Custos Privacy Policy

Last updated: October 6, 2026

Custos (the "App") is developed and maintained by Spock Hsueh. It turns two iPhones or iPads into a monitor for a baby, a pet, or an elderly family member: one device is the camera, the other is the viewer you carry with you. Because the App handles a live camera and microphone feed of your home, we designed it so that the video and audio never leave your control.

The short version. Live video and audio are never uploaded to us — we operate no server that can view your camera. Event Clips are saved only on the camera device, and are sent only to your own viewer devices when you open them, always encrypted. On your home network the live feed travels directly between your devices; when you are away it travels over an end-to-end encrypted connection, and the relay server that may forward it can only see encrypted bytes.

1. Information We Collect

1.1 Camera and Microphone (Live Feed Never Stored by Us)

The App requires camera and microphone access on the camera device to function. The live feed is:

Never uploaded to our servers or any cloud storage — we operate no video infrastructure
Transmitted only to your own paired viewer devices, and only while someone is watching
Not recorded, except for the optional Event Clips and overnight time-lapse described in 1.2

1.2 Event Clips and Overnight Time-Lapse

When an alert happens (for example crying or a possible roll-over), the App saves a short clip covering about 30 seconds before and after it, so you can review what happened. It can also save an overnight time-lapse. Formats:

Outline (on by default): a low-resolution character-grid animation that shows movement and posture but contains no recognizable image of a person. The overnight time-lapse always uses this format.
Video (Plus plan, off by default): the full camera image, without audio
Off: nothing is saved, and existing clips are deleted

Clips are:

Stored only on the camera device that recorded them — never uploaded to us, never stored on any server
Sent to your own viewer device only when you open one, over the same encrypted connection as the live feed. Video clips can only be opened on the same home network. Outline clips can also be opened when you are away; in that case they may pass through the encrypted relay described in section 3, which cannot read them.
Automatically deleted according to your plan and the retention period and storage limit you choose (1 hour on Standard; up to 30 days on Plus; 200 MB / 500 MB / 1 GB). The overnight time-lapse is kept for 48 hours.
Deletable at any time in Settings, or by uninstalling the App

1.3 On-Device Analysis (Never Leaves the Device)

To detect crying, barking, meowing, calls for help, movement, possible falls, and sleeping position, the App analyzes the camera and microphone feed entirely on the device using Apple's built-in Vision and SoundAnalysis frameworks. No images, audio, or biometric data are sent anywhere for analysis. Only the conclusion (for example, "crying detected at 02:13") may be shared as described in section 1.5.

The App does not perform facial recognition or identify individuals. Face detection is used solely to determine whether a face is visible in frame, which powers the "may have rolled over" alert.

1.4 Account Information

The viewer signs in with Sign in with Apple. The camera device and invited guests do not sign in; they receive a limited credential from your viewer. Through Google Firebase we store:

A Firebase user ID
Your name, if you choose to share it with Sign in with Apple
Your family pairing code, so your other viewer devices can join automatically. Only a one-way hash of the code is used for pairing; the code itself is readable only by your own devices.
The list of your paired devices (device name and a random device identifier) and guest invitations
Push notification tokens for the devices that should receive alerts
Your subscription tier (Standard or Plus), so your other devices and our relay quota know which features apply. Payment is handled entirely by Apple; we never see your payment details.

We do not request your email address or phone number through sign-in.

1.5 Alert Metadata

To deliver notifications to your family, the App records short event entries:

Event type (crying, barking, large movement, left the safe zone, possible fall, and similar)
A confidence value, the camera device's name, and a timestamp

These entries contain no images and no audio — they are the textual equivalent of "crying detected at 02:13."

1.6 Connection Data

To establish an away-from-home connection, the devices briefly exchange technical connection descriptors (WebRTC session descriptions and network candidates, which include your devices' IP addresses). These records are deleted as soon as the connection is established and contain no media. We also keep a monthly total of how much relay traffic your account used, so we can enforce the relay quota of your plan.

1.7 Feedback You Send Us

If you send feedback from the App, we receive your message, the email address you choose to enter (optional), your app version, device model, system version, app language, role, plan, and Firebase user ID. We use this only to respond to you and fix problems.

1.8 Diagnostic Data

Firebase Crashlytics: crash reports (stack traces, device model, iOS version)
Firebase Analytics: anonymous aggregate usage (app launches, screen views, feature usage) — never includes camera, audio, or alert content
Diagnostic logs you upload: the App keeps a technical log on your device (connection state, detection values, temperature, frame rate). It is sent to us only if you tap Upload in Settings, so we can investigate a problem you reported. It contains no images or audio. Uploaded logs are stored in Firebase Storage under a support code derived from your account.

1.9 What We Do Not Collect

Any recording, still image, or audio clip of your child, pet, or home on our systems
Phone number, location data, contacts, or photo library access
Facial recognition data, biometric identifiers, or health data
Advertising identifiers — the App contains no ads and no third-party trackers

2. Where Your Data Lives

Data Type	Storage / Path	Can We Access?
Live video & audio	In transit only — direct between your devices, or end-to-end encrypted relay	❌ Never uploaded, never viewable by us
Detection analysis	On device, in memory	❌ No
Event Clips & overnight time-lapse	The camera device's own storage; sent encrypted to your viewer only when you open one	❌ No
Safe-zone settings & preferences	Local device	❌ No
Account, family pairing code, device list, guest invitations, push tokens, subscription tier	Google Firebase	✅ Yes — technical records, no media
Alert metadata	Google Firebase	✅ Yes — event type & time, no media
Feedback & uploaded diagnostic logs	Google Firebase (only when you send them)	✅ Yes — no media
Encrypted relay traffic (away from home)	Cloudflare TURN — forwards encrypted bytes, retains no content	❌ Encrypted; not readable by us or Cloudflare
Crash & anonymous usage reports	Google Firebase	✅ Aggregate only

We do not operate our own media server. No video or audio from your home is ever stored on, or backed up to, any system we control.

3. How Your Video Is Protected

At home: the devices connect directly over your local network. The connection is authenticated with an 8-character family code, shown on the viewer and entered once on the camera, and encrypted with ChaCha20-Poly1305, so other devices on the same Wi-Fi cannot connect or eavesdrop.
Away from home: the connection uses WebRTC with DTLS encryption. If the two networks cannot connect directly, traffic is forwarded by a Cloudflare TURN relay, which can only see encrypted bytes — not your video, audio, or clips.
Access control: only devices you paired with your family code, and guests you invited, can connect. Guests can watch and receive alerts but cannot change settings, open Event Clips, or use two-way talk.

4. Third-Party Service Policies

The App uses the following third-party services. Please refer to their privacy policies for details:

Apple (Sign in with Apple, push notifications, in-app purchase): apple.com/legal/privacy
Google Firebase (Authentication, Firestore, Cloud Functions, Cloud Storage, Cloud Messaging, Crashlytics, Analytics): firebase.google.com/support/privacy
Cloudflare (TURN relay): cloudflare.com/privacypolicy

5. Children's Data

While Custos is used to watch over infants and young children, the App is not directed at children. Its users are caregivers — parents, grandparents, and other adults. The camera is operated by you as the legal guardian, and the resulting video is never transmitted to us. Event Clips remain on your own devices.

The App does not:

Upload, transmit, or retain on our systems any imagery or audio of a child
Perform facial recognition or build any profile of a child
Share any data with advertisers or data brokers — the App contains no advertising
Use any data about your child for training, analytics, or commercial purposes

Under COPPA (U.S. Children's Online Privacy Protection Act) and GDPR-K guidelines, Custos is classified as a "parenting tool" rather than a children's service.

6. Your Rights

Delete your account in the App: Settings → Delete Account. This permanently deletes your account, family pairing code, device list, guest invitations, alert history, uploaded diagnostic logs, and feedback from our systems, and revokes your Sign in with Apple authorization. Deleting your account does not cancel your subscription; manage that in your Apple Account settings.
Revoke camera or microphone access: iOS → Settings → Custos — the App stops capturing immediately
Sign out: Settings → Sign Out removes this device's push token
Stop notifications: disable notifications for Custos in iOS Settings
Turn off or delete Event Clips: Settings → Event Clips → Off (which also deletes existing clips)
Delete local data: uninstalling the App removes all data stored on that device, including Event Clips and logs
Other requests: to access or correct your data, contact us at the address below

7. Data Retention

Live video and audio: never retained — discarded immediately after display
Event Clips: kept on the camera device only, deleted automatically per your plan, retention period, and storage limit; time-lapse after 48 hours
Connection setup records: deleted as soon as the connection is established
Account, device list, alert metadata, relay usage totals: kept until you delete your account
Feedback and uploaded diagnostic logs: kept until the issue is resolved, and deleted when you delete your account
Crash & anonymous usage reports: per Google Firebase default policy (auto-deleted after 14 months)

8. Security

Home-network connections are authenticated with the family code and encrypted with ChaCha20-Poly1305
Away-from-home connections are encrypted with DTLS; relay servers cannot decrypt the contents
The family code is stored in the iOS Keychain on your devices
Access to account data is enforced by server-side security rules — each account can only read its own records, and camera and guest devices only get the access they need
All communication with Firebase and Cloudflare is over HTTPS/TLS

9. Changes to This Policy

If we make material changes to this policy, we will update this page and revise the "Last updated" date. For substantive privacy changes (such as adding a new third-party service), we will display an in-app notice.

10. Contact Us

For any privacy questions or to exercise your data rights, including account deletion, please contact:

📧 spock.hsu@gmail.com