What each LibrePortal phone app connects to, which permissions it asks for and why, what it keeps on your phone, and how to turn off its update check. Laid out like an F-Droid listing.
LibrePortal's phone apps follow the Promise: your data stays on your server, nothing is sent unless you choose, there is no tracking and no Google, and the code is open. This page shows what each app gives and takes, in the same layout for all three, so you can compare them. The same text is inside each app, under Privacy in its settings.
Every app was checked for the known tracker libraries (the Exodus Privacy list), its permissions, what it stores, and every address it can contact. None of them has a tracker. The only address outside your own server is git.libreportal.org, used to look for a new version of the app, and each app asks you once, in plain words, whether it may do that. Say no and it never looks by itself: you can still press Check now, or update by hand from libreportal.org/download. You can change your answer any time with the Check for updates switch.
The update check sends what any web request sends: your IP address and a generic app name. It never sends your server's address, your name or anything about what you do. A downloaded update is only installed if its checksum matches and it is signed with the same key as the app already on your phone.
NoneThe release app was scanned for the known tracker libraries (the Exodus Privacy list). None are in it: no Google Play Services, Firebase, analytics, crash reporting or ads.
Anti-featuresAll clear
Ads
Tracking
NonFreeNet
NonFreeDep
NonFreeAdd
NonFreeAssets
UpstreamNonFree
KnownVuln
NSFW
NonFreeNet: It only talks to your own server and to git.libreportal.org (open source).
Permissions
Needed to work
Internet, network stateTo reach your server, and to know whether the phone is online.
NotificationsTo show the alerts your server sends you.
Run in the background, start at boot, foreground serviceTo keep one quiet connection to your own server open so alerts arrive with the app closed. No Google push is used.
Only when you use it
CameraFor video calls and scanning a QR code, only when a page of your server asks.
Microphone, audio settingsFor calls and voice notes, only when a page of your server asks.
Install appsTo install this app's own updates, after checking them. Android asks you every time.
Storage (Android 8 and 9 only)To save a download you started into Downloads.
Connects to
Your own serverYour LibrePortal, its sign-in page if you use one, and its notification service.
git.libreportal.orgUpdate checks only, and only if you say yes: the app asks once. When on, about twice a day. It sees your IP address and a generic app name, nothing else. Change it any time in Setup, under Check for updates; Check now always works.Off unless you say yes
Web viewThe built-in browser view only opens your own server and its sign-in page. Other links open in your normal browser. No Google Safe Browsing lookups or usage statistics.
Nothing elseNo analytics, no Google.
Stores on your phone
Your serversNames and addresses, in the app's private storage.
Sign-in and trusted certificatesEncrypted with a key in the Android Keystore. Your password is never stored.
Sign-in sharingOther LibrePortal apps on this phone can ask this app to sign them in, only after you allow it; each gets its own key; nothing is shared without a check of the app's signature.
Apps your server addsA server can name extra apps of its own that may use this sign-in. Their name, package and certificate hash are kept per server on this phone and trusted for that server only; you still allow each one, and it is removed when the server stops listing it.
BackupsOff. Nothing from this app goes to Android or Google backups.
AGPL-3.0-or-laterFree software: read it, change it, share it.
View the sourcegit.libreportal.org/LibrePortal/LibrePortal-App
NoneThe release app was scanned for the known tracker libraries (the Exodus Privacy list). None are in it: no Google Play Services, Firebase, analytics, crash reporting or ads.
Anti-featuresAll clear
Ads
Tracking
NonFreeNet
NonFreeDep
NonFreeAdd
NonFreeAssets
UpstreamNonFree
KnownVuln
NSFW
NonFreeNet: It only talks to the servers you add and to git.libreportal.org (open source).
Permissions
Needed to work
Internet, network stateTo reach your server, and to know whether you are on Wi-Fi.
NotificationsTo tell you when files arrive.
Run in the background, start at boot, foreground serviceTo finish big syncs, and to keep one quiet connection to your own server so a change is noticed at once. No Google push is used.
Only when you use it
Photos, videos and their locationTo upload the camera-roll folders you pick, with their place tags kept. Only to your server.
All files access (optional)Lets synced folders live in one LibreSync folder. Without it they go into Music, Movies and Pictures instead.
Storage (older Android only)The same, on Android 12 and earlier.
CameraTo scan your server's QR code. Nothing is recorded or kept.
Install appsTo install this app's own updates, after checking them. Android asks you every time.
Connects to
Your own serverYour LibrePortal and its file service, and its sign-in page. Also any ownCloud or Nextcloud you choose to add yourself.
git.libreportal.orgUpdate checks only, and only if you say yes: the app asks once. When on, about twice a day. It sees your IP address and a generic app name, nothing else. Change it any time in Settings, under Check for updates; Check now always works.Off unless you say yes
LibrePortal app on this phoneCan sign in through the LibrePortal app on this phone, only after you allow it. It hands LibreSync a one-time code for your own server, never your password.
Sign-in pageSigning in opens your own server in your default browser. The app adds nothing to that request.
Nothing elseNo analytics, no Google.
Stores on your phone
Your sign-inA token or app password for each source, encrypted with a key in the Android Keystore. Your own password is never stored.
Your synced filesIn the LibreSync folder you can see in your file manager. Other apps with storage access can read them.
Sync notesWhich files were synced, in the app's private storage.
BackupsOff. Nothing from this app goes to Android or Google backups.
AGPL-3.0-or-laterFree software: read it, change it, share it.
NoneThe release app was scanned for the known tracker libraries (the Exodus Privacy list). None are in it: no Google Play Services, Firebase, analytics, crash reporting or ads.
Anti-featuresAll clear
Ads
Tracking
NonFreeNet
NonFreeDep
NonFreeAdd
NonFreeAssets
UpstreamNonFree
KnownVuln
NSFW
NonFreeNet: It only talks to your own server and to git.libreportal.org (open source).
Permissions
Needed to work
Internet, network stateTo reach your LibreMoney server, and to know whether the phone is online.
NotificationsTo tell you a ledger was shared with you. A notification never says what is in a ledger.
Run in the backgroundSo those notifications arrive on time with the app closed.
Only when you use it
CameraTo scan your server's QR code during set-up. Nothing is recorded or kept.
Keep a connection, start at bootOnly when the LibrePortal app is not on the phone: LibreMoney then keeps one quiet connection to your own server's ntfy (a one-line notice shows while it runs) and starts it again after a restart. With the LibrePortal app installed, that app holds the connection instead.
Fingerprint (biometrics)Only if you turn on Unlock with fingerprint. Android does the fingerprint check; the app never sees your fingerprint, only whether it matched.
Install appsTo install this app's own updates, after checking them. Android asks you every time.
Connects to
Your own serversEach LibreMoney you added, and its sign-in page. With Authelia, the sign-in happens in your own browser, on your own server, and the app adds only a one-time code to it. Your ledgers are encrypted on your phone before they leave it.
git.libreportal.orgUpdate checks only, and only if you say yes: the app asks once. When on, about twice a day. It sees your IP address and a generic app name, nothing else. Change it any time in the menu, under Check for updates; Check now always works.Off unless you say yes
Your server's ntfyFor notifications only, at the address your own LibreMoney server gave. No Google or other push service is involved.
Web viewThe built-in browser view only opens your own server and its sign-in page. Other links open in your normal browser. No Google Safe Browsing lookups or usage statistics.
Nothing elseNo analytics, no Google, no fonts or scripts from anywhere else.
Stores on your phone
Your server's addressIn the app's private storage.
Your sign-inEither a session cookie in the app's private storage, or, if you sign in with Authelia from the app, a short-lived token and a refresh token for each server, sealed by a key in the Android Keystore. Your Authelia password is never stored, and you can end a phone's sign-in from the menu (Sign out) or from the server.
Your serversThe list of servers you added, in the app's private storage.
Fingerprint unlock (off unless you turn it on)Your unlock password for one server, sealed with a key that only your fingerprint opens, every time. It never leaves the phone: it is not sent to the server, not logged and not in a backup. Adding a new fingerprint to the phone destroys the key, so the app forgets the copy and asks for your password. Turn it off in the menu to delete it. Threat model: someone with the phone but not your finger cannot open it; malware with root on an unlocked, running phone is outside what any app can defend against.
Your ledgersAn encrypted copy so it opens offline. On this phone a ledger is only ever ciphertext.
BackupsOff. Nothing from this app goes to Android or Google backups.
AGPL-3.0-or-laterFree software: read it, change it, share it.