1. Scope and controller
This policy applies to the Ivuta: Hidden Camera Detector app for iPhone and Android (the “App”) and the website at ivuta.com. Ivuta is operated by Vumoa LLC, which is the data controller for the processing described in this policy. Contact us about privacy or exercise a privacy right at privacy@ivuta.com or by mail at Vumoa LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110-7845, United States.
Ivuta’s core inspection features run locally. Camera frames, raw network histories, raw Bluetooth advertisements and GPS coordinates are not uploaded to Ivuta or included in analytics, diagnostics, purchase data or feedback.
2. Information we process
| Information | Purpose | Storage and sharing |
|---|---|---|
| Camera frames | Analyze lens reflections and compatible infrared indicators on your device. | Transient. Not uploaded or stored as raw images. |
| Network, Bluetooth and sensor findings | Evaluate visible device services, public signals and magnetic changes locally. | Raw histories are not uploaded. Summarized findings may be included in a local report. |
| Local reports, room labels and selected evidence photos | Show your previous inspections on your device. | Stored locally. Selected photos are resized and re-encoded without their original EXIF/GPS metadata. The newest 100 reports are retained unless you delete them earlier. |
| Essential service and integrity data | Deliver current configuration, protect backend services from abuse and keep purchase access available. | Firebase Remote Config and App Check may process a Firebase installation ID, app/device information, IP address and an integrity or attestation token. No raw scan content is included. |
| Optional product analytics | Understand feature use and improve reliability. | Firebase Analytics receives limited feature events only after you enable analytics. Events may include the feature or detector used, result category, app variant and product identifier, but never raw scan content. |
| Optional crash diagnostics | Diagnose crashes and technical failures. | Firebase Crashlytics may receive installation identifiers, device/OS details, app version, crash traces and the limited non-sensitive context attached to an error, only after you enable diagnostics. |
| Feedback you explicitly submit | Improve classification quality based on your verdict. | A pseudonymous Firebase user ID, random installation identifier, detector type, verdict, classification fingerprint, confidence, app version, platform, locale and timestamp. Firebase Authentication may also process an IP address as part of the sign-in request. |
| Purchase and entitlement information | Display products and prices, verify purchases, restore access and maintain Ivuta Pro entitlement. | Apple App Store or Google Play and RevenueCat may process a randomly generated app-user ID, product identifier, receipt or purchase token, transaction/subscription status and limited app/device technical information. Ivuta does not receive payment-card details. |
| Optional Google Play reviewer access | Give authorized reviewers temporary Pro access without payment. | If a reviewer enters the code, the Android App sends it with its anonymous RevenueCat app-user ID to an Ivuta endpoint hosted by Cloudflare. The code is checked against a stored hash and is not retained in our application logs. RevenueCat records the resulting promotional entitlement for 14 days. Cloudflare may process IP address and request metadata for delivery and security. No scan content is sent. |
| Website technical logs | Deliver the site, prevent abuse and maintain security. | The hosting provider may temporarily process IP address, browser information and request time. |
3. Information we do not collect
Ivuta does not read or store GPS coordinates for reports and does not collect contacts, microphone recordings, messages, your full photo library or advertising identifiers. On Android 11 and earlier, Android may label the system permission required for Bluetooth scanning as “location”; Ivuta uses that permission only to discover nearby Bluetooth advertisements and does not request device location updates. Camera frames, IP addresses or hostnames discovered during a scan, Bluetooth device identifiers and full local-network histories are excluded from feedback. The App does not sign in to discovered devices, bypass authentication or attempt to read private content.
4. Purposes and legal bases
- Performance of a contract to provide scans, reports and purchase features you request;
- legitimate interests in service security, fraud prevention and product integrity;
- your consent for optional analytics, diagnostics and feedback;
- legal obligations relating to billing, consumer rights and official requests.
Where local law requires a different legal basis, we process information under that basis. You can withdraw consent from the in-app Privacy Center without affecting earlier lawful processing.
5. Service providers and international transfers
Ivuta uses Google Firebase for configuration, app integrity checks, pseudonymous authentication, optional analytics, optional diagnostics and feedback; RevenueCat for product, purchase and entitlement management; Apple App Store or Google Play for payment processing; and Cloudflare to deliver ivuta.com and the reviewer-access endpoint. These providers act under their own terms and, where applicable, data-processing commitments. They may process information in countries other than yours. Where applicable law requires it, transfers are supported by an approved legal mechanism such as standard contractual clauses.
6. Retention and deletion
- The App retains the newest 100 local reports; older reports and copied photos are removed when the limit is reached. You can delete an individual photo or report, delete all reports, or uninstall the App.
- Submitted pseudonymous feedback carries a deletion time no later than 24 months after submission. Firestore’s time-to-live process may take additional time to remove expired records from live storage and backups.
- The short-lived anonymous Firebase Authentication account used to authorize a feedback submission is scheduled for deletion by the App after the submission completes. Firebase may keep authentication request logs, including IP addresses, for its documented retention period.
- Event-level product analytics are configured for a maximum retention period of 14 months.
- Firebase Crashlytics retains crash traces and associated identifiers for 90 days before beginning removal from live and backup systems.
- Firebase installation, App Check, store and RevenueCat records follow the applicable provider retention rules and may be kept while needed to secure the service, maintain entitlement, resolve transactions or meet accounting and legal obligations.
- Reviewer access codes are checked transiently against a stored one-way hash. A promotional Pro entitlement lasts 14 days per activation and may be renewed with the same code while it remains authorized. Rotating the code blocks future activations; previously granted access can be revoked in RevenueCat.
- Website security logs are retained by the hosting provider for its operational security period.
Delete local reports through Settings → Privacy Center → Delete all local reports. For other requests, use our Privacy Choices page.
7. Your rights
Depending on applicable law, you may have rights to access, correct, delete, restrict or port your information, object to processing, and withdraw consent. You can also ask for information about processing and recipients. We may need to verify your identity and the scope of your request. Because feedback and purchase records use pseudonymous identifiers, we may be unable to locate a specific record unless you can provide the relevant identifier or transaction information. You may complain to your local data-protection authority. Ivuta is not directed to children under 13. A minor may use the App only with permission from a parent or legal guardian where required by applicable law.
8. Security, changes and contact
We use encrypted connections, data minimization, access controls and app-integrity checks. No system can offer absolute security. If our practices change, we will update the “Last updated” date and provide additional notice in the App or on the website when appropriate.
Privacy questions and rights requests: privacy@ivuta.com. Postal address: Vumoa LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110-7845, United States.