Privacy Policy

Effective date: August 1, 2026

Elsinore is a native client (iPhone, iPad, and Mac) for a Frigate NVR server that you host and control. This policy describes what the app does and does not do with your data.

Summary

• Elsinore collects no analytics and no personal data.
• The app connects only to the Frigate server (and optional companion "sidecar") that you configure, which is your own infrastructure, not anything operated by Elsinore or its maintainer.
• Video and images from your cameras never leave your own infrastructure, with one narrow exception for optional push notifications, described below.
• There is no Elsinore account and no cloud backend to sign into.

What the app stores, and where

When you add a server, Elsinore stores the server address and your username locally on your device, and stores your password or credential in the system Keychain, protected by the operating system. Credentials are never transmitted anywhere except directly to the server you configured.

The app also keeps local caches on your device so things open quickly: thumbnails and images, a per-camera index of event times and labels for the scrub reel (pruned after 30 days), Live Activity snapshots, push thumbnails, widget data, and a short on-device log of when the live picture was switched on and off. Settings › Storage shows and clears the caches. Nothing in them leaves your device, except that you can choose to copy the live log into a bug report.

If you use Handoff, what you are looking at (a camera name and playback time, or the id of the encounter you are exploring) is shared between your own signed-in Apple devices by Apple's Handoff service.

What the app does not do

• Elsinore does not include any analytics, telemetry, advertising, or crash-reporting SDK.
• Elsinore does not operate a backend service that your camera footage, snapshots, or metadata pass through. Live video, recorded clips, and review/event data are fetched directly from your Frigate server to your device.
• Elsinore does not require or create a user account of any kind.

Third-party software

Elsinore uses one third-party library: a WebRTC media framework, used to negotiate and play low-latency live video directly between your device and your Frigate server (via its embedded go2rtc component). This is a media-transport library only; it does not collect or transmit any data on its own, and no video passes through Elsinore's maintainer or any third party as a result of using it. No other third-party SDKs are included in the app.

Optional push notifications

Push notifications are optional and off by default. They require the optional, self-hosted Marcellus sidecar. If you enable them, here is exactly what happens:

• Your device registers its Apple Push Notification (APNs) device token with your own sidecar. The app itself does not contact the relay. Your sidecar forwards notifications through a small relay service operated by the app's maintainer. This relay exists only because Apple requires push notifications to be sent from a server holding APNs credentials. It is not a general backend and never proxies your video.
• When your own Frigate server detects something, your sidecar composes the notification and sends it to the relay for forwarding to Apple. That payload contains what the notification needs to display: your device's push token, the title and body text (for example "Person at Front Door"), the camera and zone names as you configured them in Frigate, the kind of subject detected (such as person, vehicle, or package), a severity level, timestamps, an identifier for the alert, and a link back to your own server from which your device fetches the thumbnail. When the sidecar has grouped a detection with sightings on other cameras, the payload also names those cameras.
• The payload never contains snapshots, thumbnails, video, recordings, or your server address in a form the relay uses. Images are fetched by your device directly from your own server after the notification arrives.
• If you have a UniFi Protect doorbell mapped through your sidecar, a doorbell press sends the same kind of payload: title and body text, the camera name, a notification category identifying it as a doorbell ring, a Protect event identifier and timestamp, and a link back to your own server for the snapshot. No image bytes travel through the relay for doorbell rings either.
• The relay forwards the payload to Apple's push service, which delivers it to your device. Apple's handling of push traffic is governed by Apple's own privacy terms.

In short: the card text, including camera and zone names, passes through the relay in flight on its way to Apple. The relay and Apple see the same text you see on your lock screen, plus your device token and routing identifiers. They never see an image, and all alert media stays on your own server.

Data sharing

Elsinore does not sell, rent, or share your data with third parties. There is no advertising, and no data is used for anything beyond operating the app's core function of connecting to your own server.

Children's privacy

Elsinore is not directed at children and does not knowingly collect any information from anyone, including children, because it does not collect personal information at all.

Changes to this policy

If this policy changes, the updated version will be published at this same URL with a new effective date.

Contact

Questions about this policy or the app's data practices can be sent to helicopterrun@gmail.com.