Privacy Policy

Last updated: 2026-07-15

The short version

Kestrel is a client for your own self-hosted Frigate server. Your camera footage, snapshots, recordings and event data travel directly between your phone and your server. We never receive, store, or can access any of it. The one optional exception is cloud push notifications (a paid feature, off by default): if you explicitly turn it on, small alert payloads are relayed through our push service so your phone can be notified while the app is closed — see “Cloud push notifications” below for exactly what that includes.

What we process

• By default: nothing. Live view, review, playback, export and in-app notifications are direct connections from your phone to your own hardware — on your LAN, or over your own VPN (e.g. Tailscale or WireGuard) when you are away. Management traffic (video, recordings, configuration) never touches any cloud, under any setting. No account with us is required or offered.
• Cloud push notifications (optional, paid, off by default). Only if you explicitly enable them — see the dedicated section below.
• Purchases and subscriptions (only if you buy Pro). Payment is handled by the app store; we never see your card details — see the dedicated section below.
• Crash reports (optional, off by default in settings). If enabled, anonymized crash traces are processed to fix bugs.

Cloud push notifications (optional)

Real-time push while the app is closed requires Apple/Google push infrastructure, so this feature — and only this feature — uses a cloud relay (Firebase). It is:

• Off by default and opt-in. Nothing is sent until you explicitly enable cloud push on your own sidecar (an environment switch on your server) and consent in the app. The free tier stays fully local; cloud push is part of the paid tier.
• Limited to the alert payload. When your rules match an event, the relay carries: the camera name, zone names the object entered (as configured by you), detected object labels, the severity level, the event start time, review/event identifiers (also embedded in the tap-to-open deep link), your server’s display name, and (best-effort) one snapshot image of the event. To route the push, the relay also processes your device’s push token and language preference. That is the complete list — video streams and recordings never transit the relay.
• Short-lived. Snapshot images are retained for at most 1 day, then deleted. Push messages carry a 1-day delivery expiry: if your phone stays unreachable longer than that, the message is dropped by the push network instead of being delivered late.
• Never video. Live streams, recordings, exports, audio and configuration never transit the relay — they remain direct connections to your own server. Turning cloud push off (either side) returns you to the fully local notification path.

Purchases and subscriptions

Kestrel Pro (which unlocks cloud push) is sold through the Apple App Store and Google Play. When you buy or restore a subscription:

• The store handles payment. Your card and billing details are processed by Apple / Google — we never receive or store them.
• We process purchase status, not payment data. To unlock Pro and gate cloud push, our server validates your purchase directly with the app store's developer API and stores an anonymous per-install id, the purchase status (active, expired, refunded) and your device push token, so a lapsed subscription stops relaying. This is not linked to a name, email, or the contents of your cameras.
• Managing / cancelling. Auto-renewing subscriptions are managed and cancelled in your App Store / Google Play account settings, per the store’s terms — see the Terms of Service.

What we never do

• No analytics SDKs harvesting behavior, no ads, no data sale — ever.
• No proxying or storage of video, audio, images, or event metadata in plaintext.

Data stored on your device

Server addresses, usernames and session tokens are stored in your phone's secure storage (Keychain / EncryptedSharedPreferences). Passwords are stored only to re-authenticate with your own server and never leave your device.

Deletion

We hold no data about you, so there is nothing for us to delete. Uninstalling the app removes all local data from your phone.

Contact

Questions about this policy or your data: pingnestapp@gmail.com · Support · Terms of Service