| Data | Why | How it's stored |
|---|---|---|
| Email address | Identifies your account | Plain, in our database |
| Passkey public key | Signs you in — there is no password | Plain (public keys aren't secret by design) |
| Verkada API key (optional) | Lets CAPACITY call Verkada's API on your behalf | Encrypted at rest (AES-GCM); never sent back to any browser once saved |
| Site/floorplan/zone configuration | The dashboard you build | Plain, private to your account |
We don't collect passwords (CAPACITY uses passkeys, not passwords). We don't access, store, or view your Verkada camera footage — CAPACITY only reads the specific occupancy/queue/LPR metrics your zones are configured to display, via API calls made on request.
Only you, while signed in. The one exception is the operator's own admin account, which can choose to publish its own data as the public example anyone sees without signing in — this is a deliberate, manual action, never automatic, and never applies to any other account's data.
We don't sell your data. The only third-party service your data passes through is Verkada's own API, and only for the specific calls needed to power your dashboard — and only when you've provided your own Verkada API key.
Your account data is kept for as long as your account exists. Signed-in sessions expire automatically; expired sessions are periodically purged from our database.
Sign-in uses passkeys (WebAuthn) rather than passwords. Your Verkada API key, if you add one, is encrypted at rest and decrypted only server-side, only when needed to make a Verkada API call on your behalf.
You can remove your stored Verkada API key at any time from Settings. To delete your account entirely, contact the account you're working with directly — self-serve account deletion isn't built yet.
We may update this policy as the product changes. Material changes will be reflected here with an updated date once this page is out of draft.