Last updated: August 25, 2026
Witness ("the app") is built to help people document encounters with law enforcement and preserve that footage off-device. This policy explains what data the app handles, where it goes, and who can see it.
drive.file scope only, which limits it to files the app itself creates. It cannot read, list, or modify any other file in your Drive.| Data | Purpose | Where it goes |
|---|---|---|
| Video and audio | The core recording feature | Written to your device, then uploaded to your Google Drive |
| GPS location | Embedded in video metadata and a chain-of-custody manifest file, so footage can be tied to where it was captured | Stored in the video file and in a single per-session manifest file, uploaded to your Google Drive |
| Timestamps (UTC) and device time zone | Chain-of-custody / evidentiary record of when footage was captured | Stored locally in an event log and the per-session manifest file, uploaded to your Google Drive |
| Google account authorization (OAuth token) | Lets the app upload to your Drive on your behalf | Stored in your device's Keychain; sent only to Google's servers to authenticate upload requests |
| A copy of each recording, saved to your Photos library | On-device backup, independent of Google Drive, so footage survives even if the app is removed | Saved to your device's Photos library; if you have iCloud Photos enabled, Apple syncs it to your iCloud account |
| Emergency contact names/emails (if you add any) | Automatically sharing each recording with people you trust, as it uploads | Stored on your device; when a recording starts uploading, each contact's email is sent to Google Drive's sharing API to grant them view access to that recording's folder |
The app does not collect analytics, does not use advertising or tracking SDKs, and does not transmit any data to the developer. The only third parties contacted are Google, for the sole purpose of uploading files to your own Drive account, and a time-stamp authority, which receives nothing but a cryptographic hash (see below).
Witness uses Google Sign-In to request the drive.file OAuth scope. This is Google's most restricted Drive scope: it only grants access to files and folders the app itself creates in your Drive. The app cannot see your existing files, folders, or any other data in your Google account.
You can revoke this access at any time from your Google Account's Third-Party Apps & Services settings, or by deleting the Witness folder from your Drive. Revoking access does not delete footage already uploaded to your Drive. That footage is yours, stored in your own account, and is managed the same as any other file in your Drive.
Video is recorded in short chunks on your device and deleted automatically once Google Drive confirms it has received both the video and its accompanying metadata file. If the device has no network connection, chunks remain in local storage until a connection is available, so no footage is deleted before it is safely uploaded.
When a recording finishes, Witness sends a SHA-256 hash of that session's manifest file to an independent time-stamping authority (currently freetsa.org), which returns a signed token certifying that the file existed in exactly that form at that moment. This is what allows footage to be shown later as unaltered, by a party with no connection to you or to this app.
Only the hash is transmitted. A hash is a short fingerprint computed from a file; it cannot be reversed. The authority never receives your video, your manifest, your location, your identity, or any information about what was recorded, and cannot reconstruct any of it from what it does receive.
The signed token is stored alongside your recording in your own Drive, and a copy is kept on your device so a report can be produced later. If the authority cannot be reached, the recording and its hashes are kept exactly as before, only the external certification is missing.
You can optionally add emergency contacts in the app's settings. When a recording starts uploading, Witness grants each contact view access to that recording's folder in your Google Drive via their email address, and Google Drive sends them a notification. This means people you choose can see your footage as it arrives, and keep access even if your phone is taken.
Contact details are stored on your device and are used only for this purpose: the email address is sent to Google's Drive sharing API and to no one else. Contacts are shared with only when you record. You can remove a contact at any time in the app, and you can revoke access to any already-shared folder from Google Drive's own sharing controls.
Unless you turn it off in the app's settings, Witness also saves a full copy of each recording session to your device's Photos library, as an on-device backup independent of Google Drive. The app requests only "add-only" Photos access: it can add its own recordings to your library, but it cannot see, read, or access any of your existing photos or videos.
If you have iCloud Photos enabled on your device, Apple will sync these recordings to your iCloud account like any other video in your library, subject to Apple's Privacy Policy. You can turn off the Photos backup in the app's settings while still uploading to Google Drive, and you can delete saved recordings from your Photos library at any time.
Witness requests "While Using the App" location access. Recording runs with the display dimmed to zero brightness but the app genuinely in the foreground, so this level of access is sufficient and the app does not ask for background location. Location is used exclusively to timestamp and geotag recordings for evidentiary purposes. It is not used for any other purpose, is not shared with any third party, and is not used to track you outside of active recording sessions.
Because recordings are stored in your own Google Drive, you control retention and deletion directly through Drive. The developer has no copy of your data to retain or delete. Deleting a file from your Drive removes it from Google's storage subject to Google's own retention policies (see Google's Privacy Policy, linked below).
Witness is not directed at children and is not intended for use by anyone under 13.
If this policy changes, the "Last updated" date above will be revised and the updated policy will be published at this same URL.
Questions about this policy can be directed to: olmaster13@gmail.com
This app uses the Google Drive API and Google Sign-In. Your use of those services is also subject to Google's Privacy Policy.