Privacy Policy
Caught In The Act is an anti-theft app for your own phone. When it is armed and someone picks the phone up, it takes a photo and a short video with the front camera, can sound an alarm, and can email that evidence to an address you have confirmed. This policy explains exactly what that involves.
The app is operated by Dante Jackson ("we"). Questions: djackson@invisionthat.com.
The short version
- The camera is only used while you have armed the app, and only captures when it is triggered.
- Photos and videos stay on your phone unless you set up email alerts.
- If you do, the photo and video pass through our server on the way to your inbox and are not stored there. They are discarded as soon as the email is handed off.
- No audio is ever recorded. The app does not use your location, contacts, or advertising IDs, and contains no ads.
- Test versions only: while the app is in testing, it sends anonymous usage events (for example "armed", "email confirmed") so we can see how testers use it. They never include photos, video, location or your email address. The public release does not send them.
What stays on your phone
Captured photos and videos, your settings, a custom alarm sound if you choose one, and a diagnostic log of what the app did (for example "photo saved", "email sent"). None of this leaves the phone except as described below, or when you choose to share a capture yourself. Deleting a capture in the app, or uninstalling the app, deletes it from the phone. The usage events described below are separate from the diagnostic log and never contain its text.
Email alerts (optional)
Email alerts are off until you enter an address and open the confirmation link we send to it. No alert is ever sent to an address that has not been confirmed.
| What we receive | Why | How long we keep it |
|---|---|---|
| Your email address | To send the confirmation link and your alerts | Until you remove the address in the app |
| A random identifier for your installation, created by our server | To know which confirmed address an alert belongs to | Until you remove the address in the app |
| Your phone's model name (for example "Samsung SM-S947U") | To say which phone was picked up, in the email | Until you remove the address in the app |
| The photo and video from a trigger, and the time it happened | To attach them to your alert email | Not stored. Discarded once the email is handed to our email provider |
| A record that an alert was sent (the time and your installation, never the content) | To limit how many alerts one installation can send | About 30 days |
| The IP address and email address used when setting up alerts | To stop the setup form being used to spam other people | About 30 days |
Usage events (test versions only)
This applies to test versions only. The public release of the app does not collect usage events.
Versions of the app given to testers, through Google Play testing, Apple TestFlight or directly by us, send a record of how the app is used. This helps us find what is confusing or broken before the public release. The public release does not include this. It is not optional in test versions: leaving the test, or uninstalling the app, stops it.
| What we receive | Why | How long we keep it |
|---|---|---|
| A random identifier created by the app on first launch. It is not linked to your email address or to the email-alerts identifier above | To tell one tester's events apart from another's | About 30 days |
| What happened in the app and when: screens and setup steps reached, actions such as arming, triggering and disarming, settings changed and their new values, whether an alert email was sent, and which part of the app hit an error. Also the app version and platform (Android or iOS) | To see how testers use the app and where it goes wrong | About 30 days |
Usage events never include photos, video, audio, location, your email address, file names, or the text of any message or error.
Service providers
We use two providers to run email alerts and, in test versions, usage events. They process data only to provide that service to us.
- Cloudflare hosts our server and its database. Like any web host, it handles the network connection, including your IP address, and keeps short-lived request logs for operating and securing the service.
- Resend delivers the emails, including the attachments. It may keep delivery records under its own privacy policy.
Once an alert reaches your inbox, it is held by your own email provider like any other email.
We do not sell your data, share it for advertising, or give it to anyone else, unless the law requires us to.
Security
Everything sent between the app and our server is encrypted in transit (HTTPS). The app holds no password or key that could be used to send email; only our server can.
Your choices
- Remove your email address in Settings → Email alerts. This deletes your address, installation identifier and phone name from our server immediately. Rate-limit records expire on their own after about 30 days.
- Usage events (test versions only) stop when you leave the test or uninstall the app. Because they are not linked to you, we cannot pick out yours to delete them early; they expire on their own after about 30 days.
- Delete captures in the app's Evidence screen.
- Revoke camera access at any time in your phone's settings. The app cannot capture anything without it.
- To ask about or delete any other data, email djackson@invisionthat.com.
People who are photographed
The app captures whoever picks up the phone. It is intended only for protecting a phone you own. It records video without sound, because recording someone's voice without consent is unlawful in many places. You are responsible for using it lawfully where you live. Using it to monitor another person is not permitted.
Children
The app is not directed at children under 13, and we do not knowingly collect their information.
Changes
If this policy changes, we will update the effective date above, and for significant changes we will say so in the app.
Contact
Dante Jackson · djackson@invisionthat.com