Last updated: 5 August 2026
Account and deletion descriptions updated: 6 October 2026, against the current development candidate. Public app release and on-device validation remain pending; other disclosures retain their previous review date.
UAP Hub is a project by Angel IT Studio (angelitstudio.com). This policy covers the Universal Anomaly Photographer iOS app and the API at uaphub.app/api/.
This policy is written from the source code, not from intent. Where a control exists in the app but does not currently do what its label promises, this page says so plainly instead of describing what it was meant to do. We would rather tell you about a defect than let you rely on a protection that is not there.
A photo is saved exactly as the camera produces it, including the camera's own embedded information — make, model, lens, exposure settings, and the original date and time. The app does not write your GPS coordinates into the photo file, but it does record them separately alongside the observation. On capable devices, depth information is embedded in the photo as well.
Video is recorded with a real audio track. The microphone is attached to the capture session the whole time the camera screen is open, and anything audible while you are recording — including speech — is in the file. There is no option to record video without audio.
While you are recording video, the app takes a full sensor sample twice a second. A single snapshot is taken when you press the shutter for a photo. Each sample contains, among other fields:
While video is recording, the app analyses the same audio it is already recording, roughly six times a second, and keeps only measurements — never audio samples. Those measurements include broadband and peak level, dominant frequency, spectral centroid and flatness, band levels from infrasound to ultrasonic, and a description of which microphone was in use. This series is written to a file on your device. It is not uploaded; only a cryptographic digest of it travels with the capture.
During a capture session the app records changes in the camera's optical state — focal length, principal point, exposure duration, ISO, aperture, lens position, zoom, and which physical lens was in use — and, where depth is available, summary depth statistics and camera intrinsics. If you connect an external Bluetooth or MFi accessory, its readings are recorded too, along with the accessory's name, serial number, and firmware version. Connecting an accessory is entirely your choice; the app does not scan for or connect to anything until you turn a supported accessory on.
The optics series and the external-sensor series stay on your device. Depth summaries and camera intrinsics do travel with the capture.
Detection runs on your phone, using Apple's on-device vision framework and a model bundled inside the app. No frame is ever sent anywhere for analysis. The resulting scores and detections are stored on the observation and are uploaded with it.
A vendor device identifier — a value iOS gives to all apps from the same developer on your phone — is attached to essentially every record: telemetry samples, uploads, event-room presence, and device registration. It is not resettable except by deleting all of our apps from your device.
The current development candidate uses server-backed accounts. For email registration and login, it sends your email address and password to the account API over HTTPS; registration also sends your display name and, when available, your device identifier. The server stores password verification material rather than a plaintext password. The app keeps the access and refresh tokens in the iOS Keychain and caches your profile locally. The account identifier can be attached to observations and evidence records.
The app also creates an Apple App Attest key for your device and sends the attestation to our server once, and registers an Apple push token if you allow notifications.
As of 5 August 2026 our server actually checks that attestation — it verifies Apple's certificate chain, the challenge, and the app identity, and records the outcome against your device. Be clear about what that does and does not mean today: verification is recorded but not required. A device that offers no attestation, or an invalid one, is still registered and still issued a credential; the record simply says it was not attested. Requiring attestation is planned, and it is deliberately off by default so that existing installs and development builds keep working. Until it is switched on, attestation tells us which registrations came from a genuine app instance — it does not stop the ones that did not.
Notes, titles, tags, and categories you write are stored with the observation and uploaded with it. The app also writes an automatic note containing the file name, its hash, the recording duration, and the capture time. There is no speech recognition anywhere in the app.
Location collection is broader than capture. The app starts location, heading, motion, magnetometer, and altimeter updates every time it comes to the foreground, whether or not you capture anything, and it asks for the Always level of location permission. Readings taken while you are simply using the app are held in memory and shown on screen; they are written to storage only while a capture or telemetry session is running.
The app declares the background location capability. When the app goes to the background it reduces location accuracy; the code is ambiguous about whether updates stop entirely at that point, so we will not claim here that the app never receives location in the background. Your iOS location permission is the control that actually governs this.
All traffic to our server uses HTTPS, and the app refuses to use anything else. We do not use certificate pinning.
Apple receives your capture coordinates when the app fetches weather for an observation and when it resolves a place name and time zone. Apple's attestation service is contacted when your device key is created. Apple's push service delivers alerts, so it sees the recipient's push token and the alert contents, which include the sighting's coordinates. Map screens fetch Apple map tiles for the area you are looking at.
The app fetches a planetary geomagnetic index from the United States Space Weather Prediction Center while building context for an observation. That request carries no coordinates, no identifiers, and no parameters of any kind — but, like any web request, it discloses your device's IP address to them.
Our server sends an event's centre coordinates to Open-Meteo to fetch conditions. It can also query an open flight-tracking service for aircraft in the area, but that is switched off by default. Neither service receives device identifiers, account identifiers, media, or telemetry. Nothing goes to any advertiser, data broker, analytics provider, or crash-reporting service, because we do not use any.
This is the part to read twice.
Photos and normal-sized videos are encrypted on your device with AES-256-GCM before they are written to storage, using a key held in the iOS Keychain that is never transmitted and never synced to iCloud. Because the upload sends that same file, our server receives and stores ciphertext it cannot read. There are two exceptions we know of: videos larger than about 1.5 GB are stored and uploaded unencrypted, and one save path used elsewhere in the app writes and uploads unencrypted at the app's default setting.
Everything that travels alongside the media — coordinates, notes, transcripts, hashes, and the signed evidence record — is in the clear, always. Your observation notes are moved into the iOS Keychain on your device rather than left in the app's database.
The app's own database on your device is not encrypted by the app; it relies on the operating system's default file protection. Our server's database and media directory are not encrypted by our software. Whatever disk-level protection the host provides is outside what we can verify here, so this policy does not claim encryption at rest on the server.
The retention setting in Privacy Settings genuinely works: it deletes observation records older than your chosen window, along with their media files and notes, when you change the setting and again at every launch. Three things you should know about it:
Three categories of data survive both the retention sweep and the delete-everything button, on your own device. The app writes a plain-text backup file for every observation save, containing coordinates, altitude, heading, speed, times, and hashes; those files are never pruned or deleted by anything. Thumbnail images are written unencrypted and are not removed with the observation. A privacy audit log, recording actions such as settings changes and data exports, is appended to for the life of the installation with no size limit and no way to clear it.
The app's data folder is not excluded from device backups, so it is included in your iCloud or computer backups of the phone.
Nothing expires. There is no retention policy, no scheduled purge, and no time limit of any kind. Observations, media files, telemetry, evidence records, alert-delivery records, device registrations, accounts, sessions, teams, and chat messages persist indefinitely. The only automatic deletion anywhere on the server is a rolling window of the most recent clock-synchronisation samples per device.
Deletion endpoints now exist. You can erase an individual observation — its record, its evidence-chain rows, its telemetry, its alert history and the media file itself — and you can erase the data tied to your device. Both are authenticated and scoped so that you can only remove your own. An erased observation leaves a deliberate, recorded gap in the evidence hash chain: the audit tool distinguishes an authorised erasure from tampering, but an outside verifier recomputing the chain will still see a broken link, which is the unavoidable cost of honouring erasure in a tamper-evident record.
The server is backed up on a timer. Each backup contains a snapshot of the whole database and a copy of the entire media directory, and is kept for fourteen days by default on the same machine. Encryption of the backup archive and copying it off the machine are both optional features that are off unless explicitly configured, and this policy does not assert that they are enabled in production. The practical consequence: even after we remove something by hand, a copy may exist in backups for up to the retention window.
The API itself does not write request logs and does not store IP addresses in its database; addresses are used only as short-lived in-memory keys for rate limiting. The web server in front of the API may keep ordinary access logs, and because the nearby-events request carries coordinates in its URL, those coordinates could appear there. That configuration is outside the application, and we are not making a claim about it here.
The server's public status probe used to return its database path, its media directory, how long it had been running, the pending-alert queue depth, and the analysis worker's state. None of that is your data, but all of it is useful to someone attacking the machine that holds your data, so it now returns only whether the service is up and which version is running. The detail moved behind an operator credential.
These exist in the app's settings, save the value you choose, and change nothing — or change less than their label implies. We are listing them rather than letting you rely on them. This list is shorter than it was: Location Precision and the metadata-stripping toggles were on it until 5 August 2026 and now work, and are described in the section above.
We consider all of these to be defects rather than design decisions, and they should be either implemented or removed from the interface.
Camera, microphone, motion and fitness, location (requested at the Always level), weather, Bluetooth, and notifications. The app also declares permission to add to your photo library but never reads from or writes to it, and contains unused code for contacts access that is never invoked — the app does not access your contacts. Background modes for location and background fetch are declared, the latter so that queued uploads can finish after you leave the app.
There are none. The app contains no third-party software of any kind — no analytics, no crash reporting, no advertising, no attribution, no tracking framework — and the project declares no external code dependencies. It does not use the advertising identifier and never asks for tracking permission. Our server runs on four small open-source libraries. Data reaches only the destinations named in this policy.
The Service is not directed at children. The app does not ask for or verify your age and contains no age gate. Uploaded captures are readable by anyone using the Service, and registering to become such a person is open, so we ask that you do not let a child use the app to publish captures. If you believe a child has uploaded data through the Service, contact us and we will remove it.
The current candidate provides separate controls to delete an observation, erase this device's uploaded data, and delete an account. Deleting an observation asks the server first when a device credential is present and retains the local record if that request fails. Account deletion removes the account and sessions, team memberships, its invitations and chat messages; uploaded evidence is retained with its account identity links removed. To erase uploaded evidence, use the observation or device-data control separately. If you cannot authenticate or those controls do not reach the records you need removed, email support@angelitstudio.com with enough detail to identify them. Copies may remain in backups for the retention window described above.
If you want a copy of what our server holds about you, ask at the same address. On your own device, the Export My Data button gives you your observations immediately, with the limits noted above.
We do not currently operate an automated rights-request portal.
When the app or server changes in a way that affects this policy — including when the controls listed as not working are fixed — we will update this page and change the date at the top. This policy describes behaviour as of the date shown, and we will not describe a protection here before it exists in the code.
UAP Hub is built and operated by Angel IT Studio, angelitstudio.com. Privacy questions, data requests, and reports of anything in this policy that does not match what the app actually does: support@angelitstudio.com.