Privacy Policy

Phone2Cam - Home Security Cam

한국어

Last updated: 2026-10-06 · Effective: 2026-10-06

Document version: 2026-10-06 — the revision identifier recorded when you accept this document. It changes whenever the text changes, which is what triggers a request to accept it again.

This Privacy Policy applies to the Phone2Cam - Home Security Cam app ("Phone2Cam") published by Wishmon Inc. M8M Labs on the App Store and Google Play. It explains what information Phone2Cam collects, why, and how we handle it. Phone2Cam is a free, local-first home security camera app that turns spare iOS and Android phones into cameras: you pair two phones on one account, with one running "Camera Mode" and the other acting as the "Viewer". This version is free to use and shows no ads (see Advertising below). There are no in-app purchases, paid subscriptions, or paid cloud backup yet.

Who We Are and How to Contact Us

Phone2Cam ("we", "us", "our") is provided by Wishmon Inc. M8M Labs, located at Room 505-A363, Gukje Plaza, 66 Gimpohangang 9-ro 75beon-gil, Gurae-dong, Gimpo-si, Gyeonggi-do 10071, Republic of Korea.

For any privacy questions, requests, or concerns, contact us at:

• Email: [email]
• Postal address: Room 505-A363, Gukje Plaza, 66 Gimpohangang 9-ro 75beon-gil, Gurae-dong, Gimpo-si, Gyeonggi-do 10071, Republic of Korea
• Data protection contact: Privacy officer 이언탁, [email]

What Data We Collect and Why

We collect only the limited information needed to operate your account, pair your devices, and notify you about events. Specifically:

We do not sell this backend information, share it with advertisers, or use it to build advertising profiles. This version serves no ads at all (see Advertising).

What We Do NOT Collect

To be explicit about what Phone2Cam never collects or does:

• No video in the cloud. Recorded clips stay on the camera phone. The backend never receives, decodes, or stores video. In this version there is no cloud upload of clips.
• No audio on our servers. Audio capture is off by default. The optional "loud-sound detection" measures loudness on-device only and stores no audio. If you explicitly enable audio capture on a camera device (after an in-app consent notice), audio streams peer-to-peer to your Viewer and — only if you also enable "include audio in saved clips" — is written into on-device recordings. Either way audio stays on your devices, exactly like video: our backend never receives, decodes, or stores it.
• No face recognition.
• No background or stealth recording. Recording is foreground-only and always shows a visible indicator.
• No location data. We do not collect your location.
• No contacts.
• No sale or sharing of your personal data, and no sharing of your video or audio with anyone. Several U.S. state laws define "sell" and "share" by effect rather than by payment, which can catch ad-supported apps — but this version serves no ads, so there is no advertising identifier to share and nothing falls inside those definitions.

Advertising

This version shows no ads. Nothing in the app requests, displays, or measures advertising, and we therefore:

• collect no advertising identifier and share none with anyone;
• run no ad SDK. The ad library is present in the app but never starts, so it receives nothing;
• do no tracking as App Store rules define it, and consequently never show the App Tracking Transparency prompt.

If we introduce advertising in a future version, we will update this policy and the App Store and Google Play privacy disclosures, and obtain consent where the law requires it, before any ad is served. Enabling ads requires a new app release; it cannot be switched on remotely.

Marketing Messages

This version sends no promotional messages. We do not ask for marketing consent, do not collect one, and send no new-feature announcements, event notices, or promotions.

What we do send is limited to messages required to operate the service — security alerts, notices of changes to these documents, and event notifications you turned on yourself. Those are not promotional and are not covered by this section.

If we introduce promotional messages, we will ask for separate opt-in consent first, record the time of each opt-in and each withdrawal, provide a withdrawal control in the app, and update this section before sending anything.

How Video and Live Viewing Work

Phone2Cam is built to keep your video private to your own devices:

• Recorded clips are stored locally on the camera phone. They are not uploaded to our servers.
• Live video streams peer-to-peer (P2P) between your camera phone and your Viewer using WebRTC, encrypted with DTLS-SRTP.
• Our backend never sees your media. It only relays signaling metadata needed to set up a connection. In some network conditions, our relay (TURN) may pass along the encrypted connection between your two devices, but it cannot see, decode, or store the media that flows through it.
• On-device clips are bounded by a storage cap you can configure and a ring-buffer, so older clips are overwritten as new ones are recorded.

Legal Bases for Processing

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — to create and operate your account, pair your devices, and deliver the service you request.
• Legitimate interests — to keep the service secure, prevent abuse, and maintain reliable connections, balanced against your rights.
• Consent — where required, for example for any optional feature you choose to enable, such as loud-sound detection or audio capture. You may withdraw consent at any time.
• Legal obligation — where we must process data to comply with applicable law.

Where Korea's Personal Information Protection Act (PIPA) applies, we process personal information to perform the service contract with you, on your consent where the law requires it, and to comply with legal obligations. The collection items, purposes, and retention periods PIPA requires are set out in the Korean version of this policy.

Data Sharing

We do not sell or share your personal information, and no advertiser receives anything from us — this version serves no ads, so there is no ad partner and no advertising identifier in the picture at all (see Advertising).

We use a small number of service providers to operate the app, who process data only on our instructions and only as needed to provide their service:

That list has no advertising partner on it, because this version has none. Google appears only as a processor for push delivery and crash diagnostics, acting on our instructions.

The TURN relay does not see, decode, or store your media. Even when a connection is relayed, it is end-to-end encrypted between the two phones (DTLS-SRTP), so only ciphertext passes through the relay.

No processor stores your video. Cloud clip backup is not offered, so video files are never sent to our servers or to any external storage.

We may also disclose information if required by law, to comply with a valid legal process, or to protect the rights, safety, and security of our users or the public — limited to what is necessary.

International Data Transfers

Every processor named above is headquartered outside the Republic of Korea, so your personal data may be processed outside Korea.

Why the country is not a single value for every recipient. Our own server (Oracle) runs in one region we select, so that country is fixed. Cloudflare's relay, by contrast, is an edge network: the nearest point of presence is chosen based on where the user connects from. Google operates its services across data centers worldwide. For those two, the processing location follows what each provider publishes; we cannot pin it per request.

None of this concerns your video or audio. Only ciphertext passes through a relay (see below); what reaches Cloudflare is the IP address needed to establish the connection.

Video and audio are never transferred abroad. Even a relayed connection is end-to-end encrypted, so the relay operator cannot decrypt it, and the video files themselves are never transmitted or stored.

You may refuse cross-border transfer. Because these transfers are essential to providing the service, refusing means discontinuing use by deleting your account.

Data Retention

• We keep your account data and the data tied to it (household name, camera names, event metadata, and device registration info) while your account is active.
• This data is deleted when you delete your account (see below).
• Recorded clips on your camera phone are not stored on our servers; they are bounded by your configurable storage cap and a ring-buffer on the device, so they are overwritten over time.

There is one retention rule — we keep it until you delete your account, and deleting your account destroys it.

• Everything stored on our servers — account data, consent records, activity logs, device data, event metadata, device-health records, live-session records. Nothing expires on a timer. Deleting your account removes all of it.
• Clips on your device — never stored on our servers. They are bounded by your configurable storage cap and an on-device ring buffer, so the oldest are overwritten first, and you can remove them immediately by deleting the app or using in-app deletion. Video on your phone is under your control, independent of your account.

Records we are legally required to retain are kept for the period that law requires and then destroyed.

How We Protect Your Data

We use technical and organizational measures appropriate to the data we handle, including:

• Encryption in transit for connections to our backend over HTTPS/WSS (TLS).
• Password protection using salted scrypt hashes; we never store plaintext passwords.
• Encrypted live media between your devices using DTLS-SRTP.
• No central video store, which means there is no cloud video library to be exposed.

No system can be guaranteed perfectly secure, but we work to protect your information against unauthorized access, loss, or misuse.

Your Rights

Depending on where you live, you may have rights over your personal information, including the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (see "Account and Data Deletion" below).
• Restrict or object to certain processing.
• Data portability, where applicable.
• Withdraw consent for any optional feature, at any time.
• Lodge a complaint with your local data protection authority — for example, Korea's Personal Information Protection Commission (PIPC), the supervisory authority of your EU/EEA country, or the UK Information Commissioner's Office (ICO).

To exercise any of these rights, contact us at [email]. We will respond within the timeframe required by applicable law. We may need to verify your identity before acting on a request.

Account and Data Deletion

You can delete your account at any time:

• In the app: go to Settings → Manage account → Delete account.
• By email: if you cannot access the app, email [email] to request deletion.

Deleting your account removes your account, the household data you own, camera registrations, event metadata, any clips stored on the server, live sessions, and subscription records, and it invalidates your existing sessions. Recorded clips stored locally on your phones remain on those devices; you can remove them directly on the device.

Children

Phone2Cam is not directed to children.

• Republic of Korea — we do not collect personal information from children under 14, and we confirm at sign-up that the user is 14 or older.
• Elsewhere — we apply the local children's online privacy threshold (for example, 13 under COPPA in the United States).

The store age rating is set by the operator. If you believe a child has provided us personal information, please contact [email] so we can delete it.

Regional Supplements

Everything above applies to everyone. The supplements below add the disclosures and rights that particular jurisdictions require. Where a supplement differs from the main policy, the supplement controls for residents of that jurisdiction.

United States — State Privacy Rights

This supplement applies to the extent the CCPA/CPRA and comparable U.S. state privacy laws apply to us.

Categories of personal information we collect, using the CCPA's own category names:

Sources — you (when you create an account, name a camera, or contact us) and your devices (when they register, report status, or generate an event). Business purposes — the purposes in What Data We Collect and Why. Recipients — the service providers listed under Data Sharing. Retention — as stated under Data Retention: until you delete your account.

"Selling" and "sharing." We do not sell your personal information and we do not share it for cross-context behavioral advertising. We are never paid for it, and — because this version serves no ads — there is no advertising identifier, no ad network recipient, and no targeted advertising of any kind. Nothing here falls within the CPRA's "sharing" definition or the "targeted advertising" definitions in Virginia, Colorado, Connecticut, and similar laws. There is therefore no opt-out for us to offer; there is nothing to opt out of.

We do not knowingly sell or share the personal information of consumers we know to be under 16 — or of anyone else.

If a future version introduces advertising, that will change, and we will update this section and the store privacy disclosures and provide an opt-out before any ad is served.

Your rights. Subject to verification and to the limits each state's law allows, you may request to know what we collect and how we use it, access a copy, correct inaccurate information, and delete your information. We will not discriminate against you for exercising these rights — we offer no financial incentives tied to your personal information, and the service is free either way.

How to exercise them. Email [email], or use Settings ▸ Manage account ▸ Delete account in the app to delete directly. We will verify your identity by confirming control of the account email. An authorized agent may submit a request on your behalf with written permission, which we may ask you to confirm. We respond within the period the applicable state law requires.

European Economic Area, United Kingdom, and Switzerland (GDPR)

Controller. Wishmon Inc. M8M Labs, Room 505-A363, Gukje Plaza, 66 Gimpohangang 9-ro 75beon-gil, Gurae-dong, Gimpo-si, Gyeonggi-do 10071, Republic of Korea, is the controller of the personal data described in this policy.

• EU representative (Article 27): None designated. Send requests to our privacy officer at [email].
• UK representative (UK GDPR Article 27): None designated. Send requests to our privacy officer at [email].
• Data protection officer: None designated. Send requests to our privacy officer at [email].

Legal bases are stated under Legal Bases for Processing. This version serves no ads, so no processing here relies on advertising consent, and there is no ad-related consent to withdraw.

Transfers outside the EEA/UK. Our servers and our processors are outside the EEA and the UK; the recipients and countries are listed under International Data Transfers. Transfers to us rely on the European Commission's adequacy decision for the Republic of Korea; onward transfers to our processors rely on the Standard Contractual Clauses or other Chapter V safeguards in each processor's data processing terms.

Your rights are listed under Your Rights and apply here in full: access, rectification, erasure, restriction, objection (including to processing based on legitimate interests), and portability. You may withdraw consent at any time without affecting processing carried out before withdrawal.

No automated decision-making. We do not make decisions producing legal or similarly significant effects about you by automated means. On-device event detection classifies what a camera sees; it produces a notification for you, not a decision about you.

Complaints. You may lodge a complaint with the supervisory authority in your country of residence, place of work, or where you believe an infringement occurred; in the UK, with the Information Commissioner's Office (ico.org.uk).

Japan (APPI)

Business operator handling personal information (個人情報取扱事業者). Wishmon Inc. M8M Labs, address as stated at the top of this policy.

Purposes of use (利用目的). As set out in What Data We Collect and Why. We do not use personal information beyond those purposes without your consent.

Provision to third parties (第三者提供). We do not provide personal data to third parties for their own purposes. The parties listed under Data Sharing are entrusted with handling (委託) — they act on our instructions only. There is no joint use (共同利用).

Provision to third parties in foreign countries (外国にある第三者への提供). All of the entrusted parties are located outside Japan; the recipients, countries, and items are listed under International Data Transfers. Information about the personal-information protection systems of those countries and the measures each recipient takes is available on request at [email].

Personally-related information (個人関連情報). None is provided to a third party. This version serves no ads, so no advertising identifier or app-usage data is collected or passed to anyone who might acquire it as personal data.

Requests for disclosure and related demands (開示等の請求). You may request disclosure, correction, addition, deletion, suspension of use, or suspension of provision of your retained personal data, and disclosure of records of third-party provision. Send the request to [email]. We verify identity by confirming control of the account email. We do not charge a fee for these requests.

Security control measures (安全管理措置). As described under How We Protect Your Data.

Complaints. You may contact us at [email], or the Personal Information Protection Commission of Japan (個人情報保護委員会, ppc.go.jp).

Republic of Korea (PIPA)

The Korean collection-and-use table, entrustment (위탁) list, cross-border transfer table, and retention rule appear in the main body above. This supplement adds what PIPA additionally requires.

Personal information protection officer (개인정보 보호책임자).

• Name: 이언탁
• Contact: [email]

Remedies for infringement of rights (권익침해 구제방법). You may apply to the following bodies for dispute resolution or for help with a personal-information complaint:

A person whose rights or interests are infringed by a decision or omission of a public institution in response to a request under PIPA Articles 35 through 37 may file an administrative appeal under the Administrative Appeals Act.

No automatic collection devices. Phone2Cam is a mobile application and installs no cookies or comparable automatic collection devices.

Notice of changes. If this policy changes, we announce the change and its effective date in the app and on our website at least 7 days before it takes effect; for changes unfavorable to users, at least 30 days before.

Other Jurisdictions

Phone2Cam is distributed worldwide, and the supplements above name only the regimes with the most specific disclosure requirements. If the law where you live grants you rights over your personal information that are not described here — for example under Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, or a national law of similar effect — those rights still apply, and we will honor them. Write to [email] and tell us which law you are relying on; we will respond within the period that law requires.

The commitments in the main body do not vary by country: video and audio never reach our servers, we are never paid for your personal information, everything we hold is deleted when you delete your account, and we do not collect location, contacts, or biometrics anywhere.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Please review this policy periodically.

Contact

If you have any questions about this Privacy Policy or how we handle your information, contact us at:

• Email: [email]
• Postal address: Room 505-A363, Gukje Plaza, 66 Gimpohangang 9-ro 75beon-gil, Gurae-dong, Gimpo-si, Gyeonggi-do 10071, Republic of Korea
• Data protection contact: Privacy officer 이언탁, [email]