Privacy Policy

This policy explains what personal data tinyCCTV collects when you use this website and the tinyCCTV app (together, the "service"), what it is used for and what choices you have. It is written to be read, so please do.

1. Who is responsible

The service is provided by Volodymyr Triapichko, Sytova 6 apt 56, Zaporizhzhya, Ukraine, 69050 ("we", "us"). We are the controller of the personal data described here.You can reach us at [email protected] or through the contact form.

2. The short version

• We store your account, the devices you add and your settings, so the app can work.
• We do not record, store or analyse the video from your cameras.
• We do not use advertising or tracking tools, and we do not sell personal data. Errors and crashes are reported to us so we can fix them.
• Our server counts, anonymously, which kinds of devices people add (brand, model, number of cameras), so we know which devices to support better. No analytics code runs in the app or on this website.
• Passwords of your devices are stored encrypted.
• You can delete your account and everything linked to it at any time, yourself, in the app's Settings.

3. What we collect

Account data

You sign in with a Google account (or with Apple in the iOS app). From the sign-in provider we receive your email address, your display name, the address of your profile picture and a user identifier. We also store when your account was created, when you last signed in and when your trial ends.

Device data

For each recorder, camera or stream you add, we store the name you give it, its network address and ports, the user name and password you enter for it, and what the device reports about itself: brand, model, serial number, firmware version, channel names and video formats. Device passwords are encrypted with AES-256-GCM before they are saved and are never sent back to your browser.

Settings

Your preferred layout, video quality and colour theme.

Purchase data

If you buy a plan, we store the store it was bought in, the product, the transaction identifier, the amount, the currency and the date. For the Pro subscription we also store its status, the end of the paid period and the payment provider's customer reference. We never receive or store your card number or other payment details; those are handled by the payment provider.

Technical data

Our servers write log entries when the service is used. An entry can contain your IP address, the time, the address requested, the response code and error details. Logs are used to keep the service running and secure, are rotated automatically and are not used to build profiles.

Error reports

When the app or our server runs into an unexpected error, or the mobile app crashes, a report is sent to our error tracking provider: what went wrong and where in the code, the version of the app, the browser or phone model and its operating system, and your user identifier. Reports contain no email address, no IP address and no video; addresses of your devices are sent without their user names and passwords. We use them only to find and fix faults.

Device statistics

When you add or remove a device, our server sends an anonymous record of it to Google Analytics: the kind of device it is (recorder or camera, and how it was added), its brand and model as the device reports them, its number of cameras, whether it could be detected, whether it was added from the web, iPhone or Android app, and how many devices the account has, in ranges (such as "2-3"). The account is identified only by a code computed from its internal identifier with a secret key, which cannot be turned back into your account. The record contains no email address, no name, no IP address, no network address, no user name or password and no video. We use these statistics only to decide which devices to support and improve. No analytics or tracking code runs in the app or on this website, and nothing is used for advertising.

Messages you send us

When you use the contact form, we receive your name, your email address and your message by email, and use them only to answer you.

When you send feedback from the app (Settings, Send feedback), we receive your message, a screenshot if you attach one, your account's email address and user identifier, your plan and number of devices, and technical details: the app version, your browser or phone and its operating system, screen size and language. It is kept in our own issue tracker, visible only to our team, and used to fix problems, consider your ideas and answer you.

4. Video from your cameras

When you watch a camera, our servers connect to your device and pass the video on to your browser as it arrives. The video is not written to disk, not kept after you stop watching and not looked at by us. While you watch, a still image may be held in memory for a few seconds so the picture appears quickly.

Some public streams can be played by your browser directly from their source. In that case the video does not pass through our servers at all, and the operator of that stream sees your IP address, as with any website you visit.

You decide which devices to connect. If people can be recognised in the video, you are responsible for having the right to view it (see the Terms of Service).

5. Why we use the data and on what legal basis

We do not make automated decisions about you and we do not send marketing email.

6. Who else processes the data

We use a small number of service providers. They may only use the data to provide their service to us.

• Google (Firebase Authentication): sign-in and verification of your identity.
• Our hosting provider: the servers and database that run the service.
• Stripe: payments made on the web. Stripe is an independent controller of your payment data.
• Apple App Store, Google Play and RevenueCat: purchases made in the mobile apps, where these are available.
• Our email provider: delivery of contact form messages.
• Sentry (Functional Software, Inc.): error reports, stored in its data centre in Germany.
• Google (Google Analytics): the anonymous device statistics described above, sent by our server only.

We disclose data to authorities only when the law obliges us to. If the service is transferred to another operator, your data moves with it under the same protections, and we will tell you beforehand.

7. Transfers outside your country

Some providers process data outside the European Economic Area, in particular in the United States. Where that happens, the transfer relies on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or on standard contractual clauses.

8. How long we keep it

• Account, devices and settings: until you delete them, or delete your account in Settings (Delete account). The account, its devices with their stored passwords, settings and plan are then deleted at once, a subscription paid by card is cancelled, and your sign-in is removed.
• After an account is deleted: only a keyed hash of its e-mail address (not the address itself) and the date its free trial ended, so that signing up again does not start a second trial.
• A device you remove: deleted immediately, together with its stored password.
• Purchase records: kept by the payment provider (Stripe, Apple or Google) for as long as tax and accounting law requires, usually up to ten years, also after the account is deleted.
• Server logs: for a limited time; old entries are overwritten automatically.
• Error reports: deleted automatically by the error tracking provider after 90 days at most.
• Device statistics: the individual records are deleted automatically by Google Analytics after 14 months at most; only totals are kept after that.
• Contact messages and feedback: for as long as needed to handle your request, and no longer than two years.

9. Cookies and storage in your browser

This website sets no cookies. The app keeps your sign-in session and your display preferences in your browser's local storage, and caches its own files so it starts quickly and can be installed. These are needed for the app to work, so no consent banner is shown. Nothing is used for advertising or tracking across sites.

10. Security

All connections to the service use HTTPS. Device passwords are encrypted at rest. Access to the servers is limited to the people who run the service. No system is perfectly secure; if a breach affects your data, we will inform you and the supervisory authority as the law requires.

We recommend creating a separate user on your recorder for tinyCCTV, with permission for live view only, and a password you do not use anywhere else.

11. Your rights

You can at any time:

• ask what data we hold about you and receive a copy;
• have incorrect data corrected;
• have your account and data deleted;
• ask us to restrict processing, or object to processing that relies on our legitimate interest;
• receive your data in a portable format.

To use these rights, write to us at [email protected]from the email address of your account. We answer within one month. You also have the right to complain to the data protection authority of the country where you live or work.

12. Children

The service is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, please tell us and we will delete it.

13. Changes to this policy

When we change this policy, we publish the new version here with a new effective date. If a change is significant, we also announce it in the app or by email before it applies.

14. Contact

Questions about privacy are welcome at [email protected] orthrough the contact form on tinycctv.com.