Privacy policy
Effective 2026-09-18. Short version: the app is offline. No accounts, no cloud, no analytics, no ads. Your clips live on your phones. This page says exactly what the app does with each permission it asks for.
What leaves your phones: nothing
pose.video has no servers to send anything to. Pairing, control and media transfer all happen directly between your phones over Bluetooth and your local Wi‑Fi. There is no account system, no crash reporting, no analytics SDK, and this website sets no cookies and loads nothing from third parties.
What each permission is for
| Permission | What it does |
|---|---|
| Bluetooth (scan, advertise, connect) | Finds paired phones, carries start/stop commands, status and clock sync. Advertisements carry only a 6‑byte hash prefix of the camera ID plus coarse state flags — not your identity or any footage. |
| Local network / Wi‑Fi state | Discovers cameras via mDNS and moves thumbnails, proxies and originals over TCP on the Wi‑Fi you joined. The handshake is mutually authenticated with your pairing key and media is encrypted (AES‑256‑GCM, forward secrecy). The network is assumed hostile; an attacker without your pairing key learns nothing beyond “a pose.video camera exists”. |
| Camera | Records runs — only after you (or a paired phone you connected to) start one, and only until stop or the max duration. Nothing records silently: a capture buzzes, lights the screen, and shows a red ring with the elapsed time. |
| Microphone | Records the audio track of runs you start, at the quality preset you chose. It is never sampled outside a recording. |
| Notifications | Shows recording state (“● Recording run #7”) and sync backlog so a phone in your pocket still answers “is it recording?”. |
| Gallery / media | Originals this phone records or pulls are moved into the system gallery under Movies/pose.video/ so they survive uninstall. Proxies and thumbnails stay app-private. Deleting a clip removes its gallery entries too. |
| Battery optimisation (optional) | Offered once so the camera stays reachable with the screen off. Declining is final and costs nothing but one quiet line in Settings. |
| Location (Android 11 and older only) | Legacy OS requirement for BLE scanning; on current Android it is not requested at all. |
Keys and pairing
Pairing is a QR code scanned optically — the secret never travels over radio. The per-pair key is stored encrypted (Android Keystore; iOS Keychain when the iOS app ships). To revoke a phone, long-press its row and Forget it. There is no remote wipe because there is no remote anything; a lost phone holds whatever clips were on it, protected only by your lock screen.
This website
Static pages, no JavaScript, no cookies, no fonts or assets fetched from anywhere else. Server access logs (standard Caddy rotation, 5 × 10 MiB) exist for operations and are never joined with anything — there is nothing to join them with.
Contact
Questions about this policy: open an issue at github.com/h379wang/pose.video.