Privacy of every app
What each app in LibrePortal does with your data, in one table: what still leaves the server, what LibrePortal turns off, and how we judged it.
The Promise says LibrePortal has no telemetry and keeps your data on a machine you own. That covers LibrePortal itself. Every app you install is somebody else's software, and plenty of it comes set up to check in with its makers. So each app has been read against its own documentation and source, and LibrePortal switches off whatever it safely can.
Each app gets one of three verdicts, and every page says what still leaves the server and what LibrePortal turns off. Dated 21 October 2026.
- All clear nothing leaves the server that you did not ask for.
- Worth knowing something still reaches outside, and it is listed on the app's page. Often it is the app's whole job, like federation or a VPN provider.
- Not recommended a known problem, explained on the page.
Of 81 apps, 53 are all clear, 28 are worth knowing about, and 0 are not recommended.
| App | Verdict | In one line |
|---|---|---|
| AdGuard | All clear | AdGuard Home blocks ads and trackers for your whole network and collects no usage statistics. |
| Audiobookshelf | Worth knowing | Your browser asks GitHub for the latest version whenever the page is opened; there is no setting to stop it |
| Authelia | All clear | Authelia is your sign-in gate and sends nothing anywhere on its own. |
| Backup Server | All clear | The Backup Server collects encrypted backups from your other LibrePortal servers and reports nothing about you. |
| Bookstack | Worth knowing | Editing a diagram opens the editor from diagrams.net in your browser, which tells them you used it |
| Connect Accounts | All clear | Connect Accounts is the sign-up site for a hosted LibrePortal Connect relay. |
| CrowdSec | Worth knowing | Attacker IP, attack type and time go to CrowdSec while the Community blocklist setting is on (the default); off also stops the shared blocklist |
| CryptPad | All clear | CryptPad is an encrypted office suite where the server cannot read your documents. |
| Dashy | All clear | Dashy does not report on you. |
| Draw.io | Worth knowing | Not yet confirmed whether the editor loads fonts or icons from outside hosts |
| FMD Server | Worth knowing | Map tiles are loaded from OpenStreetMap by each viewer's browser |
| Forgejo | All clear | Forgejo is your own Git hosting. |
| Friendica | All clear | Friendica talks to other social servers because that is how it works, so what you post goes where you send it. |
| Funkwhale | All clear | Funkwhale is your own music server. |
| Gitea | All clear | Gitea is your own Git hosting. |
| Gluetun | All clear | Gluetun has to contact your VPN company, which is its job. |
| Grafana | All clear | Grafana shows your server's numbers. |
| Headscale | All clear | Headscale runs your own private VPN control server. |
| Home Assistant | Worth knowing | Brand logos load from Home Assistant's site in your browser |
| Immich | All clear | Immich keeps your photos on your server. |
| Invidious | Worth knowing | Your server contacts YouTube for every page, so Google sees its address |
| IT-Tools | All clear | IT-Tools is a set of small helper tools that run in your browser and send nothing anywhere. |
| Jellyfin | Worth knowing | Titles and years are sent to metadata sites (TMDb, TheTVDB and others), which can be turned off per library |
| Jitsi Meet | All clear | Jitsi keeps video on your server. |
| Kavita | All clear | Kavita is your own comic and book library. |
| LibreMoney | All clear | LibreMoney keeps your money records encrypted on your own server and never contacts outside services, except notifications to an address you choose. |
| LibrePortal Connect | All clear | Connect is LibrePortal's own relay and sends nothing anywhere itself. |
| LibrePortal IP | All clear | LibrePortal IP tells a caller its own public address as plain text, from your server. |
| LibrePost | Worth knowing | Spam-filter rules and the web admin are downloaded from GitHub, which sees this server's address |
| LibreSpeed | All clear | LibreSpeed measures your internet or network speed. |
| LibreSTUN | All clear | LibreSTUN is your own STUN and TURN server. |
| LibreTranslate | All clear | LibreTranslate translates on your server and sends your text nowhere. |
| Linkding | Worth knowing | Site icons are fetched from Google, only when a person turns icons on |
| Mastodon | All clear | Mastodon is your own social network server. |
| Matrix | Worth knowing | Federation: messages reach the servers of the people you talk to |
| Mattermost | All clear | Mattermost is team chat on your server. |
| Mobilizon | Worth knowing | Map tiles and address search come from OpenStreetMap by default |
| Mosquitto | All clear | Mosquitto is a quiet message broker that only talks to the devices you connect. |
| Navidrome | All clear | Navidrome plays your own music. |
| Nextcloud | Worth knowing | The app store is reachable (apps.nextcloud.com) when you add apps |
| Node-RED | All clear | Node-RED sends nothing about you unless you agree when it asks, and LibrePortal says no to its usage telemetry. |
| ntfy | All clear | ntfy delivers push notifications from your server to your phone and tells no one else. |
| Ollama | All clear | Ollama runs AI models on your own machine and keeps your prompts local. |
| OnlyOffice | Worth knowing | Not yet confirmed whether the editors or plugin marketplace fetch from onlyoffice.com |
| Open WebUI | All clear | Open WebUI has analytics, its update check and community sharing switched off by LibrePortal, and may still download an embedding model from Hugging Face. |
| OpenClaw | All clear | OpenClaw is an AI assistant that runs on your own models. |
| openWakeWord | All clear | OpenWakeWord listens for a wake word like 'okay nabu' on your own network and does not contact the internet. |
| Owncast | Worth knowing | Federation: followers on Mastodon and similar servers hear when you go live, once you have a domain |
| ownCloud | Worth knowing | A connectivity check against a Mozilla server, which sees your server's address |
| PairDrop | All clear | PairDrop moves files directly between your devices. |
| Paperless-ngx | All clear | Paperless keeps your scanned documents on your server. |
| PeerTube | Worth knowing | Federation with other servers |
| Pi-hole | Worth knowing | Blocklists are downloaded weekly from public sources |
| Piper | All clear | Piper turns text into speech entirely on your server. |
| PrivateBin | All clear | PrivateBin is a private paste site where text is encrypted in your browser, so even the server cannot read it. |
| Prometheus | All clear | Prometheus measures your own server and stores the numbers locally. |
| Rallly | All clear | Rallly helps you find a time to meet and keeps everything on your server. |
| Redlib | Worth knowing | Your server fetches everything from Reddit, so Reddit sees its address |
| Rocket.Chat | Worth knowing | Phone notifications go through Rocket.Chat's push gateway, which sees notification details |
| Screego | All clear | Screego shares your screen directly between you and the person you invite. |
| SearxNG | Worth knowing | Every search is sent to the search engines you have enabled |
| Shared folders | All clear | Files (SFTPGo) keeps everything on your server and does not phone home. |
| SnappyMail | All clear | SnappyMail is a webmail screen that runs on your server and does not report on you. |
| Soundcloak | Worth knowing | Your server contacts SoundCloud for every request, so SoundCloud sees its address, not yours |
| Stalwart | Worth knowing | Spam-filter rules and the web admin are downloaded from GitHub |
| Stirling-PDF | All clear | Stirling PDF edits PDFs on your server so your files never go to a website. |
| Stoat | Worth knowing | Voice calls may ask a public STUN server for the server's address (switchable in Config); LibreSTUN gives callers your own |
| Syncthing | Worth knowing | Public discovery and relay servers see your device ID and address |
| Traefik | All clear | Traefik is your reverse proxy and sends no usage statistics. |
| Trilium | Worth knowing | Not yet confirmed whether it checks GitHub for updates |
| Trivy | All clear | Trivy scans your apps for known security holes. |
| Unbound | All clear | Unbound looks up website addresses itself instead of handing your history to a big DNS company, and it sends nothing else out. |
| Uptime Kuma | All clear | Uptime Kuma watches your services and keeps its data on your server. |
| Vane | All clear | Vane is an AI search assistant. |
| Vaultwarden | All clear | Vaultwarden keeps your passwords encrypted on your server. |
| Vikunja | All clear | Vikunja is your task manager and keeps everything on your server. |
| wg-easy | All clear | The VPN manager does not report on you, and LibrePortal has turned off its update check. |
| Whisper | All clear | Whisper turns speech into text on your own server. |
| WriteFreely | Worth knowing | Federation: posts are delivered to followers' servers |
| Zigbee2MQTT | Worth knowing | Firmware lists are fetched from GitHub when a device asks for an update, at most once a day |
| Zulip | All clear | Zulip sends no usage reports, and LibrePortal turns off Gravatar and keeps phone push off until you opt in. |
