Privacy Policy

Last updated: October 11, 2026

Forsheur ("we", "our", "us") operates the Forsheur mobile application and web platform. This policy describes what data we collect, why, and how we protect it.

1. Data We Collect

Account information. When you sign in (with Google, Apple, or an email and password), we store your email address and, if you use one, your password in hashed form. Sign-in sessions use signed tokens.

Recordings. When you record with the Forsheur app, the video and audio are sent to our server in short segments, each sealed and signed on your phone. Depending on your setting, a recording is stored either in clear or end-to-end encrypted.

Location and sensor data. While recording, the app collects your phone's GPS position (latitude, longitude, altitude, speed, heading), its motion sensors and compass, the capture time from several clocks, and the battery level. These are attached to the recording to certify when and where it was made.

Device information. Device model, operating system and app version, and the device certificates and hardware attestations (Apple App Attest, Android key attestation, Google Play Integrity) that prove a recording comes from a genuine phone.

Technical logs. The app automatically sends technical logs to our server to diagnose problems. They contain no location coordinates.

Usage data. For security purposes, we log sign-ins to your account (date and sign-in method). We count visits to our website per day, page and country; the country is derived from the IP address at the time of the visit, and the address itself is not kept. We do not record IP addresses: not in these logs, not for website visits, and not in our servers' access logs.

2. How We Use Your Data

• Certification: the time, location and sensor data are cryptographically bound to the recording, and its timestamps are notarized, to prove when and where it was made and that it was not altered.
• Public map: the location of every recording is public on the Forsheur map, immediately or after a delay you choose in the app. Its content is visible to everyone if the recording is public, and only to you and the people you share it with if it is encrypted.
• Account management: your email address and credentials are used to sign you in and manage your sessions.
• Operating the service: technical logs and usage data help us keep the platform working and secure.

3. End-to-End Encryption

When a recording is encrypted, it is encrypted on your phone before it is sent. Our server stores it but cannot decrypt it. Only you, and the people you grant access to, hold the keys. Your private keys are stored on our server only in a form encrypted with your password, which we do not know. You can export your decryption key from your account menu on forsheur.com, to decrypt your recordings offline.

4. Data Sharing

We do not sell your personal data. We may share data only in these circumstances:

• Publicly, by design: the location of recordings, and the content of public recordings, on the Forsheur map and verification pages.
• With your consent: for example, when you share an encrypted recording with another user.
• Legal obligations: if required by law, regulation, or valid legal process.
• Service providers: hosting providers who process data on our behalf under strict confidentiality agreements.

5. Data Retention

Recordings are evidence. Once uploaded, a recording is kept indefinitely: its video, audio and metadata (capture time, location, device and sensor data), together with its device certificate, its encrypted key envelopes and its notarized timestamp proofs. Nobody, including Forsheur, can withdraw or alter a recording after the fact; this is what allows anyone to verify it.

• Account data (email address, password, sign-in sessions, encryption salt and encrypted private keys) is kept while your account exists, and deleted when you delete your account.
• After your account is deleted, your recordings are kept but no longer linked to your email address. Encrypted recordings stay encrypted: only someone holding a key that was granted access can read them.
• Technical logs and usage data (logs sent by the app, the sign-in log, website visit counts) are kept for 12 months, then deleted automatically.
• Backups: deleted data remains in our encrypted backups for up to 12 months.

6. Data Security

We protect your data with TLS encryption in transit, end-to-end encryption of private recordings, an additional encryption layer between the app and our server, and access controls on our servers. A delay can be set in the app before the location of your recordings is disclosed, for sensitive situations; the location stays cryptographically certified.

7. Your Rights

Under the GDPR and similar laws, you have the right to:

• Access the personal data linked to your account, and receive a copy of it
• Correct inaccurate data
• Delete your account at any time, yourself, at forsheur.com/account/delete
• Request the erasure of a recording. Recordings are kept to preserve the integrity of evidence; a request to erase one is examined case by case, within the exceptions the GDPR provides (freedom of expression and information, archiving in the public interest, the establishment or defence of legal claims)
• Object to or restrict certain processing
• Data portability: download your recordings as evidence bundles
• Lodge a complaint with the data protection authority of your country

To exercise these rights, contact us at contact@forsheur.com.

8. Children

Forsheur is not intended for use by children under 16. We do not knowingly collect data from children under 16.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the app or by email. Continued use of Forsheur after changes constitutes acceptance of the updated policy.

10. Contact

For questions about this privacy policy or your data, contact us at:
contact@forsheur.com