Your footage is nobody's business.

OpenZCine is an open-source camera monitor and remote control for Nikon Z cinema-line cameras. The app has no account, telemetry, or automatic data upload. A bug report leaves your device only when you explicitly choose to send one.

What the app does with data

• Camera control and live view happen entirely over your local Wi-Fi network between your device and your camera. Video frames and camera settings never leave your device.
• Settings, camera pairing profiles, and the reconnect identity are stored only in app-local storage on your device.
• Saving clips to Photos only happens when you choose “Save to Photos”, using add-only photo library access.
• On-device diagnostics include a bounded history of predefined app events and diagnostic payloads delivered by Apple. The report excludes camera frames, media names, camera identities, network addresses, Wi-Fi details, pairing data, credentials, and account identifiers. It leaves your device only when you choose “Share Diagnostics” and select a destination.

Optional anonymous bug reports

When you choose the anonymous path in System > Report a Problem, the app sends the report text you enter, its frequency and connection choices, and coarse app context: platform, app version and build, operating-system version, and phone/tablet class. No GitHub account is required.

By default, the app does not include diagnostics, logs, screenshots, media, camera or device identifiers, Wi-Fi names or addresses, pairing data, credentials, contact details, or a persistent installation identifier. You can explicitly include two optional additions: a privacy-filtered activity snapshot containing only predefined event names, and selected screenshots. The snapshot does not include device names (for example, a phone name), model or serial data, timestamps, raw diagnostics, or free-form log text. Selected screenshots are re-rendered with a generic filename and no embedded file metadata; the original image is not sent. Do not enter passwords, pairing codes, private media, or security vulnerabilities.

Anonymous does not mean private. Every anonymous report and any selected screenshot become public with the GitHub issue. The app cannot reliably remove names, locations, notifications, messages, serial numbers, or other sensitive details visible in screenshot pixels. Review each attachment carefully before sending it.

A narrowly scoped OpenZCine relay hosted by Cloudflare receives the request and creates a public GitHub issue. Cloudflare processes connection metadata, including an IP address, to deliver the request and enforce abuse limits. The relay is configured not to log report bodies or IP addresses; it keeps the resulting GitHub issue number and URL plus a one-way request fingerprint for up to 24 hours to prevent duplicate submissions. If the relay cannot determine whether GitHub created an issue, it keeps only the fingerprint and an outcome marker for up to 30 days so retrying cannot create a duplicate public issue. Sanitized screenshot copies are held in the relay's private object storage for up to 30 days and served by opaque links in the public issue. After that, the relay stops serving its copy. Because the issue is public, GitHub, browsers, search engines, or other people may retain, cache, download, or copy an image independently; OpenZCine cannot guarantee its removal from those places. GitHub stores the public issue under its own policies. Anonymous reports cannot receive a private reply.

You can instead choose a signed-in GitHub issue with richer optional details. That route sends the information you provide directly to GitHub under its policies, not through the anonymous-report relay; it is also public.

Optional third-party services

• Apple TestFlight diagnostics. When you install a beta through TestFlight, Apple may provide crash and diagnostic reports to the developer under Apple's TestFlight and privacy terms. OpenZCine adds no third-party crash-reporting SDK.
• Google Play diagnostics. When you install a beta through Google Play, Google may provide crash and diagnostic reports to the developer under Google Play's terms. OpenZCine adds no third-party crash-reporting SDK.
• Frame.io upload (optional). If you connect your own Frame.io account, the app talks directly to Adobe's sign-in service and the Frame.io API to upload clips you select. Your sign-in token is stored in the iOS Keychain on your device only. Uploads go directly from your device to Frame.io — never through us. Adobe's handling of your account is governed by the Adobe Privacy Policy.
• RED LUT download (optional). If you choose to download RED's IPP2 output presets, the app opens RED's website. That visit is governed by RED's own privacy policy.

What the app does not do

• No analytics, telemetry, or crash-reporting SDKs.
• No advertising or tracking of any kind.
• No account with us — the app has no sign-up.
• No sale of personal data or use of diagnostics for advertising.

Changes and contact

Changes to this policy are published on this page and in the project's public repository. Questions: open an issue at github.com/erik-sutton95/OpenZCine.