Privacy Policy

Information we collect

The short answer: essentially nothing. There are no accounts, no email or phone signup, no analytics, no advertising SDKs, no crash-reporting services, and no telemetry of any kind.

Personal information

We do not collect your name, email address, phone number, physical address, date of birth, or any other personally identifiable information at any point.

Device and usage information

We do not collect device identifiers, advertising IDs, browser fingerprints, usage statistics, session durations, feature-usage metrics, or any form of behavioral analytics. Your IP address is necessarily seen by the servers you connect to (see Infrastructure providers); we do not store it except in the security logs described below.

Call content

Your face and voice are masked on your device before anything is sent, so no server ever receives your unmasked camera or microphone. We never record, transcribe, or store call content.

1:1 mask calls are end-to-end encrypted. The relay server forwards encrypted bytes only — it cannot decrypt them.

Conferences are encrypted in transit but not end-to-end encrypted. Each participant's (already masked) audio and video, and conference chat messages, are decrypted by Faraday's media server (SFU) in memory so it can forward them to the rest of the room. The server does not record or store them.

Call metadata

We do not log who called whom, when calls occurred, call durations, or participant counts. The signaling broker ferries the WebRTC handshake and immediately forgets it. While a call is live, the relay and media servers necessarily hold connection state (IP addresses, ports, room membership) in memory; our servers are configured not to write it to logs, and it is gone when the call ends.

Pairing codes

Pairing codes are generated in your browser, held in memory only, and discarded the moment the call ends. They are never written to a database.

Purchase information (Android app only)

The Android app is sold on Google Play as a one-time paid app, and the transaction is handled entirely by Google Play. The app tells our server it is the paid Play build so we can issue an unlock cookie; we do not store anything about the purchase in any database. We never see your payment method, billing address, or Google account details.

How we use information

Because we collect almost nothing, there is very little to use:

• Unlock cookie: A cryptographically signed, 30-day cookie, stored in your browser, records that you have paid for hosting. It contains a hashed user ID, tier level, and expiry — nothing else. It is verified via signature, not by database lookup.
• Rate limiting: The relay-credential endpoint keeps an in-memory counter per IP address to prevent abuse. This counter is never written to disk and is lost when the server restarts.
• Security logs: Content Security Policy violation reports (which describe the blocked resource, not you) are logged for security monitoring. Requests to known attack-scanner paths such as /.env or /wp-admin are logged with the requesting IP address, user agent, and referrer. Ordinary use of Faraday never touches those paths. Both are written to our web host's (Vercel's) runtime log stream.

Data sharing and third parties

We do not sell, rent, trade, or share your data with any third party for advertising, analytics, profiling, or any other purpose.

Faraday has no advertising partners, no analytics providers, no data brokers, and no third-party SDKs that receive user data. The video masking model (MediaPipe Selfie Segmenter) runs entirely on your device — no frames are sent to Google or any external service.

Infrastructure providers. Running a network service means some companies necessarily carry its traffic. They may process transient network information such as IP addresses and request times. We do not send them call content, identities, analytics profiles, or advertising identifiers.

• Vercel hosts the website and its API. Like any web host, it processes request metadata (IP address, URL, time) and keeps short-lived platform logs under its own policy.
• Hetzner hosts the server at turn.faraday.cam that runs our TURN relay, signaling broker, and conference media server. Faraday operates the software; Hetzner provides the machine and network.
• Let's Encrypt issues our TLS certificates. It receives no user data.
• Google Play distributes the Android app and handles its purchase.

The Google Play purchase is governed by Google's Privacy Policy, not ours.

Data retention

Since we do not collect personal data, there is nothing to retain. Specifically:

• Call content and metadata: never stored.
• Pairing codes: discarded when the call ends.
• Rate-limiting counters: in-memory only, lost on server restart.
• Unlock cookie: expires after 30 days. You can delete it at any time by clearing your browser or app data.
• Scheduled meeting tokens: the token is the data — there is no server-side copy. It expires at the time encoded in the token.
• Security logs (CSP reports, scanner-path probes): kept only as long as our web host retains runtime logs, then discarded. Probe entries contain the requester's IP address and user agent.

Your data and deletion rights

Because Faraday does not create accounts and does not store personal data on any server, there is no user profile or data record to delete. However, you have full control over the small amount of data stored locally on your device:

• Android app: Go to Settings → Apps → Faraday → Storage → Clear Data. This removes all locally stored data including the unlock cookie and any cached files. You can also uninstall the app, which deletes all app data from your device.
• Web browser: Clear cookies and site data for faraday.cam in your browser settings. This removes the unlock cookie and any cached assets.

If you bought the app through Google Play and want to request deletion of any data Google holds about that transaction, contact Google through your Google Account privacy settings.

If you believe we hold any data about you and want it deleted, email 1800bobrossdotcom@gmail.com and we will respond within 30 days.

Call encryption and relay

1:1 mask calls use WebRTC with DTLS-SRTP encryption negotiated directly between the two browsers. All media is forced through our TURN relay (turn.faraday.cam) — there is no direct peer-to-peer fallback, so the other person never learns your IP address. If the relay is unreachable the call fails rather than connecting directly. The relay forwards encrypted bytes — it cannot see or hear the call.

Conferences use WebRTC with DTLS-SRTP between each browser and our self-hosted media server (SFU) on turn.faraday.cam. Other participants never learn your IP address. The media server decrypts each (already masked) stream in memory in order to forward it, so conferences are not end-to-end encrypted.

The signaling broker (peerjs-server, also self-hosted on turn.faraday.cam) only ferries the WebRTC offer/answer handshake. It never sees media, and it does not log who connected to whom. There is also a Tor onion broker for users who want to hide their IP from the broker entirely.

On 1:1 calls, before any audio is unmuted, both ends compare a 4-word Short Authentication String derived from the SHA-256 of the lex-sorted DTLS fingerprints. If the words don't match, you have caught a MITM in the act and should not unmute.

Camera, microphone, and screen

The browser or app asks for camera and microphone permission only after you tap to start a call. Video frames are processed locally for the person-mask effect (MediaPipe Selfie Segmenter, served from the same origin — no third-party model host). Audio is processed locally through the CBAY DSP engine. Nothing is uploaded unencrypted.

When you tap SHARE SCREEN, the browser's native picker asks which tab, window, or full screen to capture. The screen frames are not masked — whatever is on the shared screen is sent as-is. They are encrypted with DTLS-SRTP on your device and travel the same path as your camera feed. On 1:1 calls that path is end-to-end encrypted; in conferences the media server forwards it as described above. We never record or transcribe screen content. Stop sharing (or close the browser's share UI) and your masked face takes over again. Screen share is desktop only; mobile WebRTC does not expose getDisplayMedia yet.

On Android, the app declares only three permissions: Internet, Camera, and Microphone. Camera and microphone access is revoked by the OS when the app is in the background.

The Android app

The Android app is a thin Capacitor wrapper that loads this same web app inside a Chromium WebView. It has allowBackup=false, refuses cleartext HTTP, and trusts only system-installed certificate authorities so a corporate MITM proxy cannot intercept calls. App data is excluded from Google Drive backup and from device-to-device transfer.

The Play Store version is a one-time paid app. Paying unlocks hosting — starting 1:1 calls and hosting or scheduling conferences. It does not unlock, disable, or change any privacy or security feature. Every protection in this policy applies to free and paying users equally.

Children's privacy

Faraday is not directed at children under 13. We do not knowingly collect personal information from children under 13. Because Faraday collects no personal information from any user, there is no children's data to identify or delete. If you believe a child under 13 is using Faraday in a way that concerns you, contact us at 1800bobrossdotcom@gmail.com.

Security

All connections use TLS 1.2 or higher. The site is on the HSTS preload list. Mixed content is blocked. Cross-origin embedding is denied. Referrer headers are stripped. All tokens are cryptographically signed with HMAC-SHA256.

What we cannot protect against

Faraday is not a Pegasus shield. If your device is compromised at the OS level — a state-grade implant, a malicious app with screen recording, a camera tap on the wall behind you — no in-app feature can save the call. Faraday raises the cost of mass passive surveillance and casual interception. It is not a substitute for a hardened device and good operational hygiene.

Changes to this policy

We may update this Privacy Policy from time to time. The "Effective" date at the top reflects the most recent revision. If we make material changes, we will update the date and post the revised policy here. Your continued use of the Service after changes constitutes acceptance of the updated policy.

Contact

For privacy questions, data deletion requests, or security concerns, email 1800bobrossdotcom@gmail.com, or security@faraday.cam for vulnerability reports. The source code is not yet public; see /security for the current architecture and release status.