Privacy Policy

What stays on your device

This data is created and stored on your iPhone or in your browser and is never sent to our servers:

• The groups you create and the apps chosen for each one. On iPhone, apps reach Camuflo as opaque tokens from Apple Screen Time: not even we know which apps they are.
• Safe places (name, map point and distance) and lock schedules. Your position is compared with the places on the iPhone itself; for that, iOS asks for location “Always”.
• The state of each group (available, locked or hidden) and of Street Mode.
• Your progress in the theft kit, and your chosen country and language.

What we collect if you create an account

An account is optional. On-device protection works without one. If you sign in, we store:

• Your email and, if you use Apple or Google, the name they send us and an account identifier from that service.
• 6-digit sign-in codes, stored only as a hash and valid for 10 minutes.
• Sign-in sessions: when they were created and last used, when they expire, and the browser or app used. The session token is stored only as a hash.

Subscription

Apple handles billing. We never receive your card or payment details. To know whether your subscription is active, RevenueCat tells us the plan, the start and renewal dates and an anonymous purchase identifier.

What we never collect

• The content of any app: messages, chats, balances, emails, photos or files.
• Your iPhone passcode, biometrics (Face ID) or passwords for other services.
• Your contacts or browsing history.
• Advertising data. Camuflo has no ads and uses no tracking tools.

How we use data

The legal bases are performance of our contract with you (GDPR art. 6(1)(b); LGPD art. 7, V) and our legitimate interest in keeping the service secure (GDPR art. 6(1)(f); LGPD art. 7, IX).

• To create and keep your account and let you sign in from the app or a browser.
• To email you the sign-in code.
• To turn protection on while your subscription or free trial is active.
• To show your location history and that of family members who agreed to share, if you turn the feature on.
• To protect the service from abuse, for example by limiting code attempts and keeping technical access logs.

Location (optional)

We only record a device’s location if you turn on "Record this device’s location" in Family and allow access in iOS. We store latitude, longitude, accuracy, time and the device that sent it, about every 15 minutes or when you move, even with the app closed.

By default only you see your history. People in your Camuflo family only see it if you turn on "Show to my family", and anyone can leave or be removed at any time. Nobody joins your family without a code you sent.

You can also share with friends or relatives outside the family by typing the email of their Camuflo account. You choose whether they see only where you are now or also your route over the last 30 days. We keep that email and your choice, and we email the person to let them know. They only see it if they sign in with that email and have an active subscription. You can stop at any time, and they can stop seeing it too.

You can also create a live location link (1 hour to 1 day) to send by WhatsApp, messages or email. Anyone with the link sees your position over the last 2 hours, without an account, until the link ends or you stop it. The link does not show your email. While it is on, the phone records its location every minute, when it has signal.

You see the last 30 days. If you erase your history it disappears right away for you and your family, but it is kept hidden for up to 90 days for safety and to recover it if you ask. Every point older than 90 days is deleted for good. Support staff only access this history to answer your request or for safety, and every access is logged.

The legal basis is your consent (GDPR art. 6(1)(a); LGPD art. 7, I), which you withdraw by turning both options off or in iPhone Settings.

Remote commands

From the portal (app.camuflo.com) you can send commands to your devices: lock everything, record the location now, or show a message on the screen. We keep the command, the message you write, the target device and its status (waiting, received, done). Only you, with your account, can send commands to your devices. If you turn on "Let my family lock my devices", people in your Camuflo family can also lock them or block all their apps (never locate, message or unlock them), and you get an email each time.

Panic code

If you create a panic code and type it in Camuflo, we keep the time, the device and, if the iPhone can report it, the location at that moment, and we email an alert to you and the people in your Camuflo family. The code itself stays only on your device, stored as a scrambled value (hash); we never receive it.

Disguise mode

The disguise mode code stays only on your device, stored as a scrambled value (hash). We never receive it, and the sums you do on the calculator never leave the device. Changing the icon is a setting of the iPhone itself.

Intruder photo

If you turn on Intruder photo, after two wrong attempts to get past Camuflo (code or Face ID) within a few minutes, the front camera takes a photo. It is kept on the device and, if you have an account, we email it to you and keep it with the time, the device and the location at that moment. Photos are deleted after 30 days and you can delete them sooner. The camera is only used at that instant, with the iOS permission.

Kids mode

Kids mode rules (blocked apps, limits, bedtime and sites) and the parent PIN stay only on the child's iPhone; the PIN is stored scrambled (hash). None of it is sent to our servers. Usage time is counted by iOS itself.

Future features

A cloud vault does not exist yet. When it arrives, it will work only if you turn it on, and this policy will be updated before launch.

Who we share data with

We do not sell or rent your data. We use providers that process data only to deliver the service to us:

• Render (hosting for the website, web app and API), in the United States.
• Neon (database), in the United States.
• Resend (sending the sign-in code email), in the United States.
• RevenueCat (status of your App Store subscription), in the United States.
• Cloudflare (DNS for camuflo.com).
• Apple and Google, only if you choose to sign in with those accounts.

International transfers

Our servers are in the United States. Transfers follow LGPD art. 33 and, for users in the European Union, GDPR safeguards such as the providers’ standard contractual clauses.

How long we keep data

• Account: for as long as it exists. When you delete your account, we erase your email, sign-in methods and sessions immediately.
• Sign-in codes: expire after 10 minutes.
• Sessions: up to 30 days without use, or until you sign out.
• Remote commands: the type, the message you write and the status are kept for 30 days and then deleted.
• Panic alerts: kept while the account exists, so you can review them in the portal. Deleting your account erases them at once.
• Location: visible for 30 days; deleted for good at 90 days, including what you erased earlier. Deleting your account erases the history at once.
• Server access logs: for the hosting provider’s retention period, for security.

Your rights

You can confirm whether we process your data, access it, correct it, request portability, withdraw consent and ask for deletion (GDPR arts. 15–21; LGPD art. 18).

To delete your account right now: in the app, open Settings → Account → Delete account. For any other request, email privacidade@camuflo.com. We reply within 15 days.

You may also complain to your local data protection authority, or to Brazil’s ANPD.

Security

• All traffic uses HTTPS.
• Codes and session tokens are stored only as hashes.
• On iPhone, the session token is kept in the system Keychain.

Children

Camuflo is meant for adults protecting their own device. We do not knowingly collect data from children under 13 (16 in the European Union). If that happens, email privacidade@camuflo.com and we will delete it.

Changes to this policy

When this policy changes, we update the date at the top. Important changes will be announced in the app before they take effect.

Contact

Data protection officer: privacidade@camuflo.com