Proof Camera: Timestamp Hash — Privacy Policy

Last updated: 29 October 2026 · Package: com.ibrahimtxy.kanitkamera · Developer: bulbildir

In short: the developer collects no personal data, the app does not ask you to create an account and sends nothing to any server of ours — we do not operate one. Everything you enter stays on your phone. The free tier shows Google AdMob ads (every format is listed in §5); the Google Mobile Ads SDK that serves them collects and shares with Google the IP address, app interactions, diagnostic information and device identifiers, including the advertising ID (§5). Paid members see no ads and no ad request is made at all. The developer uses no analytics and no crash reporting.

Important: A matching hash shows the file is unchanged since its hash was recorded. It does not prove what the camera was pointed at and it is not a legal certification; time and place come from your device. Whether a court accepts it is for the court to decide.

1. What the app does

Proof Camera: Timestamp Hash keeps the records you enter and works them out for you. An example entry: Damage report · 14:22 · 3 photos.

The app reads nothing from the internet: it contacts no source, looks nothing up and has no account to sign in to. Every figure it shows is computed on this phone from what you typed.

2. Data we collect

The developer collects none. We run no server and receive nothing from your device — not your records, not your device identifier, not your usage, not crash reports.

The one exception is advertising, and the developer does not process that either: in the free tier Google serves the ads and may use your device's advertising ID (AAID) and IP address. See §5.

3. What is stored on your device

The records you enter, the settings you choose and the reminders you set, with the time each reminder last went off so that it is not sent twice. All of it lives in the app's private storage and is deleted when you uninstall the app.

4. Servers the app talks to

For its own work, none. The app contacts no source server: there is nothing to fetch. The only network traffic it makes is the advertising and purchase traffic described in §5 and §6, and the free tier is the only tier that makes the first of those.

5. Advertising

This section applies to version 0.1.0 and later. Earlier versions show no ads, contain no advertising library and read no advertising ID.

The free tier shows ads. They are served by Google AdMob; the developer does not choose what is shown and has no direct relationship with advertisers. The formats used are:

Banner — at the bottom of the screen; it never covers your content.
Rewarded — only when you tap the offer yourself; it relaxes free-tier limits for 24 hours.
Native — a card inside the app's own screens, always marked with an “Ad” label.

Interstitial, rewarded interstitial and app open ads are no longer used; versions of the app released before 28 October 2026 also showed these formats.

Paid members see no ads and no ad request is made — nothing leaves the device for AdMob, and no consent form is shown.
To select, serve and measure ads, Google may use your device's advertising ID (AAID) and IP address. The developer never reads or stores that identifier; Google is the party that processes it.
You can reset or delete the advertising ID in Settings › Google › Ads. The app keeps working if you do.
In the European Economic Area, Switzerland and the United Kingdom, Google's certified consent form is shown before the first ad loads. You can change your choice later from the Privacy options link inside the app.
How Google processes this data: policies.google.com/technologies/partner-sites

There is no analytics (Firebase Analytics and the like), no crash reporting (Crashlytics and the like) and no marketing tracker. How you use the app is never reported to the developer.

6. Permissions

Permission	Why
`ACCESS_COARSE_LOCATION`	Only to stamp an approximate place on a record you create, and only while you are creating it. It is never read in the background and never sent anywhere.
`ACCESS_FINE_LOCATION`	To record where an entry was taken. Location is read ONLY while you are recording, stays on the device and is never sent anywhere; if you decline, the app keeps working without location.
`ACCESS_NETWORK_STATE`	So the ad library can see the connection state. Your entries do not use the network.
`INTERNET`	For ads ONLY. Your entries never leave the device and the app has no server of its own.
`POST_NOTIFICATIONS`	To remind you about the dates and reminders you set yourself.
`READ_BASIC_PHONE_STATE`	So the ads library can tell Wi-Fi from mobile data. It grants no access to your phone number, IMEI or call log; the app does not declare it, the ads library adds it.
`RECEIVE_BOOT_COMPLETED`	So your reminders keep working after the phone restarts.
`VIBRATE`	To vibrate when a notification arrives.
`WAKE_LOCK`	So the phone does not fall asleep in the middle of a check. The app does not ask for this itself; the background work library (Android Jetpack WorkManager) adds it.
`BILLING`	So you can buy a paid membership through Google Play. The app does not declare this permission itself; the Google Play Billing library adds it. Your payment details (card, address, invoice) never reach the app and are never seen or stored by it — Google Play takes the payment. All the app learns is whether your membership is active.
`AD_ID`	Ads in the free tier are served by Google AdMob, which may read the device advertising ID (AAID). The app does not declare this permission itself; the ads library adds it. Paid members make no ad request at all. You can reset or delete the ID in Settings › Google › Ads.

7. Payment and membership

If you buy a paid membership, the payment is handled by Google Play. Your card details are never entered into the app and are never seen by the developer.

Monthly and yearly memberships renew automatically; Google Play charges your account at the start of each period. The lifetime membership is a one-off purchase and does not renew. You can cancel a subscription at any time in Google Play Store › Menu › Subscriptions; cancelling takes effect at the end of the period you have already paid for. Refunds are also handled by Google Play — the developer has no access to the payment.

The app has no server of its own. Whether your membership is active is read again every time the app asks Google Play (when you open the app and when you view the membership screen). That is why a cancellation or refund closes the membership the next time you open the app. If you changed device, Restore purchases on the membership screen brings back a purchase made with the same Google account.

8. Children

The app is not directed to children. The developer collects no data from anyone; the advertising data described in §5 is processed by Google.

9. Keeping and deleting your data

Everything the app stores stays on your device; there is no account and no server copy. Clearing the app’s storage, or uninstalling the app, deletes everything it has ever kept — nothing survives elsewhere, so there is no separate deletion request to make. A paid membership is held by Google Play, not by the app: it survives reinstalling and can be brought back with Restore purchases.

10. Changes

If this policy changes, the date at the top changes with it.

11. Contact

bulbildir@mail.com

12. This app in detail

The sections above apply to every app by this developer. What follows is written for this app only and describes exactly what it records, what it never records and what it will not claim.

SUMMARY
The developer receives none of your personal data. Everything it records —
your photos and videos, the case names you type, the times, the positions and
the SHA-256 digests and seals computed from your files — is stored ONLY on your
device. There is no account and no sign-in, and no network connection is made
in order to take a photo, to record a video, to seal it, to verify it or to
produce a report.

PHOTOS AND VIDEOS STAY ON THIS DEVICE
Photos and videos are written to the app's private storage (the app's own files
directory), which other apps on the phone cannot read. They are never uploaded,
never sent to us and never added to your phone's shared gallery. A copy of a
file leaves the app only when you save it or an export to a place you pick
yourself with the system file picker (the app then reads it back to check it),
or when you tap Share and pick the receiving app in the system share sheet —
from then on that app's own policy applies to the copy it received. Automatic
cloud backup is disabled
(allowBackup=false). A backup is made only when you choose to write one, to a
file you select yourself — and that backup contains the LEDGER ONLY (names,
times, positions, digests, seals), not the photo or video files, because a
single photo can be several megabytes and a video far more. The backup also
holds your company fields, stamp style and saved sites, but not the logo image.

STAMPED AND OTHER COPIES — THE ORIGINAL IS NEVER CHANGED
On request the app makes a separate COPY of a photo: a stamped copy (the date,
time, time zone, position, altitude, speed, compass heading, saved site, a QR
code and your company fields drawn on the picture, as set in your stamp style,
optionally with a colour filter), a copy without metadata (the camera's EXIF and
XMP data, such as the phone model and the position, removed without re-encoding
the image), a copy with the recorded position and time written into its EXIF,
or a before/after picture of two photos. Of a video it makes a stamped copy: the
same stamp on every frame with the clock running, counted back from the moment
the finished clip arrived, re-encoded on this phone (clips up to 10 minutes). A
stamped copy names the first digits of the sealed original's digest. Copies are
written to the app's private cache folder, are deleted from it after 24 hours,
and leave the phone only when you save or share them. The sealed original file
is never modified. The QR code holds an OpenStreetMap web link to the recorded
position; the app makes no network request for it — whoever scans the code opens
the link in their own browser. Exports (CSV, .xlsx spreadsheet, KMZ map, a .zip
evidence package with the original files and a SHA256SUMS list, and .srt video
subtitles) are written only to a place you pick.

COMPANY PROFILE, LOGO, SITES AND THE TEAM SETUP CODE
The company name and the two extra lines you type, the logo you pick
with the system photo picker (copied, scaled down, into the app's private
storage) and the work sites you save (a name, coordinates and a radius) stay on
this device. A site added "at my position" uses the position the phone already
knows at that moment, under the location permission you granted. A team setup
code is a QR code shown on your screen; it contains the company fields, the
stamp style and up to twelve sites, not the logo. Importing one reads a picture
you pick, or a photo your camera app takes into the app's private cache, which
is deleted right after it has been read.

THE CAMERA AND THE MICROPHONE
The app does NOT request the camera permission or the microphone permission
(android.permission.CAMERA and android.permission.RECORD_AUDIO are not in this
package). When you tap "Take photo" or "Record video", your phone's own camera
app is opened through the standard system action and it writes the picture or
the clip directly into the app's private folder, using a one-shot permission for
that single file. Any sound in a video is recorded by your camera app under its
own permission; this app never records anything itself. The app never opens the
camera in the background and never takes a picture or a video without you
pressing the shutter.

LOCATION — OPTIONAL, OFF BY DEFAULT
Attaching a position to each record is switched OFF when you install the app.
The screen first explains what a position adds to a record and what it does not;
the permission (android.permission.ACCESS_COARSE_LOCATION and
android.permission.ACCESS_FINE_LOCATION) is requested only at the moment you
switch it on. When it is on, the app reads the position the phone already knows
at the moment a photo or a finished video arrives, and only if that position is
less than five minutes old — a stale coordinate is discarded rather than guessed.
With position on, the same moment also records the altitude, speed and direction
of travel the phone reports with that position, the compass heading from the
phone's motion sensors (no permission is needed for them) and, when a fresh GPS
fix exists, a comparison of the phone's clock with the time carried by that fix.
These readings are stored in the record but are not covered by the seal. Location is
never read in the background, is never sent anywhere, and is stored only inside
the record on this device. You can switch it off again at any time; existing
records keep the position they were sealed with, because changing a sealed fact
is exactly what this app is built to make visible.

WHAT THE SEAL IS
For every photo and video the app computes a SHA-256 digest of the file and stores
it with the time, the time zone, the file size and the optional position. For a
video the time is the moment the finished clip arrived, i.e. the end of the
recording. Each record is
sealed to the previous one, so editing, removing or reordering a record makes the
seals stop matching. This is a local integrity mechanism, not a digital signature
and not a trusted timestamp authority: the times come from this phone's clock.
The digests are not secret — the whole point is that anyone you hand the report
to can recompute them with a standard tool and check for themselves.

INTERNET AND PERMISSIONS
The internet permissions (android.permission.INTERNET,
android.permission.ACCESS_NETWORK_STATE) are used for advertising only.
POST_NOTIFICATIONS, VIBRATE and RECEIVE_BOOT_COMPLETED are used for the open-case
reminder, and WAKE_LOCK is added by the background work library while a scheduled
check runs. The advertising and measurement libraries add
com.google.android.gms.permission.AD_ID and
android.permission.READ_BASIC_PHONE_STATE to the package. Purchases use
com.android.vending.BILLING. The app requests NO external storage permission and
no background location permission.

ADVERTISING (Google AdMob)
The free version shows Google AdMob advertising. Three ad formats are used:
a bottom banner, a native ad inside the app's own content, and a rewarded
video you start yourself. There are no full-screen ads between screens or
when the app opens. AdMob may process identifiers such as the advertising
ID in order to serve ads. Users in the European Economic Area, the United Kingdom
and Switzerland are shown a consent screen through Google's User Messaging
Platform (UMP), and you can change your choice later under Settings > Privacy.
Google's privacy policy applies to AdMob's own processing:
https://policies.google.com/privacy

⚠️ Your photos, videos, case names, notes and positions are NEVER shared with the
advertising network. Ads are requested with no information from your records.

PAID MEMBERSHIP
You can buy an ad-free membership through Google Play Billing. A paying member
sees no advertising at all: no ad is displayed and no ad request is even sent.
The paid plan also unlocks PDF export of the evidence report and a larger number
of cases open at the same time. Alternatively, watching a rewarded ad unlocks PDF
export for 24 hours; it does not change how many cases you may keep open, so
nothing you have recorded can ever become inaccessible. Closing a finished case
never deletes anything — the records stay readable, verifiable and exportable.
Purchases are handled by Google Play; the app never sees or stores your payment
details, and you can restore an existing purchase from the membership section.

DELETING YOUR DATA
Withdrawing a record deletes the photo or video file from the device and keeps a dated row
in the ledger saying that you withdrew it, so that the seal chain is not broken
and the report stays honest. Uninstalling the app removes all of it: the photos,
the videos, the ledger and the counters (copies you saved elsewhere with "Save a
copy" stay where you put them). Nothing is kept anywhere else, because nothing was
ever sent anywhere else.

ACCURACY AND SCOPE
This app is a recording tool. It is not a legal service, not a trusted timestamp
authority and not a certified forensic system, and it is not connected to any
authority, insurer, landlord or employer. It shows that records have not changed
since they were made; what a record is worth in a dispute is decided by whoever
reads it. The app makes no finding about what a photo or video shows.

CHILDREN
The app is not directed at children.

CHANGES
This policy may be updated; the current version is published at:
https://bulbildir.it.name.tr/gizlilik/kanitkamera.html

Questions: bulbildir@mail.com