In principle, what stops one party from simply reverse engineering the client app and permanently retrieving the file? Once the video file is decrypted on the client, even briefly, you've lost control.

Your answer demonstrates that you've thought about this problem, not that you've solved it. I like the idea of this app, but I would argue that the core promise of your app is technically infeasible.

EDIT: I clicked through to read your whitepaper and see that you've explicitly called this concern out and admitted the DRM scheme cannot be foolproof. That's admirable, and I'm glad you did address it. I would gently suggest you place that disclaimer somewhere in your FAQ as well.

While you literally did address the question (and I applaud you for responding), you didn't actually answer it.

There is, of course, no technological way to prevent someone from capturing a video through the analogue hole (i.e., pointing a camera to the video as it is played), even if we assume that is possible that a consumer device can be controlled to such an extent that its owner can't find a way to capture the video output digitally.

To the OP's credit, this is explicitly called out in the whitepaper introduction. I think the point is that this app makes casual, "in the heat of the moment" backstabbing pretty difficult.

In my opinion this is fair, because the vast majority of bitter/petty ex's are not going to know how to, or bother with, reverse engineering an app to spite their significant other. They'd also have to do it when they're granted access to the app, which implies a certain forethought.

I you are physically present when you grant access you can ensure they do not record with something else via the analog hole. If you're at work and they're at home and would like to view it then sure, there's a plausible covert copy being made if you agree to let them view it.