Privacy

• No account, no cloud. Nestwatch has no sign-up and no company server that your audio or video passes through.
• Only your devices. The apps talk only to your own devices, plus a relay server if, and only if, you turn one on.
• Encrypted end to end. Everything between a station and a listener is encrypted and authenticated, also on your own Wi-Fi.
• No recordings. Nestwatch never records audio or video, and keeps no history of either.
• No tracking. No analytics, no advertising, no crash reports, no update checks, no fonts or scripts loaded from the internet.

A listener can only follow a station after you paired them. Pairing works only while you have the pairing screen open on the station: at most 10 minutes, up to 8 devices, and after 5 wrong codes it closes.

When you pair by code, both devices show the same number. If the numbers differ, someone may be in between: choose Different and try again.

Every listener has its own key. On the station you see every trusted listener and can remove one at any time; it is disconnected immediately and refused afterwards, without affecting the others.

Connections use the Noise Protocol Framework: both devices prove who they are with their own keys, every session gets fresh keys, and messages that are changed, replayed or reordered end the session.

Keys stay on the device that made them, in the system's key store where there is one (Android Keystore, macOS Keychain, Windows Credential Manager, the Secret Service on Linux). They are never exported, logged or put in backups. A new phone means pairing again.

The station's camera starts only when a listener opens the camera view, and stops when the last one closes it. While it sends, the station shows an unmistakable indicator, and it always shows how many listeners are connected and whether someone is talking.

Apps ask for microphone and camera permission only when a feature first needs it, and explain why. You can switch the camera and talk-back off entirely on a station.

The browser listener is served by your own station and loads nothing from anywhere else. Its key and settings stay in that browser's storage for the station's address. Over plain HTTP the conversation is still end-to-end encrypted; the station's HTTPS address also protects the app itself and is needed for talk-back. Check that the certificate fingerprint matches the one the station shows.

The optional relay is for networks where your devices cannot reach each other directly. It is off by default; a station uses it only after you enable it and choose the server. The project plans to run one at nestwatch.appmire.be, and you can run your own.

Byte counts can reveal when there is sound, because sound activation sends audio only then. On relayed connections you can choose always-on listening to hide this. Relayed devices keep trying to switch to a direct path. The server keeps no recordings, does not log mailbox IDs or contents, and keeps IP addresses only as long as abuse protection needs, at most 24 hours.

This site is plain static pages. It sets no cookies, has no analytics or trackers, and loads no fonts or scripts from other servers. The only thing it remembers is your choice of night or day theme, stored in your own browser.

The full threat model and rules are in the specifications: security.md and rendezvous.md §7.