Where are my recordings? Privacy at VintageCam
What VintageCam stores, for how long, where and how encrypted, and what it does not. Honest, including about the limits of the encryption.
Anyone who puts a camera in the nursery wants to know what happens to it. Here is what VintageCam stores and what it does not. The privacy policy is always the authoritative text; this article explains it in everyday language.
What is not stored
Live video, the still-image preview, sound and talk-back are only passed on by the server while a viewer requests them. They are not recorded. Anyone who only watches or listens leaves no recording behind. Sleep analysis does not store pictures or sound either, only numbers about volume and movement. Motion alert analyses the picture on the camera phone and transmits nothing as long as nothing happens.
What is stored when an alert goes off
When the camera triggers, an event is created with a time, a volume, a short audio clip and a still image, and in the Complete plan a short video as well. These recordings can only be retrieved by your account or your household. At most the last 100 events and at most 30 days are kept, after which the server deletes them automatically. You can also delete recordings earlier.
How the encryption works
Alert audio, still images and videos are stored on disk only in encrypted form (AES-256-GCM). The key is kept separate from the data and from backups. So anyone who got hold of a hard drive or a backup copy would find only ciphertext. Each file has its own derived key, bound to its place in the account; tampered files are not delivered.
The limit: this is not end-to-end encryption. The server decrypts a recording when you view it, and anyone with administrator access to the running server can get at the key. We therefore do not claim that nobody could ever read along, only that stored data does not simply lie around in readable form.
Where the server is
VintageCam is run by me personally and hosted on a server in Germany. There are no tracking cookies and no analytics services. The only cookie keeps you signed in. If you sign in with Google, the sign-in token is checked with Google; the server then takes over your verified email address.
Location and phone protection
If you let a phone run as an alarm system or with “Protect this phone”, it reports its position to the server. The track is stored for at most 14 days and at most 6,000 points per device, can be deleted at any time and is part of the subject access request and the data export. With phone protection, all members of your household see the route; Android shows a notification the whole time. Only switch it on for phones that belong to you or whose owner knows about it.
Access, export, deletion
You can download your data as an export, request a subject access report and delete your account. When you delete it, recordings, tracks and sessions disappear with it.
What you can do yourself
Use room names that are not complete (“Nursery” rather than first and last name). Only invite people to the household whom you trust, because they see the same recordings. And secure your access with a strong password or Google sign-in.
