Privacy: what leaves your device
Every connection Filarr makes: sync, update checks, error reports, link previews, database sources, notifications. When, what, and how to turn it off.
On this page
Documentation sections
Filarr keeps your files and notes on your device, encrypted. Some features still need to talk to a server. This page lists every one of them: when it happens, what is sent, and whether you can turn it off.
At a glance
| What | When | What is sent | Can you turn it off? |
|---|---|---|---|
| Sync and sharing | With a cloud account | Your data, encrypted before it leaves | Yes: a local profile never syncs |
| Update check | Desktop app, about a minute after launch, then every four hours | A request for the latest version | No |
| Version message | Desktop app, when a profile opens, at most once a day per profile | App version, system type, a random installation code | No |
| Error reports | Desktop app, when an error isn't handled by the app | The error, its technical context and the last actions in the app | No |
| Link titles and previews | When you paste a link or ask for a preview | The link address | Desktop app: no. Web app: off until you allow it |
| Database sources | When you search a source from a database | The words searched | Web app: off until you allow it |
| Embedded videos | When a note shows a YouTube or Vimeo video | The video request, to that site | Do not embed videos |
| Feedback | Only when you send it | Your message and a few system details | You decide |
Sync and sharing
With a cloud account, Filarr syncs your profile and lets you share. Everything is encrypted on your device before it leaves. How Filarr protects your data lists exactly what the servers can see, and what they never see.
A local profile, with no account, never sends your files or notes anywhere. If you store your synced files in your own bucket, they go to your storage provider, still encrypted: see Use your own storage.
When Live editing of my personal notes is on (Settings → Security), your devices exchange changes through a Filarr relay. The content stays encrypted. The relay sees which of your devices are connected to a note, not what it says.
Update checks (desktop app)
About a minute after launch, then every four hours, the desktop app asks releases.filarr.com whether a new version exists. If one does, Filarr downloads it and installs it when you quit. Settings → About → Updates has a Check for updates button to check right away. There is no setting to turn automatic checks off.
When a profile opens, at most once every 24 hours for each profile, the desktop app also sends a short message to a Filarr server (filarr-version.filarr-app.workers.dev). It contains:
- the version of Filarr you use;
- the type of system (Windows, Linux);
- a random installation code, created the first time this message is sent, kept on this computer and shared by all its profiles.
This code is not linked to your account, your email or your files. Filarr can use this message to count installations and the versions they run.
The web app does neither. app.filarr.com always serves the latest version, and a banner, A new version of Filarr is ready, offers Reload when one comes out.
Error reports (desktop app)
When an error happens in the desktop app's window and nothing in the app handles it, the desktop app sends a report to Sentry, an error-tracking service, on its European servers. This is on by default, and there is currently no setting to turn it off. Filarr sends at most one report every ten seconds.
A report contains:
- the error message and the technical trace of where it happened in Filarr's code;
- the version of Filarr and the type of system;
- the random installation code described above;
- a short trail of what the app did right before: screens opened (internal addresses made of codes), elements clicked or filled in, and the addresses of the requests the window made. An element is described by its label or its tooltip, which can be the name of a file or a note.
Filarr removes the secret part of invitation links from reports, and asks Sentry not to keep your IP address. A report does not include the content of your files or your notes. An error message can still mention a file name, or a path on your computer, which often contains your user name. Errors in the background part of the app (sync, file handling) are not sent.
The web app sends no error reports. Errors stay in your browser.
Link titles, previews and database sources
These features read information from other websites: the title of a link you paste into a note, the preview of a Bookmark block, Fill from link in a database, and the lightning button of a database when you choose a source (Books, Anime, TV shows, Movies).
In the desktop app, Filarr contacts the website itself: the page of the link, or the source (OpenLibrary, AniList, TVmaze, TMDB) with the words searched, plus your TMDB key for Movies. The site sees a visit from your computer, as if you had opened the page. Filarr's servers are not involved. The title of a pasted link is fetched automatically when you paste a link on its own, and no setting turns this off.
In the web app, the browser can only talk to Filarr's servers. These features therefore go through a Filarr relay, and only once you allow it. Two separate switches control them, and both are off by default:
- Link previews via server, in Settings → Security: only the link address is sent, never the content of your notes, and it is not logged;
- Source lookups via server, in Settings → Integrations: only the words searched are sent, plus your TMDB key for Movies, and nothing is recorded.
The first time you use one of these features in a database, Filarr asks first. Click Continue to allow it, or Cancel. Allowing one never turns on the other.
Embedded videos
When a note shows a YouTube or Vimeo video (the Embed URL block), the desktop app loads the player from YouTube (youtube-nocookie.com) or Vimeo as soon as the note shows. That site sees the request. In the web app, the player doesn't load.
Mobile notifications
If you use the Filarr mobile app, Filarr can notify your phone when someone assigns you a task, mentions you, comments on your page, replies to your comment or resolves a thread in a shared vault. The notification goes through Google's push service. It says who did what, and nothing more: never the title of the note, never an excerpt.
Feedback
Settings → Feedback → Send feedback sends your message to Filarr, which receives it by email through an email delivery provider. The message goes with its type, your email address if you enter one, the version of Filarr, your system and your language. Nothing leaves until you click the button. If you are offline, Filarr keeps the message and sends it later.
In an organization
If your account belongs to an organization, your devices tell Filarr's server when they catch up with the organization's rules after a period offline, with a rough number of offline hours. This feeds the organization's audit log. See Run your organization.
What never happens
- Filarr does not send usage statistics from the desktop app or the web app: apart from the version message and the error reports above, there is no count of what you do in the app.
- Opening a note doesn't make Filarr fetch pictures from websites: the app's security rules block images from the internet. The pictures of a Bookmark preview are downloaded when the preview is created, and kept in the note. One exception, in the desktop app: a Bookmark block whose preview hasn't been fetched yet (a note received through a shared vault, an imported note, or a preview that failed) contacts the site as soon as the note shows, for the page, its picture and its icon. As long as that fails, it tries again each time the note shows.
- The web app can only connect to Filarr's own servers. Its security rules block every other address.
- Extensions from the Marketplace run in a sealed space, with no network access.