Data We Collect
Chameleon is designed to work offline-first. We collect minimal data:
- Device ID (ANDROID_ID) — Used to derive your device-bound key. Never leaves your device except when you request a key via the web flow.
- Signed link token — When you request a key via the website, the token (timestamp + random) is sent to verify the channel trip. Valid for 30 minutes.
- Install check-in — A single ping to our stats endpoint on first run, counting total installs and active devices. No personal identifiers.
- GitHub release checks — The app fetches the latest release from GitHub API to check for updates. No auth, no user data.
Data We DON'T Collect
- Your Google account / YouTube subscription status
- App usage patterns, launch history, screen time
- Installed app list (stays on device)
- Vault contents, keys, passwords
- Location, contacts, SMS, call logs
- Biometric data (stays in Android Keystore)
- Any analytics, crash reports, telemetry beyond the two counters above
How We Use Your Data
- Key generation: Device ID + nonce + package name → SHA-256 → your unique key
- Channel trip verification: Signed token confirms you visited the channel and returned
- Update checks: GitHub API fetch for latest release version
- Stats: Aggregate counters (downloads, active devices, channel trips) for public stats page
Data Storage
- All keys, vault entries, settings stored locally in Android SharedPreferences/DataStore
- Vault entries encrypted with AES-256-GCM, master key in Android Keystore
- No cloud sync unless you explicitly enable vault QR sync (device-to-device)
- No backup to Google Drive unless you use Android's full backup (opt-in)
Third Parties
We use no third-party analytics, crash reporting, or tracking SDKs. The only external requests are:
- GitHub API (api.github.com) — for release checks
- YouTube (youtube.com) — only when you tap "Go to channel", opened in system browser
- Our stats endpoint (chameleon-5by.pages.dev/api/stats) — single install check-in
Your Rights
- Revoke your key anytime → all local keys deleted
- Uninstall the app → all local data deleted
- No account to delete — there is no account
- No data to export — everything is already on your device
Children's Privacy
Chameleon is not directed at children under 13. We do not knowingly collect data from children.
Changes
We may update this policy. Changes posted here with updated date. Continued use constitutes acceptance.
Contact
Questions? Open an issue on GitHub.