Privacy Policy
Last updated: 2026-11-05
Who is responsible
The data controller is 4KEye. There is no separate registered trade name. Contact: [email protected].
Data stays on your device
Camera names, addresses, usernames and passwords are stored only on your device (passwords in the iOS Keychain or Android Keystore). Video streams go directly between your device and your cameras. We do not receive or store your video. The exceptions are scanning a recorder's QR code (see "Camera") and the optional Premium remote viewing (see "Remote viewing").
Crash reports
Crash reports are off until you allow them. The first time you open a camera the app asks whether it may send crash reports (Firebase Crashlytics, Google); you can change this any time in Settings. A report may include the device model, OS version, app version and a Firebase installation ID, never camera logins or addresses. Firebase Remote Config, which switches features on or off, contacts Google when the app starts (IP address and Firebase installation ID) and runs without asking because the app needs it to work.
Local network
The app asks for local network access to find cameras on your Wi-Fi (ONVIF and XM-series search). These searches stay on your network.
Camera
The phone's camera is used only when you tap "Scan QR code", to read the code on your recorder. No picture is stored. Some recorders (XM-series) show a code that holds the device ID, login name and password in scrambled form. To read it, the app sends the scanned text to the 4KEye API (4keye.com) over HTTPS, additionally encrypted with a key unique to your installation. The server decodes it, returns the result to your phone, and does not store or log the scanned text or the result. It keeps only a random installation ID and its key. If you do not scan, nothing is sent. If the device isn't found on your network, the app may also ask the API to look up its current internet address from the manufacturer's own public status service (no account, no video, just an address), so you can connect to it directly.
Accounts and subscriptions (optional)
4KEye works without an account. If you subscribe to Premium you sign in with Google, Apple or email through Firebase Authentication. We store your account ID, your email address and the status of your subscription (plan, expiry date, renewal state) so that Premium works on all your devices and when you restore purchases. Payments are handled by Apple or Google; we never see your card details. You can delete your account in the app (Premium screen), which removes your profile from our server.
Remote viewing (Premium)
With Premium the app can show a camera that is not on your network. For this the app sends the camera's serial number and login to the 4KEye API over HTTPS. The API uses them once to request a temporary viewing address from our video-cloud provider, JFTech (a company based in Hangzhou, China; we use its servers for your region), and returns only that address to the app. The camera is registered with the provider under our developer account by its serial number. We do not store or log the camera login. While you watch, the video passes through the provider's servers. Without Premium, or when the camera can be reached directly, video still goes straight between your device and the camera. We keep a record linking your account to the serial numbers of the cameras you view this way (to limit how many cameras one account can use). It is deleted with your account. The camera's login is also passed on to the provider with each request, so that it can open the camera.
Why we process data, and on what legal grounds
Account and subscription data (account ID, email, subscription status, and camera serial numbers used for remote viewing) are processed to provide Premium, which is performance of our contract with you (KVKK art. 5/2-c). Crash reports are sent only if you allow them in the app; that is your explicit consent (art. 5/1), which you can withdraw any time in Settings. Basic technical logs on our server serve security and abuse prevention, our legitimate interest (art. 5/2-f). Store purchase records are kept where the law requires it (art. 5/2-ç).
Who receives data, and transfers abroad
Recipients: Google (Firebase Authentication, Crashlytics and Remote Config; servers in the USA and other countries), Apple or Google Play for payments, JFTech (Hangzhou, China) for remote viewing, and the hosting of our own server. Google, Apple and JFTech are outside Türkiye, so this data is transferred abroad. These transfers are occasional and happen only when you use the related feature: they are necessary to perform our contract with you (signing in, subscribing, remote viewing; KVKK art. 9/6) or rest on your explicit consent (crash reports). Where the recipient offers contractual safeguards (for example Google's standard contractual clauses) they apply in addition. If you use none of these features, nothing is sent except the Remote Config request described under "Crash reports". You can withdraw consent by deleting your account or switching crash reports off.
How long we keep data
Account and camera-link data: until you delete your account. Subscription records: after you delete your account they are kept as store records, no longer linked to you, so that refunds and renewals can still be matched. A camera serial waiting to be released at the video-cloud provider: a few days. Cameras not viewed remotely for 30 days are dropped from your account. Server logs: up to 30 days. Crash reports: as Firebase keeps them (90 days).
Your rights under KVKK article 11
You may ask whether your data is processed and request information about it; learn the purpose and whether it is used accordingly; learn the recipients at home and abroad; ask for incomplete or wrong data to be corrected; ask for data to be erased or destroyed and for recipients to be told; object to a result produced against you solely by automated analysis; and claim compensation for damage caused by unlawful processing. Write to [email protected]; we answer within 30 days. You may also complain to the Personal Data Protection Authority (KVKK).
Your rights (KVKK / GDPR)
Camera data stays on your device and is removed when you uninstall the app. If you created an account you can delete it in the app (Premium screen) or by writing to us; this removes your account ID, email address, subscription link and remote-viewing camera records from our server, and cameras that no other account uses are also released at the video-cloud provider. Questions: [email protected]