Privacy policy

NAS Reborn is designed to keep your information private. It does this by collecting very little information, using as few third-party services as possible and keeping your data on your own device.

On the device

Your files, the accounts and access keys you create, camera video and clips, and the readings from your home's accessories and the device's own sensors are stored on the device and go only where you send them: to the clients you let in and onto the pages you choose to serve. Clients connect straight to the device, without an account with me or a relay in the middle, and on your local network the server announces its name so the Finder, the Files app and Windows can find it.

The app asks for Local Network access so other devices can find the server. It asks for the camera, the microphone, your home's accessories and motion data only when you set up something that needs them, and Face ID, Touch ID or the device passcode confirms it is you before a secret is shown, when the device has a passcode. Video is captured while somebody watches a camera feed or while the feed watches for movement, and it stays on the device. A camera feed with Audio turned on records sound along with the video. For a noise reading the microphone is reduced to a loudness number, and the audio itself is discarded.

The server keeps a log of failed requests and a diagnostics log on the device, both readable in the app. The error log records what a failed request asked for and the address it came from. Neither leaves the device unless you export the diagnostics log yourself, for instance to attach it to a support email. The diagnostics log holds hostnames, addresses, request paths, errors and the names of folders, files, devices and your router, and never a password or the secret half of an access key.

Usage statistics

The app collects usage data to know how many servers are running and on what hardware. Signals count that the app launched and that it was installed for the first time. Test versions of the app also report what kind of network a server is on, such as whether its router lets another device connect to it directly and whether it has IPv6, as a category only and at most once a week. To tell, the app asks my backend which address and port it sees the device's connection come from, and the backend keeps no record of the answer. This check only runs while usage statistics are on. Each signal carries what the TelemetryDeck software sends by default: the app version and build, the operating system version, the device model and processor type, the language and region, the time zone, the screen size, orientation and light or dark appearance, accessibility settings such as text size and reduced motion, the day and hour, whether it is a test version, counts of the days and sessions the app has been used, and an identifier hashed on the device from Apple's per-app vendor identifier so an install is counted once without being identified. No file, share, hostname, address or account is included.

Usage data is recorded using TelemetryDeck and can be disabled with the Anonymous usage statistics switch in Settings. While the switch is off nothing is collected and nothing is queued for later.

Security advisories

At most every six hours the app fetches a signed file from nasreborn.com listing known security problems for its version. The address of that file contains the app version, and like any web request it arrives from your internet address. Nothing else is sent, and the file is the same for everyone running that version. An advisory can show you a notice and, for a version that can no longer be updated, turn sharing off once until you turn it back on. The check can be disabled with the Check security advisories switch in Settings.

Hostname and certificate

The first time the app runs with a connection it registers with my backend and is assigned a random hostname under nas2.dk, and it requests a certificate for that name right after. From then on the app keeps the DNS records for that name pointed at the device, also while it is not serving. With the Serve tab set to LAN, the default, the records hold the device's address on your home network and its IPv6 address. Set to Internet, they hold the addresses it can be reached at from the internet. DNS is public: anyone who knows the hostname can look up those addresses, which is also what a visitor learns by opening any page you serve. The backend keeps no database. The address lives in the DNS record itself, and the token that lets a device edit its own name is derived on the fly rather than stored. It runs on DigitalOcean, which also hosts the nas2.dk DNS, so DigitalOcean handles those requests and any logs of them.

The reachability check asks the backend to connect to your public address from outside, carrying a one-time token that only your device can answer, and tells you which addresses work.

To learn the internet address of your connection, the app asks ipify at api4.ipify.org, which answers with the address the request came from. To check that the hostname, and any custom domain you add, point at the device, the app looks them up with Cloudflare's DNS over HTTPS, which receives the name looked up and your internet address.

The certificate is requested by the device itself from Let's Encrypt, with no email address on the account. My backend only relays the DNS record that proves you control the hostname. Every certificate Let's Encrypt issues is published in public Certificate Transparency logs, so the hostname, and a domain of your own when you add one, becomes public along with the dates each certificate was issued. A domain of your own is validated by Let's Encrypt connecting to the server directly, and my backend plays no part in it.

Network relay and backups

While the network relay is switched on, or while the device holds a backup for someone, it tells my backend the addresses it can be reached at every 25 seconds, so your other devices, or the device backing up to it, can find it. A device that wants to reach it sends a knock through the backend, which passes on the addresses of both devices so they can connect to each other through their routers. The connection itself runs directly between the two devices, encrypted end to end, and the backend never sees what they send. It keeps the addresses in memory only, forgets a device 90 seconds after its last check-in and a knock after 30 seconds, and writes neither to a log. A device reaching yours through the relay tells it the name it has in NAS Reborn and its model, which the relay shows so you can see who used it.

Notifications

When you let a browser receive notifications from a camera, the device sends them through the push service of that browser, run by Apple, Google or Mozilla. Each notification is encrypted for your browser and carries a line of text and a link, never a picture or video. The subscriptions live on the device.

Backups

A backup to another person's device or to an S3 bucket is encrypted on your device before it leaves. Whoever hosts it sees encrypted blocks, their size, when they arrive and the address they come from, and never a file name or a byte of content. By default the key that encrypts a backup is kept in your iCloud Keychain, which Apple end-to-end encrypts, so a new device signed into your Apple account can find and restore the backup. The Keep key in iCloud switch on each destination turns that off, leaving the recovery phrase as the only way back in.

A backup invitation travels in the part of a link after the # sign, which your browser never sends anywhere, this site included.

Purchases and crash reports

Pro is a one-time purchase through the App Store. Apple handles the payment and I receive no name, address or payment details. The app keeps the purchase state on the device. Crash reports reach me only through Apple, when you have allowed sharing them with developers in your device's settings, or through TestFlight along with the feedback you send from there.

Support

Writing to support@nasreborn.com puts your email address and whatever you send in my mailbox. I use it only to help you and keep it for as long as that takes.

This website

nasreborn.com is a static site served by Netlify, which handles each request and keeps its own logs of it. The site has no analytics, sets no cookies and loads nothing from anywhere else.

The newsletter form, and Subscribe to Newsletter… in the app's Settings, send the address you enter to EmailOctopus, which sends the confirmation mail and, once you have confirmed, one or two emails a year. I use the address for the newsletter only, every mail ends with an unsubscribe link, and an address that is never confirmed is dropped.

NAS Reborn and this site are made by Anders Borum. This page changes when the app does and was last updated on 7 October 2026.