Acceptance
By installing and using Chameleon, you agree to these terms. If you don't agree, don't use the app.
No Warranty
CHAMELEON IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
The app may have bugs, crash, lose data, or not work on your device. You use it at your own risk.
Limitation of Liability
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
This includes but is not limited to: data loss, device damage, bricked devices, lost keys, vault corruption, security breaches, or any indirect, incidental, special, or consequential damages.
License
Chameleon is open source under the MIT License. You may use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the software, subject to the license terms.
The MIT License text is included in the repository and in the app's license screen.
No Affiliation
Chameleon is not affiliated with, endorsed by, or connected to Google, YouTube, Android, or any device manufacturer.
Key System
- Keys are device-bound and cannot be transferred
- The channel trip (visit YouTube, return) is the only verification gate
- No subscription is actually verified — YouTube provides no API for that
- Keys expire in 3 days, extendable 7 times (+1 day each)
- Keys can be revoked anytime from the app or website
Vault & Security
- Vault uses Android Keystore (StrongBox when available)
- Master key never leaves secure hardware
- Biometric auth required for decrypt operations
- Emergency codes are one-time use, 24h expiry
- QR sync is device-to-device, no cloud
- YOU are responsible for remembering passphrases and backing up emergency codes
System Modifications
- Chameleon writes to real Android system settings via documented APIs
- Some settings require privileged permissions (granted via ADB or root)
- Writing to settings the system refuses will be reported honestly, not silently ignored
- App freezer uses DeviceAdminReceiver (user-enabled)
- Launcher replacement requires user to set as default home app
Updates
- App checks for updates via GitHub Releases API on launch
- Mandatory updates (min_version) will block the app until updated
- Network failure fails open — you're never locked out by a network issue
- Updates distributed via GitHub Releases with published SHA-256 hashes
Termination
We may terminate or suspend access to the key generation service at any time, without notice, for any reason. Local app functionality (launcher, vault, monitor) will continue to work.
Changes
We may update these terms. Changes posted here with updated date. Continued use constitutes acceptance.
Governing Law
These terms are governed by the laws of the jurisdiction where the developer resides, without regard to conflict of law principles.
Contact
Questions? Open an issue on GitHub.