Last updated: September 15, 2026
Also available in: English · Deutsch · Ελληνικά · Español · Français · Italiano · Nederlands · Polski · Português · Română · Svenska
Witness ("the app") is built to help people document encounters with law enforcement and preserve that footage off-device. This policy explains what data the app handles, where it goes, and who can see it.
| Data | Purpose | Where it goes |
|---|---|---|
| Video and audio | The core recording feature | Written to your device, then uploaded to the cloud storage account you connected |
| GPS location | Embedded in video metadata and a chain-of-custody manifest file, so footage can be tied to where it was captured | Stored in the video file and in a single per-session manifest file, uploaded to your cloud storage account |
| Timestamps (UTC) and device time zone | Chain-of-custody / evidentiary record of when footage was captured | Stored locally in an event log and the per-session manifest file, uploaded to your cloud storage account |
| Cloud account authorization (OAuth token, or a WebDAV server address and password) | Lets the app upload to your chosen storage account on your behalf | Stored in your device's Keychain; sent only to that provider's own servers to authenticate upload requests |
| A copy of each recording, saved to your Photos library | On-device backup, independent of cloud storage, so footage survives even if the app is removed | Saved to your device's Photos library; if you have iCloud Photos enabled, Apple syncs it to your iCloud account |
| Emergency contact names/emails (if you add any) | Automatically sharing each recording with people you trust, as it uploads | Stored on your device; when a recording starts uploading, each contact's email is sent to your provider's sharing API (Google Drive or Dropbox) to grant them view access to that recording's folder. This feature is unavailable on WebDAV, which has no sharing mechanism to use |
The app does not collect analytics, does not use advertising or tracking SDKs, and does not transmit any data to the developer. The only third parties contacted are whichever cloud storage provider you connect, for the sole purpose of uploading files to your own account there, and a time-stamp authority, which receives nothing but a cryptographic hash (see below).
Witness supports three kinds of storage account, and you choose one when you connect the app:
drive.file OAuth scope — Google's most restricted Drive scope. It only grants access to files and folders the app itself creates in your Drive. The app cannot see your existing files, folders, or any other data in your Google account.You can revoke Google or Dropbox access at any time from that provider's own account settings (for Google, Third-Party Apps & Services), or by disconnecting the account in the app. For WebDAV, disconnecting the account in the app removes the stored credentials from this device. Revoking access does not delete footage already uploaded. That footage is yours, stored in your own account, and is managed the same as any other file there.
Video is recorded in short chunks on your device and deleted automatically once your cloud storage account confirms it has received both the video and its accompanying metadata file. If the device has no network connection, chunks remain in local storage until a connection is available, so no footage is deleted before it is safely uploaded.
When a recording finishes, Witness sends a SHA-256 hash of that session's manifest file to an independent time-stamping authority (currently freetsa.org), which returns a signed token certifying that the file existed in exactly that form at that moment. This is what allows footage to be shown later as unaltered, by a party with no connection to you or to this app.
Only the hash is transmitted. A hash is a short fingerprint computed from a file; it cannot be reversed. The authority never receives your video, your manifest, your location, your identity, or any information about what was recorded, and cannot reconstruct any of it from what it does receive.
The signed token is stored alongside your recording in your own cloud storage account, and a copy is kept on your device so a report can be produced later. If the authority cannot be reached, the recording and its hashes are kept exactly as before, only the external certification is missing.
You can optionally add emergency contacts in the app's settings. When a recording starts uploading, Witness grants each contact view access to that recording's folder via their email address, using your storage provider's own sharing feature, and that provider notifies them directly. This means people you choose can see your footage as it arrives, and keep access even if your phone is taken. This feature requires Google Drive or Dropbox; a WebDAV account has no sharing mechanism to grant, so emergency contacts cannot be added when that is your storage choice.
Contact details are stored on your device and are used only for this purpose: the email address is sent to your storage provider's sharing API and to no one else. Contacts are shared with only when you record. You can remove a contact at any time in the app, and you can revoke access to any already-shared folder from your storage provider's own sharing controls.
Unless you turn it off in the app's settings, Witness also saves a full copy of each recording session to your device's Photos library, as an on-device backup independent of cloud storage. The app requests only "add-only" Photos access: it can add its own recordings to your library, but it cannot see, read, or access any of your existing photos or videos.
If you have iCloud Photos enabled on your device, Apple will sync these recordings to your iCloud account like any other video in your library, subject to Apple's Privacy Policy. You can turn off the Photos backup in the app's settings while still uploading to your cloud storage account, and you can delete saved recordings from your Photos library at any time.
Witness requests "While Using the App" location access. Recording runs with the display dimmed to zero brightness but the app genuinely in the foreground, so this level of access is sufficient and the app does not ask for background location. Location is used exclusively to timestamp and geotag recordings for evidentiary purposes. It is not used for any other purpose, is not shared with any third party, and is not used to track you outside of active recording sessions.
Because recordings are stored in the cloud storage account you chose, you control retention and deletion directly through that account. The developer has no copy of your data to retain or delete. Deleting a file removes it from your provider's storage subject to that provider's own retention policies — see Google's Privacy Policy and Dropbox's Privacy Policy, linked below, or your own server's policies if you use WebDAV.
Witness is not directed at children and is not intended for use by anyone under 13.
If this policy changes, the "Last updated" date above will be revised and the updated policy will be published at this same URL.
Questions about this policy can be directed to: olmaster13@gmail.com
Depending on which storage provider you choose, this app uses the Google Drive API and Google Sign-In (subject to Google's Privacy Policy) or the Dropbox API (subject to Dropbox's Privacy Policy). If you connect a WebDAV server such as Nextcloud, your credentials and files are sent directly to the server address you provide; that server is not operated by the developer and is governed by whatever privacy practices its operator has in place.