Off The CloudPrivacy
What the Off The Cloud bridge keeps about you, why, and for how long. Last updated 11 October 2026.
Your photos, videos and files are on your own device, not here. Off The Cloud is a device in your home. This page is about the bridge at off-the.cloud: the service that gives your device a name, lets you reach it from outside your home, and connects it with your friends' devices. You only need it, and an account, for that. Once it is set up, a device used only at home (at http://otc.local:8080) or through Tailscale Funnel never talks to us; while it is being set up, it does (see the setup check-in below).
The bridge relays your connection; it does not store what passes through it. Read how the relay works: it is not end-to-end encrypted.
Who we are
The bridge is run by Off The Cloud, the controller for the data on this page. Write to info@off-the.cloud about anything here, or use the contact form.
What is stored on your device is yours: you decide what goes on it and who sees it, and we have no access to it.
What we keep, why, and for how long
| What | Why | Legal basis | Kept |
|---|---|---|---|
| Your account: email, name, surname, country of residence, a hash of your password (never the password), and which Google or Apple sign-in it is linked to; when it was created and last used; the language for our emails (from the page you signed up on, or your browser's language; an account without one takes the language of the account page you open) | To give you your device names and let you manage them, and to write to you in your language | Contract (Art. 6(1)(b) GDPR) | Until you delete the account, or it goes unused for 6 months (we email you a month before) |
| Your devices' names (e.g. casa.off-the.cloud), each device's identity and secret, whether it is switched off, and when an app last reached it | To route connections to the right device and keep anyone else from using its name | Contract | Until the name is released or the account deleted. A released name stays reserved for 30 days, so no one can pose as your device to your friends. |
| Traffic counts per device and hour: number of requests and bytes, never their content | To run the service and find abuse | Legitimate interest (Art. 6(1)(f)) | 90 days |
| Security log: rejected attempts to connect as a device, with the address they came from | To detect someone trying to take over a device's name | Legitimate interest | 90 days |
| Notification addresses: the Apple and Google push tokens and browser push subscriptions your device registers, the language it asks for our own notifications in, and the text of each notification while it is sent | To pass your device's notifications on to your phones (a friend request or an accepted one, a friend's new post, a like or a comment on yours, a storage disk that stopped working or works again) and to tell your phones and browsers, in your language, when your device goes offline. A notification names who did what, never what a post or comment says. | Contract | Until your device removes them or its name is released; the language is replaced whenever your device updates them. Notification text is not stored. |
| Setup codes and sign-in links: short-lived codes linking a new device or app to your account | Setting up a device | Contract | 15 minutes, or until used |
| Email links: to confirm your email (needed before registering a device) and to reset your password - only a fingerprint of each link is kept | Proving the email is yours; recovering your account | Contract | 48 hours (confirmation) or 1 hour (reset), or until used |
| Setup check-in: while a device is being set up from our image, it tells us every few seconds its address on your home network (such as 192.168.1.20), under a random code that only your setup page knows. It does this even if you then continue without an account. | So the setup page can find the device again if your phone loses it | Contract, or legitimate interest if you set up without an account | 10 minutes |
| Device logs you send us: only when you press "Send to us" in Settings > Logs - the last part of your device's logs (which can include file and folder names, search words, Wi-Fi network names and addresses), your note and your account's email, emailed to us | To help you with a problem you asked about | Your consent (Art. 6(1)(a)), given each time you send them | Until the problem is solved, at most 12 months |
| Contact messages: name, email and message | To answer you | Legitimate interest | Until the matter is closed, at most 12 months |
| Server logs: technical errors with IP addresses; no emails or file names | To keep the service working and secure | Legitimate interest | 30 days |
No advertising, no analytics or tracking, and we never sell data. The only cookies are the one that keeps you signed in to your account page (it expires after 30 days) and, while you sign in with Google or Apple, two that tie that sign-in to your browser (they expire after 15 minutes).
How the relay works
Devices sit behind home routers, so the apps and browsers connect to the bridge and the bridge passes the connection to your device. The connection to the bridge is encrypted (HTTPS/TLS), and so is the device's own connection to it, but the bridge itself decrypts and re-encrypts the traffic: it is not end-to-end encrypted. While a request passes through, its content is in the bridge's memory. It is not stored or logged, and only the traffic counts above are kept.
Your device password never crosses the bridge in readable form: the apps encrypt it with a key only your device holds. Everything on your device is encrypted at rest with a key derived from that password.
If you would rather nothing passed through us, use your device at home, through Tailscale Funnel, or with a bridge of your own; the bridge is open source too.
Who else is involved
- OVH (France) hosts the bridge's servers and its domain name, in the EU.
- Apple and Google: if you sign in with them, they confirm who you are and give us your email and name. Push notifications to iPhones go through Apple, and to Android phones through Google's Firebase Cloud Messaging: the Android app registers with Firebase, which gives it an installation ID and a notification token and receives basic technical details such as the app's version. Both are in the US and certified under the EU-US Data Privacy Framework.
- Browser push services: if you turn on notifications in a browser, they go through its maker's push service (for example Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge), encrypted so that only your browser can read them. Your device sends most of them itself; the bridge sends the one saying your device went offline.
- Proton (Switzerland, which the EU recognises as protecting data adequately) sends our emails - the link to confirm your email, password-reset links and the warning before an unused account is removed - and receives what you write to info@off-the.cloud and the device logs you send us.
- Downloads while installing and updating: devices fetch their software and its updates from GitHub (US, Data Privacy Framework) directly, and also building blocks from the Go language's download site and module mirror (
proxy.golang.org, run by Google), packages from their operating system's and Tailscale's repositories and, the first time, the photo-tagging model from Hugging Face. Like any download, these see your device's internet address.
No one else receives your data, unless the law requires it.
Your rights
You can see, correct and download everything the bridge keeps about you, and delete it, from your account page: Download my data gives it to you as a file, and Delete my account removes it. Your devices then go on working at home. You can also object to what we keep for our legitimate interests, ask us to limit it, or ask anything at info@off-the.cloud; we answer within a month.
You can complain to a data protection authority. In the Netherlands it is the Autoriteit Persoonsgegevens; you can also go to the one where you live.
The apps
The Off The Cloud apps talk to your device, through the bridge when you are away. The iPhone and Android apps send your photos and videos to your device and keep your device password in the phone's secure storage. The map in a photo's details comes from OpenStreetMap in the web app and on Android, and from Apple Maps on iPhone, which receive the map area being shown. The apps contain no analytics or advertising.
Age
Accounts are for people aged 16 and over.
Changes
If this changes in a way that matters, we tell account holders by email before it applies.