Jpicam

Jpic is an Android camera and gallery application designed to reduce local data exposure and avoid plaintext media upload by default.

The application is not a replacement for a trusted operating system, verified boot, strong device credentials, or operationally secure backend delivery. Its security model is centered on limiting what is stored locally, binding sensitive local state to a user secret, and uploading encrypted media payloads instead of raw JPEG/MP4 files.

Security Properties Local gallery metadata is stored in a SQLCipher database. The database passphrase is protected by a vault key unlocked from the user secret. Stored API keys and thumbnails are vault-protected and require an active unlocked session. Gallery and settings access relock when the activity leaves the foreground. Duress and wrong-attempt wipe use the same local crypto-erasure path. FLAG_SECURE blocks screenshots, screen recording, and recents previews for the app window. Android Auto Backup and device-transfer extraction rules exclude shared preferences, databases, app files, thumbnails, temp media, and sidecars. Location stamping, GPS EXIF writing, visible location watermarking, and video audio capture are opt-in. Captured media is processed into encrypted internal temp storage. Plaintext capture files are wiped after processing and stale plaintext files are cleaned on startup. Uploads use the encrypted media endpoints under /api/v1/upload/encrypted/*. Share links use URL fragment key delivery. A full URL containing #k=... is secret-bearing. HTTPS requests to the configured host use certificate pinning. Release artifact builds require a backup SPKI pin. Limitations A rooted or otherwise compromised device can observe app memory, UI input, screenshots outside app control, Keystore operations, or runtime values while the app is unlocked. Accessibility services, keyboard capture, screen overlays, or shoulder-surfing can compromise the vault secret. A 6-digit PIN is not high entropy against a capable offline attacker who obtains a usable verifier. High-risk deployments should use an 8+ digit PIN or passphrase. Flash-storage wipe is best-effort. Crypto-erasure is the primary local wipe mechanism. Encrypted upload security depends on backend support for opaque ciphertext storage and safe viewer delivery. A malicious or compromised web viewer can steal URL fragment keys. URL fragments are not sent to the backend in HTTP requests, but full share URLs can leak through clipboard managers, browsers, extensions, intents, screenshots, or logs outside this app.