Privacy, Data Protection & Impressum

CameraBench — app and website

CameraBench is a free Android app that measures what a phone's cameras and video encoders can really do, plus this website, where you can publish a report so results can be compared across devices. Publishing is optional and strictly your choice.

The short version

The app works entirely offline. It contacts this site in exactly two cases when you press a button: Upload report, to publish one, and Delete report, to take one down again.
A report holds hardware measurements only: phone model, chipset, Android version, camera and codec capabilities, storage speed, and thermal-soak results.
The app sends no photos, no video, no audio, no location, no contacts, no account, no name, no email address, no advertising ID, no serial number, and no IMEI to the website.
No cookies, no analytics, no tracking, no advertising, no third-party SDKs are used in the app or on this site.
You can delete your report whenever you like, from inside the app or by emailing me.

No warranty

CameraBench is given away free of charge, and it is built as carefully as I know how. It still comes with no warranty of any kind, express or implied — including any implied warranty of merchantability, of fitness for a particular purpose, and of non-infringement. You use it at your own risk.

Two things are worth saying plainly up front:

The thermal test works your phone hard on purpose. It records continuously for up to ten minutes per codec, and heating the device is the entire point of the measurement. It runs only when you start it, only while the phone is plugged in and above 25% charge, and it stops itself if the system reports a critical thermal state or the battery falls to 10% — but heat is a stress on hardware and a battery, and choosing to run it is yours.
The measurements can be wrong. They are what one phone did on one run, read back through interfaces that manufacturers implement inconsistently and sometimes describe inaccurately — finding exactly that is much of why this exists. Do not treat a report as a specification, and do not make a purchase or a production decision on one alone.

To the extent the law allows, I accept no responsibility for loss or damage of any kind — to data, to a device, to time, or to anything else — arising out of the app, this site, or anything measured or published by them.

Privacy policy / Datenschutzerklärung

1. Who is responsible

The controller (Verantwortlicher) for the processing described here is Max Vilimpoc, contactable as in the Impressum at the foot of this page. A project this size is not required to appoint a data protection officer, and none has been appointed.

2. What a report contains

Only when you press Upload report, the app sends one JSON document containing:

Device — manufacturer, brand, marketing model, device codename, the board name the kernel reports, Android build type, chipset model / vendor / platform, Android version and API level, and the CameraBench version, build number and commit it was built from.
Cameras — for each lens: focal length, physical sensor size, available resolutions and formats, and the capability flags the camera reports.
Encoders — which video codecs exist, their measured maximum frame size and bitrate, colour bit depth, and which combinations were verified by actually recording.
Measurements — camera start-up timing, storage read/write speed, capability checks that passed or failed, and, if you ran them, thermal soak results: battery temperature, frame rate, dropped frames and bitrate sampled over the run.

The list above is the whole of it. Before you send anything the app tells you what a report contains, and the measurements in it are the ones already on its screen; afterwards the report stays readable at its own address.

3. What is never sent

No photographs, no video, no audio, no filenames, no location, no contacts, no calendar, no account or login, no name, no email address, no phone number, no advertising ID, and no device serial number, IMEI or Android ID are ever sent to the website.

Test recordings never leave your phone. The benchmark writes its clips into the app's own private storage or discards them as it records, and the server refuses any upload larger than 256 KB — so a video cannot be sent, even by mistake.

4. The upload token

The first time you upload, the app generates a random unique token and keeps it in its private storage. It is sent with each upload and stored alongside your report so that re-uploading updates your existing report instead of piling up duplicates.

It is a pseudonym: not derived from you, from your phone, or from anything else, and it never appears in the published report. It is still personal data under the GDPR, because it tells one uploader apart from another, and it is described here rather than glossed over for that reason.

There's a limit of 3 uploads or updates a day from one device — separate from the per-address limit in section 5.

5. IP addresses

Every request to any web server discloses the address it came from; that is how the internet works rather than a choice made here. What this site does with it:

The upload endpoint stores only a hash of your address, computed with a secret key held on the server, which is enough to enforce a limit of 5 uploads per address per 24 hours without keeping the address itself.
The web server's ordinary access logs, held by the hosting provider, do record IP addresses in the usual way.

Hashing here is pseudonymisation, not anonymisation — given the key and a candidate address, a hash can be tested — so it is treated as personal data throughout this page.

6. Cookies, analytics and tracking

There are none. This site sets no cookies, uses no local or session storage, and loads no analytics, tag manager, third-party fonts, scripts, social plugins or advertising. Because nothing beyond what is strictly necessary is stored on your device, no consent banner is required under § 25 TDDDG — and you will not find one.

The app keeps its own settings and its upload token in its private storage on your phone. That is necessary for the features you asked it to perform, and this website never reads it.

7. Legal bases

Publishing a benchmark report — consent, Art. 6(1)(a) GDPR. It is voluntary, given by pressing a button after being shown what will be sent, and you withdraw it by deleting the report (section 10). Withdrawal does not affect processing that was lawful beforehand.
IP hash, upload limits, server logs — legitimate interests, Art. 6(1)(f) GDPR: keeping a free public service available, and defending it against flooding and abuse.

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

8. How long data is kept

Your report, and its ledger entry (report id, upload token, IP hash, timestamp, size, checksum, report format version, phone model, Android version, app version): until you delete it. Reports are benchmark data, so they are otherwise kept indefinitely — that is what makes the comparison across devices worth anything.
Server access logs: rotated by the hosting provider every 30 days.

Deleting a report removes the stored document and its ledger entry together, and with them the IP hash and the link to your token.

9. Who else can see it

Everyone, as far as the report itself goes — publishing it is the entire point. Anyone with the link can read it and it is listed on the overview page. Nothing in it identifies you.
The hosting provider, which operates the server and processes the data as a processor under Art. 28 GDPR, on instruction: Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA
Nobody else. Nothing is sold, shared with advertisers, or sent to analytics providers.

Transfer outside the EU. Namecheap is a US company, so anything the server holds is stored and processed in the United States. Two separate instruments cover that, and they do different jobs:

What Namecheap may do with it — its Data Processing Addendum, the Art. 28 GDPR contract. Under it Namecheap, Inc. is the processor and I am the controller, and it may process the data only on my documented instructions, never for its own purposes.
Why the data may leave the EU at all — the Standard Contractual Clauses (Art. 46 GDPR): Module Two, controller to processor, as approved by European Commission decision 2021/914 of 4 June 2021. They are reproduced in full in the Addendum and apply, by its section 9.4, to any personal data transferred out of the EEA. They are governed by Belgian law and Belgian courts — and a data subject may bring proceedings instead in the member state where they live.

Under those Clauses Namecheap must process the data only on documented instructions, tell me without undue delay of any personal data breach, give ten days' notice before changing its own sub-processors, and — where a public authority demands the data — notify me where the law allows, assess whether the demand is lawful, challenge it if it is not, and disclose the minimum the request permits. Its Data Protection Officer is at dpo@namecheap.com. The Addendum also states that Namecheap does not voluntarily give governments access to user data for surveillance purposes.

It is worth keeping the scale of all this in proportion. The Addendum's annex lists what a customer could put on a host — name, address, telephone number, date of birth, email address — and this site puts none of it there. What actually crosses the Atlantic is a report of hardware measurements, a random token and a hashed IP address. No data that identifies you is sent to this website at any point — no name, no email address, no account, no location, no contacts, no photographs, nothing you typed and nothing your camera saw (sections 2 and 3). There is no identity here to transfer, because none was ever collected.

10. Deleting your report, and your other rights

The quick way: in the app, open Benchmark Webpages and press Delete report. Your token authorises it, it happens immediately, and it cannot be undone.

If you no longer have the token — you reinstalled, cleared the app's data, or changed phones — email camerabench@vilimpoc.org with the link to the report and I will delete it by hand.

Requests that are manifestly unfounded or excessive may be refused or charged for, as Art. 12(5) GDPR permits.

(In other words, if I suspect you're trolling to delete a bunch of reports, I probably won't do it.)

Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent at any time (Art. 7(3)). Write to camerabench@vilimpoc.org.

On access and portability: the published page shows you everything this site displays about your device, and on request I will send you the stored JSON document your phone uploaded — the complete, machine-readable record.

You may also lodge a complaint with a data protection supervisory authority — under Art. 77 GDPR, in particular the one in the EU member state where you live, where you work, or where you believe the infringement happened. The authority that supervises me is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

11. Security

This site is served over HTTPS. Your upload token is held server-side and deliberately kept out of the published report, so nothing a stranger can read gives them the ability to change or delete it.

12. Children

CameraBench is a measurement tool for developers and enthusiasts. It is not directed at children, and it collects nothing about anyone's age.

13. Changes to this notice

Revisions appear on this page under a new date below. If what a report contains ever changes, the disclosure the app shows you before uploading changes with it.

Impressum

Max Vilimpoc
Paul-Lincke-Ufer 30
10999 Berlin, Germany
Email: camerabench@vilimpoc.org
Web: https://vilimpoc.org

CameraBench is given away free of charge and nothing is sold through this site or the app. There is accordingly no sales contract, no right of withdrawal to describe, and I do not take part in consumer arbitration proceedings under the VSBG.