Clear boundaries for camera data.

At a glance

The public website contains no analytics or advertising scripts. It does not offer a sign-in form. Never send credentials, pairing codes, Recovery Kits, or camera media to a support channel. A complete WT-RK1 Recovery Kit belongs only in the Watchtower app's Redeem a Recovery Kit screen when recovering access, or at https://watchtowerhome.com/account-deletion/ when you personally choose permanent deletion. Check the address bar before entry. Both flows verify the kit locally. The account deletion page sends only the recovery method identifier and a one-time signature—never the kit's private key—and stores only a random retry identifier in this browser.

Data the service handles

The exact data depends on the features a preview participant chooses to use. The current service may handle:

• Account and Space data, such as chosen display names, Space names, time zone, memberships, roles, invitations, and authorization revisions.
• Device and security data, including generated identifiers, public keys and fingerprints, device labels, pairing and recovery state, permissions, and revocation status.
• Service metadata, including camera and alert identifiers, timestamps, media format and ciphertext size, authorization and access records, and network or rate-limit metadata needed to operate and protect the service.
• Activity and detected-motion metadata, including live-session and security-action history, detected-motion occurrence and time, encrypted-asset digests, and access state. These records can be linked to an account, Space, camera, or enrolled device.
• Optional motion-push registration data, including a provider installation endpoint sealed at rest, the APNs or FCM provider and environment, app identifier, device fingerprint, registration state, and delivery timing and status.
• Camera health, meaning battery level, power state, network connection type, and the time of the last report, when an enrolled camera reports its current owner-visible status.

The current account model does not rely on password, email, SMS, or support-assisted recovery. Recovery Kits and device-bound keys are sensitive. WatchtowerHome administrators should never ask a participant to disclose or paste secret material into a support message. A participant may enter a complete WT-RK1 kit only in the Watchtower app's Redeem a Recovery Kit screen to recover access, or at https://watchtowerhome.com/account-deletion/ when personally initiating permanent deletion. The browser sends only a method identifier and one-time cryptographic proof.

Live and event media follow different paths

Live view and talk

Live camera audio and video use encrypted WebRTC transport between authorized devices. When a direct connection is not possible, encrypted traffic may pass through the WatchtowerHome TURN relay. The current backend does not provide continuous cloud recording of a live session.

Media encryption does not hide all connection metadata. Depending on the relay transport, network operators may observe connection addresses and relay session identifiers in transport-control messages. This is different from access to camera video or audio.

Media saved on a device

Snapshots, manual recordings, motion evidence, event clips, and rolling-history segments are device features with separate controls and platform limits. Committed local event media uses the app's encrypted local-media path. It remains on that installation unless the participant explicitly exports or shares it using an available feature, or enables eligible event-clip sharing. A passphrase-encrypted portable archive can be saved or shared through the operating system with a destination the participant chooses. Watchtower cannot recall those exported copies.

Optional cloud event media

Client-encrypted event sharing is off by default. When enabled for an eligible post-trigger clip, the client encrypts media before it is uploaded. The service stores ciphertext and the envelopes needed by authorized recipient devices. The service can still see metadata such as the account, Space, camera, alert and asset identifiers, recipient-key identifiers, timestamps, format, ciphertext length, digests, access, and authorization records.

This is client-encrypted, ciphertext-only media storage. It is not presented as protection against a malicious or compromised control plane, and alert-to-asset relationships are not hidden.

Motion alerts and optional push

Motion detection analyzes camera frames on the device. If Space alerts are enabled, the app sends the enrolled camera identifier and the time of a detected motion event with authentication and retry information. This metadata does not include an image, video, motion score, detection-zone geometry, or person/object classification. The service stores event metadata for authorized viewers. The feed is polled while the app is foregrounded and can catch up after a later foreground resume.

Mobile builds include a separate opt-in to an APNs or FCM data wake. Registration and delivery depend on the deployed service supporting the feature; an enabled setting is not a guarantee of delivery. When supported and enabled, iOS uses Apple Push Notification service and Android uses Firebase Cloud Messaging. Registration is associated with the account device and includes provider routing information needed for delivery. The wake carries a version, a generic motion-alert kind, and an opaque notification identifier, not a camera name, Space name, account name, image, or clip. The app must obtain authorized alert data separately. Apple or Google receives the registered endpoint and delivery timing. Turning off notifications does not erase retained account or event records.

Android QR scanning and delivery SDKs

On Android, QR scanning uses Google's ML Kit. QR images and decoded contents are processed on the device; ML Kit sends Google installation identifiers and technical information about the device, app, scanner configuration, feature use, performance, and errors. Google processes those metrics to operate, diagnose, and improve ML Kit and detect misuse, as described in its privacy terms. This is separate from Watchtower's optional Firebase Cloud Messaging notifications and is not disabled by our Firebase Analytics setting. This Android SDK is not used for iOS scanning.

Firebase can process installation identifiers and technical app/device information for notification delivery and service operation. Notification wake messages do not contain camera images or clips. Disabling notifications does not itself delete all previously retained service or Google installation records.

How data is used

WatchtowerHome uses the data above to:

• create and operate Spaces, memberships, devices, and permissions;
• pair devices and authorize bounded live sessions;
• relay encrypted live traffic when required by network conditions;
• publish and display foreground event alerts and, when supported and enabled, deliver fixed generic APNs or FCM motion wakes;
• store and return optional client-encrypted event media to authorized recipients;
• detect abuse, enforce limits, revoke access, and protect service integrity; and
• diagnose preview failures when a participant reports them through the preview administrator.

Sharing, service access, and advertising

WatchtowerHome does not sell personal information and does not use it for targeted advertising. The product has no advertising feature, and the public website contains no analytics or advertising scripts.

In addition to the Android SDK processing described above, information is made available as needed to run the preview: to people and devices an authorized owner or member grants access, to infrastructure that delivers the service, and to the preview administrator for operation, security, and support. A participant should grant camera access only to people they trust.

When supported motion push is enabled, Apple Push Notification service or Firebase Cloud Messaging receives the provider endpoint and the fixed generic wake payload needed for delivery. Watchtower does not send those providers a camera name, Space name, account name, image, or clip in that payload.

Retention and deletion

• Local media: participant-controlled retention and manual deletion apply on the device. Deletion cannot promise physical secure erasure from storage hardware, operating-system copies, or backups.
• Foreground alert records and cloud event objects: the current preview applies a bounded default logical retention of up to 24 hours. Removal is traffic- or cleanup-driven and has no physical or backup secure-erasure guarantee.
• Account and authorization records: records may remain while an account, Space, device, grant, or security record is needed to operate or protect the preview. Permanent in-app deletion disables and anonymizes the account and owned Spaces, revokes access, purges owned alert/status metadata, and queues owned encrypted event objects for garbage collection. A minimal digest-only deletion receipt and immutable security audit record remain. Residual database write-ahead-log and encrypted backup material may outlast logical deletion.

Operational connection and diagnostic logs are rotated by storage size and file count. They do not have the same 24-hour logical retention boundary as foreground alerts or optional event objects. Residual database records and retained backups may outlast logical deletion. This is not a promise of immediate physical erasure or deletion of copies exported to other people or devices.

Supported preview builds provide permanent deletion under the Account screen's Danger zone. An account with a WT-RK1 Recovery Kit can also request permanent deletion through the official account deletion page. The page verifies the kit locally, persists only a random replay capability needed to resolve an uncertain result, and sends neither the kit nor its private key. See that page for both paths and their exact limitations.

Your controls

Depending on platform and current preview support, participants can:

• close the privacy shutter or stop Camera Mode to release capture;
• control microphone use, camera choice, local recording, and local retention;
• leave client-encrypted cloud event sharing off, as it is by default;
• leave motion push off, turn it off later, or revoke the registered device;
• review and revoke devices, cameras, memberships, or grants available to their role;
• permanently delete the account from supported preview builds or, with a WT-RK1 Recovery Kit, from the official account deletion page; and
• remove local application data using the app and operating-system controls.

Removing an app or its local files is not the same as deleting server-side account or Space records.

Security has limits

WatchtowerHome uses scoped credentials, HTTPS/WSS service requests, encrypted live media, client-side media encryption for eligible shared events, bounded authorization, and explicit privacy controls. No connected camera service can guarantee absolute security, uninterrupted delivery, or recovery from every device or network compromise.

Changes and privacy questions

This policy may change as the private preview gains or removes features. The updated date will change when the published policy changes. Material public-release requirements will be reviewed before general availability.

For support or privacy questions, email mediahostingltd@gmail.com or call +972524697777. There is no website contact form. See Support for what to include without exposing sensitive material. Support contacts updated 2026-09-09.