Privacy

Effective 2026-07-13 · version 1.2

This policy explains what 4DHD Inc.(“OpenEyes,” the data controller) collects and why. Questions or requests: privacy@openeye.cam.

We try to collect as little as possible.

• Accounts — email, optional name. Used to sign you in and email you receipts / magic links.
• Sessions & security — when you sign in we store your session, the IP address, and the browser user-agent for that session. We use these to keep you logged in, secure the account, and prevent abuse.
• API usage — timestamps, stream ids, amounts billed. Used for metering, payouts, and rate-limiting.
• Payment & payout info — Stripe customer/Connect identifiers and, for broadcasters, USDC wallet addresses. Card numbers never touch our servers (Stripe handles them). Note that on-chain payouts are public and permanent by the nature of the blockchain.
• Submitted cameras — the metadata you give us, plus the IP prefix used for rate-limiting.
• Consent records — when you accept these policies we record the version and timestamp, so we can show what you agreed to.

We don't sell your data. We don't run ads.

Where the GDPR applies, we process your data to perform our contract with you (running your account, metering, payouts), for our legitimate interests (security, abuse prevention, improving the service), to comply with law (tax, accounting, takedowns), and with your consent where we ask for it.

We don't sell data. We do use a small number of processors to run the service, and share only what each needs:

• Cloudflare — hosting, storage, and edge infrastructure.
• Stripe — payments, broadcaster payouts, and identity verification (KYC).
• Resend — sending magic-link and receipt emails.
• Public blockchains (Base / Solana) — when you take a USDC payout, the transaction and your wallet address are recorded on-chain.

We may also disclose data when legally required, or to protect rights and safety. If OpenEyes is involved in a merger or acquisition, data may transfer as part of that deal.

We use cookies only to keep you signed in and protect the session (the Better Auth session cookie, plus any CSRF token it sets). They're HttpOnly, Secure, SameSite=Lax. No advertising or third-party tracking cookies, and no analytics cookies.

Frames we pull from upstream cameras are cached in a short-lived ring buffer (60-second TTL) — just long enough to serve a couple of agent requests. We don't keep long-term archives. Frames are attributed to the upstream source and we respect takedown requests.

Some cameras in the directory are on public streets and may incidentally capture identifiable people. We don't run face recognition. We don't provide tools for anyone else to do biometric identification on feeds in the directory (see Terms § 7). If a specific camera captures you in a way that concerns you, write to privacy@openeye.camand we'll take it down.

OpenEyes and our processors operate primarily in the United States. If you're outside the US, your data will be transferred and processed there (and elsewhere our processors operate). Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Wherever you are, you can email privacy@openeye.cam to:

• Get a copy of the data we have on you, or have it ported to you.
• Correct it.
• Delete it (we'll honor this unless we're legally required to retain for tax / audit).
• Opt out of any non-essential processing.

If you're in the EU/UK, you also have GDPR rights including lodging a complaint with your local DPA. If you're in California, CCPA rights apply. We don't make legally-significant decisions about you by automated means alone; account suspensions involve human review.

• Account data: until you delete your account + 30 days.
• Sessions (incl. IP / user-agent): until the session expires or you sign out.
• Usage events: 2 years (required for accounting).
• Ring-buffer frames: 60 seconds.
• Consent records: kept as long as your account exists.
• Source attribution + takedown records: indefinitely.

We protect data with encryption in transit, hashed credentials and API keys, and least-privilege access. No system is perfectly secure, but if a breach affects your personal data we'll notify you and the relevant authorities as required by law.

OpenEyes isn't for anyone under 18, and we don't knowingly collect data from children. If you believe a child has given us data, write to privacy@openeye.camand we'll delete it.

We'll update this policy as OpenEyes evolves. Material changes will be announced via the console, and the version and effective date above will change.

privacy@openeye.cam