Privacy policy

This policy covers the Camlane Android app (from camlane.live and Google Play), the Camlane desktop app, camlane-cli, and this website.

Summary

• Camlane itself collects nothing. It has no accounts, analytics, telemetry or crash reporting, and no Camlane server exists to send data to.
• Your camera and microphone stream only to the computer you pair with, on your own local network. They never go to us or to any server.
• Recordings stay on your own devices. In Watch mode the desktop app can record cameras’ video (never sound) to that computer’s own disk, encrypted by default and kept for 1 week unless you choose otherwise. A phone in Camera mode records itself while none of its computers answers, encrypted on the phone, and moves those recordings to one of your computers when it’s back.
• The Android app includes Google AdMob for its banner ads, which may collect data as described below.
• The desktop app fetches one static file from GitHub at most once a day to show a small sponsor strip. That request carries no identifiers.
• Private AI (desktop, off by default) runs entirely on your computer. It analyses recordings of the cameras you choose and sends nothing anywhere. Its only network use is downloading a model when you choose Install.

What is processed, where it goes, and who receives it

Data	Where it goes	Who receives it
Camera video and microphone audio	Over your local network, directly to the computer you paired with	You only
Two-way audio: your voice from the computer’s microphone while you hold Talk	Over your local network to the camera phone, which plays it. It isn’t stored	You and the people near the phone
Watch mode only: recordings of camera video, and an index of when each camera recorded and detected motion	Stored on the computer that records, until they expire or you delete them (details)	You only
Camera mode only: video the phone recorded on itself while none of its computers answered, with when it detected motion	Stored on that phone until one of your computers has it, or the phone’s limits delete it (details)	You only
Pairing PIN and token, paired-device list, settings, imported LUTs, the recordings key	Stored on your phone and your computer (the recordings key in the operating system’s keyring where there is one)	Nobody
Discovery information: the computer’s display name, OS and Camlane version; the phone’s model name and a random per-install ID	Your local network only	Devices on your local network and the computer you connect to
Logs	Stored locally; shared only if you send them to us yourself	Nobody unless you choose
Android app: advertising ID, IP address, device and app information, ad interactions	Google AdMob, when the phone is online (including while you stream)	Google, under Google’s policies (below)
Private AI (only when turned on): descriptions (embeddings) of pictures sampled from recordings of opted-in cameras; with the people features, face templates, names you give people, tags and notes	ai.db in the recordings folder on your computer, sealed with the recordings key	You only
Private AI model downloads, only when you choose Install for a model	huggingface.co (models) and github.com (ONNX Runtime)	Hugging Face or GitHub receive the standard information of any web request (IP address, user agent). Camlane sends nothing about you or your recordings
Desktop app: one HTTPS request for the sponsor strip, at most once a day	raw.githubusercontent.com (GitHub)	GitHub receives the standard information of any web request under the GitHub Privacy Statement. Camlane adds no cookies, identifiers or query parameters

Permissions on Android

• Camera and microphone: used only to capture what you stream to your paired computer. When that computer records the camera, the app shows “Recording” on the camera screen and in its notification. In Camera mode, while none of its computers answers, the phone records its own camera (never sound) and shows “Recording” the same way.
• Nearby devices (Android 13+) or location (Android 8–12): Android requires these permissions to discover devices on Wi-Fi. Camlane never reads or stores your location.
• Notifications: required for the foreground-service notification that keeps streaming alive.
• Internet: Android requires this for any network socket, including local-network ones. It’s also used to load ads.
• Advertising ID: declared by the Google Mobile Ads SDK.

Recordings on your computer (Watch mode)

The desktop app records cameras only when that computer is in Watch mode, and camlane-cli watch does the same on a computer without the desktop app. Neither records in Share camera and mic, and camlane-cli listen never records.

• What is recorded. The video each phone sends, stored in one-minute pieces. No sound is recorded, even when the phone streams its microphone. Each camera is set to Off, Motion only (the default: the minutes with motion, plus one minute before and after) or Continuous. If a phone isn’t detecting motion (its battery saver is off), Motion only keeps every minute.

• The index. Next to the video, an index file (recordings.db) holds each camera’s random per-install ID, when each minute starts and ends, its size, and when the phone reported motion. The index isn’t encrypted. It holds times and sizes, not pictures.

• Who can tell. A recorded phone shows a red “Recording” pill on its camera screen and starts its notification with “Recording.”. Phones with Camlane versions too old to show it are marked on the computer. Recording people may need their consent: see recording people. You’re responsible for recording lawfully.

• Where it’s stored. Only on the computer that records, in its recordings folder. Settings → Recording shows the folder in use, and you can move it. The default folders are:

  System	Recordings folder
  Linux	~/.local/share/camlane/recordings
  Windows	%APPDATA%\camlane\Camlane\data\recordings
  macOS	~/Library/Application Support/app.camlane.Camlane/recordings

• Recordings from camera phones. Minutes a phone in Camera mode recorded on itself are stored here like the rest once the phone uploads them, encrypted with this computer’s key, and marked on the timeline as recorded by the camera.

• Nothing leaves that computer. Recordings are never uploaded. There is no Camlane cloud, and neither we nor Google receive them. The ad SDK runs only in the Android app and never sees the camera. When you play recordings in the app, they’re decrypted in memory and shown through a server that only this computer can reach.

• Encryption at rest. On by default. Each minute is encrypted with AES-256-GCM using a random 256-bit key that the app creates on first use. The key is kept in one of three places:

  • the operating system’s keyring: Secret Service on Linux, Keychain on macOS, Credential Manager on Windows;
  • recordings.key in Camlane’s settings folder, with owner-only file permissions, where no keyring is reachable (for example on a headless Linux server);
  • derived from a passphrase with Argon2id, when a headless recorder sets CAMLANE_RECORDINGS_PASSPHRASE.

  Settings → Recording shows where the key is kept, and Back up key shows the key so you can save a copy. Encryption protects recordings that are copied or taken without the key. It doesn’t protect them from someone using your signed-in user account, because the app can read the key then. If the key is lost and you have no copy, the recordings can’t be opened. Turning off Encrypt recordings stores new recordings unencrypted from then on; existing ones stay as they were.

• Exported clips. “Export clip” and camlane-cli recordings export write a normal, unencrypted MP4: to Videos/Camlane from the app, or wherever you choose with the CLI. Clips are your own files. Retention and “Delete all recordings” don’t touch them.

• How long recordings are kept. 1 week by default. Settings → Recording → Keep offers 1 day, 1 week, 1 month or 1 year. An optional size limit for all cameras together also applies. Older recordings are deleted, oldest first, when the recorder starts and every 10 minutes while it runs.

• Deleting recordings. “Delete all recordings” on the Recordings page deletes every camera’s recordings, their index entries and what Private AI learned from them, after you confirm. It doesn’t delete exported clips, the key or your settings. Uninstalling the desktop app may leave the recordings folder in place, so delete it if you no longer want it. As with any deleted file, the disk may keep the data until it’s overwritten; deleted encrypted recordings can’t be read without the key.

• Planned, not available yet. This policy will be updated before either ships: a phone or tablet that records cameras with no computer, and audio recording per camera (off by default).

Recordings on a camera phone (Camera mode)

A phone in Camera mode stores its recordings on the computers you list, best first. When none of them answers, for example during a power cut, the phone records on itself until one is back, so the recording has no hole.

• When. Only in Camera mode, only after the phone was streaming to a computer that records it, and only while none of the computers in its list answers. Share mode never records on the phone. Settings → Recordings → “Record on this phone when no computer answers” turns it off.
• What is recorded. The phone’s small recording stream (480p at 15 fps by default), in one-minute pieces, with the times it detected motion. No sound is recorded. It follows the camera’s setting on that computer: Off records nothing, Motion only keeps the minutes with motion plus one minute before and after, Continuous keeps everything.
• Who can tell. The phone shows “Recording” on its camera screen, and its notification says it’s recording on this phone and looking for the computer.
• Where it’s stored. In the app’s private storage on the phone, not in the gallery or any folder other apps can read.
• Encryption at rest. Always on. Each second of video is encrypted with AES-256-GCM, with a key the app creates in the Android Keystore. The key never leaves the phone and can’t be exported.
• How long it’s kept. Until a computer has it, or until the phone’s limits remove it: up to 5 GB and 1 week by default. Settings → Recordings offers 5 GB, 10 GB or a size you choose, and 1 week, 1 month or until full. The oldest go first.
• Moving to your computer. When one of the computers in the list answers again, the phone sends what it recorded over your local network, oldest first, and deletes each minute only after the computer confirms it stored it. The computer stores it encrypted with its own key. Nothing goes anywhere else.
• Deleting. Settings → Recordings → Delete recordings on this phone deletes what is still on the phone, after you confirm. Clearing the app’s data or uninstalling the app deletes the recordings and the key.

Advertising

The Android app shows banner ads from Google AdMob: one banner on each screen (the device list, the camera screen, settings, about and the QR scanner), and none in dialogs or sheets. Banners never cover the camera picture or a control. There are no full-screen, video, pop-up or app-open ads. The camera screen banner stays visible during a stream and doesn’t request new ads until the stream ends. Ads don’t load when the phone is offline. More on how ads fund Camlane.

Google may collect and use your device’s advertising ID, IP address, device information and ad interactions to deliver, measure and personalise ads. Read how Google uses information from sites or apps that use its services and the Google Privacy Policy.

• Consent: in the European Economic Area, the United Kingdom and Switzerland, the app asks for consent through Google’s User Messaging Platform before personalised ads are requested. You can change your choice any time in Settings → Privacy & ad choices.
• Advertising ID controls: you can reset or delete your advertising ID, or opt out of ad personalisation, in your Android settings (Settings → Google → Ads, or Settings → Privacy → Ads, depending on the device).

Camlane never passes camera, microphone or stream data to the ad SDK. The desktop apps have no ads.

Private AI

Private AI is an optional desktop feature, labelled Private AI (fully offline), that understands recordings: it recognises people you name, suggests what they were doing, and writes a short summary of each day. It’s off by default and only looks at cameras you opt in one by one.

• Where it runs. On your computer only. Pictures are taken from recordings already on your disk, never from the live stream, and they never leave the computer. There’s no cloud service, account or telemetry, and ONNX Runtime is started with its telemetry switched off.
• Network. The only connections are model downloads you start in Settings, after reading and accepting each model’s licence. On a computer without internet you can copy the model files in instead. After that, Private AI works without a network connection.
• What is stored. In ai.db, next to the recordings: for each analysed picture, a list of numbers describing it (an embedding), with the camera and time; with the people features, face templates, names and tags you choose, highlights and notes. Everything that describes a person is encrypted with the recordings key; times and camera IDs aren’t, as in the recordings index.
• Retention and deletion. Data follows the recordings: when a recording is deleted by retention, what Private AI learned from it goes too. Settings → Private AI → Delete all AI data removes everything at once, and “Delete all recordings” removes what it learned from them. Turning Private AI off stops all processing.

People library

• Off by default, with several opt-ins. It needs Private AI on, then Recognise people on, then each camera switched on by itself.
• Consent. Camlane lets you name a person only after you confirm that they know the camera recognises them and agree. It records when you confirmed. Importing a person from a file asks the same.
• Where it runs. On your computer only, with the YuNet and SFace face models from OpenCV Zoo, downloaded once after you accept their licences. Faces, face templates and names never leave the computer unless you export them yourself.
• What is stored. For each person, at most five face templates (128 numbers each) that differ from each other; the names you give; sightings (person, camera, start and end time, and how sure the match was); and a small picture of each kept face only if you turn on “Keep a picture of each person” (off by default).
• Retention. Sightings are deleted together with the recording they came from (the default), after 7, 30 or 90 days, or never, as you choose. An unnamed person disappears with their last sighting. A named person’s templates stay until you delete the person. Delete all recordings also deletes the sightings seen in those recordings.
• Deletion. Delete person removes everything about that person: templates, pictures, name, sightings, and the tags and notes linked to them. Deleted entries are overwritten in the database file.
• Exports. You can export the log of sightings as CSV or JSON, and save a named person as a file encrypted with a passphrase you choose, to import on another Camlane computer. Camlane never sends these files anywhere. Anyone you give a person file to, with its passphrase, can recognise that person.

Activities and highlights

• Off by default. Suggestions need Private AI on, Recognise people on with the camera opted in, and Suggest what people are doing on. Highlights only need Private AI on.
• How it works. The picture descriptions Private AI already made are grouped into stretches of a recognised person’s sightings, up to 30 seconds each, and compared with a list of activity words and with stretches you tagged before. No other model runs and no extra pictures are taken. Day summaries are fixed sentences filled in from what is stored, not written by a language model or an online service.
• What is stored. Stretches (person, camera, times, a description, and what was suggested or answered), activity words, tags, and highlights with a picture and your note, all encrypted with the recordings key except times and camera IDs.
• Retention and deletion. A stretch goes with its recording; tagged stretches are kept as examples, at most 24 per activity. A highlight keeps its recording until you delete the highlight. Delete person, Delete all recordings and Delete all AI data remove the matching activities.

Faces are biometric data

If you use the people features, you decide whose faces are processed, and the law may treat you as responsible for that data. This is a summary, not legal advice:

• EU and UK (GDPR Article 9): face templates used to identify people are special-category data. Processing them generally needs the person’s explicit consent. The household exemption covers purely personal use, but not cameras that also capture public space or other people’s property (CJEU, Ryneš, C-212/13).
• Illinois (BIPA): collecting a face template needs written notice and a written release from the person first, a published retention schedule, and deletion when the purpose ends or within three years of the last interaction. Similar laws exist in Texas and Washington.
• India (Digital Personal Data Protection Act, 2023): personal data needs notice and consent for a stated purpose, unless it’s processed for a purely personal or domestic purpose.

In practice: tell people that a camera records and that recordings are analysed (a visible sign helps), add a person to the people library only with their knowledge and agreement, keep the retention short, and delete a person’s data when they ask.

Recording people

Not legal advice. This is general information as of October 2026. Laws change and depend on where the camera is, who it records and why. Check the rules that apply to you. You’re responsible for how you use Camlane.

Video and audio are treated differently. Many legal systems regulate recording what people say more strictly than recording what they look like. Audio falls under wiretap and eavesdropping laws: some places allow recording a conversation if one person in it agrees, others need everyone’s agreement, and a room camera mostly records conversations its owner isn’t part of. Video without sound is more often lawful in your own home, but filming people secretly where they expect privacy (bathrooms, rooms where guests or tenants sleep, changing areas) is a crime almost everywhere. Pointing a camera at a street, a shared hallway or a neighbour’s garden, or filming people who work for you, brings in data protection, employment or harassment rules in many places. Camlane records video only.

• United States. Federal law is one-party consent for conversations you take part in; intercepting other people’s private conversations is a crime. About a dozen states, including California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington, require every party’s consent for some or all conversations. Hidden cameras in private places are crimes under state voyeurism laws.
• European Union. The GDPR doesn’t apply to purely household activity, which regulators read narrowly for cameras. A home camera that covers a public footpath isn’t household use (Ryneš, C-212/13): you then need a legal basis, a sign, short retention (often a few days) and to answer requests from people you recorded. Audio a camera doesn’t need should be turned off, and national laws, such as § 201 of the German Criminal Code, protect the spoken word.
• United Kingdom. Once a camera records beyond your property, data protection law applies: put up a sign, delete recordings regularly, give people their recordings when they ask, and stop recording someone who objects unless you have a legitimate reason. Voices count as personal information like images.
• India. No statute sets a consent rule for private recordings; privacy is a fundamental right (Puttaswamy, 2017). Section 66E of the IT Act punishes capturing images of a person’s private area without consent, and section 77 of the Bharatiya Nyaya Sanhita covers voyeurism. The DPDP Act doesn’t apply to purely personal or domestic use, but does to shops, offices and housing societies.

Practical steps: point cameras at your own space; never record bathrooms, changing areas or rooms where guests or tenants sleep; tell the people you live with, guests and anyone who works in your home, and put up a sign where the law asks; use Motion only and the shortest retention that works; delete what you don’t need; and keep Camlane up to date on the phones so they can show that they’re being recorded.

The recording indicator is a notice, not consent. People may not see a phone mounted high or with its screen off, and it doesn’t replace telling people or a sign. Live viewing isn’t recording: a phone that streams without being recorded shows its usual live status.

Children

Camlane isn’t directed at children under 13 and doesn’t knowingly collect personal information from children. Camlane itself collects no personal information from anyone.

This website

camlane.live is a static website. It sets no cookies and has no analytics, tracking or advertising.

• Hosting. Requests reach our web server through Cloudflare, which processes the technical data of each request (such as your IP address and browser) to deliver and protect the site, under the Cloudflare Privacy Policy. Our server records each request (the time, your IP address and the page asked for) in its system log, which is rotated automatically; we use it only to keep the site working and secure.
• Builds page. Your browser asks GitHub’s public API for the list of releases when you open /builds. GitHub receives the standard information of that request.
• Relay status page. Your browser asks relay.camlane.live whether the relay is running when you open /status.
• Downloads come from GitHub’s release servers.
• Theme. If you switch between light and dark, the choice is kept in your browser’s local storage on that device only.
• Email. If you write to hello@camlane.live, we use your message and address only to answer you.

Retention, access and deletion

We hold no data about you from the apps, so there’s nothing for us to give you, correct or delete. Everything Camlane stores is on your own devices. To remove it:

• Android: clear the app’s data, or uninstall the app. Recordings a camera phone keeps on itself can also be deleted in Settings → Recordings.
• Desktop: delete the settings folder (~/.config/camlane on Linux, %APPDATA%\camlane\Camlane\config on Windows, ~/Library/Application Support/app.camlane.Camlane on macOS); delete the data folder, which holds recordings, ai.db and Private AI models (~/.local/share/camlane on Linux, %APPDATA%\camlane\Camlane\data on Windows, and the same folder as the settings on macOS); delete any recordings folder you chose yourself; and remove the “camlane” entry from the operating system’s keyring.

For data collected by Google through ads, use Google’s controls linked above. If you emailed us and want the message deleted, say so and we’ll delete it.

Security

The live stream between phone and computer isn’t encrypted yet and is meant for networks you trust. Recordings are encrypted at rest as described above. Pairing uses a PIN that is never transmitted. See Security.

Changes to this policy

When this policy changes, the effective date above is updated, and material changes are noted in the changelog and the release notes.

Contact

Questions about privacy: hello@camlane.live. Camlane is maintained by Aryan Singh.