Privacy policy

The VCAP app for Android (com.gregoriogalante.vcap) and the web console at console.vcap.gregoriogalante.com. Last updated 10 November 2026.

Who is responsible

The app, the console and the service at api.vcap.gregoriogalante.com are run by Gregorio Galante. Contact: vcap@gregoriogalante.com.

If you join an organization in the app, that organization decides what it does with the captures you send it, and is responsible for that data alongside us.

The app

What stays on your phone

Photos and videos you take, their proofs and the signing key never leave the phone unless you choose to send a capture. The signing key is created in the phone's secure hardware where it has one and cannot be exported. You can delete captures in the app at any time.

There is no account: the app never asks for your name, email or phone number. It contains no advertising, analytics or crash-reporting SDK and does not read your advertising ID.

Permissions

• Camera and microphone: to take photos and record videos with sound.
• Location (precise or approximate, as you allow): off by default. Only if you turn it on, the position at the moment of capture is signed into the capture's proof. Never collected in the background.
• Notifications and foreground service: to finish sealing a long video if you leave the app.
• Network: to talk to our service when you join an organization or send a capture.

What is sent, and only when you act

Joining an organization (or the open demo): the organization identifier or code, the app's package name, your consent, the device's public signing key and the hardware attestation of that key. The service assigns the device a pseudonymous identifier.

Sending a capture: its proof — cryptographic hashes, signature, signing key identifier, device clock and, only if you turned it on, location — with the app version and a Google Play Integrity token. The photo or video itself is uploaded only if the organization stores originals and you choose to send it; depending on the organization, it is encrypted on the phone with the organization's key or sent as is.

As with any connection, our server sees your IP address. All traffic is encrypted with HTTPS.

Who else receives data

• The organization you joined sees the captures you sent, their proofs, the device pseudonym and when it joined.
• Anyone with a copy of a sealed file can read its proof, including the location if you added it.
• Timestamp authorities (FreeTSA, DigiCert) receive only a 32-byte hash of each proof.
• A public blockchain (Base Sepolia, a test network while VCAP is in development) receives only a hash summarising a batch of proofs. Nothing on it identifies you or a capture's content.
• Google processes the Play Integrity check under its own privacy policy.
• Hosting: servers run by Hetzner in the European Union.

We do not sell data or use it for advertising.

The web console

Checking a file, without an account

On Check a file the file is checked in your browser and never uploaded. The page asks our server only for the public record of the capture the file names, and your browser reads blockchain anchors directly from a public Base node (sepolia.base.org). Public capture pages show what the capture's proof contains; where it includes a position, the map is drawn from OpenStreetMap tiles that your browser fetches from OpenStreetMap.

If an organization sends you a link to answer a request with a photo or video, the file you upload is verified and then discarded: we keep the verdict and the file name, not the file. The request link itself is stored only as a hash.

Accounts

Accounts are for people working for an organization. We store your email address, a hash of your password (never the password), your two-factor secret if you turn it on (encrypted), the organizations you belong to and your role in each. If you sign in through your organization's identity provider, we receive your email address from it. Each sign-in records the IP address and browser of that session. Actions that change an organization's data are written to an audit trail with the account that made them; it never contains passwords or two-factor secrets.

The console uses only the cookies it needs to keep you signed in and to complete a sign-in: no advertising or analytics cookies, no trackers, no third-party scripts. That is why it shows no cookie banner. Emails are sent only for invitations and password resets.

Organizations' captures

Captures that phones send to an organization belong to that organization, which decides who among its members can see them and how long they are kept (deleted automatically when that period ends). Originals are stored encrypted with a key that only the organization holds, so we cannot read them, or readable, if the organization chooses so; VCAP staff can access readable originals to operate the service. Each download of an original is recorded in the audit trail.

Servers

Server logs record the IP address and the address requested; they are rotated by size and overwritten. Backups of the database are kept for seven days. Everything runs on servers in the European Union (Hetzner, Helsinki).

How long it is kept

For the app, each organization sets a retention period, shown to you before you join; the app only joins organizations that delete data when it expires. The open demo keeps proofs and originals for 30 days. Hashes already written to the public blockchain cannot be removed, but they reveal nothing on their own.

A console account, with its sign-in records, is kept while it exists. The audit trail of an organization is kept even after the organization closes, because it is the record of who did what.

Your choices and rights

You can leave an organization in the app at any time, which deletes the enrolment and keys on the phone. To have data already sent deleted earlier than its retention period, or to exercise your rights of access, rectification, erasure, restriction, objection and portability under the GDPR, write to vcap@gregoriogalante.com with the capture identifiers shown in the app. To have a console account deleted, write to the same address from that account's email. You can also complain to your data protection authority (in Italy, the Garante per la protezione dei dati personali).

Children

The app is not directed at children under 16.

Changes

We will update this page and its date when this policy changes. An organization's consent text is versioned and shown again in the app when it changes.