Last updated: April 25, 2026
Videotapr is built to collect as little data as possible. Your video and audio recordings stay on your device and are never uploaded by us. The only data that leaves your phone is a hashed device identifier and a timestamp, which we use to prevent abuse of the free trial. We do not use analytics, advertising, tracking, or user accounts.
Videotapr is developed and operated by StepFox, a sole proprietorship based in Veghel, the Netherlands.
Contact for privacy questions: info@stepfox.com
| Data | Purpose | Legal basis | Where it goes |
|---|---|---|---|
| Hashed device identifier (SHA-256 hash of Android SSAID with a fixed salt) | Preventing repeated abuse of the free trial period | Legitimate interest (Art. 6(1)(f) GDPR) | Google Firebase Firestore (EU region eur3) |
| Trial start timestamp | Determining whether the trial period is still active | Legitimate interest (Art. 6(1)(f) GDPR) | Google Firebase Firestore (EU region eur3) |
| Purchase token (when you buy Pro) | Verifying your in-app purchase and unlocking Pro features | Performance of contract (Art. 6(1)(b) GDPR) | Google Play Billing (handled by Google) |
About the device identifier: the raw Android SSAID is never sent or stored. It is hashed on your device with SHA-256 and a fixed salt before it leaves the phone. The result is a pseudonymous identifier that cannot be reversed back to the original ID and that we cannot link to your name, e-mail, phone number, or Google account.
Balancing test (legitimate interest): we have weighed our interest in preventing trial abuse against your privacy. We minimize the impact by (a) hashing the identifier, (b) storing nothing else alongside it, (c) building no profile, (d) keeping retention to a strict minimum (see section 5), and (e) never sharing the data for marketing or analytics.
| Data | Purpose | Where it stays |
|---|---|---|
| Camera footage (video) | Core functionality: recording the last 10/20/30 seconds as a clip | Stored only on your device |
| Microphone audio | Recorded as the audio track of your video clips | Stored only on your device, as part of the video file |
| Contact names (if you grant access) | Tagging players in your saved clips | Read locally on your device only — never transmitted off the device. Phone numbers are not stored. |
| Wear OS messages | Receiving start/stop/save commands from a paired smartwatch | Exchanged locally between phone and watch via Google Wearable APIs |
If you fill out one of the forms on videotapr.com, we store the data you submit. Both forms are voluntary and based on your consent (Art. 6(1)(a) GDPR).
| Form | Data | Purpose | Where it goes |
|---|---|---|---|
| Early access signup | E-mail address | Sending one launch announcement e-mail | AWS DynamoDB (EU region eu-west-1, Ireland) |
| Tester signup | Name, e-mail, phone model, platform choice (Android / iOS / both), smartwatch choice | Coordinating the testing programme: sending opt-in links and occasional updates | AWS DynamoDB (EU region eu-west-1, Ireland) |
You can request deletion at any time (see section 7).
Below is the complete list of Android permissions the app requests and why.
| Permission | Why we need it |
|---|---|
CAMERA | To record video |
RECORD_AUDIO | To record audio as part of the video |
FOREGROUND_SERVICE, FOREGROUND_SERVICE_CAMERA, FOREGROUND_SERVICE_MICROPHONE | To keep the recording running reliably while the screen is off or another app is in front, with a persistent notification as required by Android |
POST_NOTIFICATIONS | To show the recording status notification (Android 13+) |
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS | To prevent Android from killing the recording service during long matches |
READ_CONTACTS | To let you tag players in saved clips. Contact data is only read locally and never leaves your device |
INTERNET, ACCESS_NETWORK_STATE | To talk to Firebase Firestore (trial check) and Google Play Billing |
com.android.vending.BILLING | To process the one-time Pro purchase via Google Play |
Where data is stored:
eur3 (European Union). Google acts as our data processor.Encryption: all data sent off-device to any backend (Firebase Firestore, Google Play Billing, AWS) is encrypted using HTTPS/TLS — this is enforced server-side and cannot be disabled by the app. Firebase Firestore encrypts data at rest by default. We never send personal data over an unencrypted connection.
Access control: Trial records are protected by Firestore Security Rules: a record can be created once but never modified or deleted by clients, preventing tampering with the trial period. Bulk listing of the collection is disabled. Records contain only a hashed device identifier and a timestamp, with no personal data.
| Data | Retention |
|---|---|
| Hashed device ID + trial timestamp | Stored as long as needed to enforce the trial limit. Records older than 12 months from the trial start date are eligible for deletion. You can request deletion at any time (see section 7). |
| Video and audio recordings | Managed entirely by you on your own device. Deleting the app removes any clips stored in the app's private folders; clips you saved to a public folder remain until you delete them. |
| Contact names | Read on demand from your phone's contact list. Only the names of players you have added to a session are stored locally inside the app, and removed when you uninstall. Phone numbers are not stored. |
| Early access e-mail address (website signup) | Stored until the public launch of the app, plus a maximum of 30 days for the launch announcement. Deleted automatically thereafter, or earlier on request. |
| Tester signup data (name, e-mail, phone model, platform, smartwatch) | Stored for the duration of the tester programme, plus a maximum of 30 days after the public launch for final communication. Deleted automatically thereafter, or earlier on request. |
| Third party | Role | Data | Location |
|---|---|---|---|
| Google Ireland Limited (Firebase Firestore) | Storing the hashed device ID and trial timestamp | Hashed device ID, trial start timestamp | EU multi-region eur3 |
| Google Ireland Limited (Google Play Billing) | Processing the in-app purchase of Pro | Purchase token, Google Play account (held by Google, not by us) | Per Google's policy |
| Amazon Web Services EMEA SARL (DynamoDB, Lambda, SES, S3, CloudFront) | Hosting the videotapr.com website, processing the early access and tester signup forms, and sending confirmation e-mails | Website request data; e-mail address (early access); name, e-mail, phone model, platform and smartwatch choice (tester signup) | EU region eu-west-1 (Ireland) |
Under the General Data Protection Regulation (GDPR) you have the right to:
To request deletion of the data we hold about you, send an e-mail to info@stepfox.com with the subject line "Data deletion request". Because we do not have user accounts, please include in your message:
We will confirm receipt within 7 days and complete the deletion within 30 days, in line with Article 12(3) GDPR. Deletion of trial data may cause the trial period to reset on your device.
Videotapr is not directed at children under the age of 13, in line with Google Play's Families policy and the U.S. Children's Online Privacy Protection Act (COPPA). In the European Union, the minimum age for consent under GDPR varies between 13 and 16 depending on the member state — children below the applicable age in their country should only use Videotapr with the involvement of a parent or guardian. We do not knowingly collect personal data from children below these ages.
All personal data we process is stored in the European Union (Firebase Firestore eur3 and AWS eu-west-1). Google and Amazon may, for the purpose of operating their global infrastructure, process limited operational metadata outside the EU. Both providers offer Standard Contractual Clauses (SCCs) and other appropriate safeguards as required by Chapter V of the GDPR.
We may update this privacy policy from time to time. The current version is always available on this page, with the "Last updated" date at the top. For material changes affecting how we handle your data, we will notify you through the app before the changes take effect.
StepFox
Veghel, the Netherlands
info@stepfox.com