Lowpan Camera

Privacy Policy

Last updated: June 13, 2026

1. Introduction

Lowpan ("we", "us", or "our") operates the Lowpan Camera cloud storage service accessible at camera.lowpan.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read it carefully. By using the Service you agree to the practices described here.

2. Information We Collect

Account Data

When you register we collect your email address, display name, and authentication credentials (managed securely via Supabase Auth).

Camera & Clip Data

We store video clips, snapshots, and metadata (timestamps, device IDs, home IDs) that your Lowpan cameras upload to our servers. Clip thumbnails are encrypted with AES-128-CBC before storage; the decryption key is derived per-user.

Payment Data

Subscription payments are processed by Paddle (our Merchant of Record). We do not store credit card numbers or full payment details. We receive transaction confirmations and subscription status from Paddle via webhooks.

Usage & Log Data

We collect IP addresses, browser type, pages visited, and timestamps to operate, improve, and secure the Service.

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, we process your personal data under the following legal bases:

  • Contract performance — processing your account data and camera footage to deliver the Service you subscribed to
  • Legitimate interests — security monitoring, fraud prevention, and Service improvement
  • Legal obligation — retaining transaction records as required by tax law
  • Consent — for any marketing communications (you may withdraw at any time)

4. How We Use Your Information

  • Provide, operate, and maintain the Service
  • Process subscription payments and send billing receipts
  • Store, retrieve, and display your camera clips and live streams
  • Send service-related notifications (storage limits, expiry warnings)
  • Detect and prevent fraud, abuse, and security incidents
  • Comply with legal obligations

We do not sell your personal data to third parties.

5. Data Sharing & Processors

We share data only with the following sub-processors:

  • Supabase — database, authentication, and file storage (EU/US regions)
  • Paddle — payment processing and subscription management
  • Cloudflare — content delivery, DDoS protection, and Pages hosting

We may disclose data if required by law, court order, or to protect the rights and safety of our users.

6. Data Retention

Camera clips are retained according to your active storage plan. On plan downgrade or cancellation, clips exceeding your new quota are deleted after a 30-day grace period. Account data is deleted within 90 days of account closure.

7. Security

We use TLS in transit and AES-128-CBC encryption for clip thumbnails at rest. Access to your data is restricted via Row-Level Security policies enforced at the database level. Despite these measures, no system is 100% secure and we cannot guarantee absolute security.

8. Your Rights

Depending on your location you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your account and associated data
  • Port your data in a machine-readable format
  • Opt out of non-essential communications

To exercise these rights, email us at privacy@lowpan.com.

9. Cookies

We use only essential cookies required for authentication session management. We do not use advertising or tracking cookies.

10. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or a prominent notice in the Service at least 14 days before they take effect.

12. Data Controller & Contact

The data controller responsible for your personal data is:

Lowpan
Email: privacy@lowpan.com
Website: https://camera.lowpan.com

EEA/UK users who believe their data protection rights have not been respected may lodge a complaint with their local supervisory authority (e.g., the ICO in the UK or relevant EU data protection authority).