Virtual Viewfinder

Privacy Policy

Effective [[EFFECTIVE_DATE]] · Last updated [[EFFECTIVE_DATE]]

This policy describes how [[COMPANY]] ("we") handles information in the Virtual Viewfinder applications for iOS and Android and the service behind them. Virtual Viewfinder is an internal production tool, not a consumer social product: we collect what the tool needs to do its job and nothing else. Where the two apps differ, this policy says so. The Android app is distributed from a download page on our own server, not through Google Play.

The short version. The live camera feed never leaves your device. We do not use advertising identifiers, we do not embed third-party analytics or tracking SDKs, and we do not sell or share your data with data brokers. On Android, augmented reality runs on Google Play Services for AR, which Google operates under its own privacy policy (see Sharing). Photos and videos you capture are saved to your own photo library, not to our servers.

1. Who we are

[[COMPANY]], [[COMPANY_ADDRESS]]. For any privacy question, contact [[PRIVACY_EMAIL]].

We are the controller of the data described here. Virtual Viewfinder runs against servers operated by [[COMPANY]]; scene and account data is stored there and is not handed to a third-party backend provider.

2. Information we collect

Account information

Your work email address, a password stored only as a salted hash, your role, and the timestamps of your sessions. Accounts are created by a [[COMPANY]] administrator; the app has no public registration. We keep a session on your device so you do not have to log in on every launch.

Scene data

The scenes you build and save: scene names, which people and props you placed, and their positions, orientations, and scale relative to the scene origin you put on the floor, plus your framing and camera settings. This is uploaded so you and your colleagues can reopen the same scene later and on other devices.

Relocalization map (iOS)

When you save a scene on iOS, the app may upload a relocalization map (ARKit's ARWorldMap) for that scene. A relocalization map is ARKit's mathematical description of the space — feature points and anchor positions that let the app recognise the location again and put everything you placed back exactly where it was. It is not a photograph and not a video, but it does describe the geometry of the place where you worked. It is stored with the scene and is downloaded only by logged-in users of your organisation who open that scene.

The Android app does not create or upload a relocalization map. When you reopen a scene on Android, you place the scene origin again by hand and everything you placed follows it.

Scene thumbnails

Saving a scene uploads a small preview image so the scene list is recognisable. When you save from the AR view, that preview is a snapshot of what the app was showing at that moment, which includes the live camera image of the location behind the people and props you placed. When you save from the plan view, the preview is a diagram with no camera image in it. If you do not want a picture of a location on our servers, save from the plan view, or ask us to delete the scene.

Device capability information

Whether the device has a LiDAR sensor and depth support, the camera stream format in use, and similar technical facts. We use this to decide which features the device can run and to diagnose problems. On Android, the same information tells the app whether Google Play Services for AR and depth support are available.

Diagnostic logs

Our servers keep ordinary request logs (timestamp, path, status, account) for operating and securing the service. Optional on-device diagnostic files exist for internal testing, are off by default, are written only to the app's own storage area on the device (on Android, the app-specific folder that other apps cannot read), and are never uploaded automatically.

3. What we do not collect

  • The camera feed. The camera is used on-device for augmented reality tracking and framing. Frames are processed locally and are not streamed or uploaded. The only exception is the scene thumbnail described above, which you trigger by saving a scene from the AR view.
  • Your photos and videos. Stills and recordings you capture are written to your device's photo library. On iOS the app requests permission to add to your library; on Android it saves through the system media store, which needs no storage permission. On neither platform does it request permission to read your existing photos, and it does not upload what you capture.
  • Location. The app does not request or use GPS or your device's location services.
  • Contacts, calendar, microphone, or health data. Never requested. On iOS, screen recordings capture system audio only if your device is configured to do so; recordings made on Android contain no audio. Either way the recording stays on your device.
  • Advertising and tracking. No advertising identifier (IDFA on iOS, Advertising ID on Android), no App Tracking Transparency prompt, no third-party analytics, attribution, or crash-reporting SDK, and no cross-app or cross-site tracking of any kind.

4. Device permissions

Camera
Required. Augmented reality needs the camera to understand the room and to show you the frame. Without it the app cannot work.
Add to Photos (iOS)
Required only when you save a capture. Grants writing new photos and videos into your library; it does not grant reading existing ones. The Android app does not ask for a photo or storage permission.

You can change permissions at any time in the iOS Settings app, or on Android under Settings › Apps › Virtual Viewfinder › Permissions. Revoking camera access disables augmented reality features.

5. How we use the information

  • To authenticate you and keep you logged in.
  • To store, list, and reopen your scenes, and to share them with colleagues in your organisation.
  • On iOS, to relocate a saved scene in the real world when you return to the same place.
  • To deliver the library of people and props your organisation has approved.
  • To operate, secure, troubleshoot, and improve the service.

We do not use your data for advertising, profiling, automated decision-making, or training machine-learning models.

6. Sharing

Scene data, thumbnails, and relocalization maps are visible to other logged-in users of your organisation's Virtual Viewfinder instance, and to [[COMPANY]] administrators. Beyond that we disclose information only to service providers strictly necessary to run the service (hosting and network infrastructure), where required by law, or to protect our rights and the safety of users. We do not sell personal information.

Google Play Services for AR (Android). The Android app runs on Google Play Services for AR (ARCore), which is provided by Google LLC and governed by the Google Privacy Policy. To provide augmented reality, ARCore processes camera frames on your device, and Google may collect and process data about how ARCore runs as described in How Google uses information from sites or apps that use our services. We do not receive that data.

7. Storage, security, and retention

Data is stored on servers operated by or for [[COMPANY]]. Traffic between the app and the server uses HTTPS. Passwords are stored as salted hashes and never in plain text. Session tokens are held on your device in the iOS Keychain, or on Android in the app's private storage that other apps cannot read; a logged-in session refreshes for up to 90 days of continued use before you must log in again.

Scenes, thumbnails, and relocalization maps (iOS only) are retained until you or an administrator deletes them. Account records are retained while the account is active and for a reasonable period after it is closed, as required for our records and legal obligations. Server request logs are kept for a limited operational period and then rotated out.

8. Your rights and choices

You can access, correct, export, or delete your scenes from inside the app or by asking us. Depending on where you live, you may also have the right to object to or restrict certain processing, or to lodge a complaint with your data protection authority.

Accounts. Virtual Viewfinder does not offer self-service account creation, so it does not offer self-service account deletion either. Accounts are issued and closed by a [[COMPANY]] administrator. To have your account and its associated data deleted, write to [[PRIVACY_EMAIL]] from your work address; we will confirm your identity and act on the request.

9. Children

Virtual Viewfinder is a professional tool for employees and contractors. It is not directed to children and we do not knowingly collect information from anyone under 13 (or the equivalent minimum age where you live).

10. International transfers

Our infrastructure may process and store data in [[JURISDICTION]]. Where data moves across borders, we rely on appropriate safeguards permitted by applicable law.

11. Changes to this policy

If we change how we handle your information, we will update this page and move the "last updated" date above. Material changes will also be communicated to account holders directly.

12. Contact

Privacy
[[PRIVACY_EMAIL]]
Support
[[SUPPORT_EMAIL]]
Post
[[COMPANY]], [[COMPANY_ADDRESS]]