SECURITY AND PRIVACY
The threat model
If you are deciding whether to carry this into a situation where being caught filming has consequences, you need more than a promise. What follows is what the app stores, where it stores it, who can reach it, and the list of things it does not protect you from, which is the part worth reading twice.
Anonycord is built for documenting what is happening around you and to you in places where being seen doing it carries a cost. A checkpoint. A raid. A protest where phones are being confiscated on sight. An arrest that will later be described very differently by the people who carried it out. A source who has agreed to be recorded but cannot be seen meeting a reporter.
What it removes is the signal, not the record. The camera and the microphone behave exactly as they would in any other app. The only thing that changes is that the screen stops announcing which person in the room is the one holding the evidence.
It is not built for, and this project does not endorse, surveillance of private individuals. Hiding the fact that you are filming from an authority that would stop you is a different act from hiding a camera in a room where someone has a reasonable expectation of privacy, and the second one is outside what this tool is for.
| Data | Location | Who can reach it |
|---|---|---|
| Recordings (library destination) | The system Photos database, optionally in an Anonycord album | Anything with photo-library access; syncs to iCloud Photos if you have it enabled |
| Recordings (vault destination) | Anonycord’s app sandbox, on-device only | Only the vault viewer, behind the system Face ID prompt; invisible to Photos, Files, and other apps |
| Settings | Local preferences inside the app container | The app itself |
| Accounts, identifiers, analytics | Nothing. There is no such data. | No one; it is never created |
The vault viewer sits behind the system LocalAuthentication prompt. The app declares NSFaceIDUsageDescription in its build settings, and vaulted recordings live inside the app sandbox, which iOS encrypts at rest as part of its standard data protection. Anonycord adds no encryption of its own, and this page will not pretend otherwise.
So be precise about what the gate does. It stops someone who picks up your phone and scrolls the camera roll, and it stops other apps holding photo-library permission. It does not stop anyone who can get you to unlock the device and look at it.
Sandbox storage has a sharp edge too, stated in the README and repeated here: vault recordings are removed if the app is deleted or a reinstall goes wrong. If a recording matters, use the Both destination and move the visible copy off the phone when you can.
There is no analytics SDK, crash reporter, advertising identifier or account system in this app, and no networking layer that could carry a file off the device even if something wanted to. None of that is a preference that ships switched off. The code is not there to switch on.
That claim is the easiest one on this page to verify and the one you should verify. The source is public under GPL-3.0, every release is built from that source by a public CI workflow, and you can open the project in Xcode, run it on your own handset, and watch what it does on the network while it records. It does nothing.
- A lit screen identifying you as the person recording, which is how it usually goes wrong
- Someone taking your unlocked phone and scrolling the camera roll: vault recordings are not in it
- Other apps with photo-library permission reading vaulted footage
- Cloud exposure of vault recordings, which are never uploaded anywhere by this app
- Anyone who can make you unlock the device and pass the Face ID prompt, whether by law or by force
- Forensic extraction of a seized handset, which is a different order of problem than a locked camera roll
- Someone who simply watched you point a phone at them: this hides the interface, not the object in your hand
- iCloud sync of Library saves, which are ordinary Photos assets by design
- Losing the vault when the app is deleted, which is documented behaviour rather than a bug
Recording law varies enormously and it is your responsibility, not this app’s. Some jurisdictions allow recording anything you can lawfully see or hear. Others require the consent of one party, or of everyone. Audio is frequently regulated more tightly than video, and press credentials help in some places and are a liability in others. Know the local position before you press record.
The other half of that is the part no law will decide for you. A dark screen does not change what the camera and the microphone are doing, and it does not change what you owe the people in frame. Document the powerful. Protect the people who trusted you enough to be in the room.
- 01
Read the source: jackghx/Anonycord, GPL-3.0, forked from c22dev/Anonycord.
- 02
Watch the build: build.yml on GitHub Actions produces every release IPA from the tagged source, unsigned, with public logs.
- 03
Check the digest: each release asset publishes a SHA-256 hash. Hash your download and compare before you sideload.
- 04
Or trust nobody: open
Anonycord.xcodeprojin Xcode and run it on your own device. The simulator cannot use the camera, the volume buttons or Face ID, so a physical handset is required.
Nothing here is held back. The app source, the build workflow and the release history are all public, which is the only arrangement under which the rest of this page means anything. If you are auditing on behalf of a newsroom and want to go further than reading the diff, get in touch on Signal at Y01.01. I would rather hear from someone who intends to break it than not.