Privacy Policy

1. Who we are

This policy is issued by Schooley Industries, the publisher of the Kestrel applications — Kestrel for Linux, the Kestrel channel for Roku, and the Kestrel Screensaver for Roku — and of this website at kestrel-app.com.

It explains what those applications do with information, and what this website does. It covers nothing else: your camera hardware, its manufacturer's own apps and cloud services, your Roku device, and any other software you run are governed by their own policies.

2. What we collect

Nothing. We do not collect, receive, store, process, sell or share any personal information through the Kestrel applications.

This is a structural fact rather than a promise about our intentions. Kestrel is client software that runs entirely on your device and talks to your own equipment — plus, only if you switch them on, the public weather services and Reolink's P2P service described in section 4. We operate no servers for it to report to. There is:

• no Kestrel account, sign-in, licence key or registration;
• no analytics, usage measurement or event reporting;
• no crash or diagnostic reporting;
• no advertising, advertising identifiers, or advertising frameworks;
• no tracking, profiling or fingerprinting of any kind;
• no automatic “check for updates” call to us;
• no cookies or equivalent storage used for tracking.

On the Roku channel this extends to declining Roku's optional marketing pixel, which would report an event to Roku each time you connected to your own NVR. It is not implemented, deliberately.

Buying the app does not change this. Kestrel for Roku is a paid channel, but the purchase happens entirely between you and Roku: Roku takes the payment and records the entitlement on your Roku account. The app itself does not check a licence with us, does not phone home to verify a purchase, and works exactly the same whether or not it can reach the internet. See section 8 for what Roku does with the transaction.

3. What the apps store on your device

Kestrel stores what it needs to reconnect to your equipment next time. All of it stays on the device you installed it on, and none of it is transmitted to us.

Kestrel for Linux

Kestrel and Kestrel Screensaver for Roku

The screensaver reads the settings the Kestrel app wrote — it has none of its own, because a screensaver cannot take remote input. This works because the Roku registry is shared between apps signed with the same developer key. No settings are copied off the device to make it happen.

Kestrel HLS

The add-on is optional, and it runs on your own machine beside Home Assistant. It is not a service of ours: we host nothing, see nothing and receive nothing from it.

4. What the apps send, and where

Everything to do with your cameras goes to your own equipment and nowhere else, with one exception you have to ask for: a Reolink device reached by its cloud UID from the desktop client, which goes through Reolink's own P2P service. The weather is the other exception: switch it on and Kestrel will contact public weather services directly. Both are off by default, both are separate from everything else, and both are set out in full below.

• Your cameras and NVRs. Kestrel sends the requests needed to log in, list cameras, fetch snapshots and video, control PTZ and lights, and read detection state — over your local network, using each system's own documented interface. Each device is contacted separately with its own credentials, and those credentials go to that device and nowhere else.

  For a Reolink device at an address, the desktop client now takes live video over Reolink's own protocol, Baichuan, on TCP port 9000 of that device, falling back to RTSP — on by default, and switchable off per device. It is the same device on the same network, reached on a different port; everything else still goes over its HTTP interface.

• The rest of your network, only when you ask Kestrel to look. Both clients can search the local network for devices: Find on network in the desktop client's device dialog, and Find devices on my network in the Roku channel's device list, which arrives with the channel's next update. Nothing is scanned unless you press it. The desktop client sends an ONVIF WS-Discovery probe to the multicast address 239.255.255.250 and to the broadcast address, UDP port 3702, then tries TCP ports 80, 443, 8000, 5000, 8080 and 8443 on every address of the networks this machine is directly attached to (it refuses anything wider than a /22). The Roku channel sends the same WS-Discovery probe plus an SSDP search (UDP 1900), then an unauthenticated GET / to port 80 on every address in the TV's /24. Whatever answers is asked, without credentials, what system it is running — the same questions Identify this system asks. All of it stays on your local network; results are held in memory and nothing is saved until you pick one and save it yourself.
• Reolink's P2P service, if you reach a Reolink device by its UID. Desktop client only, and only for a device whose UID field you have filled in; nothing below happens otherwise. This is the route Reolink's own phone app uses, which is what lets it work from outside the camera's network — and it means the connection is brokered by Reolink's servers rather than made straight to an address you typed. In order:
  • a UDP broadcast on your local network, ports 2015 and 2018, carrying the UID and a random client identifier, asking whether the device is right here;
  • Reolink's registrars, p2p.reolink.com and p2p1.reolink.com through p2p11.reolink.com, on UDP port 9999, which are sent the UID and asked which server knows it;
  • the Reolink register server that registrar names, which is sent the UID, this machine's local IP address and port, and a random client identifier;
  • then a data channel to the device itself — at its local address if this machine can reach it, otherwise at its public internet address, and otherwise through a Reolink relay server.

  Your username and password are not sent in the clear over that channel: the login carries salted digests of them, and commands after login are encrypted. The video largely is not. Reolink's protocol marks most video as unencrypted, or encrypts only the first bytes of each piece, so when the connection runs through Reolink's relay, the relay is in a position to see your video. Reolink's registrars also learn your public IP address and which UID you are connecting to. This is Reolink's protocol, not one we designed, and it is not documented by Reolink; Kestrel speaks it the way Reolink's app does. If you would rather none of this happened, leave the UID field empty and give the device an address.

• Kestrel HLS, if you pair the Roku channel with it. Optional and off by default. Once paired, the channel sends the add-on its camera list over your local network on every connection — the RTSP addresses it has built, including the username and password embedded in them, since the add-on has to log in to the cameras itself — and then requests video from it. All of that stays on your network between two pieces of your own equipment. The add-on contacts your cameras and nothing else: it has no update check, no telemetry and no address of ours to call.
• A third-party HLS restreamer, if you configure one instead. Optional, off by default, and entirely under your control. If you point the Roku channel at a restreamer such as go2rtc, MediaMTX or Frigate, it will request video from the address you gave it. That software is yours; its handling of your video is governed by its own configuration and terms.
• Your own weather server, if you choose that source. Optional and also yours. If you give Kestrel the address of a WeeWX server's JSON document, it fetches that document on a timer — an unauthenticated GET, with no credentials to send and nothing about you in the request. Where that document contains a forecast or weather alerts, your WeeWX server is what obtained them from the National Weather Service, not Kestrel.
• The National Weather Service, if you use the weather.gov source or the radar. Optional and off by default, but this is a public service on the internet rather than equipment of yours, so it is the one place Kestrel goes that you did not install. Both the Roku channel and the desktop client request, on a timer you set:
  • observations, the forecast and any active alerts from api.weather.gov, for the coordinate your ZIP code resolved to;
  • for the radar, map layers from mapservices.weather.noaa.gov and opengeo.ncep.noaa.gov, and the base map underneath them from services.arcgisonline.com, which is Esri's — the same base map radar.weather.gov itself draws under, and the only non-government address anywhere in Kestrel. It is credited wherever the radar is shown.

  These requests carry no account, no credentials and no identifier: there is nothing to log in to and nothing of yours to send. What they necessarily reveal is the IP address of the device asking and roughly where you are asking about, because that is what a weather request is. Each of those services keeps its own logs under its own policy, and we receive nothing from any of them.

  Your ZIP code is not transmitted. Both apps carry the US Census centroid table and convert the code to a coordinate locally, once, when you type it.

There is no destination beyond those. Kestrel does not use a UniFi cloud account, contacts no vendor's service other than Reolink's P2P service when you give it a UID, and does not contact any service of ours, because we run none. Every address it connects to is one you typed in, a device on your own network that you asked it to search for or that answered a search, one of Reolink's P2P servers if you entered a UID, or one of the public weather services named above if you switched the weather on. That is true of the desktop client, the Roku channel and the HLS add-on alike — and the Roku channel and the add-on never use Reolink's P2P service at all.

5. Your video and recordings

Your camera footage never reaches us. Live video, snapshots, recordings and downloaded clips travel from your device to the screen you are looking at, across your own network — or, for a Reolink device you reach by its UID, across the internet and possibly through Reolink's relay, as section 4 describes. Anything saved is written to storage you chose, on hardware you own.

We have no copy, no cache, no backup and no means of retrieval. If you delete a recording, it is gone; we cannot restore it.

6. This website

kestrel-app.com is a static site. It sets no cookies, runs no analytics, contains no advertising or tracking scripts, and loads no fonts, scripts or images from third-party services. Nothing you do here is measured, and there is nothing to opt out of.

As with any website, the server that hosts it may keep standard access logs — typically the requesting IP address, timestamp, requested URL, referrer and browser user-agent string — generated automatically by the web server for security and operational purposes such as diagnosing faults and identifying abuse. We do not use these logs to identify individuals, build profiles, or combine them with anything else, and they are not shared with third parties except where a hosting provider processes them on our behalf or where the law requires disclosure.

7. If you email us

If you contact [email protected], we receive whatever you put in your message — your email address, and anything else you choose to include. We use it only to reply to you and to fix the problem you raised, and we keep the correspondence no longer than is useful for that.

Please do not send us camera footage, credentials, or the addresses of your devices. We do not need them to help, and we would rather not hold them. If you send a screenshot for a bug report, blur or crop anything you would not want a stranger to see.

We also do not need — and would rather not receive — payment details or receipts. Refunds for the Roku channel are handled by Roku, as the Terms explain; we have no access to the transaction.

8. Third parties

Inside the applications there are two, and each only if you choose it:

• Esri, if you switch the weather on: the map under the radar is served from services.arcgisonline.com, reached without any account or key. The weather services themselves are US government ones — the National Weather Service and NOAA — rather than commercial third parties.
• Reolink, if you reach a Reolink device by its UID from the desktop client: its P2P registrars, register servers and relays broker the connection, and may carry your video. Reolink operates that service under its own privacy policy and terms. We have no relationship with Reolink, receive nothing from it, and cannot see or control what its servers log.

Section 4 sets out exactly what is requested. Outside the applications:

• App distribution and payment. If you install Kestrel from the Roku Channel Store, Roku handles that transaction and knows you installed it. Kestrel for Roku is a paid app, so for it Roku also acts as the merchant: Roku collects the payment, issues the receipt and records the entitlement against your Roku account. We never receive your card details, billing address, name or Roku account identity. Roku may give us sales and performance reporting about the channel, which arrives as counts and totals rather than as information about identifiable buyers. Roku's own privacy policy governs all of this, along with anything else your Roku device does.
• Web hosting. This site is served by a hosting provider that processes server logs on our behalf, as described above.
• Email. Our email provider processes messages you send us, as any email provider does.

We do not sell personal information, and we do not share it for cross-context behavioural advertising — we have none to sell or share.

9. Security

The strongest security property here is architectural: information that is never collected cannot be breached at our end. There is no Kestrel database to compromise, and no credential store of ours holding your camera passwords.

What remains is on your side, and Kestrel is built to help rather than hinder it: the Linux config file is written with owner-only permissions, passwords go to your system keyring where one exists, and tokens and credentials are redacted from log output and error messages so they do not leak into a terminal or a bug report.

Securing the devices and network Kestrel runs on remains your responsibility — current firmware, a least-privilege camera account, a trustworthy network, and no port-forwarding your NVR to the public internet.

10. Retention and deletion

We retain nothing, so there is nothing on our side to delete. What is stored locally is yours to remove at any time:

• Linux — delete ~/.config/kestrel/config.json and remove the Kestrel entry from your keyring; your media folder is unaffected unless you delete it too.
• Roku — choose Forget saved settings in the channel's settings to clear the stored host and credentials, or remove the channel from your device.

Uninstalling the software ends its access to everything.

11. Your rights

Depending on where you live, you may have rights under laws such as the UK and EU GDPR, the California Consumer Privacy Act, or similar legislation — to access, correct, delete or port your personal information, to object to or restrict its processing, and not to be discriminated against for exercising those rights.

Those rights apply to personal information a business holds about you. Because Kestrel collects none, there is in practice nothing for us to produce, correct or erase — and no profile, no sale of information, and no automated decision-making. The exception is any email correspondence you have sent us, and website server logs; you may ask us about those, and ask us to delete correspondence, using the contact address below.

Where we do process such limited information, our lawful basis under the GDPR is our legitimate interest in responding to enquiries and in operating and securing our website. If you are in the UK or EEA and are unhappy with how we have handled a request, you may complain to your national data protection authority.

12. Children

Kestrel is not directed at children, and is not designed or marketed for use by them. We do not knowingly collect information from anyone, children included. If you believe a child has sent us personal information by email, contact us and we will delete it.

13. People your cameras record

Kestrel displays footage your cameras capture, which may include other people. We never see that footage and are not a controller or processor of it — but you may have obligations towards those people under privacy, data protection, employment or tenancy law, including where cameras may point, whether audio may be recorded, what notice or signage is required, and how long footage may be kept.

Meeting those obligations is your responsibility, as set out in the Terms of Service. If you have been recorded by someone else's cameras and want that footage addressed, please contact the camera's owner — we have no access to it and no ability to act on it.

14. Changes to this policy

If Kestrel ever changes in a way that affects this policy, we will update it here and change the date at the top. Should we ever introduce anything that collects information — which we have no plans to do — it would be described here first, and made optional and off by default.

15. Contact

Schooley Industries
[email protected]

For questions about this policy, or to ask about information we may hold from your correspondence, use the address above and mark your message “Privacy”.