Legal

Privacy policy

Farview and your data: what stays on the phone, and what does not.

Last updated: 12 October 2026

1. Who processes the data

The controller is Ubiquitous S.r.l., Via Ariosto 25, 00185 Roma, Italia, P.IVA 17584931004. For anything about this policy, write to [email protected].

2. What stays on your device

Farview stores in the app's private storage, on your phone:

• the address and ONVIF port of every camera you save, with the name you give it
• camera credentials and the companion relay token, encrypted with an AES-256/GCM key held in the Android Keystore: the key material never enters the app process or a backup
• the last resolved RTSP stream URL, and your theme preference

None of it is transmitted to us. Uninstalling the app takes it with it.

3. What goes over the network

Video goes from the camera to your phone. On the same network the connection is direct; from outside it goes through the companion relay, which you install on a machine inside the camera network. The relay is yours: it runs on your hardware, uses your bandwidth, and we never see it. No video passes through a Synapsi server, because this product has none.

Diagnostics: crashes and usage statistics

The app uses two Google services: Firebase Crashlytics and Firebase Analytics (Google Ireland Limited).

When the app crashes, Crashlytics receives a technical report we use to understand what broke: the stack trace, the device model, the Android version and the app version. Analytics receives anonymous events about how the app is used — which screens are opened, which features are tapped — along with an identifier Google assigns to the installation, not to you.

Neither receives video, audio, credentials, your camera addresses, or anything of what you film. Those do not leave the device, as described above.

4. The account, the vault, and the relay

Farview for the desktop and the companion relay are the same product on a computer. Both the desktop app and the Android app can keep your camera list on an account instead of only on the device, inside something we call a vault: create one on either, and the same list opens on both.

What the vault holds, and what we can read of it

A vault is a camera list attached to your account. It is encrypted on your device before it is sent, under a key made on the device itself, at random — not derived from anything you type. That key is then wrapped with a second key, derived by Argon2id from a vault password you choose; what we store is the wrapped key and the ciphertext, never the password and never either key. What sits on our server is a byte string we cannot read, in a shell we cannot open either. A copy of our database is a list of email addresses and a pile of ciphertext.

The vault password only opens the vault — it does not sign you in, and it is not the same thing as your Google or email-link sign-in. The price of that is not negotiable and we would rather say it here than in a support reply: a forgotten vault password is an unrecoverable vault. There is no reset that keeps the data, because there is nothing on our side to reset it with; "start over", in the app, empties the vault, and every camera has to be set up again.

An account can hold several sites — "Home", "Office" — and each one is a vault of its own: its own key, its own password, its own cameras, its own people. One site's password never opens another, and what we said above is true of each of them separately. Of a site itself we keep, in the clear, only the name you give it, the email addresses you share it with, and which of your adopted machines serve it: a name so that somebody you share a site with can see which one it is before opening it, exactly as the name of a machine you adopt is in the clear; the link between site and machines so that each of your devices sends every machine the right list of cameras even when that site is not open on it. The cameras inside it stay ciphertext to us.

You can delete the account, and its vaults with it, from inside the app or from the account deletion page.

Signing in on the phone, and the vault there

The Android app signs in to the same account as the desktop — with Google or with a link by email, never a password — for the vault, the tunnel, and adopting a machine you run the relay on. It is optional, and nothing on your own network needs it.

• With Google: Google hands our server a signed statement of your email address and an identifier for your Google account, which is what the account is then tied to. It carries your name too, which we do not keep. We get no access to anything in your Google account.
• With a link by email: the address you type is sent to our server, which emails you a sign-in link through Mailjet (Sinch Email, France). We send the same answer whether or not an account exists for that address.

Either way the phone keeps a session — encrypted with a key held in the Android Keystore, like the camera credentials — and your email address, to show you who is signed in. After signing in with Google it also keeps your name and profile picture, for the avatar in the corner of the screen: the picture is downloaded once, from Google, and neither is sent to us.

The first time you sign in, you create a vault on the phone, or open the one already made on the desktop, so the same camera list is on both. While you are signed in, the phone keeps the vault's key too — encrypted with a key held in the Android Keystore, the same way it protects the camera credentials — and the desktop keeps its own copy in the operating system's keychain. Signing out forgets the session on the phone at once and ends it on our server whenever it can be reached, and it also removes the vault's key and its cameras from that device; nothing is removed from the vault itself, only from the phone that signed out. Without an account, everything stays on the phone exactly as it always did.

Sharing a vault (Pro)

If you are on Pro, you can give other people access to your vault by email address, as a member who can only view the cameras or one who can also edit them. We store each invited address, the role you gave it and when you invited it, and we send the invited person one email — through Mailjet (Sinch Email, France) — saying that a vault was shared with them. That email never contains the vault password: you give it to them yourself, some other way.

A member sees your email address. With the password, a member holds the vault's key, so technically they can read everything the vault contains, including camera passwords; the apps never show them this. Changing the vault's password always makes a new key, which is how you cut off someone you remove. A member may keep the key on their own phone, behind their fingerprint — never sent to us. When a member watches a camera through the tunnel, that use counts against your plan's allowance and appears in your tunnel usage log, not theirs.

We remove an invitation when you remove the member, start the vault over, or delete the account; deleting an account also removes every membership that address held in other people's vaults. If your Pro ends, members stay listed but their access is suspended until it returns.

Watching from outside: the relay, and the tunnel

The relay runs on your hardware, uses your bandwidth, and we never see it. If your internet connection is one no incoming connection can reach — carrier-grade NAT, which most mobile and fixed-wireless lines are — you can switch on the tunnel, and then your video does cross a machine of ours. That machine copies bytes between two sockets and reads none of them; with TLS on your relay, which we recommend and which this is the reason for, what crosses is ciphertext we hold no key to. It is off unless you turn it on, and it is part of a paid plan.

The tunnel's usage log. The tunnel gives each camera an amount of time a day, and to hold to it we keep a log: for each stream, your account, which relay, when it started, how long it ran, how many bytes it carried and how it ended; for each day, the time and bytes of each camera. A camera appears in it not by its address but by an identifier derived from a secret key, which the address cannot be recovered from. The log holds nothing of what the streams contain, because we do not read it. It exists to apply the plan's limits and to know what the service costs us, and only the people who run it see it. Stream rows are deleted after 90 days, daily totals after 400. If you delete your account they stay until then, with nothing left that links them to you.

Finding motion, people and animals (Pro)

If you are on Pro, a relay that records a camera can also watch it for movement, people and animals, so that the apps can draw a box around them and mark them on the timeline of the recordings. That happens on the machine the relay runs on and nowhere else. The analysis is a separate program next to the relay, with no network access of its own. It is never given the camera's address, user name or password, and no picture, box or result is sent to us. What it finds is written on the relay's disk beside the recording it belongs to, and deleted with it. The apps read it from your relay the way they read video: directly on your network, and from outside through the tunnel, where it crosses our machine as bytes we do not read, like the video.

The one download. The program needs a decoder, a neural-network runtime and a model, about 15 MB, which the relay fetches once, the first time a camera needs it and again only when a relay release brings a new pack, from https://farview.synapsi.ai/download/detect/. It is a single request for a file. It carries no account, no camera, no identifier and no parameters; our server sees the file asked for, the relay's name and version in the user agent, and the network address any download would show it. The relay checks the file against a checksum compiled into it before it unpacks anything, and installs nothing that does not match. Nothing else about detection is sent: that your plan includes it comes with the camera list the relay already fetches, and which kinds of detection you switched on and how sensitive it is (which are part of your vault, and so ciphertext to us) reach the relay with that list, like the recording settings. Set detect to false in the relay's configuration and it never downloads the pack and never analyses a camera.

Notifications (Pro)

A camera can tell you when it sees someone, or an animal, a vehicle or movement, if you turn that on for it. The relay decides, on your machine, from what its detection found; the notices are kept on the relay's disk for seven days, and the apps read them from your relay the way they read the recordings. While the app is open nothing else is involved.

When the app is closed a phone can still be told, through Google's push service, Firebase Cloud Messaging. For that the phone registers with our server a push token that Google gives it, a public key it makes for itself, and a name for the phone (its model). When a notice is made, your relay asks our server which phones may receive it — yours and those of the people you share the site with — and encrypts the notice on the relay, for each phone, with that phone's key. Our server passes the encrypted message to Google with the token, and Google delivers it. Neither we nor Google can read which camera saw what: what we learn is that one of your relays sent a notification to one of your phones, and when — which is roughly when something happened. We do not keep the messages. Signing out, turning off "Notifications when Farview is closed" in the settings, or deleting the account removes the phone's registration.

Farview for TV

You can connect an Android TV to your account from your phone. For each TV you connect, our server keeps the name the TV gives itself, its platform, the sites you gave it, when it was connected and when it was last used, and its session. The TV receives the keys of those sites encrypted for itself, and we cannot read them. You disconnect a TV from the phone or from the TV, and its data is deleted. Each time a TV is connected, we send you an email to tell you.

Farview for Wear OS

The watch talks only to your phone, through Google's Wearable channel on the device. Pictures travel from the phone to the watch; they are not stored there and are never sent to our server. There is no account on the watch.

Checking whether the relay can be reached from outside

To tell you whether reaching your cameras from outside will work, the relay asks two things, once when it starts and then every thirty minutes. A public STUN server (Google's or Cloudflare's) is asked which address your connection has on the internet. Then our server is asked to connect back to that address, on the relay's port, and says whether it reached your relay. It dials only the address the request came from, and what it learns is that address and whether the port answered — the same thing any website sees when you visit it. It is not tied to your account and is kept only in our server's ordinary access logs. Set reachabilityCheck to false in the relay's configuration and neither request is made.

The version check

The desktop app and the relay are downloaded from this site rather than from a store, so nothing on your computer would ever tell you a new version exists. Once each time it starts, each of them fetches https://farview.synapsi.ai/appcast.json — a static file containing a version number and the address of the download page — compares it locally, and says so if there is something newer.

The request carries no identifier, no version and no parameters. Our server sees a request for one file and the network address any download would show it. Nothing is downloaded and nothing is installed without you. The relay makes no such request at all when updateCheck is set to false in its configuration.

Google's own privacy policy governs its processing. You can ask us to have the diagnostic data deleted by writing to [email protected].

5. Permissions, and why

• Internet and network state — to reach the cameras and, if you configure one, your companion relay
• Wi-Fi state and multicast — ONVIF discovery is a multicast request on the local network, and without the multicast lock Android would silence it
• Camera — only to read the QR code the desktop app shows when you set up a relay, and only while that scanner is open. It is asked for at that moment and not at launch. Nothing is photographed and nothing is stored: each frame is decoded in memory and dropped, no image is written to the device, and none leaves it. Saying no costs you nothing but the convenience — the same address and token can be typed in by hand.
• Notifications — to show a camera's notices. It is asked for when you turn notifications on for a camera, not at launch; saying no keeps the notices in the app's list.

6. In-app purchases

The Farview Plus subscription is sold and managed by Google Play. Payment happens on your Google account: we never see a card number and we store no payment data. Google tells us only whether a subscription is active, without identifying you. Google's own privacy policy governs its processing.

7. Support: reports, and licences

From Info → Support the app can send a report — something that went wrong, or something you would like — to apps-management, a service of ours at apps-management.synapsi.ai. This is the one part of Farview that talks to a server of ours, and none of it happens unless you start it.

What is sent when you send a report:

• the title and the description you typed
• the app version, the Android version, the device model and the language the app is set to — what makes a fault reproducible
• only if you turn the switch on: a block of diagnostics about the app and the device, redacted before you see it. It is shown on the screen before it goes, and you can read it and decide
• only if you pick one: a screenshot, chosen by you from your gallery
• only if you type one: an email address, so we can answer. Without it the report is sent anyway and cannot be replied to
• a number drawn at random for that one report, so that sending it again after a lost connection is a retry rather than a second report in the queue. It is thrown away with the screen and identifies nothing and nobody

What is never sent: no account, no password, and no identifier of any kind — not an advertising id, not an installation id. Nothing is collected in the background: what travels is what you typed or switched on.

Reading the answer, and asking for features. To read a reply, or to vote on what other people have asked for, you need to be signed in to your Farview account — with Google or with a link by email — from version 2026.9.8. The app sends those requests to the Farview service with your account's session, and the Farview service passes them to our support service saying which address they come from: your account's. No separate code, no second password. Earlier versions asked for your email address and sent a six-digit code to it, and kept the key that bought in the app's private storage; from 2026.9.8 that key is deleted from the phone.

Licences. If we have granted you Farview Plus or Pro by hand — a tester, a translator, somebody whose payment failed for a reason that was not theirs — the app asks the Farview service, when it starts and when you sign in, whether that grant is still valid for your account's address. Nothing is sent but the session. When you sign out, the app stops treating the grant as yours on that phone.

How long your address is kept. It is stored so we can write back, and where it is only used for a comparison it is stored as a fingerprint rather than as an address. After five months in which nothing has happened — no report, no reply, no sign-in — we email you to say the address will be deleted in a month, and that opening the app is enough to keep it. A month later it goes. Nothing is ever deleted without that warning first: an address that passed six months while our mail was not working is warned then, and deleted a month after that.

How to have it deleted sooner. From the app: Info → Support → Your messages → Close my account, which asks once and then does it. It closes the support address and not your Farview account, and deleting your Farview account does not close the support address: our support service is shared by our apps, and the same address may be in use in another of them. Writing to [email protected] works too, and is the route that still works when you no longer have the app (both, in full). Either way the reports themselves stay, with the link to you removed: a fault is a fault once it is reported, and what is left cannot be traced back to anybody.

The service runs on our own machine in Milan (Google Cloud, europe-west8), behind Cloudflare. The verification and reply emails are sent through Mailjet (Sinch Email, France).

8. Your rights

The GDPR gives you access, rectification, erasure, restriction, portability and objection. For this app the practical answer is nearly always the same: the data is already only yours and already only on your device. For the diagnostic data, write to us and we will have it deleted. You can still write to [email protected], and you may lodge a complaint with your data protection authority.

To remove what the app holds, or to ask for the diagnostic data to be deleted, see Delete your account.

9. Children

The app is not directed at children under 13 and does not knowingly collect data about them.

10. Changes

If this policy changes, the date at the top changes with it. Material changes are announced in the Google Play release notes too.