Privacy policy
Last updated: 30 July 2026
pimaso is an Android app published by Alefa Studio, for viewing RTSP cameras and for controlling imaso, a DVR that you run yourself on your own local network. This policy describes what the app does with data on your phone.
The short version: pimaso has no server of its own, no account system, and no analytics. It talks to your imaso server and your cameras, on your local network, and to nothing else. Nothing is sent to Alefa Studio.
What pimaso does not do
- It does not collect, transmit or store any personal data on any server operated by Alefa Studio, the publisher of this app. There is no such server.
- It contains no advertising, no analytics SDK, no crash-reporting SDK and no tracking of any kind.
- It does not use an advertising identifier, and does not build a profile of you.
- It does not read your contacts, calendar, photos, files, SMS or call log, and asks for no permission that would let it.
- It does not access your location. It has no location permission.
- It does not sell or share data with anyone, because it holds nothing to sell or share.
What is stored on your phone, and only on your phone
| What | Where | Why |
|---|---|---|
| Your imaso account session (login cookie) | Android Keystore-backed encrypted storage | So you are not asked to sign in every time |
| The camera list synced from your server, including each camera’s RTSP username and password | Android Keystore-backed encrypted storage | So live video keeps working while the server is unreachable. This is the app’s central design choice |
| Camera RTSP passwords you type in yourself | Android Keystore | Same |
| Your preferences: server address, where streams come from, grid layout and columns, per-camera volume, whether motion alerts are silenced | App-private storage | Settings |
All of it is inside the app’s private storage, which Android does not expose to other
apps. None of it is backed up off the device: the app sets allowBackup="false", so
Android’s own cloud backup does not copy it to Google Drive. Uninstalling the app deletes
all of it.
What leaves your phone, and where it goes
Everything below stays on your local network. There is no internet endpoint in this app.
- To your imaso server, at the address you enter in Settings: your username and password when you sign in, and afterwards the same REST API requests imaso’s own web interface makes — reading the camera list, recordings, snapshots, timelapses, motion events and system health, and sending the record / snapshot / timelapse commands you press.
- To your cameras, directly: an RTSP connection carrying the camera’s own credentials, to pull the video you are watching. This does not pass through the imaso server.
- To your imaso server, only while you hold the Talk button: live microphone audio, relayed by the streaming relay on your server to the camera’s speaker so you can speak through it.
Your imaso server is your own machine. What it keeps, and for how long, is governed by how you have configured it — not by this app.
Microphone
pimaso requests microphone permission the first time you press Talk, never at launch.
The microphone is used only for the duration of a Talk call, and only to carry your voice to the camera you are speaking through. pimaso does not record audio, does not store audio on the phone, and does not transmit audio anywhere except to your own server for that call. There is no other code path in the app that opens the microphone.
Camera and video
pimaso displays video from your cameras. It does not record video on the phone. Every recording, snapshot and timelapse this app can start is a process that runs on your imaso server and writes to your disk; the phone sends a command and then reads the result back over your local network.
The app does not request camera permission, because it never uses the phone’s own camera.
Permissions, and why each exists
| Permission | Used for |
|---|---|
INTERNET | Connecting to your imaso server and your cameras over your local network. Android requires this permission for any network socket, including a purely local one |
ACCESS_NETWORK_STATE | Telling “the phone has no network” apart from “the network is fine but the server did not answer”, which are different messages to show you |
RECORD_AUDIO | Two-way audio (Talk), requested on first use |
MODIFY_AUDIO_SETTINGS | Putting the device into communication audio mode for the duration of a Talk call |
BLUETOOTH (Android 11 and below) | Letting a Bluetooth headset be used as the microphone during a Talk call |
Children
pimaso is not directed at children and contains nothing aimed at them. It is a utility for people who administer their own camera system.
Third-party components
pimaso is built with open-source libraries — React Native, Media3/ExoPlayer and WebRTC among them — which handle video, audio and networking inside the app. None of them is a service: they run on your device and none of them phones home in this app’s configuration. The full list is on the Third-Party Licenses page.
Changes to this policy
If this policy changes, the updated version will be published at this same address and the date at the top will change. Material changes will be noted in the app’s release notes.
Contact
Questions about this policy, or about anything the app does with data:
alefa-support@googlegroups.com