1. Who we are and how to reach us
Vigilens is operated by HighBrow Marketing Limited (NZBN 9429051079864), 4/56 Priestly Drive, Bucklands Beach, Auckland 2014, New Zealand.
We are the data controller for your account and for the service data described below. For the video and audio your own cameras record, see section 2 — that footage stays on your phone, and you decide what it contains.
- Privacy questions and requests: support@sidefolk.app
- Everything else: support@sidefolk.app
- Security problems: security@vigilens.cam
- EU/UK representative: none appointed today
You can complain to us first, and you can complain to a regulator instead or afterwards. Section 15 names the regulator for your region.
2. What this policy covers, and who controls the footage
This policy covers the Vigilens apps for Android and iPhone (cam.vigilens), in both of their roles — the phone you
leave running as a camera, and the phone you watch from — and the Vigilens signalling server and
website.
You decide what the camera sees and who may watch it. You choose where the phone points, when it records, and who you pair with it. That makes you responsible for whether the recording is lawful where you are, and for telling the people who may appear in it. Rules about recording audio are usually stricter than rules about recording video. The Terms say more about this.
Our server does not receive your video or audio. There is no route, socket message or buffer anywhere in our server that carries video, audio or an image. Our server passes connection-setup messages between your two phones and hands out relay credentials; it never holds a frame. That is a claim about our architecture, and section 9 explains exactly where it stops being a comfort.
The one exception is Vigilens cloud, on paid accounts only. If your account has it, your camera phone uploads its event clips and their poster pictures, encrypted on the phone, straight to our storage providers (section 6). They never pass through our server, but they are held by us, in storage we pay for, until the camera's own "Keep events for" runs out (section 8).
What a viewer you share with can see depends on the access level you give them: full access shows live video, the event list, event clips and recordings; limited access shows live video only, with clips and recordings hidden.
3. What we collect
3.1 What you give us
| What | When |
|---|---|
| Your email address and a password | When you create an account or sign in. We store the password only as a scrypt hash, never in a form we can read |
| Your email address and Google's id for you, if you use Continue with Google | Google sends them to us in a token it signs, which our server checks. We keep the id so we can recognise you next time. An account made this way has no password. On Android and on an iPhone |
| Your email address (which may be Apple's private relay address) and Apple's id for you, if you use Sign in with Apple | Apple sends them to us in a token it signs, which our server checks. We keep the id so we can recognise you next time. On an iPhone through Apple's own sign-in; on Android, Apple's sign-in page opens in your phone's browser and our server passes Apple's answer back to the app, which sends it to us as an iPhone does. Offered once Apple's set-up is done |
| A camera name | If you rename a camera. If you do not rename it, the name defaults to your phone's model string, for example the model name your handset reports. See section 3.4 |
| A pairing code | A 7-digit code, held in our server's memory for 5 minutes, single use, never written to a database |
| A key backup blob | Under Keep it easy: your clips' key, wrapped with a secret our server holds, so every phone you sign in on can open your clips. Under No encryption: nothing. See section 9 |
| Event clips and their poster pictures, in Vigilens cloud | Paid accounts only. Each is encrypted on the camera phone before it is uploaded, under the same key as on the phone, and stored with its file name (the moment it began and its kind, such as "person"), its size and the camera it came from |
| An invite link | If you share a camera by link. We keep only a hash of the link's secret, the camera, and when it was made; it stops working after 7 days, once used, or when you cancel it |
3.2 What the service generates
| What | Where it is kept |
|---|---|
| An account id and a camera id (both UUIDs we mint) | Our database |
| A device key — a value derived from your account id and an identifier of the phone (on Android, an Android identifier; on an iPhone, a random value the app creates and keeps in the Keychain) | Our database. The phone's identifier itself is never sent to us. The same handset under two different accounts produces two unrelated device keys |
| A session token, valid 30 days, and a record of each phone signed in to your account | The token travels with each request. Our database keeps one record per signed-in phone: when it signed in and was last active, the phone's name as it reports it (its maker and model), whether it is a camera or a viewer, and its push token. You see the list in the app. Signing out ends that phone's session only; you can sign out another of your phones from the list |
| A password-reset link, if you ask for one | We email you a single-use link that works for 15 minutes. Our database keeps only a hash of it, until it is used or expires |
| Which version of the Terms and of this policy you accepted, and when | Our database, when you create an account |
| Which accounts may watch which camera, and when that was granted | Our database |
| When a camera was last seen online | Our database, rewritten every time the camera registers |
| Camera health, while the camera is connected | Our server's memory only, never a database: recording state, why recording stopped, battery percent, charging, overheating, whether the lens is blind or the scene is dark, whether it is listening, care mode, whether encryption is off, how long it has been recording, and the camera's own clock. It is gone when our server restarts |
| Failed sign-in counts, and request counts by IP address | Our server's memory only, for 15 minutes (sign-in lockout) or 10 and 60 minute windows (rate limits). Gone on restart |
| Your push notification token | Our database, so we can deliver alerts. Up to 20 per account |
| An access-history line each time a camera is set up, watched, or shared by a redeemed pairing code | Our database, 365 days, then deleted. Each line holds the time, the account, the camera and the source IP address. You see your own lines under Access history in the app; the IP address is never shown there, and another person is never named. Repeat watching by the same account on the same camera is recorded at most once every 5 minutes |
| Guest mode | A guest token (4 hours, never written to a database) and, while a guest camera is running, its code, the secret its QR code carries, and the connection, in our server's memory. Guests who connect through our relay are counted by network address so the free relay time cannot be restarted with a new token. Nothing about a guest is stored |
| Crash reports from the Android app | When the app crashes it sends us a report: what kind of error it was and where in our code it happened (never the error's message), the app version, the Android version, and the phone's maker and model, with your account id if you are signed in. Kept in a file on our server, the last 2,000 reports. When you delete your account, your account id is removed from them. There is no setting to turn this off today. The iPhone app sends none |
| Usage statistics | Our server counts what happens on it: sign-ups, sign-ins, cameras added and coming online, viewers joining and leaving, pairings, alerts sent, account deletions, each with the time, the account and camera ids and a few allow-listed details (such as the sign-in method). No email, IP address, name, token or device detail. Kept 400 days; when you delete your account the account id is removed and the counts stay. Nothing is sent by the app for this, and no third party is involved |
| An account-deletion code, if you start deleting your account | A 6-digit code we email you, held in our server's memory only as a hash, for 15 minutes |
| Operator logs | Our server writes one line per event to its own log. A separate error log keeps the last 2,000 errors, each with a message, a stack trace and, for a failed request, the method and path. These are engineering logs; they carry no personal-data minimisation promise, and a stack trace can contain more than we intend |
3.3 What stays on your phone and never reaches us
| What | Where |
|---|---|
| Every recording, event clip, event poster image, and every snapshot or recording a viewer saves | The app's private storage on that phone, encrypted |
| On a viewing phone, the newest picture of each camera it can see, shown on that camera's card in the list | The app's private storage on that phone, encrypted, one picture a camera, replaced by each newer one |
| The event sidecar file — the time, the kind and the tag ("person", "pet", "vehicle", a sound class) of each event | The same folder, deliberately not encrypted. It holds no coordinates, no labels beyond the class, and nothing about the room |
| Your session token, your email address and your account id | On Android, an encrypted file, protected by a key held in the phone's hardware keystore that never leaves the phone. On an iPhone, the Keychain, never synced to iCloud or moved to another phone. Unlocking the screen is not required to read it (on an iPhone, once the phone has been unlocked after it started) |
| The keys that open your recordings | The same keystore, or on an iPhone the same Keychain, with a copy wrapped by our server (section 9) so a phone you sign in on again can open your clips |
| Which role you chose, and which permissions you have already been asked for | Ordinary app settings, not encrypted |
On Android, none of the app's storage leaves your phone through Android cloud backup or device-to-device transfer. Both are switched off for every part of the app's data.
On an iPhone, recordings and events are excluded from iCloud and computer backups. The app's settings file — which on a camera phone holds the email addresses of the people you share it with — its connection logs, and its ordinary preferences are not excluded, so they can be in your phone's backup.
3.4 Two things you would not expect, said plainly
Your camera's name becomes the title of a push notification. If you never rename a camera, its name is your phone's model string. That name is sent to Google's push service with every alert, and it appears on the lock screen of every phone you have shared that camera with. Rename the camera if you would rather it did not.
Sharing a camera discloses your email address to the person who owns the camera phone. When you join someone's camera, our server tells that camera your account id and your email address, and the camera phone stores your email address, in readable form, in its own settings file, so its owner can tell viewers apart. When the camera's owner removes your access, the camera phone forgets your email address. Deleting your own account does not reach those camera phones, so they keep it until their owner removes you — see section 11.
3.5 What we never collect
This list is short because it is true, and we would rather keep it that way.
- No analytics SDK and no crash-reporting SDK is in the app. Crash reports and usage statistics go only to our own server (section 3.2), not to a third party. Firebase Analytics is deliberately left out of the build. The Android app contains Google AdMob for the free plan's ads (section 6), but the version we release does not start it and shows no ads yet. The iPhone app has no ad code.
- No facial recognition, no face detection, no biometric identification of any kind. There is none in the code. See section 13 for what the detection actually does.
- No speech recognition, no transcription, no speaker identification.
- No location permission, no contacts, no call or phone-state access, and no reading of your photo library or shared storage. The app does not ask for any of them. Saving a clip you choose is the one exception, and it only adds: on an iPhone the app asks to add to Photos (it cannot see what is there); on Android it writes to Movies/Vigilens, which needs no permission.
- No selling of personal information. To be confirmed
4. Why we use it, and our lawful basis
| What we do | Why | GDPR basis |
|---|---|---|
| Create and run your account; keep you signed in | To give you the service you asked for | Contract (Art. 6(1)(b)) |
| Register cameras, pair viewers, decide who may watch what | Same | Contract |
| Relay the connection between your two phones, and issue relay credentials | Same | Contract |
| Send alerts through Google's push service | Same | Contract |
| Store a key backup blob | To let you recover your recordings after a reinstall | Contract |
| Crash reports and usage statistics (section 3.2) | To find and fix faults and to see how the service is used | To be confirmed |
| Rate limits, sign-in lockouts, connection caps, operator logs | To keep the service up and to stop abuse | Legitimate interests (Art. 6(1)(f)) — keeping the service available and unabused. We have weighed this against your interests; the data is a counter in memory or an engineering log, and none of it is used to profile you |
| Suspending an account that broke our Terms, and keeping that suspension after the account is deleted | To stop the same account being used again for abuse | Legitimate interests (Art. 6(1)(f)): keeping the service safe for everyone. The record holds only the account id and when it was made |
| Responding to a legal request | Because we have to | Legal obligation (Art. 6(1)(c)) |
We do not rely on consent for any of the above, so there is no consent to withdraw. Agreeing to the Terms is not consent to anything that would need consent; advertising is the case: where the law requires it, we ask separately, through Google's consent message, before any ad is requested, and you can say no and change your mind later.
No special-category data is processed. We do not do biometric identification (section 13). Footage you record may of course contain images of people; that footage never reaches us.
You can object to the legitimate-interests uses above by writing to support@sidefolk.app.
5. Camera, microphone and running in the background
The Android app asks for these permissions, and only these:
| Permission | What it is for |
|---|---|
| Camera | To be a security camera. The camera phone asks for this; a viewer phone never does |
| Microphone | Recordings carry sound. You can refuse it — the camera then records video only |
| Notifications | The "this phone is recording" notice, which Android requires us to show, and your alerts |
| Internet and network state | To reach our signalling server and your other phone |
| Modify audio settings | To turn on the loudspeaker while a viewer holds the talk button. Android refuses otherwise |
| Foreground service (camera, microphone) | To keep capturing with the screen off |
| Wake lock | To stop the phone sleeping while it is acting as a camera |
| Receive boot completed | So a camera phone comes back after a restart or an app update |
| Display over other apps | So the camera can reopen its own screen and take the sensor back after a reboot, with nobody touching the phone. You grant this yourself in Android's settings; no app can award it to itself |
| Fingerprint or face (biometric) | App lock, if you turn it on: the phone's own fingerprint, face or screen-lock prompt before Vigilens' screens show. The app never receives your fingerprint or face |
| Receive push messages | Google's push service delivers your alerts |
| Advertising ID and Android's ad-services permissions | Added by Google's ad SDK (section 6). The version we release does not start that SDK |
Android also lists one permission private to the app itself, which it uses to protect its own internal messages.
The iPhone app asks for the camera, the microphone, local network access (so your phones can connect directly when they share a Wi-Fi network), notifications and, only when you save a clip, permission to add to Photos. It asks for nothing else.
On Android, while the app is a camera it runs in the foreground with a permanent notification, with the screen off, using the camera and (unless you refused it) the microphone. On an iPhone, the camera works only while Vigilens is open on screen and the phone is unlocked; locking the phone or leaving the app stops recording, and there is no notification. What leaves the phone while that is happening is: the live picture and sound, but only while a viewer you authorised is actually watching; the camera health readings in section 3.2; and an alert through Google's push service when something is detected. Nothing else. No frame, no audio buffer and no detection result is ever sent to us or to anyone else for analysis.
Battery optimisation, autostart on some manufacturers' phones, and "display over other apps" are Android settings pages, not permissions. The app tells you what each one is for and opens the page; it cannot grant them.
6. Who we share with
We do not sell your data, and no advertising partner ever receives your footage, your detection events or anything derived from them. The complete list of outside parties that receive anything at all is this one.
| Who | What they receive | Why |
|---|---|---|
| Google — Firebase Cloud Messaging | Your phone's push token, the camera's name (which is the alert's title — see section 3.4), a short fixed sentence such as "Something moved", the camera id and the time. No image, no clip, no footage, no location, no person's name | To deliver your alerts |
| Google — sign-in (Continue with Google) | If you sign in with Google, Google tells us your email address and its id for you, in a token it signs. We never see your Google password | To sign you in, on Android and on an iPhone |
| Apple — Sign in with Apple (iPhone and Android) | If you sign in with Apple, Apple tells us its id for you and your email address, which may be a private relay address Apple forwards to you, in a token it signs. Our server fetches Apple's public keys to check that token. On Android, Apple's sign-in page runs in your phone's browser and returns to our server, which hands the token to the app. We never see your Apple password | To sign you in. Not offered until Apple's set-up is finished |
| Google — Play services sign-in | A Google sign-in, for one narrow permission: files the app itself created in your Drive. The app never sees or stores anything else in your Drive | So you can back up clips to your own Drive, if you turn that on |
| Google — Drive | The encrypted clip files, byte for byte, under their own names, in your own Drive. Google holds ciphertext. A clip sealed under a key only your phone holds is never uploaded at all | The same |
| Google — public STUN server | Your phone's IP address, at the moment a call is set up. This is the default address-discovery server in the build | To work out how your two phones can reach each other |
| Our own relay (TURN), at Hetzner in Germany | When your phones cannot reach each other directly, the encrypted stream passes through our relay, which sees both phones' IP addresses and ports and the encrypted bytes — not the picture. The relay credential is scoped to your account and time-limited | To make the connection work behind awkward networks |
| Our database host (Supabase, Frankfurt) | Everything in sections 3.1 and 3.2 that is stored rather than held in memory | It is where the database runs |
| Cloudflare — R2 storage | Paid accounts with Vigilens cloud: the encrypted event clips and posters, their names and sizes, and the camera phone's IP address when it uploads and the viewing phone's when it downloads | Where Vigilens cloud keeps clips |
| Backblaze — B2 storage | The same, only when an upload to Cloudflare fails | The fallback copy of Vigilens cloud |
| Google — AdMob (free plan only, Android only, not started in the version we release yet) | An ad request: your advertising ID where you allow it, your IP address, the device and app details Google needs to choose and show an ad, and your consent choice. Never an image, a clip, an event or a camera's name | To show the free plan's ads. A paid plan shows none |
| Zoho — email | If you ask for a password reset or start deleting your account: your email address and the single-use link or code | To send those emails. Zoho sends it from its Australian data centre |
| Apple — App Store (iPhone app) | If you buy a plan on an iPhone, Apple handles the payment, and the app gives Apple your Vigilens account id with the purchase so it can be matched to your account. To be confirmed | To sell and restore plans on an iPhone |
| Our hosting provider (Hetzner, Germany) | Whatever a hosting provider's access logs record, which is outside our code — see the owner list at the top | It is where the server runs |
Two more things about this list.
Our database is shared with the product Vigilens replaces. Accounts and push tokens live in the same tables as that earlier product's. That product's server was switched off in October 2026, but its tables remain. Vigilens writes a marker on every push-token row it creates so it only ever reads and deletes its own push tokens, but the older product's code does not filter the same way and can still read rows Vigilens wrote. Account rows carry no such marker. We cannot change that from inside Vigilens. It is listed here because it is true, not because it is comfortable.
The current release build connects to our staging server, which shares that host and that database.
We will also disclose data if the law requires it, or where we genuinely believe it is needed to stop someone being seriously hurt. If Vigilens is ever sold or merged, your data moves with it, and we will tell you before that happens.
7. Where your data is processed
Our server and our relay run in Germany, at Hetzner (Falkenstein), and our database runs in Germany, at Supabase (Frankfurt).
Google's push, sign-in and Drive services, and Google's public STUN server, are global. Password-reset emails are sent by Zoho from Australia. Apple's App Store is global. Vigilens cloud clips are kept by Cloudflare in Oceania (a location Cloudflare chose automatically) and, when that fails, by Backblaze in the EU (Central).
If you are in the EEA, the UK or Switzerland and your data is processed outside it, we rely on the European Commission's standard contractual clauses, with the UK addendum where the UK is involved. Write to support@sidefolk.app for a copy of those safeguards.
If you are in New Zealand: where we give your information to an overseas provider that only handles it on our instructions, we stay responsible for what it does with it (IPP 12).
Your recordings do not travel internationally, because they do not travel at all: they stay on your camera phone, except for the live stream and the clips you ask a viewer to fetch, which go directly between your two phones or through our relay, and, on a paid account with Vigilens cloud, the event clips your camera uploads to the storage named above.
8. How long we keep things
| What | How long |
|---|---|
| Recordings on the camera phone | No time limit. They fill the space you choose under "Space for 24/7" (5, 10, 20, 30 or 50 GB, or all the free space but 2 GB; 10 GB unless you change it). Then, by default, the oldest is deleted to make room; you can choose to stop recording instead. With "Record 24/7" off, only the last 10 minutes are kept. Recording stops if the phone drops below 256 MB free |
| Events (clip, poster, sidecar) on the camera phone | The camera's "Keep events for", 1 to 90 days, 7 days unless you change it. No size limit. To be confirmed will replace this once plans exist |
| Your account, your cameras and your sharing grants | Until you delete your account or remove the camera. Both are in the app, and account deletion is also on the web — see section 11. A deletion waits 14 days, so you can change your mind; it happens on that day or up to 2 days later, to allow for time zones |
| Vigilens cloud clips and posters | The camera's own "Keep events for" (1 to 90 days); a sweep removes older ones every 6 hours. Removing a camera deletes its clips at once; deleting your account deletes them when the deletion happens, 14 to 16 days after you ask. Any we could not delete at that moment are retried until they are gone |
| A pending account deletion | The day you asked, the day it happens and, once done, when it was done. Kept after the deletion, holding only your account id and those dates, so that your sign-in no longer opens Vigilens |
| An account suspension | Until we lift it. If the account is deleted while suspended, the suspension stays, holding only your account id and when it was made, so that starting a new account with the same email does not lift it |
| Invite links | 7 days, or until used or cancelled. Deleted with your account |
| A camera's last-seen time | For as long as the camera row exists |
| Session tokens | 30 days from issue, or until that phone signs out or you sign it out from another phone. The record of a signed-in phone is deleted 31 days after it was last used or signed out |
| Password-reset links | 15 minutes, or until used. A new request deletes older ones. Deleted with your account |
| The link between your account and your Google or Apple sign-in | Until your account deletion happens |
| Which Terms and policy versions you accepted | Kept today, also after you delete your account — see section 11 |
| Pairing codes | 5 minutes, in memory only |
| Camera health readings | In memory only, and gone when our server restarts |
| Rate-limit and lockout counters | 15 minutes, or a 10 or 60 minute window; in memory only |
| Push tokens | Until that phone signs out or you sign it out from another phone, or Google tells us the token is dead, or you uninstall the app — see section 11 |
| Our error log | The last 2,000 entries, oldest dropped |
| Crash reports from the app | The last 2,000 reports, oldest dropped; your account id is removed when you delete your account |
| Usage statistics | 400 days; your account id is removed when you delete your account |
| Our application log | Kept by the server's own journal. Nothing in our code bounds it, and the owner has to settle a retention period before this policy is published |
| Your Drive backups | Until you delete them from your Drive. They are your files, in your account |
The recording and event limits are enforced continuously, by rereading the folder rather than trusting a counter, so the oldest footage really is the footage that goes.
Blunt facts about the recordings on your phone:
- Uninstalling the app deletes every recording on that phone. The one exception is your choice: on Android 10 and later, uninstalling from the phone's Settings asks whether to keep app data (unticked unless you tick it). Ticked, the recordings stay on that phone, still encrypted, until you reinstall Vigilens or clear them under Settings, Apps, Vigilens, Storage. A copy of a recording opens only in Vigilens, signed in to your account.
- Signing out deletes nothing on the phone. The recordings stay, put away for your account: another account signing in on that phone cannot open them, and they come back when you sign in again.
- Deleting your account deletes nothing on any phone either. Your recordings are yours. Before you delete, the app offers to save copies to the phone (Movies/Vigilens on Android, Photos on an iPhone), which play anywhere.
- A clip you send or save leaves Vigilens' encryption. Share or save makes an ordinary video: sent through your phone's share sheet, or saved to the phone (Movies/Vigilens on Android, Photos on an iPhone). From then on it is a normal file, and anyone who has it can watch, keep and forward it. It never passes through our servers.
9. Security — and what we do not claim
What protects your data
- Passwords are stored only as scrypt hashes with a per-account salt.
- Recordings, event clips, posters and saved snapshots are encrypted on the phone with AES-GCM. Each file is sealed to its own name, so a file cannot be renamed and a chunk cannot be moved from one file to another.
- The session token and email address the app keeps on your phone are encrypted behind the phone's hardware keystore (on an iPhone, kept in the Keychain). Reading them does not require unlocking the screen, so anyone holding an unlocked phone has the app's access.
- The connection between your phones is encrypted by WebRTC (DTLS-SRTP).
- Drive backups are uploaded already encrypted. Google stores ciphertext.
- Sign-in has per-account lockouts and per-IP rate limits.
What we will not claim
We do not offer end-to-end encryption, and this policy will not say we do. The encryption on a live stream is hop-by-hop: it protects each link, and when your phones cannot connect directly the stream passes through our relay server. Event clips and recordings sent to a viewer are decrypted on the camera phone first and then sent over that same connection. Anyone who reached the data channel would see plaintext footage. That is an accepted trade-off today, written into our design record, with the way out reserved for a later version.
You choose once, when you create your account, and the app does not change it afterwards.
| Setting | Who can open a clip |
|---|---|
| Keep it easy — the default | You, and us. Your clips' key is wrapped with a secret our server holds, and our server hands it to the phones you sign in on, so each of them opens your clips with no passphrase to remember. This includes any clips in Vigilens cloud and any copies in your Google Drive |
| No encryption | Anyone who has the file. It is still written in our sealed format, but under a published key of zeroes, which is exactly what that setting promises |
Under Keep it easy we can open your clips, which means a court order or a mistake by us could. We do not offer a setting today in which we cannot. If one is added later, this policy will say so before it is offered. (An account that chose "Maximum privacy" in a test version before 10 October 2026 keeps it: only its passphrase opens those clips.)
The event sidecar is not encrypted. Anyone with access to the camera phone's files can read when each event happened and what kind it was, without any key. That is deliberate: it is what lets the app list events quickly, and it holds no room, location or identity information.
We keep an access history, and it is short on purpose. For each account we record three things: a camera being set up, a camera being watched, and a pairing code being redeemed. (Fetching the small picture shown on a camera's card in your camera list is not watching, and is not recorded; the camera gives that connection one still picture and no video.) Each line holds the time, which account acted, which camera, and the source IP address. Nothing else — never what was on screen, never the stream itself.
You see your own lines under Access history in the app: your own actions, actions aimed at you, and anything that happened on a camera you own. Other people are never named there. If someone you shared a camera with watches it, you are told "a viewer watched", and their email address does not leave our server. The IP address is never shown to anyone through the app; it is kept for us to investigate abuse.
A line is deleted 365 days after it is written. Deleting your account deletes every line naming you, immediately and in the same request.
No system is perfectly secure, and saying so does not reduce our obligations to you. If you find a problem, please tell security@vigilens.cam; we will not pursue you for a good-faith report.
10. If there is a breach
If personal data we hold is exposed, lost or accessed by someone who should not have it, we investigate, work out what happened and who is affected, and fix it.
- Where the breach is likely to be a risk to people's rights, we notify the relevant EU or UK supervisory authority within 72 hours of becoming aware of it, and we tell affected users without undue delay where the risk is high.
- In New Zealand, where a breach has caused or is likely to cause serious harm, we notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable. This is a duty, not a choice.
- We follow the equivalent obligations in United States state law and in Australia.
When we tell you, we will say what happened, what data was involved, what we have done, and what you can do.
11. Your rights, and how to use them
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, object to our legitimate-interests uses, or hand it to another service. Exercising any of these is free, and we will not treat you worse for it.
Write to support@sidefolk.app. We will not ask you for an identity document by default; we will normally verify you by sending a message to the email address on the account.
| Where you are | How long we take |
|---|---|
| EU / UK | One month, extendable by two further months if the request is complex — we will tell you why |
| New Zealand | 20 working days for an access request |
| California and comparable US states | 45 days, extendable once |
What we can and cannot do today, honestly
This is the part of the policy most likely to differ from what you expect, so it is written plainly.
| What you want | What actually happens today |
|---|---|
| Delete your account | In the app, under More → Delete account, or on the web at https://staging.vigilens.cam/delete-account, where you confirm it is you, enter a code we email you, and type "delete my account". At once you are signed out on every phone and your cameras stop. 14 days later (at the latest 16, to allow for time zones) we delete the rest; until then, signing in and choosing Cancel deletion keeps everything, and we email you at each step. After it, your email and password, or your Google or Apple sign-in, no longer open Vigilens unless you choose to start a new, empty account. The deletion removes your cameras and everyone they were shared with, any camera shared with you, your key backup and encryption choice, your alert registrations, every signed-in session, your access history, your invite links and alert settings, and your Vigilens cloud clips. What is kept, and why. Your email address and password: the sign-in is shared with the older Vizaro app, so removing it is done by a person — email support@sidefolk.app from that address and it is done within 30 days. Any record the older Vizaro app keeps of its own (its access history and usage counts), which are its records, not ours. And the recordings, events and saved clips on your phones, which are never deleted: they stay on each phone, and open in Vigilens there; delete them there, or uninstall the app, which locks them for good. Clips in your own Google Drive are not touched either. The record of which Terms and policy versions you accepted is kept too, marked as ended, so we can show the agreement was made. Also kept, and not named by the app: the withdrawn records of cameras that were shared with you (marked withdrawn, not erased); and crash reports and usage statistics, with your account id removed. A camera phone you were shared with forgets your email address if it is switched on when the deletion happens; one that is off keeps it in its settings until its owner removes you. To be confirmed |
| Delete a camera | In the app, by the camera's owner. It removes the camera, everyone it was shared with, and its Vigilens cloud clips |
| Stop someone you shared with from watching | As the camera's owner, choose Remove access for that person in the app. It takes effect at once: their access is withdrawn and, if they are watching, the connection is closed. You can also reduce a viewer to limited access, which hides clips and recordings and leaves only the live view |
| Stop a phone you signed out of from receiving your alerts | Signing out stops them. The phone asks us to forget where to send, and if it cannot reach us it throws away the address we send to, which has the same effect. Uninstalling the app also stops them |
| Stop alerts from one camera only | Mute alerts on that camera's card, for 1 hour, 8 hours, 24 hours or until you turn them back on. It applies to every phone signed in to your account. To stop all alerts on one phone, use Mute all alerts on this phone in App settings |
| Delete your recordings | They are on your phone, under your control. They delete themselves on the schedule in section 8, and uninstalling the app deletes all of them, unless you choose to keep app data when Android asks (section 8) |
| Delete your key backup | The app does this itself, and it takes effect immediately |
| Get a copy of your data | A manual export, on request. There is no in-app export today |
We would rather tell you this than publish a rights section describing buttons that do not exist.
You can also complain to a regulator — section 15 says which one.
12. Children
You must be at least 16 to hold a Vigilens account.
The app is not designed for or directed at children, and nothing in the store listing will suggest that it is. If we learn that someone under 16 has created an account, we delete it.
A child who appears in front of a camera — in a nursery, for example — is not a user of Vigilens and has no account with us. That footage stays on the camera phone and never reaches us. Whether it is lawful for you to record a particular person in a particular room is your decision to make, and the Terms say more about it.
13. Detection and alerts
All detection runs on the camera phone. No frame, no audio and no detection result is ever sent to any server for analysis.
| What runs | What it produces |
|---|---|
| An object detector | Boxes and a label, mapped to exactly three kinds: person, pet, vehicle. No identity, no face, no template, no fingerprint of anybody |
| A pose estimator | Skeletal points, used for one thing only: to tell upright from horizontal, so the app can notice a possible fall. The points are never written to disk and never leave the phone |
| A parcel detector (Android, only if you turn on Parcels) | Boxes labelled "parcel", looked for when a person has just been seen and while a parcel is waiting, so the app can say a parcel was left and, later, that it was taken. It is an object, never a person: no identity, no face |
| A sound classifier | One of ten fixed sounds: baby cry, smoke alarm, glass break, dog bark, cat meow, doorbell, car alarm, siren, scream, knock. No speech recognition, no transcription, no identifying who spoke |
On an iPhone the same jobs run on the phone through Apple's built-in Vision and SoundAnalysis frameworks (people, animals and body pose), with the same vehicle detector as Android. The sound list there has nine sounds: Apple's classifier has no car alarm.
The only thing a detection produces off the phone is a push alert naming the kind of event.
A "face covered at the door" alert appears in the app's settings as coming soon. It is not built: no face model is in the app. Before it ships, this section and section 3.5 are rewritten, as the last paragraph below promises.
Detection is probabilistic. It misses things and it fires when nothing happened. A television can look like a person. Nothing here makes a decision about you with legal or similarly significant effects, so there is no automated decision-making in the sense the GDPR uses.
Fall alerts are assistive, not medical. The alert says "Someone may have fallen" because that is all the system can honestly say. It is not a medical device and not a fall-detection service, and the Terms repeat this.
If we ever add facial recognition or any other biometric identification, this section and the lawful-basis table in section 4 are rewritten before it ships, not after.
14. Our website and cookies
vigilens.cam serves the marketing pages, this policy and the Terms. It is built to set no
non-essential cookies, so there is no consent banner to click. If that changes, we will ask for
consent before setting anything, we will not pre-tick a box, and we will not treat your continuing
to read as agreement.
We honour Global Privacy Control signals as opt-out requests where the law gives them effect.
15. Regional annexes
The sections above apply to everyone. These add what your own law requires.
15.1 EEA and UK
Our lawful bases are in section 4, our transfer mechanism in section 7, and our representative in section 1. You can lodge a complaint with your national supervisory authority — in the UK, the Information Commissioner's Office.
15.2 New Zealand
We handle personal information under the Privacy Act 2020 and its information privacy principles. You have the right to ask for the information we hold about you (IPP 6) and to ask us to correct it (IPP 7); we answer access requests within 20 working days. Section 7 covers overseas disclosure (IPP 12) and section 10 covers notifiable breaches. You can complain to the Office of the Privacy Commissioner.
15.3 California and other United States states
At the point of collection we collect the categories in section 3: identifiers (email address, account id, camera id, device key, push token, and Google's id for you if you use Continue with Google), internet and network activity (connection metadata, rate-limit counters), and the audio-visual content described in section 3.3, which stays on your own device and does not reach us.
- We do not sell personal information. To be confirmed
- We do not process sensitive personal information for the purpose of inferring characteristics.
- Our retention periods are in section 8.
- You may use an authorised agent. We will not discriminate against you for exercising a right.
- To exercise a right, write to support@sidefolk.app.
15.4 Australia
If we offer Vigilens in Australia, you may request access to and correction of your personal information and complain to us and then to the Office of the Australian Information Commissioner. Section 10 covers the Notifiable Data Breaches scheme.
16. Changes to this policy
Effective date: To be confirmed.
If we change something material — a new recipient of your data, a new category collected, a shorter or longer retention — we will tell you in the app and by email before it takes effect, and say what changed. Continuing to use Vigilens after the effective date means you accept the new version, where your law allows that. A change never applies backwards to data we have already handled under the old version.
Previous versions stay published at vigilens.cam/privacy so you can see what you agreed to.