sami/wristivo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Integrate live phone and watch remote prototype with guarded motion control

Browse Source
This commit is contained in:
sami
2026-09-18 19:11:52 +04:00
parent 3e787543c0
commit 8131f4f873
54 changed files with 4355 additions and 329 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SECURITY-PRIVACY.md
+6 -6
View File
@@ -1,6 +1,6 @@
# Security and privacy design
Status: policy for production adapters; foundation demo performs no network or sensor access.
Status: integrated prototype policy and implementation. See the dated [static privacy audit](test-evidence/2026-09-18-integration-privacy-audit.md); signed archive and physical behavior remain unverified.
## Threats and controls
@@ -20,11 +20,11 @@ Self-signed certificates may be present on compatible TVs. Default trust must fa
| Data | Location | Retention / deletion |
| --- | --- | --- |
| TV nickname, local ID, address, capabilities | Phone local store (planned) | Until forget/reset; prevent unintended cloud sync |
| TV token and trust pin | iPhone Keychain (planned) | Until forget/revoke/re-pair; device-bound policy |
| Selected TV label and opaque ID | Watch context (planned) | Replace on selection; clear on forget |
| TV nickname, local ID, address, capabilities | iPhone device-only Keychain | Until forget/reset; prevent unintended cloud sync |
| TV token and trust pin | iPhone device-only Keychain | Until forget/revoke/re-pair; device-bound policy |
| Selected TV label and opaque ID | Watch application context | Replace on selection; clear on forget |
| Raw motion | Watch memory during active session | Discard immediately after bounded processing; no default recording |
| Calibration preferences | Local watch/phone (planned) | User-resettable, no cloud sync by default |
| Calibration preferences | Watch memory for this launch | User-resettable, no cloud sync by default |
| Diagnostic metrics | Local bounded buffer (planned) | No identifiers/tokens/raw motion; explicit export only |
No backend, account, ads, tracking or analytics SDK is included. Do not declare future data practices as implemented. If motion recordings are required for QA, ask explicit informed consent, store locally outside git, define deletion time and never upload by default. Export only redacted developer-selected evidence.
@@ -33,7 +33,7 @@ Keychain accessibility must be chosen against actual locked-phone relay needs. P
## Permissions and manifest
Production phone setup will need NSLocalNetworkUsageDescription. Motion capture needs an accurate motion purpose string where required by the adopted API/platform. Add permission strings when adapters are introduced; the demo requests neither. Manual unicast address entry is the baseline. SSDP/multicast discovery and Wake-on-LAN may need separate Apple networking entitlement review; do not enable blanket capabilities speculatively. NSBonjourServices entries apply only to the actual Bonjour service types used, not generic SSDP.
Phone setup declares NSLocalNetworkUsageDescription. Motion capture needs an accurate motion purpose string where required by the adopted API/platform. The watch declares NSMotionUsageDescription. Explicit demo controls request neither. Manual unicast address entry is the baseline. SSDP/multicast discovery and Wake-on-LAN may need separate Apple networking entitlement review; do not enable blanket capabilities speculatively. NSBonjourServices entries apply only to the actual Bonjour service types used, not generic SSDP.
The current PrivacyInfo.xcprivacy describes the current demo's lack of tracking, collection and required-reason API declarations. It is not a release approval or a blanket policy for future code. Re-audit FileTimestamp/SystemBootTime/DiskSpace/UserDefaults and other required-reason APIs, dependency manifests and data flows after each adapter. Declare truthful approved reasons actually applicable to the implementation. The public privacy policy and App Store answers must match the final binary and include support/contact details before submission.