Privacy Policy

Effective October 14, 2026 · Applies to Fregata Mobile for iPhone, iPad and Apple Watch

1. What this app is ·2. Where your data goes ·3. iCloud sync ·4. Our notification relay ·5. Third parties ·6. Children ·7. Retention ·8. Changes ·9. Contact

1. What this app is

Fregata Mobile is an iPhone, iPad and Apple Watch app for Frigate, the open-source network video recorder (NVR) you install and run yourself, typically on a home server or NAS. Fregata, without "Mobile", is our own macOS port of that same NVR software, and Fregata Mobile works with either one. You give the app the address of a server you already control, and it talks to that server directly to show live cameras, browse recordings and deliver alerts. Fregata Mobile itself doesn't host, record or process your video anywhere: your own NVR does that, exactly as it did before you installed the app.

Frigate is a separate, independent open-source project. Fregata Mobile isn't affiliated with, endorsed by, or officially connected to it.

2. Where your data goes

Fregata Mobile sends data to these places:

• Your NVR. Your sign-in and requests go only to the server addresses you give the app, and your live video, recordings and snapshots come straight back from your NVR. The app uses the Local Network permission only to reach those addresses, never to scan for other devices.
• Your iCloud, if you sync (Section 3).
• Your Apple Watch, if you use it. Your iPhone gives it your servers' addresses, sign-in details, custom headers, client certificates and trusted certificates, through Apple's own connection between the two, so that the watch can reach your NVR itself.
• Our notification relay, once you turn on alerts (Section 4).
• Apple, which delivers notifications (Section 5).

Everything else stays on your devices unless you share it yourself, such as an exported clip. That includes Picture Description: Apple Intelligence describes an alert's picture on the device, and nothing is sent anywhere to do it. Privacy and your data lists what the app keeps where.

3. What syncs through iCloud

With Sync with iCloud on, which is the default, your server list follows you to your other devices signed in to the same Apple Account. You can turn it off in the app's Settings › iCloud Sync.

• Server names, addresses, usernames, header names and camera order are stored in Apple's iCloud key-value storage. Apple encrypts it in transit and on its servers, with keys Apple manages.
• Passwords, header values and client certificates are stored in iCloud Keychain, which is end-to-end encrypted.
• When you remove a server, a note of the removal syncs too, so that it disappears from your other devices.

This data lives in your own iCloud account, under Apple's privacy terms. We never receive it and have no access to it. Turning sync off stops this device sending or taking anything; the copy already in iCloud stays for your other devices. You can inspect or clear it the same way as any other app's iCloud data, under Settings › [your name] › iCloud.

4. Our notification relay

Apple delivers an app's push notifications only when they come from that app's own server. So alerts from your NVR travel through a small relay we operate, at push.fregata.app, and from there through Apple's Push Notification service (APNs) to your device.

What the relay receives

When you turn on alerts for a server, your device registers with the relay. The relay receives:

• your device's Apple push token, and which of Apple's push environments it belongs to, and
• your NVR's public push key, which lets the relay check that an alert really comes from your NVR.

After that, it receives the alerts your NVR sends, encrypted. It never receives your name, email address, your NVR's address or sign-in, or your live video, recordings or snapshots: your device fetches the picture and clip for an alert directly from your NVR. There's no Fregata account, so none of this is linked to your identity, and none of it is used for tracking or advertising.

How the relay handles an alert

Fregata Mobile lets you choose which alerts reach you and how, with rules such as quiet hours or "no cars on the driveway". An iPhone can't quietly discard a notification once it arrives, so those rules have to be applied before an alert is sent, and that means the relay has to read it:

• Your NVR encrypts each alert to a key the relay holds. The relay decrypts it in memory and reads what it's about: the camera, what was seen, the zones, and the kind of alert. Frigate's text can also include names it recognised, such as a face or a number plate, and its AI summary of the event.
• The relay applies your rules, then encrypts the alert again, with a key only your device holds, and hands it to Apple.
• The readable alert exists only in the relay's memory while it's handled, and for a few seconds more if delivery to Apple has to be retried. It's never written to storage or to logs, not even encrypted.
• What this means for you: someone who broke into the relay, or a court order served on us, could expose the text of alerts passing through it at that time. Past alerts can't be exposed this way, because none are kept.

Besides the registration above, the relay keeps:

• The public halves of two keys the app creates on your device. One signs the app's requests to the relay; the other is checked with Apple's App Attest to prove the requests come from the genuine app. It also keeps whether your device has proven that alerts reach it at its push token, and, until it has, the one-time check it sent there.
• The keys that encrypt alerts between your NVR, the relay and your device. Their private parts are encrypted under a key only the relay holds.
• To recover if a relay instance is lost, a backup in the relay's database. In that backup your device's push token, your NVR's public key and your device's notification key are encrypted, each separately, so the backup can't show which devices share an NVR or belong to the same person.
• Your notification rules for each server, and your device's time zone, so that schedules work. Whether Upgrade to video is on, so that clips go only to a device that shows them. The app also sends the names of your cameras, zones and kinds of object, so that the relay can recognise them in alerts. Those names, in your rules and in that list, are stored only as keyed hashes, never as text.
• A record of each event your NVR alerts about, while the event is happening and for up to a day after it ends (two days at most, if Frigate never reports the end). It holds no alert content, and none is ever saved or logged: only a keyed-hash ID, which server it came from, when the alert was sent, the level it was delivered at, which of your rules held it back, if one did, if Upgrade to video is on, when its clip is due, and, if you use Live Activities, whether the Live Activity showed it. The relay keeps no history of your alerts: to tell you about alerts that couldn't reach you while your device was offline, each alert carries the time of the one before it, and your device works out which it never received. So the relay also keeps the time of the latest alert it sent your device, and nothing else about it.
• If you use Live Activities: the token Apple gives your device for starting one, the token of the latest one the relay started, which cameras you chose for them (as keyed hashes, never as names), and the key what a Live Activity shows is encrypted to. None of it is in the backup. Turning Live Activities off deletes both tokens.
• No totals of any kind, and nothing about your device's activity: no record of when it last connected (each request's one-time code is kept a few minutes, so the request can't be replayed, and deleted within a day), and no app version.

What Apple sees

Apple's servers see only a generic placeholder ("Camera activity") and the encrypted alert. They can't read what an alert says.

Where the relay runs

The relay runs on Cloudflare. Like any web service, Cloudflare handles the network details of each connection, such as IP addresses, and keeps a short-lived log of each request to the relay (the address requested, the time and the result) on its own retention schedule. Those logs never contain an alert's content.

5. Third parties

• Apple. Apple's Push Notification service delivers every iOS app's notifications; it sees only the placeholder and the encrypted alert (Section 4). iCloud stores what you sync (Section 3). Our relay also uses Apple's App Attest service, through which your device asks Apple to vouch that requests come from the genuine app. Apple's privacy policy covers all three, not this one.
• Cloudflare hosts the relay (Section 4).
• Our notification relay is described fully in Section 4.

That's the entire list. Fregata Mobile has no third-party analytics SDKs, no crash-reporting service and no advertising network, and we don't sell or share data with data brokers. If you contact us for support and choose to attach something like a diagnostic log from the app's Diagnostics screen, we use it only to help with that request.

6. Children's privacy

Fregata Mobile isn't directed at children, and we don't knowingly collect anything from anyone, of any age, beyond the registration and delivery data described in Section 4, which isn't linked to anyone's identity.

7. Retention and your controls

• A registration stays on the relay while alerts are on for that server on that device.
• When you remove a server in the app, the relay stops delivering its alerts to that device, and deletes that server's keys, rules and event records.
• When Apple reports that a device's push token no longer works, for example because the app was deleted, the relay stops delivering to it. If the device comes back with a new token within 30 days, as it does after a backup is restored onto the same iPhone, delivery resumes. Otherwise the relay deletes everything it holds for that device 30 days after Apple's report.
• The relay deletes an event's record within a day after the event ends, or within two days after its last update if Frigate never reports the end, and a snooze as soon as it expires.
• Data the relay deletes can remain in Cloudflare's backups for up to 30 days.
• To ask us to delete what the relay holds for your device, reach us as in Section 9.

8. Changes to this policy

If this policy changes, we'll update the effective date at the top of this page and note anything material in the app's release notes.

9. Contact

Questions about this policy, your data, or a request like the one in Section 7 can be posted on our GitHub Discussions board: github.com/3rdBitLabs/Fregata → Discussions → Fregata Mobile. That board is public, so please don't post anything you wouldn't want visible to anyone: say you'd like to reach us, and we'll ask there for any device-specific details we need.

For anything related to your Frigate or Fregata server itself, such as camera setup, recordings or storage, that's between you and your own NVR. We don't have access to it and can't act on requests about it.