Privacy Policy

Last updated: May 9, 2026

Overview

OpenWrt Manager ("the App") is a local network management tool. We are committed to protecting your privacy. This policy explains what data the App handles and how it is stored.

Data Collection

By default, the App operates entirely within your local network and does not transmit any personal data off your device.

• No analytics or tracking SDKs are included (no Firebase, no Google Analytics, no Crashlytics).
• No user accounts or registration are required.
• No data is shared or sold to third parties.
• No advertising identifiers are read.

Two optional features — cloud push notifications and the OpenWrt-side notification agent — do upload a minimal, scoped data set to a backend we operate. Those flows are described in the Cloud Push (Optional) section below. Both are off by default and can be turned off at any time.

Data Stored on Your Device

The following data is stored locally on your device only:

• Router address and connection settings — stored in SharedPreferences to allow quick reconnection.
• Router password — if you choose to save it, the password is stored in the platform's secure storage (iOS Keychain / Android Keystore). It is never transmitted anywhere other than directly to your router.
• Traffic history — hourly and daily bandwidth statistics are stored locally in SharedPreferences for display purposes.
• App preferences — theme mode, language, device nicknames, groups, and notification preferences.
• Notified MAC list — when "New device alerts" is enabled, a list of MAC addresses already alerted on is kept locally to avoid duplicate notifications.

Notifications (Local)

• The App can send you a local notification when a previously-unseen device joins your network. This feature is opt-in and can be toggled in Settings → Notifications.
• The first time you enable it, the system prompts you for notification permission. You may revoke this permission at any time from your device's system Settings.
• Notifications are generated entirely on your device by comparing the current device list with locally stored MAC addresses. No notification content or device information is sent to our servers or any third party in this mode.

Cloud Push (Optional)

If you want push notifications to arrive even when the App is closed (for example: an unknown device joins your home Wi-Fi while you are at work), you can enable cloud push. This adds a second delivery path on top of local notifications. It is off by default. Enabling it is a deliberate action: tapping the "New device alerts" toggle plus tapping "Install router agent" in Settings.

What gets uploaded, by whom, and to where

• The App sends our backend an APNs device token (an opaque identifier issued by Apple, scoped to this App on this device — not a tracking ID), your language preference (e.g. en, zh), and a randomly generated device key + agent token. The agent token is the bearer credential the OpenWrt-side script will later use to authenticate.
• The OpenWrt-side notification agent — installed onto your router only after you tap "Install router agent" — uses the agent token to send our backend a small JSON event each time a previously-unknown MAC address joins your local network: mac, ip, hostname, and your chosen router label. No traffic content, no historical data, no logs.
• The backend is a Cloudflare Worker we operate at openwrtpush.yzinf.com. It stores your registration in Cloudflare KV and uses Apple's APNs service to deliver the notification to your iPhone. No third party other than Cloudflare and Apple is involved, and we do not use any analytics SDK, ad SDK, or tracking SDK.
• Storage retention: registrations expire after 90 days of no re-registration. The backend also keeps a 30-minute deduplication cache so the same MAC isn't pushed repeatedly. Both are automatically purged.
• The notification body that Apple delivers to your phone contains the device's name and IP. We do not log notification deliveries on the backend.

How to disable / delete

• Disable in-app: Settings → Notifications → toggle "New device alerts" off. The App will call our backend to remove your registration immediately.
• Disable on the router: Settings → Notifications → "Install router agent" again writes the latest config; conversely, the agent can be removed via SSH with /etc/init.d/openwrt-manager-notify stop && rm /usr/bin/openwrt-manager-notify.sh /etc/init.d/openwrt-manager-notify.
• Even after disabling locally, you may email us to request deletion of any residual registration tied to your APNs token.

Network Communication

• The App's primary communication is with your OpenWrt router on the local network via the ubus HTTP/JSON-RPC API.
• If HTTPS is available on your router, the App supports it to encrypt local network traffic.
• The only outbound internet connection the App makes is to openwrtpush.yzinf.com (our Cloudflare Worker), and only when you have opted in to cloud push (see Cloud Push (Optional)). All other features run entirely against your local router.

Password Security

• Your router password is used solely to authenticate with your OpenWrt device.
• Saved passwords use the OS secure storage mechanism, encrypted at rest.
• We recommend saving passwords only on personal devices. Anyone with physical access to your unlocked device may be able to connect to your router through the App.

Children's Privacy

The App is not directed at children under 13. We do not knowingly collect any information from children.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected on this page with an updated date.

Contact

If you have questions about this privacy policy, please visit the Support page.