Privacy Policy
Chameleon is designed for local processing. It has no advertising SDK, analytics SDK, crash-reporting SDK or Android advertising-ID integration.
Data processed on your device
Encryption keys, rules, geofences, contact keys, encrypted files, decoy profiles and app preferences are stored locally. Location is used only on the device when you enable a geofence. Camera and NFC access are optional and used for contact-key exchange. Chameleon does not read or upload your Android address book.
Limited network processing
When the contact listener is enabled, Chameleon sends a pseudonymous Chameleon identifier to the StealthX signalling service so another Chameleon user can deliver a signed public-key bundle that you explicitly exchange. Public keys, an optional display handle and routing identifiers may be processed transiently for this purpose. Private keys never leave the device.
If you enter a purchase activation code, the code and pseudonymous device-bound identifier are sent to the StealthX service. A signed entitlement token may later be sent to renew or revoke that entitlement. This is used only to provide paid app access and prevent fraud.
If you choose the server relay for messaging, Chameleon sends recipient and message routing identifiers together with an end-to-end encrypted message payload. The relay processes ciphertext for delivery and does not receive the message plaintext.
Optional geofencing uses the Google Play services Location SDK. Chameleon provides the geofence coordinates you configure to that on-device service; Chameleon does not send your location to StealthX. Google's handling of information through Play services is governed by Google's applicable privacy terms.
No sale, advertising or tracking
We do not sell personal data, use it for targeted advertising or share it with advertising networks. Network traffic is encrypted in transit. Chameleon does not use the Android advertising ID.
Retention and deletion
Local data remains until you delete it in the app, clear Chameleon storage or uninstall the app. Transient signalling data is used only to complete the requested exchange. Purchase and entitlement records may be retained as required for account security, fraud prevention, refunds, tax and legal obligations.
Children
Chameleon is intended for adults and is not directed to children.
Security and current alpha scope
The current release is a closed alpha. Some cross-device capabilities remain disabled until interoperability and two-device testing are complete. Security measures reduce risk but no software can guarantee absolute security.
Contact
Questions or deletion requests can be sent to kaspartisan@proton.me, submitted through the Chameleon issue tracker or the StealthX contact page.