Privacy, made specific.

About Creative Catcher

Creative Catcher is an Android security utility, package com.creativecatcher.app, operated by Mohamed Elsamman. Official website: https://creativecatcher.org.

Creative Catcher does not create a developer-hosted account or operate a Creative Catcher backend. Google sign-in is used on the device to establish the selected Google identity, and Gmail authorization is a separate user-controlled step.

The short version

Information accessed and processed

The app processes the following information for its security functionality:

• Security event metadata: event identifier, date and time, event/trigger type, severity, photo and location status, delivery status, retry count, and diagnostic error status.
• Camera evidence: a single front-camera JPEG may be captured after a qualifying failed unlock event or a user-requested protection test.
• Location evidence: latitude, longitude, and location accuracy may be recorded. The value can be precise or approximate depending on the Android permission granted and the location returned by the device. A human-readable place name may be derived with Android’s built-in geocoder.
• Google account details: the selected Google account email and display name are stored locally to show the connected account. The app uses Google Credential Manager for sign-in and Google Identity Services AuthorizationClient for Gmail authorization.
• App security state: an app-specific PIN is stored as a salted PBKDF2-HMAC-SHA256 hash, together with failed-PIN and lockout state. When enabled, Android’s strong biometric prompt is used; Creative Catcher does not receive or store a biometric template.
• Settings: camera/location/email settings, app-lock preferences, appearance/language choices, protection-test time, and the selected local retention preference are stored locally.

Creative Catcher does not read or store the device’s Android PIN, password, or pattern. The Device Administrator integration receives the Android system’s failed-unlock callback; it does not expose the credential itself.

What stays on the device

Room/Drift local database records, settings, account display information, delivery status, and cached authorization state are kept in app-private storage. Evidence photos are saved under the app’s private files directory. The app’s normal photo path encrypts the file in place with AES-256-GCM and an Android Keystore-held key. A decrypted preview can be written to the app cache when you view a photo; that preview is not the source evidence file and can be removed by Android’s cache management.

The implementation has a best-effort fallback if photo encryption itself fails, so the app does not silently discard the event. In that unusual case, the photo may remain only in app-private storage without the additional file-level encryption layer. Android app-private isolation and disabled Android backup are still used, but no storage method can guarantee absolute security.

Camera and security evidence

When the Android system reports a supported failed lock-screen credential attempt, Creative Catcher creates a local event first and then attempts one front-camera capture. A photo is not guaranteed: capture can be unavailable because permission was denied, the camera is missing or busy, the operating system blocks background service start, the hardware fails, the capture times out, or an Android/OEM restriction applies. The app records the resulting status rather than treating an unsuccessful capture as a successful photo.

Location data

When a security event is processed, Creative Catcher attempts to obtain location using Android’s Fused Location Provider. It may use a recent last-known location, request a current location, or use a real cached location as a fallback. It does not request ACCESS_BACKGROUND_LOCATION; the capture service uses the Android foreground-service location type while the event is being handled. Location can be unavailable when permission, device location services, Android, or the device manufacturer prevents a fix.

Google account, Gmail, and Google APIs

Google sign-in and Gmail alert delivery are separate:

• Sign-in: Android Credential Manager obtains a Google ID token to identify the selected account. The app uses identity information corresponding to openid, email, and profile; it stores the account email and display name locally for account status.
• Gmail: Google Identity Services requests only https://www.googleapis.com/auth/gmail.send. The app does not request Gmail read/modify access, full mail access, or Google Drive scopes.
• Alert content: when Gmail is connected, the app sends an email to the linked account through Gmail. The message can contain the event time, latitude/longitude and accuracy or “location unavailable,” a derived place label when available, and the captured JPEG attachment when a photo exists. It does not contain the device PIN, password, or pattern.

Google receives and processes the information required for the sign-in and Gmail API requests. Gmail copies are controlled by the user’s Google account and Google’s own terms and privacy policies. Creative Catcher does not sell Google user data, use it for advertising, or use it for unrelated profiling. Google API data obtained through the app is used only to provide the user-facing sign-in and Gmail alert functionality described here.

Google Drive is not part of the current app. The code contains legacy database fields for compatibility with older installations, but new events mark Drive delivery as skipped and no Drive API, Drive worker, or drive.file scope is used.

Other service providers and transfers

Creative Catcher does not operate its own data-processing server. Data can nevertheless be processed by platform services that the app calls:

• Google Credential Manager / Google Identity Services: selected account identity and authorization results for sign-in and Gmail.
• Gmail API: the alert message, event details, and optional photo attachment, sent to the user’s own linked Gmail account.
• Google Play services location: Android’s location provider may process location requests under Google’s and Android’s service policies.
• Android geocoder: the built-in geocoder may process coordinates to return a place label under the device/Android provider’s policies.

Google’s own privacy policy, Google account controls, Gmail retention, and Android/OEM behavior may apply to those services. Creative Catcher does not receive Gmail messages or read the user’s inbox.

Retention

The app stores local security-event records and their local evidence until the user deletes them, clears app data, uninstalls the app, or an automatic purge is actually scheduled and runs. The settings UI contains Never, 30 days, 60 days, and 90 days preferences, with 60 days as the stored default.

Important current-build detail: the Flutter settings screen persists that preference but does not currently invoke the native purge scheduler. Until that app-side wiring is corrected, do not rely on automatic local deletion; use the individual delete control or Android’s Clear storage/Uninstall controls. When the native purge worker is scheduled, it runs daily, removes records and photo files older than the selected period, and preserves events still pending Gmail delivery.

Emails already sent through Gmail are copies in the user’s Google account and are not deleted by local Creative Catcher deletion. Manage those copies in Gmail.

Deletion and user controls

• Individual event: use the delete control in the event detail screen. The local record and its local photo file are removed on a best-effort basis.
• All local app data: use Android Settings → Apps → Creative Catcher → Storage → Clear storage, or uninstall the app. This also removes local settings, the app PIN hash, local account state, and cached tokens.
• Gmail authorization: use Disconnect in the app to clear locally cached account/token/scope state. The installed-app authorization API does not provide a remote revoke operation in this implementation; to fully revoke account-level access, use Google’s account permissions page.
• Gmail copies: delete alert emails from the user’s Gmail account. Creative Catcher cannot delete messages from Gmail because it requests send-only access.

Creative Catcher does not maintain a developer-hosted account, so there is no separate Creative Catcher account database to delete. See Delete account and local data for the same instructions in one place.

Permissions

• Internet and network state: Google sign-in, authorization, and Gmail API delivery.
• Camera: front-camera evidence capture.
• Fine/coarse location: security-event location context.
• Camera/location foreground-service types and wake lock: complete an event while the screen may be locked.
• Device Administrator with only watch-login: observe failed lock-screen unlock callbacks.
• Notifications: show the Android foreground-service notice on Android versions that require it.
• Receive boot completed: restore monitoring state and pending work after a normal reboot.
• Biometric and battery-optimization request permissions: optional app lock and background reliability support.

Security

The app uses app-private storage, Android Keystore-backed AES-256-GCM photo encryption in the normal path, Keystore-backed encrypted preferences for OAuth tokens, salted PBKDF2-HMAC-SHA256 hashing for the app PIN, HTTPS/TLS for Gmail API transport, and disabled Android backup. These measures reduce risk but cannot guarantee that data or service delivery will always be secure or available.

Children, changes, and contact

Creative Catcher is an Android security utility and is not marketed as a child-directed service. The source does not declare a child-specific audience. Do not use the camera or location features unless your use is lawful and appropriate for the device and people involved.

We may update this page when the app or its data practices change. Material changes will be reflected by updating this page and its “Last updated” date.

For privacy questions, contact mohamed.elsamman.dev@gmail.com. The legal developer is Mohamed Elsamman.