Who is responsible
The data controller is Daniele Crescenzi, an individual based in Frosinone, Lazio, Italy. For any question about this policy or to exercise your rights, write to crescenziaziendale@gmail.com.
What reaches our servers
Exactly three pieces of information, sent when you sign in with Google: your email address, the identifier Google assigns to your account, and an identifier of the device you are using. We add the date of the first access and of the last one, to know how many devices are active on an account.
What stays on your device
- Your registered face, converted into a numeric representation from which the original image cannot be rebuilt, kept in encrypted storage. It is never uploaded, not to us and not to anyone else.
- A local copy of the reports, and your preferences: monitoring on or off, biometric unlock, onboarding.
- Everything here is removed when you uninstall the app.
What goes to your Google Drive
The photos of unrecognised faces are saved in a folder named “Remocat Intruders” inside your own Google Drive, together with the moment of capture and the name and identifier of the device. They belong to you: we cannot see them, we keep no copy, and if you want them gone you delete the folder yourself. Remocat asks Google only for the permission needed to write into that folder.
What we never collect
- No analytics, no usage statistics, no crash reporting, no advertising identifiers.
- No phone number, no contacts, no location, no access to your photo gallery.
- No screen content: the Accessibility Service only receives unlock attempt events.
- We never sell your data, to anyone, for any purpose.
Why we process it
- To give you the service you asked for: an account, and the link between it and your devices. Legal basis: performance of the contract.
- To recognise your face on the device. This is biometric data: we process it only with your explicit consent, given when you register your face, and you can withdraw it by removing the face or deleting the account.
- To send you occasional emails about Remocat. Legal basis: consent. Every message carries a link to unsubscribe, and deleting your account removes you from the list.
Who else is involved
- Google, for sign-in and for the Drive space where your reports live.
- Supabase, which hosts our database and server functions on infrastructure located in the United States.
- Mailjet, which delivers the emails we send you.
- Because our database is hosted in the United States, your email address and account identifier are transferred outside the European Union, under the standard contractual clauses adopted by the European Commission.
How long we keep it
Your account record stays until you delete it, and the deletion is immediate. The device sessions expire on their own when a device stops signing in, and are cleaned up automatically. What lives in your Drive and on your phone follows your choices, not ours.
Your rights
You can ask for access to your data, its correction or erasure, a copy in portable form, a restriction of the processing, or object to it; and you can withdraw your consent at any time. Erasure is available directly in the app, see Delete account. For anything else write to us. If you believe we are handling your data incorrectly you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of the country where you live.
Children
Remocat is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a minor has created an account, write to us and we will remove it.
Changes to this policy
If what we collect or why changes, this page changes with it, and we will tell you inside the app or by email before the change takes effect.