Without Pro, SecureEyes sends us nothing at all. There is no account to create, no analytics, no crash reporting, no advertising and no tracking of any kind. Your cameras, their passwords, your video, your snapshots and your motion history live on your own devices and your own network. We do not receive them, and we could not hand them over if we were asked, because we never have them. With Pro, the one thing we keep is a licence record for each purchase, described below. This website is separate: it counts visits with Google Analytics, and only if you accept (see This website).
Effective 29 October 2026. Applies to SecureEyes 1.0.1 and later on iOS, iPadOS and macOS, to the SecureEyes Hub, and to this website.
Automatic data collection
NoneWithout Pro, SecureEyes sends us nothing. With Pro, we keep one licence record per purchase, never used for tracking. The website counts visits only if you accept.
Your video
Never reaches usCamera to device, over your own network
Accounts
None to createNo password of ours to lose
01
The short version
Without Pro, SecureEyes sends us nothing at all. There is no account to create, no analytics, no crash reporting, no advertising and no tracking of any kind. Your cameras, their passwords, your video, your snapshots and your motion history live on your own devices and your own network. We do not receive them, and we could not hand them over if we were asked, because we never have them. This website is separate: it counts visits with Google Analytics, and only if you accept (see This website).
Two SecureEyes-operated servers exist, both optional and both used only with a SecureEyes Hub licensed for Pro: a relay that carries encrypted traffic it cannot read, which is off until you turn it on, and a licence server that turns an App Store purchase into a signed licence. The licence server keeps one record per Pro purchase: Apple's transaction identifier for it, and the Hubs it activates, each by an identifier the Hub made up for itself, so that one purchase covers at most three Hubs. Apple's App Privacy label counts that record as purchase history and a device identifier linked to you, used only to make the app work and never for tracking. Neither server holds your name, your email address, your Apple Account, your cameras or your video. The rest of this document is the detail behind those paragraphs.
02
What SecureEyes stores, and where
All of it is on your device, in the app's own container.
Camera list: names, addresses, ports, stream paths, and the brand and model found by discovery, in app storage.
Camera usernames and passwords, in the system Keychain, and inside the saved stream addresses in app storage on this device.
Motion events, snapshots and recorded clips, in app storage on disk.
App settings and preferences, in UserDefaults.
A device name and key pair, so your devices can recognise each other for sync.
Which plan you bought, read from Apple's StoreKit. The receipt is Apple's, not ours.
Motion history is deliberately excluded from device backups. It is short-term local evidence rather than an archive, so it does not restore onto a new device and does not consume your iCloud storage.
03
What leaves your device, and what does not
Your local network. The app talks to your cameras directly over your own network, using RTSP, ONVIF and HTTP. Video, snapshots and camera credentials travel between your camera and your device and go nowhere else. On iOS this is why the app asks for Local Network permission.
iCloud, only if you turn sync on. Sync is off by default. When it is on, your camera list travels through your own iCloud account, and camera passwords travel through iCloud Keychain, which Apple encrypts end to end. Apple is the processor and Apple's privacy policy governs it. SecureEyes has no access to your iCloud account and never receives any of it.
Device to device, if you use a transfer code. Moving a setup from one of your devices to another packs it into a PIN-protected transfer code that the receiving device scans. The data goes directly between your two devices.
Apple, when you buy something. Purchases run through the App Store. Apple processes the payment and tells the app what was bought. We never see your payment details, and we receive no name, email address or Apple Account identifier from the purchase.
Your own SecureEyes Hub, if you have one. The Hub is a computer in your house that you own and run. The app talks to it over your network. Cameras, recordings and events on the Hub stay on the Hub.
The two servers we run
The relay
relay.secureeyes.app
Reaches your Hub from outside your network, only when you view your cameras away from home, and only once you turn it on. It needs a SecureEyes Hub licensed for Pro; without a Hub there is nothing for it to reach.
At home
Hub
to
Your device
Video goes straight from your Hub to your device and never reaches the relay.
Away, Watch away from home on
Hub
to
Relay
to
Device
Every frame is sealed with your Hub's key. The relay forwards ciphertext it cannot read.
Only the line to turn it on
Hub
to
Relay
Watch away from home off, Allow turning on from anywhere on: an encrypted line that carries three requests only. No video, stills, cameras, events, settings or push messages.
Both switches off
Hub
no way through to
Relay
The Hub keeps no line to the relay.
What reaches the relay under each setting of the Hub's two switches. At home it is never used; away, it forwards sealed frames it has no key for.
When it is on
Watch away from home is off on a new Hub and stays off until someone who uses your Hub turns it on in the app, on your own network. It is turned off the same way, and a reset of the Hub turns it off too.
While it is on, every device that uses the Hub says so in a band across the top of the app, and so does the Hub's own web page.
A second switch, Allow turning on from anywhere, is also off on a new Hub and can only be turned on from your own network. While it is on, your phone can turn on Watch away from home even when you are not at home: the Hub keeps an encrypted line to the relay that answers only that request, and nothing else crosses it until you do.
While it is off, the Hub keeps no line to the relay when Watch away from home is off.
What crosses it
At home, video goes straight from your Hub to your device and never reaches the relay.
Away from home, every frame is sealed end to end with a key belonging to your Hub, which the app learned on your own network during pairing. The relay forwards ciphertext it has no key for, and your Hub refuses anything that arrives unsealed.
While Watch away from home is off and Allow turning on from anywhere is on, the line to the relay carries only three requests, each from a paired device: whether Watch away from home is on and whether it may be turned on, turning it on, and turning Allow turning on from anywhere off. Nothing else crosses it: no video, no stills, no camera list, no events, no settings and no push messages.
When your Hub connects, the relay checks that the Hub's licence is valid, and it keeps nothing from the licence.
What it keeps
The public key each Hub registered with, so that no other machine can take over that Hub's identifier.
A log of its requests: the time, the Hub's identifier, the result and how long it took.
What it can see
That a connection exists, from which network address, for how long, and how many bytes crossed it.
When your Hub is online, and nothing more.
It counts the bytes it carries in total, not per person.
What it cannot see
Your video.
Your camera names.
Your credentials.
The licence server
license.secureeyes.app
Used only when a Hub is licensed for Pro. It verifies a purchase with Apple and returns a signed licence bound to that Hub.
Once, to activate a Hub
ActivationThe Hub's installation identifier and public key, and Apple's signed proof of purchase
to
Licence serverVerifies the purchase with Apple
to
HubA signed licence bound to that Hub
About once a day
HubIts installation identifier, its software version and a signature made with its own key
to
Licence serverRenews the licence
What the licence server receives: once when a Hub is activated, then about once a day from the Hub itself.
What it receives
When a Hub is activated: a random installation identifier the Hub generated for itself, the Hub's public key, and Apple's signed proof of purchase. The server verifies the purchase with Apple and returns a signed licence bound to that Hub.
After that, about once a day, from the Hub itself, to renew its licence: its installation identifier, its software version and a signature made with its own key.
What it keeps
For each purchase: Apple's transaction identifier, the purchase's paid-through date and, if Apple reports one, its refund date.
For each Hub that purchase activates: its installation identifier and public key, when it was activated and last checked in, and its software version.
For a Hub removed from a purchase in the app: its installation identifier, its public key and when it was removed, so that its next check-in can be told.
For the limit on how many Hubs a purchase may free: when the purchase freed one that had stopped checking in.
Logs that record which Hub asked and when, not from where.
What it never keeps
Names.
Camera details.
Footage.
Network addresses.
The installation identifier
It identifies your Hub and nothing outside it.
It is filed with your purchase's transaction identifier, and with nothing that names you: no name, no email address and no Apple Account.
Because it is filed with the purchase, Apple's App Privacy label lists it, and the purchase record, as data linked to you.
Resetting a Hub erases it, and the Hub asks the server to forget it.
Links that open your browser. The support address, this policy and the media engine source offer open in your browser when you tap them. From that point your browser's own behaviour applies.
04
What SecureEyes never does
These are absences in the code, not promises about intent.
No analytics or usage measurement. No SDK of that kind is linked.
No crash or diagnostics reporting. Nothing is sent automatically when the app fails. A bug report is an email you compose, read and send yourself, and the playback counters it pre-fills are visible to you in the message body before you send it.
No advertising, no advertising identifier, no tracking. Nothing is shared with a data broker or an ad network, and nothing about you is combined with data from anywhere else.
No user accounts. There is nothing to sign up for and no password of ours to lose.
No runtime downloads. The bundled typefaces ship inside the app, so no font is fetched at runtime.
No selling or sharing of personal information, under the CCPA meaning of either word. There is nothing to sell.
05
This website
Everything above is about the app and the Hub. This website, secureeyes.app, is separate, and it measures visits in two ways.
Google Analytics, only if you accept. On your first visit a banner asks whether we may count your visit. Until you choose Accept, nothing is sent to Google and no analytics cookie is set. If you accept, Google Analytics sets cookies whose names start with _ga and records the pages you view, the page that sent you here, your browser and device type, your approximate location, which Google works out from your IP address, which Hub download links or install command you use, and your answer to "Did this page help?" on a knowledge base article. We use this to learn which pages people read, and we tell Google not to use your visit for advertising. Google processes it under its own privacy policy at policies.google.com/privacy. To change your answer, choose Analytics settings at the foot of any page; declining removes the _ga cookies. Your answer is kept in your browser's storage for this site.
Cloudflare Web Analytics. The site is served through Cloudflare, which counts page views without cookies and without identifying you.
Nothing from the app or the Hub reaches either service. The app has no analytics, as described above.
06
Permissions the app asks for, and why
Local Network, on iOS and iPadOS, to find and reach cameras on your network. Nothing leaves your network because of it.
Camera, to scan a setup code shown on another of your devices. It records no photo or video.
Photos, add only, to save a snapshot or clip you chose to save. It does not read your library.
Face ID or Touch ID, to unlock the app. Biometrics stay on your device with Apple; the app is told yes or no.
Notifications, to alert you about motion your own cameras or Hub detected. Local notifications only; there is no push server.
Each of these is asked for at the moment it is needed, and the app works without the optional ones.
07
Keeping and deleting
Everything the app keeps is on your device, so you control all of it. Deleting a camera removes it and its stored password. Clearing events and clips removes them from disk. Deleting the app removes the app's container, and with it every event, snapshot, clip and setting. Camera passwords held in iCloud Keychain are managed by Apple in Settings, because they are your Keychain items rather than ours.
We hold no copy of any of it. The one thing we hold is the Pro licence record described above. Resetting a Hub takes that Hub off it. To have the whole record removed, email support@secureeyes.app: every Hub on it then stops being licensed, and a Hub can be licensed again from the app with the same purchase.
08
Children
SecureEyes is not directed at children, and it collects nothing from anyone, of any age, beyond the Pro licence record described above.
09
Your rights
Under the GDPR, the UK GDPR, the CCPA and comparable laws you have rights to access, correct, delete and port your personal data, and to object to its processing. For SecureEyes those rights are satisfied structurally: we are not a controller or a processor of your personal data, because none of it reaches us. Your data is already in your hands, on your devices, and you can read, change, export and destroy all of it without asking us.
If you believe we hold something about you, write to the address below and we will tell you exactly what we find, which we expect to be nothing.
10
Security
Camera passwords are stored in the system Keychain, and the saved stream addresses in the app's own storage on the device carry them too. Neither leaves the device except through iCloud Keychain, when you turn on Camera passwords sync, and the stream addresses written to iCloud have them removed. Remote viewing is sealed end to end to your own Hub, and a relay connection that is not sealed is refused rather than downgraded. Pairing happens on your own network, which is what lets a later remote session verify it is talking to the same Hub. App Lock, if you turn it on, holds the app behind Face ID, Touch ID or your device passcode.
No system is perfect, and we would rather say so than imply otherwise. What we can say precisely is that a breach of our infrastructure would expose no customer video, no camera credentials and no camera list, because our infrastructure never holds any.
11
Changes
If this policy changes in a way that affects what happens to your data, the change will appear here with a new effective date, and the app's release notes will say so. Changes that only clarify wording will be noted by date alone.
12
Contact
Questions about this policy go to support@secureeyes.app.