Privacy Policy

The Eagle Eye app collects no personal data. This website keeps only what is listed below, and only for as long as stated.

• Camera Permission: The app requires camera access solely for scanning QR codes displayed on satellite television broadcasts. The camera is used only for real-time QR code detection. No images or video are captured, stored, or transmitted.
• Network Access: The app does not have the Android INTERNET permission. It is physically incapable of sending or receiving data over any network.
• Data Storage: All data received via QR code scanning is stored locally on the device, encrypted with SQLCipher AES-256. No data is transmitted to any server.
• Accounts: No accounts, registration, phone number, or email are required to use the app.
• Third Parties: No data is shared with any third party. No third-party SDKs collect or transmit user data.
• No analytics, no tracking, no telemetry, no crash reporting to external services.
• Screenshot protection is enabled by default to prevent accidental exposure.
• This website sets no cookies.
• The only third-party script loaded on this site is the anti-abuse check (a CAPTCHA), used to block automated activity.
• We run no analytics, tracking pixels, or telemetry. Requests are served through our hosting provider, which may log them at the network level for security and error reporting.
• Contribution processing: payments are handled entirely by Stripe over an encrypted connection. No card details ever reach or are stored on our server.
• What we keep from each contribution: a two-letter country code (e.g. GB), the tier and amount, whether it is monthly or one-time, the time, your optional display name, your optional message (up to 140 characters), and the Stripe payment session id. The session id and the amount are never published; we keep them only to find the payment if you ask for a refund and to correct the counters. The public feed shows only an identifier produced by HMAC-SHA-256 of the Stripe session id (truncated to 16 bytes), which cannot be reversed without the server-side key. No full names, addresses, emails, or card data are stored.
• Your optional name and message appear in the solidarity feed only after the project team has reviewed them; until then your contribution shows without a name.
• Retention: we keep only the 40 most recent contributions. With each new contribution, older ones are deleted from public view and from our storage; only aggregate counters (number of supporters, supporters per country, hours funded) remain. The name and message you enter before payment are held separately for at most 2 hours so they can be attached to your contribution, and Stripe payment event ids are kept for 7 days so a payment is never counted twice.
• Family messages: your message is encrypted in your browser and never reaches our server in readable form.
• To limit abuse, your network address (your IP address, or for IPv6 only its network part) is hashed with a key that changes daily and kept for that day only; a grouping code made from it (or from your invite code, when invites are required) and a key unique to each air day stays with your cards and is deleted with them. Sealed cards are kept until 24 hours after their last day on air.
• To keep track of use, we keep only the total number of messages for each day (one year) and a few totals for each month (13 months); details are in "What we keep, and for how long" on "How family messages work".
• The family messages page keeps your sender identity in your browser (IndexedDB) and, if you choose, saved people and copies. These are never sent to us and are erased with "Forget everything".
• The family messages pages use the anti-abuse check (details on "How family messages work").

For any question about this page, email us at: info@cheshmehoghab.app