Camera privacy · updated October 12, 2026

Your devices.
Your recordings.

This policy describes Zurcit’s camera app and account services. The earlier spam-reporting prototype policy is preserved separately and is not part of this camera build.

Local camera and detection

The app uses the camera while you arm it and keep it open. Apple Vision checks smaller frames for selected people, dog, and cat detections on the device. A bundled compact Core ML model checks selected vehicle types (cars, trucks, motorcycles, and bicycles); general movement uses local frame comparison. Detection choices are saved on each camera device. We do not identify faces or people and do not send continuous frames to an AI service. Local detection events contain a snapshot, silent video clip, detector score, detection category, timestamp, and delivery status. Local history is limited to 100 events, 500 MB, or seven days, with cleanup when the app runs. Rolling temporary footage is deleted when monitoring stops or the app next launches.

Optional continuous recording on the camera

Zurcit can save silent continuous video locally while armed. Enable Camera → Continuous recording before arming. The default history is retained until the 4 GB storage limit; you can choose 1, 4 or 8 GB or an eight-hour rolling history. Recordings are retained until the storage limit instead of a fixed time. Oldest footage is overwritten at the selected limit, and at least 500 MB of free space is reserved. Completed recordings survive disarming, sign-out and app relaunch. Local files are excluded from iCloud/device backup and separated by the account’s camera registration. Signing into another account does not erase or expose them. Play footage on its camera without opening the camera preview; recording dates use the viewing device’s time zone. Interruptions leave gaps. Scout continuous footage stays on the camera. Guardian automatically backs up completed recording sections to private, encrypted S3 storage while Zurcit is active. Backed-up footage can be reviewed while the source camera is offline. Uploads must finish first. Continuous backups are separate from cloud event history, are not emailed, and use the camera’s selected 1, 4 or 8 GB limit and rolling-history setting. Backup access has a maximum of 184 days; oldest backups are removed sooner when the selected storage or eight-hour loop limit is reached. Temporary incomplete uploads use one-day cleanup. Delete all recordings or delete your account on the camera to erase its continuous history. Offline-device copies must be removed on those devices.

Accounts and devices

Sign-in uses Amazon Cognito over HTTPS. Where enabled, you can continue with Google or Apple using the provider’s verified email instead of typing it. Apple can supply a private relay email when you choose Hide My Email. Cognito links a stable provider identifier to your Zurcit account; Zurcit does not receive your Google or Apple password or request access to your inbox, contacts or photos. Email and password remain available. Zurcit stores your verified email address, account identifier, camera names and types, device identifiers, connection status, and hashed device/viewer credentials in AWS. The native app stores sign-in and device tokens in the device Keychain; it does not store your password. The web dashboard holds access tokens in memory and a refresh token in browser session storage so you can return to the dashboard in the same tab. Sign-out removes it; closing the tab normally clears it, although browser session restoration can preserve tab storage. No password is stored. An account is required to access the app. Detection still runs locally on your camera device.

Optional camera locations and maps

In Devices, you can save a place name, a GPS or manually positioned pin, a camera-facing direction, and a viewing cone. GPS permission is requested when you enable location for this device or request a foreground location update. Turning off the location switch prevents remote location requests; remove the saved location separately to delete its map pin. This requests one foreground location fix; Zurcit does not track your location in the background. Saved locations are linked to your account and stored privately in AWS. They remain at the saved position until you update or remove them. Viewing cones are user-set placement guides, not measured detection coverage. Apple Maps provides map tiles and place searches; search queries and map requests go to Apple. Remove a saved location in Devices, or delete the camera or account to remove it.

Event emails and cloud storage

When cloud event history is active for your account, detection photos and short clips upload to private, encrypted AWS S3 storage. Scout keeps new cloud events for 30 days and Guardian for six calendar months. The server chooses the period from your verified plan when an event is captured. Existing events retain their original expiry when you change plans. Private-test events have seven-day history. Free includes only low-resolution live viewing and on-camera motion indication for two cameras. It does not save events or recordings, or send cloud alerts. Access ends at the event’s retention deadline; an hourly cleanup removes expired media and S3 lifecycle rules provide additional cleanup. Physical S3 and DynamoDB removal is asynchronous. Amazon SES sends a snapshot attachment and an expiring clip link to your verified address if email alerts are enabled. New event emails open a private Zurcit player using a random link that lasts up to 24 hours and never beyond the recording’s expiry. Only a hash of the link key is stored. Deleting the recording, camera, or account disables access. Anyone holding a private evidence link can view that evidence until expiry or deletion. Delivered attachments and email copies remain with the recipient.

Subscriptions and purchase records

Apple handles subscription checkout and payment details. Zurcit verifies Apple-signed transactions and stores the product, purchase and expiry dates, transaction identifiers, store environment, and an account-bound purchase token to apply your plan. Zurcit does not receive your card information. A minimal one-way purchase-to-account binding is retained to prevent a restored purchase being transferred to another account; it does not contain email or footage. Account deletion removes active billing-account lookup and account license records. Apple keeps its own purchase records. Administrator-approved complimentary Guardian accounts do not require a subscription. If an account already has an Apple subscription, complimentary access does not cancel that subscription. Manage or cancel it separately with Apple.

Live video and speaker audio

Live view, Talk, and remote arming are controlled by a switch in Devices. This starts on for new app setups; you can turn it off there. Existing saved off choices stay off. Access is limited to your account-authorized viewers or holders of your private viewer links. Remote Arm can open the camera when camera permission is already allowed and Zurcit is in the foreground; commands expire after 30 seconds. The Events screen shares stored events from all your cameras and can open several camera-wall streams at once. Talk sends microphone audio to the selected camera, or all connected cameras when you explicitly choose Broadcast. Starting with version 0.1.1, compatible cameras and app or website viewers first try encrypted direct WebRTC video. Network addresses and short-lived connection details pass through authenticated AWS signaling; authorized peers receive the information needed to connect. Google-operated STUN servers receive network addresses to discover the direct path, but do not relay video. If a direct path fails, or a viewer needs the older player or TV playback, the camera uploads short HLS video segments to private AWS storage. A working direct-only session pauses this live-video upload. A mixed group of viewers can keep one shared fallback upload active. Direct connections are rechecked and can return from fallback automatically. Signaling records expire quickly; physical database cleanup is asynchronous. Event photos, clips and recording backups follow their existing storage settings independently. Fallback video has several seconds of delay. Microphone access on the viewing phone, Mac, or browser is requested only when you tap Talk. Mono voice packets pass through AWS to the camera speaker; the camera can also capture room audio after you enable Allow live room audio and grant microphone permission. Capture runs only while the camera has a live viewer and Zurcit remains in the foreground. Native views start muted; Listen plays sound from one selected camera. Room audio passes through authenticated AWS requests as bounded half-second mono packets. At most two current packets are kept in the active live-session record; stale packets are not returned after three seconds, and session expiry or deletion removes the record. Room audio is not stored in S3, sent in emails, or added to event clips. Browser and TV feeds currently remain silent. Voice packets are not included in event clips. Voice and sound-command records expire after 30 seconds, with DynamoDB removal occurring asynchronously; leaving a viewer connection preserves a shared stream for other viewers. When the last viewer leaves, or the camera stops a failed stream, its command records and live video objects are deleted. Interrupted or expired sessions can leave temporary media in private storage until lifecycle cleanup. Live-session links and controls are private credentials: keep them private.

Temporary helper access

You can create a private, single-use invitation for selected cameras. A guest needs the Zurcit app but no account or subscription. Invitations last 15 minutes to seven days; the app currently offers one hour, four hours, 24 hours, and seven days. Guests can view live video, enabled room audio, and recordings created after sharing begins. You can separately allow Talk and alarm sounds. Guests cannot delete recordings, change device settings, or arm/disarm cameras. A guest session contains a random access credential stored in the device’s Keychain; AWS stores its hash, selected camera identifiers, helper label, permissions, and expiry. Access is checked on every request. Expiry ends the guest session; early revocation closes an online guest screen on its next check. Short-lived media links can remain usable for up to 15 seconds after revocation, and already downloaded or captured content cannot be recalled. Account deletion removes invitations and guest registrations. Unclaimed invitations and expired access records are removed asynchronously by AWS expiry cleanup. Guest event updates currently require the app to be open; background guest push alerts are not included.

Home Screen camera widget

On iOS and iPadOS 17 or later, the optional widget shares camera names, identifiers, last-reported monitoring status, an account marker, and a short-lived Arm or Disarm request with the Zurcit app through its private App Group. Account tokens and passwords are not shared with the widget. Buttons open Zurcit to validate the account and send the request. Sign-out clears the widget data. Its displayed status can be out of date.

Direct Wi-Fi and live event updates

When both native devices are on the same Wi-Fi and Local Network access is allowed, Zurcit can send encrypted camera images directly between them. AWS issues one-use, short-lived viewing credentials to your signed-in account; local discovery does not broadcast those credentials or footage. The internet feed remains available for different networks and TV playback.

An authenticated live connection sends new-event notices to devices signed in to your account while the app is open. Notices contain camera and event identifiers; the app retrieves recordings through your authenticated account. Optional new-event chimes are a setting on each viewing device. If you enable Apple push notifications, Zurcit registers a notification identifier through Amazon SNS and Apple Push Notification service. Push alerts contain only a generic activity message and camera/event identifiers, with no photos, private footage links, or location. Enable or disable push on each viewing device in Account → Event alerts. Use Devices to turn email and push alerts on or off for each camera from any signed-in device. Notification registrations are removed on connected sign-out or account deletion and expire after 90 days without renewal. Camera devices also share their battery level and charging status. A remote location update uses location permission previously granted on the camera while Zurcit is open; it does not enable background tracking.

Delete recordings, devices, and your account

Use Devices → settings gear → Delete all recordings, or delete an individual event. Use Devices → Remove device to revoke a camera and delete its AWS recordings. Use Account icon → Delete account and recordings, or the web account dashboard, to delete your whole sign-in account, registered camera connections, private viewer access, device records, and cloud evidence. Deletion is available to every account holder and does not require a support email or phone call. Confirming account deletion erases only the deleted account’s recordings and credentials on the requesting native device. Other accounts’ local recordings and saved camera connections are preserved. An optional deletion reason is never required.

If a device is delivering an event, deletion asks you to wait and retry after that operation finishes. A minimal record of the deleted account identifier and revocation state remains for one day to reject previously issued sign-in tokens; its TTL cleanup is asynchronous. It contains no email, device name, or footage. Recordings already stored on offline devices and delivered email attachments cannot be remotely removed from those copies. Erase those through the relevant device or mailbox. Deleting your Zurcit account will not cancel Apple billing. Cancel a subscription separately in Apple’s subscription settings. Refund requests are managed by Apple.

Customer numbers and service emails

Verified accounts receive a unique customer number and a one-time welcome email. Support receives a new-account notice with the verified email, customer number and active account count. Deletion removes the active customer-number record and decreases that count. Numbers are never reused. A deletion notice to support contains the departed number and remaining count, without the deleted email address. Optional deletion reasons are retained only as anonymous aggregate counts, without account identifiers, numbers or emails. A hashed notification record is retained for up to 30 days to prevent duplicate notifications and retry delivery. Delivered support emails remain in the support mailbox. These messages support account administration and are not advertising.

Authorized account administration

Authorized Zurcit staff can create and verify accounts, help with password resets, enable or disable access, and issue or remove complimentary plan access. The administration portal reports account status, customer numbers, plan access, and device health; it does not provide access to camera photos or video.

Administrative changes record the administrator username, time, affected account identifier and email, action, and a short reason. These limited security and support records are retained for approximately 13 months, including after account deletion. They contain no passwords, camera media, precise camera locations, or payment-card details. Newly generated account-setup passwords are shown once to the authorized administrator and are not stored in the administrative audit log. Existing customer passwords cannot be retrieved by staff.

No advertising or data sales

Zurcit does not include advertising, analytics SDKs, cross-app tracking, or sale of your data. AWS is the cloud processor for authentication, private storage, delivery, and remote relay. Service diagnostics are retained for seven days. AWS notification delivery diagnostics can include a device notification identifier and Apple’s delivery response. Application code does not log passwords, authentication tokens, private media, or signed evidence URLs.

Permissions and control

Camera permission enables monitoring. Alarm and speaker playback use the device’s output volume. Microphone permission is requested for Talk on a viewing device, explicitly enabling live room audio, or optional local voice keyword alerts on the armed camera. Speech-recognition permission is also requested when you enable voice keywords. You can turn off monitoring, email connection, or live controls at any time. Zurcit is not an emergency monitoring service.

Dim screen protection

Starting with version 0.1.1, optional Dim & lock covers Zurcit’s camera controls and saved recordings until device-owner authentication succeeds. Apple’s LocalAuthentication handles Face ID, Touch ID or your device passcode/password; Zurcit does not receive, store or upload biometric data or passcodes. The setting and active-lock flag stay on the device. Entering this app lock does not stop camera capture. iOS backgrounding or camera interruptions can still pause monitoring; this feature does not replace Guided Access or the device’s own security controls.

Optional voice keyword alerts

Starting with version 0.1.1, you can opt in to recognizing saved phrases such as “help help” while your camera is armed and Zurcit is open. Microphone and speech-recognition permission are required. Recognition runs only on devices and languages supporting on-device speech, with no server recognition fallback. Audio and temporary recognized words are processed in memory and discarded; keyword processing does not save or upload them. Your configured phrases and settings stay locally with that registered camera. Any speaker or recorded sound can match; this does not identify a person’s voice.

A match saves the usual camera photo and silent video clip, marked as a voice-keyword event, with the normal retention, deletion, email and push preferences. The matched words and microphone audio are not included. Keyword listening does not turn on remote room audio; if you separately enable remote listening or Talk, those features follow the audio handling described above. Disarming, signing out, changing cameras or backgrounding stops keyword listening. Noise, distance, recognition interruptions and permissions can prevent matches; test the setup on your device.

Optional person monitoring

Starting with version 0.1.1, optional person monitoring can alert when a previously confirmed person count decreases for your chosen delay. It reports “Person no longer visible”; hiding, occlusion or missed detections can also cause that condition, and it does not confirm someone left the room or identify a particular child. A new person entering while someone else leaves can keep the count unchanged. A separate marked-doorway crossing mode remains available. Settings stay locally with that camera and temporary detection counts/geometric tracks are processed on device. The saved event records its trigger and follows the usual photo, silent clip, retention, deletion, email and push preferences. Keep a fixed, adequately lit camera view and test the setup.

Camera settings and schedules

Camera names, saved placement notes, detection choices, recording limits, alert preferences and Guardian arming schedules are associated with your account. Schedules store the selected weekly hours and time zone so an active camera can apply them. Battery, connection and control status support device management. Delivery diagnostics help investigate failed notifications; they are not used for advertising or tracking.

Contact

Questions or privacy requests: support@zurcit.com.