Frequently asked questions

What is Witness?

Witness is an iOS app for documenting police encounters, protests and immigration enforcement. It records video with the screen completely black, and uploads the footage in roughly 15-second pieces while recording is still in progress, to a cloud storage account you own, so the footage survives even if the phone does not.

Is it free?

Yes. Black-screen recording, continuous upload, hashing, time-stamping and emergency contacts are all free and stay free. Witness Pro is optional and adds capture quality only (4K, 24/25/60 fps, Apple Log and ProRes) at $1.99 per month or $9.99 once. Nothing that protects footage sits behind the paywall.

What does it need?

An iPhone running iOS 17 or later, and a cloud storage account you already have.

Can the developer see my footage?

No. Witness has no server. Footage travels from your device directly to the account you connected and nowhere else. There is no copy for the developer to hold, hand over, or lose.

The one thing that goes to any third party is an irreversible SHA-256 hash of the session manifest, sent to the time-stamp authority. It contains no footage, no location and nothing identifying. The authority learns that some document existed, never what it said.

Do I need a Witness account?

No. There is no account, no sign-up and no analytics server. You authenticate only with your own storage provider, and that relationship is between you and them.

How much access does the app request to my cloud storage?

The minimum available. On Google Drive it requests drive.file, which grants access only to files the app itself creates, so it cannot read anything else in your Drive. Dropbox uses App-folder access, the equivalent. With WebDAV you supply a server and credentials directly, and we recommend an app-specific password where your server offers one, since it can be revoked on its own.

What happens if my phone is seized or destroyed?

Everything already uploaded is safe in your cloud account and unaffected by anything done to the device. Because upload runs continuously rather than at the end, the loss is at most the last few seconds. The manifest documenting the session is uploaded continuously too, so the custody record is there as well.

What if someone makes me unlock my phone?

Uploaded footage is beyond the reach of the phone, but not beyond the reach of your cloud account, and the phone is usually signed into that account. Someone with your unlocked phone could open the Drive or Dropbox app and delete footage there. The app includes guidance on hardening this in advance, and it is worth reading before you need it.

Does it work without signal?

Recording works normally. Uploading cannot happen without a connection, so chunks queue on the device and upload the moment signal returns. Nothing is deleted locally until receipt is confirmed.

What if the connection is bad but not dead?

If uploads start falling behind, Witness encodes a small low-resolution stand-in of each new chunk and sends that first, so something arrives during the event. The full-quality file follows and replaces it once the network allows. On a healthy connection this never happens.

Will this hold up as evidence?

Witness produces a genuinely verifiable record: a SHA-256 hash of every chunk, a session manifest listing those hashes with UTC times and GPS coordinates, and an independent RFC 3161 time-stamp counter-signing that manifest. Anyone can check it with standard OpenSSL, without the app and without trusting the person who filmed it.

Whether particular footage is admissible is a legal question that turns on jurisdiction and circumstance, and this is not legal advice. What the app can do is make the technical objections, that video was altered or backdated, answerable.

What is a chain of custody, and why does video need one?

It is a documented record showing evidence is what it claims to be and has not been altered. A video file on its own proves very little: file timestamps can be changed and footage can be edited convincingly. Witness builds the record while recording, hashing each chunk, listing the hashes, and having a third party counter-sign the list, so a later modification is detectable by someone who trusts neither party.

How does someone verify footage I send them?

Send the whole session folder (video, manifest and time-stamp token) and point them at the verification instructions. Send originals: messaging apps and social platforms re-encode video, which changes the file and breaks hash matching.

What happened to the ACLU Mobile Justice app?

It was discontinued in February 2025, after running in seventeen states and the District of Columbia. Two separate things went away with it: footage leaving the phone, which other apps still do, and an ACLU affiliate receiving and reviewing that footage, which no consumer app replaces. What it did and how to choose a replacement covers the difference.

Can I use this to record ICE or immigration enforcement?

Yes, and the same properties matter there: footage leaving the device during the encounter rather than after it, and starting without unlocking. Recording immigration enforcement goes into the specifics, including why photo-library cloud sync is a weaker safeguard than it appears. It is not legal advice, and the know-your-rights organisations linked there are the authority on the rest.

Does the screen really stay black?

Yes, fully dark for the whole recording, so the phone reads as idle. Stopping takes a triple-tap and then a press-and-hold, which is hard to trigger by accident or by someone snatching the phone. If you would rather see what you are filming, an optional viewfinder can be turned on.

Can I start it without unlocking the phone?

Yes. The Action Button on iPhone 15 Pro and newer, a Lock Screen widget, or a Siri phrase. Each goes straight into recording.

Can it record both cameras?

Yes, on devices that support it, producing two synchronised videos per session. Dual-camera recording is limited by hardware to 1080p at 30 fps and cannot do Apple Log, so it turns off automatically when higher Pro capture settings are selected, and the app tells you which setting is responsible.

Which storage should I choose?

All three protect footage from device loss equally. Google Drive and Dropbox are simplest, and are the only options where emergency contacts get access automatically. Nextcloud or WebDAV keeps footage on infrastructure you or your organisation control, at the cost of automatic contact sharing, since the protocol has no sharing mechanism.

What can't Witness do?

It cannot upload with no network. It cannot protect footage from someone with access to your unlocked phone and your cloud account. ProRes recordings are too large to send live and stay on the device by design. It does not make recording lawful where it is not, and it does not give legal advice.

Why isn't Proton Drive supported?

Proton encrypts every file client-side, with keys derived from your account, before anything leaves their own apps, and they publish no interface a third-party app can use. This is a property of how Proton is built, not a gap we can close. The app lists Proton and explains this rather than pretending the option exists.

Is there an Android version?

Not yet. Witness is currently iOS 17 and later.