NASPrivacy policy
Last updated: 6 November 2026 · applies to the NASlab Android app and this website
NASlab is an Android app to remote-control your own home server (for example Unraid, SABnzbd, Sonarr, Radarr, Plex). It is developed by a private person in Switzerland.
Controller
Delil Jasim Ayin
Schmiedeweg 6, 3048 Worblaufen, Switzerland
Email: sandro.ayin.business@gmail.com
The Swiss Federal Act on Data Protection (FADP) applies and, where applicable, the EU General Data Protection Regulation (GDPR).
- No user account, no server run by the developer, no sign-up.
- Addresses, API keys and passwords stay on your phone; keys and passwords are encrypted in the Android keystore.
- The app only connects to the servers you enter yourself.
- No ads, no tracking, no analytics, no crash reports to third parties.
- Feedback and crash reports only via your own mail app, after the app has shown you the full content. Nothing is sent automatically.
What data the app processes
| Data | Where | Why |
|---|---|---|
| Addresses and API keys of your services | on the phone only, encrypted | connecting to your servers |
| Unraid web UI password (optional) | on the phone only, encrypted | functions that exist only in the web UI (mover, backups, fans) |
| Readings from your server (temperatures, storage, downloads, power) | on the phone only, up to 120 days | history, statistics, widgets, notifications |
| Error log | on the phone only | understanding errors; leaves the phone only if you export it |
| Feedback and crash reports (optional) | by email from your mail app to the contact address, only when you send them | fixing bugs, implementing requests |
| Files you upload via “Share › To NAS” | go straight to your server | upload to your own NAS |
Microphone
The app asks for the microphone only when you tap the microphone in the AI assistant. Speech is recognized by your Android system's speech service (usually Google); the app only receives the recognized text and stores no audio. Everything else works without this permission.
Connections to third parties
- Your own servers. All requests go to the addresses you entered. On the home network unencrypted connections (http) are possible; outside the home network the app blocks them.
- AI providers (optional): Anthropic, OpenAI or Google. Only if you set up and use the AI assistant with your own API key: your question, attached images and the values the assistant reads from your server for it are sent encrypted to the provider you chose, and only to that one: the Claude API by Anthropic (api.anthropic.com), the OpenAI API for ChatGPT (api.openai.com) or the Gemini API by Google (generativelanguage.googleapis.com). This also applies to explanations of notifications and the NAS check. API keys, passwords, tokens and cookies are never sent, not even with that switch. Before sending, the app replaces personal and network details with placeholders: IP addresses, host and server names, your own domains and DDNS names, user and share names, MAC and e-mail addresses (for example 192.168.1.20 becomes “[Gerät-1]”, your server's name “[NAS]”). The mapping stays in the phone's memory only and applies to one conversation; the answer on your phone shows the real names again. Before sending, “Das geht an …” (“This goes to …”) shows exactly the text that leaves the phone, and “Gesendet ansehen” under each answer shows everything sent for it. Only if you turn on “Adressen diesmal mitsenden” (send addresses this time) for a question are addresses and names sent unchanged for that one question. The replacement detects known patterns and the names from your settings; it may miss names in attached images or in free text that do not look like that. With OpenAI the app asks for responses not to be stored (store=false). On the free Gemini tier Google may use the content to improve its products, according to its terms. In demo mode without a key a simulation on the phone answers; then nothing goes to any provider. The privacy policies of Anthropic, OpenAI and Google apply (plus the Gemini API terms).
- Reporting an AI answer (optional). You can flag a wrong or harmful answer with “Melden” (report). The report (reason, your note, question and answer with placeholders, without addresses and keys) stays on the phone. Only if you then choose to send it by e-mail does your own mail app open it with the text shown, as with feedback.
- Icons and posters. Icons of well-known apps (for example Sonarr) come from cdn.jsdelivr.net, posters in Seerr from image.tmdb.org, container icons from the address in your Unraid template. The provider sees your IP address; no other data is sent.
- Cloudflare (1.1.1.1). Only for the check “Reachable from outside?” the app asks for its own public IP address.
- NASlab agent (optional). The agent runs on your own NAS, not on our servers. It reads readings there such as temperatures, load, disk activity, network and the system log; these stay on your NAS and only go to your app. For the speed test it measures via speed.cloudflare.com; for disk prices it queries price comparison sites (in Switzerland toppreise.ch). If you enter an ntfy address, it sends notifications there. The respective provider sees the IP address of your connection; the agent does not send any data from the app.
- Links. Pages such as price comparisons, guides or the Plex sign-in open only when you tap them.
What the app does not do
- No data to the developer, unless you send an email yourself (support, feedback, crash report).
- No advertising IDs, no analytics, no selling or sharing of data.
- No access to contacts, location or camera. Photos only one at a time through the Android photo picker when you attach an image yourself (assistant, feedback); the app only sees that image.
Feedback and crash reports
Feedback (on every page via ⋮ or the ☰ menu) and crash reports (question after a crash, Error log › By email) are sent only by your own mail app to sandro.ayin.business@gmail.com, and only when you tap Send there. There is no NASlab server for this and no third-party analytics or crash SDK. Beforehand the app shows the full text and the images.
- Content: your message, app version, variant, Android version, device model, app language, server type (for example Unraid) and the page you were on. Crash reports also contain the time and the error report.
- Removed: IP addresses, addresses with credentials, host names, user names, tokens and keys are removed from the error report.
- Images (optional): a screenshot of the current page and an image from your gallery. You black out spots such as addresses and names before sending; location data in the photo (EXIF) is dropped. If screenshots are blocked in the app, it takes no screenshot.
- Turning it off: Settings › Appearance & behavior › “Ask after a crash” or “Never ask” in the question.
- Retention: emails stay in the mailbox of the contact address (Google Gmail) until the issue is resolved; they are deleted on request.
Storage and deletion
All data lives in the app on your phone. “Settings › App security › Delete all keys” removes all secrets; uninstalling the app removes all data. A settings export is encrypted with a password of your choice and is stored only where you save it. Keys and passwords are excluded from the Android cloud backup.
Permissions
- Internet and network state: connecting to your servers, telling Wi-Fi, mobile and VPN apart.
- Notifications: downloads, server warnings and backups (each type can be turned off).
- Fingerprint or screen lock: app lock and confirming critical actions (optional).
- Microphone: only for voice input in the assistant (see above).
- Run after the phone restarts: so background checks and widgets keep working.
This website
This website loads no fonts, scripts or content from third parties and sets no cookies. It is hosted on GitHub Pages; GitHub processes technically necessary data such as the IP address (GitHub privacy statement).
Contact
Privacy questions, access or deletion requests: sandro.ayin.business@gmail.com. Apart from emails you send yourself, the developer receives no data from you; all other data stays on your phone.
Support from the app (Help & glossary › Support): the email is sent by your own mail app, only when you send it; it contains only the technical details shown beforehand (app version, variant, Android version, device model, app language, server type, state of the agent and the home network check), no addresses, keys, user names or file names.