Privacy and boundaries

Briefly: the cloud knows who is talking to whom, and does not know what they are saying. Below is the same thing as a list, without the "we respect your privacy".

What the cloud stores

• Accounts: email, a password hash, whether a second factor is bound.
• Devices and nodes: their public keys, their addresses in your network, what each node advertised about itself, when it was last in touch.
• Networks and grants: whose network it is, who is allowed what, and until when.
• A camera's RTSP login and password – only if you set them yourself, so the cloud can pull the stream when there is no direct path. Stored encrypted, never handed back out by any request: the list only shows that they are set.

What is not in the cloud

• Video and frames. No recordings, no archive, no snapshots. When the picture goes through the relay, the relay passes it along and keeps nothing.
• Your cameras' ONVIF and SSH passwords. Your browser or your app talks to the camera with them; the cloud brokers the connection and does not look inside.
• Your devices' private keys. They never leave the hardware – not at enrolment, not at claim: only the public half travels to the cloud.
• Recovery by email. The cloud sends no mail at all, which is why a password and a second factor are restored by the owner of the instance, by hand, rather than by a link in a letter.

What leaves the camera is your call

The setting lives per camera, not once per account. The one in the bedroom can send nothing at all while the one at the gate records an archive.

The second is the default. There is no archive in the beta at all (see below), so the third describes where this is going rather than what is switched on.

Face recognition is as explicit: the system knows nobody until a person is added by hand and named by you. There are no shared databases, nobody lands there automatically, and everything is deleted in one click. That part is still being finished, and it will be shown before it is switched on.

Boundaries worth knowing

Your network is separated from other people's on the wire, not only in the panel: packets do not travel between different networks. Inside one network the boundaries are drawn by the map and by grants – which is to say, inside your own network you see your own cameras, and that is exactly what is expected of it.

A guest with a grant stands in a network of their own: they could not reach your camera directly even if they wanted to, and they get video through the relay – for exactly the device and exactly the actions you allowed.

Whoever runs an instance can see its database. That is a boundary too: openipc.cloud is run by the project's authors, and an instance someone else brought up is run by them.

What "beta" means

The beta is a test rig. It works and people use it, but:

• do not hang the one camera something depends on off it;
• do not treat the archive as reliable – there isn't one;
• entry is by invitation, and that is not marketing: an instance has a finite supply of networks;
• if something breaks or behaves oddly, write in. That is the point of a beta.