Data Security
Jag Stories is designed primarily around local device storage and direct user-controlled workflows.
Local-first records
Weapon, DOPE, training, performance, match, Stage Video, Hunter's Room and Shared Hunt records are designed to live on the user's device unless the user invokes a backup, export, sharing or device-to-device workflow.
Encrypted Match Director payloads
Current local Match Director protocol payloads use AES-256-GCM authenticated encryption to protect supported event payload data during the local exchange.
Shared Hunt synchronization
Shared Hunts are local-first. The app prefers direct device-to-device synchronization over a reachable Wi-Fi network or host hotspot, including photos. Optional cloud synchronization handles basic hunt information and harvest results when local connectivity is unavailable. Host-controlled membership and authenticated API access restrict cloud access. Cloud photos are not included in this phase.
User-controlled backups
Backup and restore are deliberate user actions. Shared Hunt backup stores supported hunt metadata and photo references without intentionally duplicating Gallery images that already exist locally.
Local shared albums
Shared Hunt photos are designed to remain available in the device Gallery album for that hunt. On restore, Jag Stories can use stored metadata to reconnect hunt records to matching images that are still present, while avoiding unrelated Gallery files.
Cloud data and notifications
Cloud Shared Hunt information may include identifiers, host/member details, hunt dates and location, planned targets, harvest details and change metadata. Cloud synchronization and push notifications require internet access; device notification tokens may be processed by a third-party notification provider to deliver hunt alerts. Direct LAN synchronization does not depend on push notification services. A QR code is an invitation mechanism, not an automatic network connection. Cloud synchronization does not serve as a full-device backup.
What AES-GCM does
AES-GCM combines encryption with integrity authentication. This means supported Match Director payloads are not simply readable network JSON, and tampering with an authenticated encrypted payload should cause validation to fail.
What it does not do
No security measure eliminates every risk. Local network availability, device compromise, screenshots, exported files, malicious software, rooted devices or unsafe sharing can still expose information. Keep Android and Jag Stories updated and protect your device with an appropriate screen lock.
Security reports
If you believe you have found a security problem in Jag Stories, contact support@jagstories.com and include the app version, device model, steps to reproduce and screenshots or logs that do not expose unnecessary personal information.
Website tester applications
The Jag Stories website is static-hosted. Tester applications are submitted through an external form-delivery service and routed to support@jagstories.com. Do not include passwords, firearm serial numbers, identity documents or other unnecessary sensitive information in the tester form.