Privacy Policy
Last updated: 10 November 2026
Who Touched My Phone ("the app") is developed by Hugo Software ("we", "us"). This policy explains, in plain language, what the app does with your data.
The short version
We never receive your data. The app has no server of ours, no account, no login, no analytics, no advertising and no crash-reporting SDK. Everything the app records stays in its private storage on your phone.
What the app stores on your device
When the guard is armed and something triggers it, the app writes an evidence record on your device. A record can contain:
- one still photo taken with the front camera,
- the date and time of the event,
- which trigger fired (motion, touch, wrong PIN, charger unplugged),
- how long the guard had been running,
- a measured light level of the captured frame,
- a short accelerometer trace ("motion signature").
The app also stores your 4-digit app PIN, your guard settings and, if you use them, short summaries of past guard sessions on the device. From version 1.1 the PIN is stored only as a salted hash, never as plain text.
All of this is written to the app's own private storage area (WebView localStorage and IndexedDB inside the app sandbox). It is not uploaded, not synced, not shared with us and not shared with any third party. From version 1.1 the app's data is also excluded from Android cloud backup and from device-to-device transfer, so it stays on this phone.
What we collect
Nothing. We do not collect, receive, process or store any personal data about you. We cannot see your photos, your PIN, your events or your settings.
Because we receive no data, there is no data of yours for us to sell, share, transfer or retain.
Permissions and why they exist
- Camera — to take one still frame at the moment the guard is triggered. The camera is opened while the guard is armed and closed when you disarm it. The app never records video and never streams a camera feed anywhere.
- Vibration — haptic feedback when the guard fires.
- Internet / Google Play Billing — used only for purchases through Google Play. The app makes no other network requests. We are not able to see your payment details; Google Play handles the transaction.
The app does not request location, contacts, microphone, storage, accessibility services or usage-access permissions.
What the app does not do
The app does not watch attempts to unlock your device with your system passcode, pattern or biometrics. The PIN the app asks you to create protects this app only. The app also cannot see anything that happened while it was closed or while the screen was off.
Purchases
From version 1.1, "Pro" is a subscription sold through Google Play (weekly, monthly or yearly). It renews automatically until you cancel it in Google Play. Versions 1.0.x sold Pro as a single one-time purchase; if you bought it, it stays yours. All purchases are processed by Google Play under Google's own terms and privacy policy. Google may provide us with anonymous, aggregated sales statistics; these contain no personal information.
Children
The app is not directed at children and we do not knowingly collect any data from anyone, including children.
Deleting your data
Everything is on your phone, so you are in full control:
- open a record and choose Delete this record, or
- open Rules → Delete all evidence (from version 1.1 this asks for your PIN), or
- clear the app's storage in Android settings, or
- uninstall the app — this removes all stored records and settings.
There is no server-side copy to request the deletion of. See also our data removal page.
Changes to this policy
If the app's behaviour changes in a way that affects this policy, we will update this page and change the date at the top.
Contact
Questions about privacy: [email protected]