Jeremiah Stüve

Ocumi

Find trackers & Wi-Fi cameras

Privacy Policy for Ocumi

Last updated:

In short

This policy applies to the iOS app Ocumi.

  • No account required
  • Your data stays on your device
  • No tracking across other companies' apps or websites
  • No location access
  • Identifiers of other devices stay in memory and are never transmitted
  • Only internet connection: checking purchases with the App Store
  • No ads
  • No sharing with third parties

Controller

The controller responsible for data processing under the GDPR is:

Jeremiah Stüve
Lomerstraße 69
22047 Hamburg
Germany
+49 162 5844811
business@jeremiah-stueve.com

Bluetooth radar

Devices such as smart glasses, headphones or trackers constantly send short Bluetooth signals to their surroundings. While the app is open, Ocumi receives these signals and uses public manufacturer and service identifiers to recognise the device category (for example “possible smart glasses” or “tracker”). The app does not connect to other people's devices and does not query them. You grant Bluetooth access through the iOS system prompt and can withdraw it at any time in Settings › Privacy & Security › Bluetooth.

The app keeps the identifiers of other devices (random, rotating Bluetooth addresses) only in memory for as long as the display needs them. They are not stored permanently, not exported and not transmitted. The app does not show device names that could identify a person, only the device category and a rough distance.

The app cannot tell who carries a device, and it does not try to. In my assessment, you process the received signals for personal purposes (Art. 2(2)(c) GDPR). To the extent the GDPR applies nonetheless, the brief, local processing is based on Art. 6(1)(f) GDPR: your legitimate interest in protecting yourself from covert recording and unwanted tracking.

AirTag search (only when you tap)

AirTags and other Find My devices do not reveal their type in every signal. When you explicitly start the AirTag search, Ocumi therefore briefly connects to nearby devices that do not broadcast a name and reads only the standardised device type. No other data is read or written, and the connection is closed immediately. The app explains this step before it starts.

Because this accesses information on other people's devices, § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) may apply. The app therefore never runs this search on its own or in the background, only when you start it for your own protection, and only for as long as necessary. As with the radar, the results stay in memory only.

Background watch (Pro)

When you turn on “Warn me automatically”, the app also watches in the background for trackers that broadcast a standardised service identifier (for example Tile, Samsung SmartTag, Google Find Hub and trackers following the DULT standard). To recognise whether a tracker has been travelling with you for a while, the app stores the rotating identifiers only in hashed form (as a check value, not in plain text) together with timestamps, for at most 3 hours, and then deletes them automatically. No locations are stored.

The warning appears as a notification on your device; you allow notifications through the iOS system prompt. iOS cannot reliably detect AirTags and smart glasses in the background; for AirTags, the tracker alerts built into iOS remain responsible.

Network check on your own Wi-Fi

On request, the app searches the Wi-Fi network you are currently connected to for devices that offer video services (for example network cameras). It uses the iOS local network discovery (Bonjour) and checks whether typical camera ports are reachable on the devices it finds. Only standard requests within your Wi-Fi are sent; no content is retrieved from devices, no data is sent to devices and nothing is sent to the internet.

You grant local network access through the iOS system prompt. The app does not read the name of your Wi-Fi or your location.

Camera and lens reflection search

For the lens reflection search, the app uses the camera and the flashlight so you can spot reflections of small camera lenses more easily. The camera image is only shown and analysed live; nothing is recorded, saved or transmitted. You grant camera access through the iOS system prompt. The app does not access your photos or videos.

History and report (Pro)

The history stores locally only which device category was nearby and when (for example “Tracker, 24 Oct, 6:30 pm”), without a location and without device identifiers. The app deletes entries automatically after 30 days; you can delete them yourself at any time.

The app creates the PDF report on your device from the history. It only leaves the device if you share it yourself through the share sheet; the recipient's privacy terms then apply.

No analytics, no tracking

The app contains no analytics, crash reporting, advertising or tracking tools and does not use an advertising identifier. If you agreed in the iOS settings to share analytics with app developers, Apple provides me with aggregated crash reports and usage statistics that are not linked to you. You control this setting in Settings › Privacy & Security › Analytics & Improvements.

Diagnostic log

The app keeps a technical log on the device (for example app and iOS version, device model, error messages and crash information that iOS provides to the app locally). It contains no identifiers of other devices and no location. If an error occurs, the app shows an error screen where you can copy the log or send it by email; “Send by email” opens a draft in your mail app, you see the content and decide whether to send it.

If you open a link (for example to the help page or to support services), you leave the app; the terms of the page you visit apply.

Storage on the device and deletion

Only the following is stored locally: your settings, the history (Pro), the short-lived check values of the background watch (Pro, at most 3 hours), the purchase status from the App Store and the technical diagnostic log. I have no access to it, and none of this is transmitted to me or to third parties. The legal basis for all processing in the app is Art. 6(1)(b) GDPR (providing the features you ask for), unless stated otherwise above.

Data in device backups (iCloud or computer) remains there until the backup is overwritten or deleted; Apple's terms apply to those. Retention:

  • Identifiers of other devices in the radar: in memory only, as long as the display needs them.
  • Check values of the background watch: at most 3 hours.
  • History: 30 days, or until you delete it.
  • Settings, purchase status and diagnostic log: until you delete them in the app or uninstall the app. When you uninstall, iOS deletes all app data.

Notifications

Ocumi only sends local notifications: the background watch warning (Pro) when a tracker seems to have been travelling with you for a while. It is created on your device; no data is sent to me or third parties. You can turn notifications off at any time in iOS Settings.

Purchases and subscriptions

Pro is available as a subscription (monthly or yearly) and as a one-time purchase. Purchases and subscriptions are handled exclusively by Apple through the App Store; Apple is the payment processor. Apple processes payment data, your Apple ID and billing under its own responsibility and privacy policy.

Through the system (StoreKit), the app only asks the App Store whether a valid purchase or an active subscription exists, and stores the result locally so Pro also works offline. There is no server-side receipt check of my own. From Apple I only receive the sales and subscription reports usual for providers (for example the number of purchases per country), but no content or payment data. The legal basis is Art. 6(1)(b) GDPR.

App Store

When you download Ocumi, Apple processes data such as your Apple ID and payment information as an independent controller. Apple also provides me with anonymised statistics (e.g. downloads, crash reports from users who opted to share with developers). Details: Apple's privacy policy.

Contacting me by email

When you email me, I process your email address, your name (if given) and the content of your message in order to answer your request. The legal basis is Art. 6(1)(b) GDPR where the request concerns the use of an app, otherwise my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

My email is stored and processed by checkdomain GmbH (Lübeck, Germany) as a data processor.

I delete your message once your request has been resolved, unless statutory retention obligations apply.

Children

Ocumi is not specifically directed at children and does not collect data about them.

Your rights

Under the GDPR you have the right to

  • access the data stored about you (Art. 15)
  • rectification of inaccurate data (Art. 16)
  • erasure (Art. 17) and restriction of processing (Art. 18)
  • data portability (Art. 20)
  • object to processing based on legitimate interests (Art. 21)
  • withdraw consent at any time with effect for the future (Art. 7(3))

An informal email to business@jeremiah-stueve.com is enough.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is: The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

Changes

I update this policy when the law or the features change. The version published here always applies.