Privacy Policy for Authentic Cam
Effective date: 1 November 2026 App: Authentic Cam (Android package com.skartys.c2pacamera) Developer: Nomdic Apps ("we", "us") Contact: skartys.dev@gmail.com
Authentic Cam is a camera that stamps photos and videos with the time, place and map where they were taken, and signs them with Content Credentials (C2PA) so that later changes can be detected. This policy explains what information the app uses, why, who else receives it, and the choices you have.
In short: your photos, videos and exact location stay on your phone. We run no servers and have no accounts. A small amount of usage and crash data goes to Google (Firebase), and, if you have not paid to remove ads, Google AdMob shows ads after asking for your consent where the law requires it.
1. Information the app uses
Camera, microphone and storage
- Camera and microphone. Used only to take photos and record videos (with sound, if the sound option is on). Nothing is recorded in the background.
- Your photos and videos. They are saved to your phone's gallery and can be viewed, shared or deleted in the app. We never upload them to our servers, and we cannot see them. They leave your phone only when you share them.
Location
- Precise and approximate location. Used while the camera is open to write the coordinates, address and a map onto your photos and videos. You can turn the location overlay off in Settings, and you can refuse or revoke the location permission in your phone's settings; the camera still works without it.
- Your location is not sent to us and is not stored by us. It is embedded in the images you create. Think about this before you share them: anyone who receives a stamped photo can read the place in it.
- Two third-party services receive a request when a location is stamped:
- Address lookup uses Android's built-in geocoder, which may send the coordinates to Google's location services to find the address.
- Map pictures are downloaded as tiles from OpenStreetMap (
tile.openstreetmap.org). The request contains the map area (which is near your location), your IP address and the app's name, and is handled by the OpenStreetMap Foundation under its own policy.
Usage and diagnostics (Firebase)
We use Firebase Analytics and Firebase Crashlytics (Google) to learn which features are used and to fix crashes. This includes:
- Events such as opening the camera, taking a photo or video, switching the lens, changing a setting, opening the gallery, and whether a permission was granted. Events contain no coordinates, addresses, file names, photos or free text.
- Whether signing a photo or video worked and, if not, a short reason, roughly how large the file was and how long it took (in wide ranges such as "under 5 MB" or "1 to 3 seconds"), whether the timestamp authority answered, and which kind of secure hardware (StrongBox, the trusted execution environment, or software) holds the signing key on your phone, and whether private capture was on. These contain no file names, photos, locations or the device's signing certificate id.
- Crash and error reports: the error and its stack trace, device model, Android version, app version, and settings in use at the time.
- Technical identifiers Firebase generates for the app installation, and approximate region derived from your IP address.
Ads (Google AdMob)
If you have not purchased "Remove ads", the app shows ads from Google AdMob. AdMob may collect your advertising ID, IP address, device and app information, and ad interactions to deliver and measure ads and prevent fraud.
- In the European Economic Area, the United Kingdom and some other regions, the app first shows Google's consent form (Google User Messaging Platform). No ads are requested until consent allows it. You can change your choice at any time in Settings → Ads → Privacy options (shown where required).
- You can reset or delete your advertising ID, or opt out of ad personalisation, in your Android settings (Settings → Privacy → Ads).
- Ads are never shown on the camera screen, and they are not shown at all if you buy "Remove ads".
Purchases
"Remove ads" is a one-time purchase handled by Google Play Billing. We never see your payment details. The app keeps a simple on-device flag that you have paid, so ads stay off without a connection.
Content Credentials and timestamps
Photos are digitally signed on your phone (the C2PA "Content Credentials" standard) so that later changes can be detected. Videos can be signed afterwards when you choose to; the signed record then says it was signed after it was recorded. The signature uses a key kept in your phone's secure hardware and a certificate that includes a random identifier for this installation, such as "Authentic Cam device 3f2a9c10". That identifier is stored inside each signed photo, so anyone you share a photo with can read it. It does not contain your name or contact details, and it changes if you reinstall the app. The signed record also notes when the photo was taken, which lens and flash setting were used, and, if the photo has a location, the same GPS position that is in its metadata.
When your phone is online, a fingerprint (hash) of the signature, not the photo, its location or anything personal, is sent to an independent timestamp authority (DigiCert, timestamp.digicert.com) so that the time can be confirmed by someone other than your phone's clock. The request is sent over plain HTTP, as is usual for timestamp services, so it is not encrypted; it contains only that fingerprint. The authority receives your IP address with the request. Offline, or if the authority does not answer within a few seconds, the photo is signed without it and the app says so in the photo's details.
Private capture. If you turn on private capture in the camera, the place, the time of capture and the device details are left out of the photo or video and of its signed record. The installation identifier above is still part of the signature, and the timestamp authority still receives your IP address.
2. What we do not do
- We do not create accounts or ask for your name, email or phone number.
- We do not sell your personal information.
- We do not upload your photos, videos or location to our own servers.
- We do not track your location in the background.
3. Why we use information (legal bases)
- To provide the camera and its overlay: performing the service you asked for.
- To sign your photos and videos with Content Credentials and confirm their time: performing the service you asked for.
- To measure usage, fix crashes and keep the app working: our legitimate interest in running a reliable app.
- To show personalised or non-personalised ads where you have consented, and otherwise as the law allows.
4. Sharing
We share information only with the service providers described above, acting under their own terms: Google (Firebase, AdMob, Google Play, Android location services), the OpenStreetMap Foundation and DigiCert (timestamps). We may also disclose information if the law requires it.
5. Retention and deletion
- Photos, videos and settings stay on your device until you delete them or uninstall the app.
- Analytics and crash data is kept by Firebase for the retention periods configured in Firebase (event data is held for a limited time, up to 14 months). It is not linked to your name or contact details.
- Ad data is handled by Google under its privacy policy.
- To remove app data from your phone, uninstall the app or clear its storage in Android settings. To ask about data we may hold, contact us at the address above.
6. Your choices and rights
- Refuse or withdraw the camera, microphone or location permissions in your phone's settings.
- Turn the location overlay off in the app's Settings.
- Change or withdraw ad consent in Settings → Privacy options, reset your advertising ID in Android settings, or remove ads with the purchase.
- Depending on where you live (for example the EU/UK under the GDPR, or California), you may have the right to access, correct, delete or restrict the use of your personal data, to object to its use, to withdraw consent, and to complain to your data protection authority. Because the app does not identify you, we may need additional information from you (such as the installation identifier) to act on a request. Contact us at the address above.
7. Children
The app is not directed at children under 13 (or under 16 where that is the age of digital consent), and we do not knowingly collect their personal information. If you believe a child has provided information, contact us and we will help remove it.
8. Security
Your media stays in your device's storage under Android's protections. Data sent to Firebase, AdMob and OpenStreetMap travels over encrypted connections; the timestamp request is the exception described above. No method of storage or transmission is completely secure.
9. International transfers
Google, the OpenStreetMap Foundation and DigiCert may process data in countries other than your own, including the United States. They apply their own safeguards, such as standard contractual clauses.
10. Changes
We may update this policy. The effective date above will change, and for material changes we will say so in the app or on the store listing.
11. Contact
Nomdic Apps
skartys.dev@gmail.com
Third-party policies: