Privacy Policy
Last updated: October 11, 2026
Camstead is made by Lightning Studio LLC ("we", "us"). This policy explains what happens to your data when you use the Camstead app, the Camstead hub and Camstead's cloud services.
The short version
- Your video, snapshots, recordings and camera passwords stay in your home, on your hub. We never receive them.
- Camstead's cloud only helps your phone find your hub from away, delivers alerts we can't read, and keeps your account if you make one.
- We don't sell your data, show ads, or put analytics or tracking in the app.
- At home, Camstead works without an account and without the internet.
1. What stays in your home
The Camstead hub runs on your own computer. It keeps your cameras and their passwords, live video, events, clips, snapshots, the phones paired with it, and your Home and Away settings. This data is stored on your hub, or in the NAS folder or S3 bucket you choose for clips, and is not sent to us. When your phone is away, video travels encrypted from your hub to your phone (see section 3).
2. What Camstead's cloud keeps
| Data | Why | How long |
|---|---|---|
| Account: an account id, your email address or the Apple or Google sign-in you chose, an optional display name, when it was created | To sign you in and link your phones and hubs | Until you delete the account |
| Sign-in sessions: device name, platform, when created and last used | To keep you signed in and let you sign other devices out | 60 days after last use, or until you sign out |
| Sign-in codes (stored hashed) | Email sign-in | 10 minutes |
| Your hub's id and public key | So phones can check they're talking to your hub, and so only your hub can send your alerts | Until you ask us to remove it |
| Connection records: which hub and phone are connecting | To set up connections from away. Video and app data never pass through this service. | 3 hours |
| Relay usage: bytes relayed for your home each month | To apply your home's free relay allowance | 400 days |
| A fingerprint (hash) of each alert sent | To avoid sending the same alert twice | 7 days |
| Service logs: request type, result, timing and ids | To run the service and fix problems | 30 days |
| Messages you send to support, with your email address | To answer you | The raw copy our mail service receives: 30 days. Our reply thread: as long as needed to help you |
3. Alerts and video away from home
- Alerts are encrypted by your hub for each of your phones before they leave your home. Our relay, Google Firebase Cloud Messaging and Apple's push service only carry the encrypted message and your phone's push token. Firebase creates that token on your phone when you allow notifications, and your hub provides it with each alert.
- Video and app data go directly between your hub and your phone, encrypted, whenever the networks allow it. When they don't, Cloudflare's relay servers pass the encrypted traffic along. Cloudflare can't see the video. It sees network addresses and the amount of data, which we use only to count your home's relay use.
4. Who processes data for us
- Amazon Web Services (United States): hosting, storage, sign-in emails and receiving support email.
- Cloudflare: the relay for connections that can't be direct.
- Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): delivering alerts to your phone.
- Apple and Google: signing in, if you choose Sign in with Apple or Google.
They process data only to provide these services to us. We don't share your data with anyone else, except when the law requires it.
5. What we don't do
- We don't receive or store your video, snapshots, recordings or camera passwords.
- We don't sell or share your personal information (as California law defines those terms), rent it, or use it for advertising.
- The app has no analytics, advertising or tracking SDKs, and this website uses no cookies or analytics.
- We don't keep your location. Home and Away is decided by your phones and your hub.
6. Why we may use your data
Where laws like the GDPR ask for a legal basis, we rely on:
- Contract: to provide the services you ask for, such as your account, connections from away and alerts;
- Legitimate interests: to keep the services secure and working, prevent abuse and fix problems, using service logs and limits;
- Consent: for notifications and for signing in with Apple or Google, which you can withdraw at any time;
- Legal obligation: when the law requires us to keep or disclose data.
7. Your choices and rights
- Use Camstead at home without an account, or run your own helper instead of Camstead's cloud.
- Turn off alerts in your phone's settings, or remove a phone from your hub, at any time.
- Ask for a copy of your account data, or ask us to correct or delete it, by emailing us from your account's address. Deleting your account removes it from Camstead's cloud right away, and signs you out of Sign in with Apple. Copies in backups expire within 35 days, and logs within 30.
- Depending on where you live (for example the EU, the UK or California), you have rights to access, correct, delete or port your data and to object to its use. We honor these requests wherever you live.
8. Security
Your phone pins your hub's certificate when you pair, device keys are random and stored hashed, camera passwords stay on your hub, alerts are end-to-end encrypted, and all traffic to our services uses TLS. No system is perfectly secure, and we'll tell you without undue delay if a breach affects your data.
9. Children
Camstead isn't directed at children under 13, and we don't knowingly collect their data. If you believe a child gave us personal data, contact us and we'll delete it.
10. International transfers
Camstead's cloud runs in the United States. If you use it from elsewhere, your data is transferred there, with the safeguards required by law.
11. Changes
We'll update this page when our practices change and change the date at the top. For important changes, we'll also tell you in the app.
12. Contact
Lightning Studio LLC, support@mycamstead.com.