of letters and numbers. On the other phone, in viewer mode, that code is typed in. With it the two phones find each other and connect. The code is the only thing that protects the camera: anyone who knows it can connect as a viewer (one at a time), so do not share it with anyone who should not see your camera. “Change code” on the camera generates a new one and the current viewer is cut off immediately.

Service	What for	What it receives
Supabase (Realtime, European Union servers, Frankfurt)	Acts as a matchmaker: lets the camera and the viewer find each other and pass the messages needed to connect and the commands to turn motion watch, LiDAR detection and “Ignore pets” on or off. Realtime stores nothing; CamPhone's only table is the alerts one (next row).	A channel name that is a hash of the code, not the code; whether the camera is online (presence); the camera's state (watching yes/no, recording yes/no, time and length of the last clip), the commands to turn motion watch, LiDAR and “Ignore pets” on or off and, if the camera has those features, whether they are on, the LiDAR's status (for example “watching” or “paused because the phone is hot”) and how many pet motions were ignored today, with no images or depth maps; and short-lived connection messages: a random viewer identifier and WebRTC technical data, which includes the phones' network addresses. None of it is stored; only the usual technical logs of any server (such as the connection's IP address).
Supabase (alerts function and its table, EU region: Frankfurt, eu-central-1)	Only if you switch on “Notify me when the camera records”: store which viewers ask for alerts and send them.	For each viewer that switches alerts on: the notification identifier (Apple token), the app language, a hash of the channel —never the link code— and the date of the last alert. When the camera saves a clip: the hash, the time and the clip length. No image or video.
Apple Push Notification service (APNs)	Deliver the alert to the viewer.	The viewer's notification token and the alert text (a title and text, no picture or video).
STUN servers from Google and Cloudflare	Help each phone discover its own network address so it can connect.	The phone's IP address. They do not see video or sound.
Cloudflare (TURN relay)	Only when the network does not allow a direct connection between the two phones (4G with CGNAT, company wifi…): forwards packets from one phone to the other.	Packets encrypted with DTLS-SRTP, WebRTC's standard encryption, that it cannot read, IP addresses and traffic volume. Credentials are temporary (1 hour) and handed out by a Supabase function; the Cloudflare token never ships in the app.
Google AdMob	Ads (see below).	Technical device data and, only if you accept, the advertising identifier.
RevenueCat	Checking the “No Banner” purchase.	An anonymous identifier and the purchase status.
Google Analytics for Firebase	Usage statistics (see “Usage analytics”).	Usage events with no personal data, only with your consent.

Video and sound are not stored on any server

The camera's video and audio travel directly from phone to phone (WebRTC), encrypted with DTLS-SRTP, WebRTC's standard encryption. They never pass through Supabase. If Cloudflare's relay is needed, it only forwards encrypted packets that it cannot decrypt and does not store them.
The developer has no server where what your camera streams can be seen, copied or stored, and has no access to it.
While no viewer is watching, the camera streams no video to anyone; with motion watch on it may record clips, which are saved only on its own device.

Motion watch

When motion watch is on (it is by default in camera mode), CamPhone continuously compares reduced, greyscale versions of the camera image to tell whether something moves. The comparison happens in the camera device's memory: those reduced images aren't stored, sent to any server or shared; only the result “motion / no motion” is kept. When there is motion, the camera records a clip (with sound) into its library —the same one as other recordings, capped at 6 GB— and, when the motion stops, it stops recording and keeps watching. Clips are saved only on the camera's own device. This image comparison doesn't identify people or objects; “Ignore pets” (below), which is optional, exists for that. Sensitivity (low, medium, high) is chosen on the camera's screen.

The viewer can turn motion watch on or off from its screen: the command and the camera's state (watching yes/no, recording yes/no, time and length of the last clip) travel over the connection channel (Supabase Realtime) and carry no images.

LiDAR detection (optional, off by default)

On iPhones and iPads that have a LiDAR sensor, the camera's screen shows a “LiDAR detection” switch (where there is no sensor, it doesn't appear). It is off by default. If you turn it on and motion watch is armed, with the back camera and no viewer watching, CamPhone watches with the sensor instead of comparing images: it reads depth maps (a reduced grid of distances in centimeters; one measurement per second by default, and you can choose up to four) and checks whether anything changes distance within the range you pick (2, 3.5 or 5 m). Depth maps are analyzed in the phone's own memory: they aren't stored, sent to any server or shared; only the result “motion / no motion” is kept.

While LiDAR is watching, the app's regular camera (the one that records and streams) is off, but iOS still shows its camera indicator because ARKit uses the system camera to keep its bearings; CamPhone neither records nor streams that picture. When motion is detected, or if a viewer connects, the regular camera turns on and the clip is recorded as usual (it starts a moment after the motion); when it ends, LiDAR resumes. If the phone gets hot, LiDAR slows down or pauses and the regular camera watches until it cools. The sensor stays on between measurements, so lowering the measurements per second barely changes power use.

Ignore pets (recognition with Vision)

“Ignore pets” is on by default on iPhone and iPad, and is switched off on the camera's screen or from the viewer. When the camera detects motion, CamPhone runs some images through Vision, Apple's image-recognition framework, which looks for people, dogs and cats. If it recognizes a dog or a cat and no person appears at any point, the motion is ignored: no clip is saved (if the camera had already started recording, the clip is deleted when it ends) and the viewer isn't alerted (if it is watching live, it sees the message “Only a pet was seen”). If a person appears, or it isn't clear what it is, it records and alerts as usual. With LiDAR, if what moves is taller than a dog or a cat, it isn't ignored either.

Recognition happens on the phone itself, with Vision, with no servers: images are analyzed in memory, aren't stored and aren't sent to any server. Only the result is kept (whether there was a person, a dog or a cat). Vision doesn't recognize faces or identify anyone: it only counts whether there is a person, a dog or a cat. The only thing kept on the phone is a counter of ignored motions for the day (the date, the number and the time of the last one); the camera shows it on its screen and, if the viewer is connected, the viewer sees it too.

Alerts to the viewer

Alerts are optional and off by default: on the viewer, the “Notify me when the camera records” switch asks iOS for permission. If you allow it, iOS creates a notification identifier (token) for that device and CamPhone stores it in a service of ours (a Supabase function and table, in a project in the EU region: Frankfurt, eu-central-1) together with a hash of the channel —never the link code—, the app language and the date of the last alert. When the camera saves a clip it tells that service the hash, the time and the clip length, and the service asks Apple (Apple Push Notification service, APNs) to deliver the viewer an alert with a title and text (“CamPhone: motion detected — The camera recorded a N s clip.”). The alert contains no image or video, and no code.

At most one alert is sent every 30 seconds per camera and up to 3 viewers are stored per camera (the least recent are forgotten). The token is deleted from the service when you switch the switch off, when you change camera on the viewer, or when Apple reports it is no longer valid. The token isn't used for advertising or to identify you. You can stop alerts by switching it off or in iOS Settings → Notifications → CamPhone.

Recordings: they live on the camera phone

A recording can be started by the viewer (with the “Record” button), by whoever is holding the camera, or by the camera itself when motion watch detects motion. It is always saved on the camera phone, never on the viewer.
They are saved in the app's own library. Only what you export by hand from “Recordings” on the camera goes to the phone's Photos gallery; CamPhone may then ask for Photos permission.
The viewer can watch a recording: the camera plays it and sends it over the same direct connection. The viewer keeps no copy.
How they are deleted: on the camera, in “Recordings” → “Delete” (one by one). They are also deleted when you uninstall the app. The library has a 6 GB limit: when it fills up, the app deletes the oldest recordings.
If the viewer started the recording, it ends when the viewer disconnects (with a few seconds' grace in case it reconnects); if you started it on the camera, it keeps going until you stop it; a motion clip ends by itself when the motion stops.

No accounts or sign-up

CamPhone has no accounts, usernames, emails or passwords, and does not ask for a name, phone number, location or contacts, and only touches your photos if you export a recording to the library. On the device itself the app only keeps: the chosen language, the camera's code (on the camera) or the last code used (on the viewer, to reconnect), whether the camera was on, whether motion watch is on or off and its sensitivity (on the camera), whether LiDAR detection and “Ignore pets” are on, the LiDAR's rate and range and the counter of ignored pet motions (on the camera), whether alerts are on and their token (on the viewer), which of the phone's cameras it uses, a random viewer identifier and the index of the recordings. It is deleted when you uninstall the app.

Device permissions

Camera and microphone: to stream and record. They are requested when the camera starts. LiDAR detection and recognition with Vision use this same camera permission; they ask for no other.
Photos: only if you export a recording to the gallery.
Notifications: only on the viewer and only if you switch alerts on.
Tracking (ATT): Apple's prompt for the advertising identifier, only for ads.

The app is free and shows ads from Google AdMob: a banner on the home screen, in the viewer and on the camera, and a full-screen ad in the viewer when a recording is stopped, while the camera saves the video (preceded by a notice and at most one every 90 seconds).

Consent. Before requesting any ad, the app shows Google's consent form (where the law requires it: European Economic Area, United Kingdom and Switzerland) and, on iPhone and iPad, also asks for Apple's tracking permission (ATT). If you consent, Google may show personalized ads and use the device's advertising identifier (IDFA on iPhone and iPad), together with technical data such as the IP address and device model, as described in Google's policy. If you don't, any ads shown will not be personalized; where valid consent is mandatory and missing, the app does not request ads. Google receives nothing from the video, sound or recordings.

You can change your choice at any time: on iPhone and iPad, in Settings → Privacy & Security → Tracking; and, in Europe, in CamPhone → Settings → “Ad privacy options”.

“No Banner” purchase

The one-time purchase “No Banner” (€1.99, no subscription) removes the banner in the viewer and on the home screen. It does not remove the camera's banner or the full-screen ad shown when a recording is stopped in the viewer. Payment is handled by the app store with your store account; we never see payment details. RevenueCat checks the purchase with the store; for that it uses an anonymous identifier of the installation, with no name or email, and knows the purchase status. There is a “Restore Purchases” button on the purchase screen. If you gave analytics consent, RevenueCat also receives the Google Analytics installation identifier so purchases appear in the same statistics.

Usage analytics

CamPhone uses Google Analytics for Firebase on iPhone and iPad to learn how many people use the app and how, so we can improve it. It is not available on other platforms.

What is collected: automatic usage events (first open, session, screens viewed: home, camera and viewer); seven custom events with no personal data (rol_camara, rol_visor, visor_conectado, grabacion_iniciada, grabacion_parada, camara_activa and vigilancia_cambiada): that camera mode is opened, that viewer mode is opened, that a viewer receives its first video, that a recording starts or ends (with “viewer”, “camera” or “motion” as the origin), that the camera is still active (when camera mode opens and then every 4 minutes while it stays on, no parameters) and that motion watch is switched on or off (armed or disarmed); an identifier of the app installation, which is not your name, an email or the advertising identifier; and basic technical data: approximate country, operating system and app version.
What is not collected: the advertising identifier (IDFA) is not used, nor Apple's tracking permission, for analytics; no user ID or personal properties are assigned; and the link code, the channel, the content of recordings, or anything that identifies a person or a camera is never sent.
What for: only usage statistics (active users, versions, countries and which features are used). They are not linked to your name or any account, nor used to follow you across other companies' apps or sites, nor for advertising. For Apple, the installation identifier counts as a device identifier, which is why it appears that way in the App Store privacy label.
With whom: Google processes it as a data processor. The installation identifier is also shared with RevenueCat (see above).

Consent and control. When the app starts, analytics is off. In the European Economic Area, the United Kingdom and Switzerland it only turns on if you accept data storage on your device in Google's consent form (the same one as for ads), and if you refuse, no usage data is collected. Outside that area, where prior consent is not required, it turns on without a form. You can change your choice in Settings → “Ad privacy options” (where it appears) or ask us to stop using it by writing to gabrielmicovictoria@gmail.com.

How long data is kept

Live video and sound: not stored; they exist only while being transmitted.
Recordings: on the camera phone, until you delete them, until the library reaches its 6 GB limit (the oldest are deleted) or until you uninstall the app.
LiDAR detection and pets: the depth maps and images that are analyzed are not stored. The counter of ignored motions stays on the camera phone (only that of the last day with ignored motions) until you uninstall the app.
The app's local data (language, codes…): until you uninstall the app or change the code.
Alerts (Supabase): the notification token, the channel hash, the language and the date of the last alert are kept until you switch alerts off, change camera on the viewer, or Apple reports the token is no longer valid; at most 3 viewers per camera.
Supabase (Realtime) and Cloudflare: CamPhone stores nothing in them; they only keep the usual technical logs under their own policies.
Analytics and advertising: according to the retention periods of Google (Analytics, AdMob) and RevenueCat.

Children

CamPhone is not directed at children and does not knowingly collect data from minors. If you believe a minor has provided data, write to gabrielmicovictoria@gmail.com and we will delete it.

Your rights

You can ask at any time for access, rectification, erasure, objection, restriction and portability of your data (GDPR) by writing to gabrielmicovictoria@gmail.com. Because CamPhone has no accounts, almost everything is on your phone, where you can delete it yourself (recordings, or uninstalling the app). The only thing we keep in a service of ours is the alerts identifier, and it is deleted by switching off “Notify me when the camera records” on the viewer. You can also complain to the Spanish Data Protection Agency (aepd.es) or to your local authority.

Legal basis: the data needed to connect the camera and the viewer is processed to provide the service you asked for (performance of the service); alerts to the viewer, on your consent (the switch and the iOS permission), which you can withdraw at any time; personalized ads and usage analytics, on your consent, which you can withdraw at any time; non-personalized ads, on a legitimate interest in funding the free version.

Security

All communication is encrypted: HTTPS/WSS to Supabase and DTLS-SRTP between the phones. The link code has 10 randomly chosen symbols (50 bits) and the connection channel is derived from it with a hash, so the code does not appear on the servers. Even so, anyone who knows the code can connect: keep it like a password and change it if in doubt.

Changes

If the app changes what it does with data, this page is updated first and the date below changes.

CamPhone · Effective 2026-10-30 · Gabriel Micó Victoria