HamSecure

1. Who we are

This Privacy Policy explains how Autcust.Dev ("we", "us", "our"), based in India, handles information in connection with the HamSecure Android application ("HamSecure", "the app") distributed on Google Play.

For the purposes of the EU and UK General Data Protection Regulation, Autcust.Dev is the data controller only for the limited diagnostic data described in this policy. Intruder photos, timestamps, and locations recorded by the app are created and kept on your device, under your control; we never receive them.

You can reach us at any time at autcust@gmail.com.

2. Summary

Reading the whole policy takes a few minutes. If you only want the short version: the evidence HamSecure collects belongs to you, stays on your phone, and is shared only when you choose to share it.

3. What HamSecure does

HamSecure is an intruder-detection app for Android. When someone enters a wrong PIN, pattern, or password on your lock screen, the app:

• takes a silent photo with the front camera;
• records the date, time, and number of failed attempts;
• optionally records where it happened, if you have granted location access;
• optionally sounds a loud alarm after a number of failed attempts you choose, which can only be silenced with your fingerprint, face, or device credential.

You review this evidence in a dashboard protected by biometric authentication, where you can view, share, or delete each record.

4. Information that leaves your device

The table below lists every category of data that leaves your device, why it is processed, and who receives it. It matches the Data Safety declaration on our Google Play listing.

Data transmitted by or through HamSecure

No data in this table is sold or used for advertising. None of it identifies you by name, and we do not attempt to link it to your identity. Intruder photos are never part of any transmission listed here.

5. Intruder photos and logs

The core of HamSecure works entirely on your device. Each time an intrusion is detected, the app saves:

• A photo (JPEG) taken with the front camera.
• A small log file containing the date, time, number of failed attempts in that session, and — if available — the latitude, longitude, and street address.
• A daily attempt counter and your app settings (such as the alarm threshold), stored in Android's DataStore.

These files live in HamSecure's private app storage, which other apps cannot read. They are not added to your gallery, not uploaded to us, and not shared with any third party unless you share them yourself. The camera is used only at the moment a failed unlock attempt is detected (or briefly while you are setting the app up); HamSecure never records video, never records audio, and never uses the camera at any other time.

Records are kept until you delete them. Deleting a record from the dashboard requires biometric or device-credential confirmation, and permanently removes both the photo and its log.

6. Location and address lookup

Location access is optional. You can skip it during setup, and HamSecure will still take photos and log attempts without it.

• If you grant precise location, the app requests a high-accuracy fix; if you grant only approximate location, it uses that instead.
• Location is requested only at the moment of a failed unlock attempt. HamSecure does not track your location in the background, does not keep a location history, and does not request the "Allow all the time" background location permission.
• The location fix is obtained through Google Play services' Fused Location Provider. Depending on your device settings (for example, Google Location Accuracy), Google may process Wi-Fi, mobile network, and sensor signals to compute that fix, under Google's Privacy Policy.
• To show a readable address, the coordinates are passed to Android's Geocoder, which on most devices sends them to Google's reverse-geocoding service and returns a street address. Only the coordinates are sent — never the photo, the time, or anything about you.
• The resulting coordinates and address are stored only in the local log on your device.

You can withdraw location access at any time in Android Settings → Apps → HamSecure → Permissions → Location.

7. Device administrator access

Android only tells an app about failed lock-screen attempts if the app is an active Device Administrator. HamSecure asks for this privilege after showing a clear disclosure, and requests exactly one policy:

• watch-login — lets Android notify the app when a lock-screen unlock attempt fails or succeeds.

HamSecure is notified only that an attempt failed or succeeded. It never sees, records, or transmits the PIN, pattern, or password that was entered. It does not use device administrator access to lock, wipe, reset, or change the password of your device, to disable the camera, or to monitor any other activity.

You can revoke this access at any time in Android Settings → Security → Device admin apps (the exact path varies by manufacturer). Once revoked, HamSecure stops detecting failed attempts, and the app can then be uninstalled normally.

8. Biometric authentication

HamSecure uses Android's built-in BiometricPrompt to protect the dashboard, to confirm deletion of evidence, and to silence the alarm. Authentication is performed entirely by the Android system.

The app only receives a "success" or "failure" result. Your fingerprints, face data, PIN, pattern, and password are never accessible to HamSecure and are never stored or transmitted by us.

9. Crash reporting and diagnostics

To keep HamSecure reliable — a security app is only useful if it works when it matters — we use Google Firebase Crashlytics. When the app crashes, the following is collected automatically:

• Crash logs and stack traces showing which code path failed.
• Device diagnostics such as device model, Android version, orientation, and available memory or storage at the moment of the crash.
• An anonymous installation UUID, randomly generated on your device and used only to count how many installations a given bug affects.

Crash reports never contain intruder photos, log contents, locations, or addresses. This data is transmitted over an encrypted connection, processed on Google's servers, and used solely to fix bugs and improve stability. It is never used for advertising, cross-app tracking, or profiling. Firebase's handling of this data is described in the Firebase Privacy and Security documentation.

10. What we never collect

• Names, email addresses, phone numbers, or any other direct personal identifiers.
• Accounts or logins — HamSecure has no sign-up and no cloud account of any kind.
• Intruder photos, attempt logs, or recorded locations — these stay on your device.
• Your lock-screen PIN, pattern, or password, or any biometric data.
• Video or audio recordings.
• Your contacts, messages, call logs, calendar, browsing history, or other apps' data.
• Background or continuous location history.
• Advertising identifiers — HamSecure contains no ads and no advertising SDKs.
• Any data sold to third parties, in any circumstance.

11. Sharing and device backups

Sharing you choose

From the dashboard you can share an intruder photo or copy an address to the clipboard. Sharing opens Android's share sheet and sends the photo only to the app you pick — for example, a messaging app or email. Once shared, the copy is handled under that app's or recipient's privacy practices, which we do not control.

Android backup

HamSecure supports Android's standard backup system. If you have turned on backup for your device (for example, Google One / Google Drive backup), Android may include HamSecure's app data — including intruder photos, logs, and settings — in your personal device backup. This backup is managed by Google under your Google Account, not by us, and on Android 9 and later it is encrypted with your device screen lock. We never have access to it. You can turn backup off in Android Settings → System → Backup (the path varies by manufacturer).

12. People photographed by the app

By its nature, HamSecure photographs whoever enters a wrong unlock code on your device — which could be a stranger, a family member, a friend, or you. Those images are personal data of the person pictured.

• We never receive, see, or store these photos, and we cannot identify anyone in them.
• You decide whether to keep, share, or delete them, and you are responsible for doing so lawfully.
• Use HamSecure only on a device you own or are authorised to protect. Do not use it to covertly monitor other people, and check that recording images of others complies with the privacy, surveillance, and data protection laws where you live.
• If someone asks you to delete a photo of them, you can do so from the dashboard at any time.

13. Legal bases for processing (EU/UK GDPR)

• Legitimate interests (Art. 6(1)(f)) — crash reporting and stability diagnostics. Our interest is in keeping a security app working reliably; the data involved is minimal and not used to identify you.
• Consent (Art. 6(1)(a)) — location access and the related address lookup, which happen only after you grant the Android location permission. You can withdraw consent at any time by revoking the permission.
• Performance of a contract (Art. 6(1)(b)) — providing the app's core detection, capture, and alarm features, which run locally on your device.

Intruder photos and logs are processed only on your device for your own security purposes. We do not process them, so we are not their controller.

14. Data retention

• Intruder photos and logs: stay on your device until you delete them. HamSecure never deletes evidence automatically. Uninstalling the app or clearing its storage removes them permanently (apart from any copy in your own device backup or anything you have shared).
• Daily attempt counter and settings: stored locally; the counter resets each day.
• Crash data: retained by Firebase Crashlytics for up to 90 days for detailed reports, with aggregated, non-identifying statistics kept longer.
• Geocoding requests: handled by Google under its own retention schedules, described in Google's Privacy Policy. We keep no copy.
• Support emails: kept only as long as needed to resolve your request, then deleted.

15. International data transfers

Google processes crash and geocoding data on servers in the United States and other countries. Where data is transferred out of the European Economic Area, the United Kingdom, or Switzerland, Google relies on legal transfer mechanisms including the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Details for Firebase are in the Firebase Data Processing and Security Terms.

16. Your rights and choices

Everyone

Because the evidence HamSecure collects is stored only on your device, you already have full control over it: view it in the dashboard, delete individual records, clear the app's storage, or uninstall the app. You can also revoke camera, location, notification, overlay, or device administrator access at any time in Android settings.

EU, UK, and Switzerland (GDPR)

You have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority. Write to autcust@gmail.com and we will respond within 30 days. Note that because crash data is pseudonymous and we hold no account or identifier linked to you, under Art. 11 GDPR we may be unable to act on a request we cannot match to any data.

California (CCPA/CPRA)

We do not sell or "share" personal information as those terms are defined under the CCPA as amended by the CPRA, and we do not use any data for cross-context behavioral advertising. California residents have the rights to know, delete, and correct their personal information, and to not be discriminated against for exercising those rights.

India (DPDP Act, 2023)

If you are in India, you may request access to, correction of, or erasure of your personal data, and may raise a grievance with us at autcust@gmail.com. We will acknowledge grievances within a reasonable period.

17. Children's privacy

HamSecure is not directed to children. It is intended for users aged 18 and over, is not enrolled in Google Play's Designed for Families programme, and does not target a child audience in its content or design.

We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction, such as 16 in parts of the EEA). If you believe a child has provided us with information, contact autcust@gmail.com and we will delete it.

18. Security

Intruder photos and logs are stored in HamSecure's private app sandbox, which other apps cannot read. The dashboard is protected by biometric or device-credential authentication, and deleting evidence or silencing the alarm requires the same confirmation. Photos are shared only through Android's secure FileProvider with a one-time, read-only grant to the app you choose. Crash data travels to Google over encrypted HTTPS/TLS connections.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If a data breach affecting your data ever occurs, we will notify affected users and the relevant authorities as required by law.

19. Android permissions and why they are needed

• CAMERA — take a photo with the front camera when a failed unlock attempt is detected.
• ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION (optional) — record where an intrusion attempt happened. Used only at the moment of an attempt, never in the background.
• Device Administrator (BIND_DEVICE_ADMIN, "watch-login" policy) — receive notice from Android when a lock-screen unlock attempt fails or succeeds. No other device-admin policy is requested.
• SYSTEM_ALERT_WINDOW (display over other apps) — allow the capture and alarm screens to open from the lock screen at the moment of an intrusion.
• POST_NOTIFICATIONS — show the ongoing notification while the intruder alarm is sounding.
• FOREGROUND_SERVICE / FOREGROUND_SERVICE_MEDIA_PLAYBACK — keep the alarm siren playing reliably until you dismiss it.
• USE_BIOMETRIC — ask Android to verify your fingerprint, face, or device credential before showing the dashboard, deleting evidence, or silencing the alarm.
• INTERNET / ACCESS_NETWORK_STATE — send crash reports and look up street addresses for recorded locations.

No permission is used for any purpose other than the one listed here.

20. In-app privacy controls

• Biometric lock on the dashboard, so only you can view recorded evidence.
• Skip location access entirely during setup, or revoke it later.
• Turn the intruder alarm on or off, and choose after how many failed attempts (1–10) it sounds.
• A live permission status panel showing which safeguards are on, with one tap to change each.
• Delete any individual photo and log, with biometric confirmation.
• Clear all app data from Android's app settings, or revoke device administrator access and uninstall to remove everything.

21. Changes to this policy

We may update this policy as the app changes or as legal requirements evolve. The "Last updated" date at the top always reflects the current version. For material changes — such as adding a new data-collecting service, advertising, or any cloud feature — we will update the policy before the change ships and, where required, ask for your consent in the app. Continuing to use HamSecure after an update means you accept the revised policy.

22. Contact us

For questions, privacy requests, or grievances about this policy or the app:

• Developer: Autcust.Dev
• Country/region: India
• Email: autcust@gmail.com
• App: HamSecure for Android, on Google Play

We aim to reply to all privacy requests within 30 days.