LibrePortal
Sponsor
Search the wiki/ Install
Privacy

Privacy of every app.

LibrePortal itself sends nothing about you anywhere. The apps you install are other people's software, and plenty of it comes set up to check in with its makers. So each one is read against its own documentation, and LibrePortal switches off whatever it safely can.

Server apps

Of 81 apps, 53 are all clear, 28 are worth knowing about. The verdict is judged after LibrePortal's own settings are applied.

Our phone apps

The same questions, answered for the apps we make for your phone: what they are allowed to do, where they connect, and what they keep on the phone. No trackers, and each report points at the source so you can check it.

LibreMoney

Android · Preview

What LibreMoney on Android gives and takes, in the shape of an F-Droid listing. The same text is in the app (Privacy, in the menu), and on the guide's "Phone apps and privacy" page.

Trackers

None. The release app was scanned for the known tracker libraries (the Exodus Privacy list). None are in it: no Google Play Services, Firebase, analytics, crash reporting or ads.

Anti-features

  • Ads: None
  • Tracking: None
  • NonFreeNet: None. It only talks to your own server and to git.libreportal.org (open source).
  • NonFreeDep: None
  • NonFreeAdd: None
  • NonFreeAssets: None
  • UpstreamNonFree: None
  • KnownVuln: None known
  • NSFW: None

Permissions

  • Internet, network state: To reach your LibreMoney server, and to know whether the phone is online.
  • Notifications: To tell you a ledger was shared with you. A notification never says what is in a ledger.
  • Camera: To scan your server's QR code during set-up. Nothing is recorded or kept.
  • Run in the background: So those notifications arrive on time with the app closed.
  • Fingerprint: Only if you turn on Unlock with fingerprint. Android does the check; the app never sees your fingerprint, only whether it matched.
  • Install apps: To install this app's own updates, after checking them. Android asks you every time.

Connects to

  • Your own servers: Each LibreMoney you added, and its sign-in page. With Authelia the sign-in happens in your own browser, on your own server; the app adds only a one-time code to it. Your ledgers are encrypted on your phone before they leave it.
  • git.libreportal.org: Update checks only, and only if you say yes: the app asks once. When on, about twice a day. It sees your IP address and a generic app name, nothing else. Change it any time in the menu, under Check for updates; Check now always works.
  • Web view: The built-in browser view only opens your own server and its sign-in page. Other links open in your normal browser. No Google Safe Browsing lookups or usage statistics.
  • Nothing else: No analytics, no Google, no fonts or scripts from anywhere else.

Stores on your phone

  • Your servers: The list of servers you added, in the app's private storage.
  • Your sign-in: A session cookie in the app's private storage, or, if you sign in with Authelia from the app, a short-lived token and a refresh token per server, sealed by a key in the Android Keystore. Your Authelia password is never stored; Sign out in the menu ends a phone's sign-in here and on the server.
  • Fingerprint unlock (off unless you turn it on): Your unlock password for one server, sealed with a key that only your fingerprint opens, every time. It never leaves the phone: not sent to the server, not logged, not in a backup. A new fingerprint added to the phone destroys the key, so the app forgets the copy and asks for your password. Turn it off in the menu to delete it. Someone with the phone but not your finger cannot open it; malware with root on an unlocked, running phone is outside what any app can defend against.
  • Your ledgers: An encrypted copy so it opens offline. On this phone a ledger is only ever ciphertext.
  • Backups: Off. Nothing from this app goes to Android or Google backups.

Licence, source and version

  • AGPL-3.0-or-later. Source: <https://git.libreportal.org/LibrePortal/LibreMoney>. Version 0.3.4. Audited 2026-10-21.

Source code ↗ Licence: AGPL-3.0-or-later ↗

What we log, and why

A server has to know who is knocking, or it cannot lock anyone out. So some addresses are kept, for as short a time as security needs, and nothing is kept that nothing reads. Your server's Privacy check page shows each line below and ticks it only when it has checked.

Kept only in memory

Sign-in limits and lockouts count addresses in the control panel's memory. They are never written down and vanish when it restarts.

Web attacks

Traefik writes failed web requests to a log so CrowdSec can spot probing. It holds no cookies, no passwords and no query strings, is rotated every 15 minutes, is deleted after 48 hours and is never in a backup. CrowdSec keeps a banned address until the ban ends, 4 hours, and clears its own records after 48.

Who did what

The control panel's activity log keeps the person, the action and the full address for 30 days. After that the address is cut to its network (the first three numbers of an IPv4 address, the first three groups of an IPv6 one). Sessions show the full address only while they are active.

Your apps

Apps that can be told how much to log are set to warnings and errors only, with their own access log off. You can turn more on, and a debug switch per app turns itself off after 24 hours. Every container's log is capped at 10 MB times 3 files.

Mail

The mail server logs at warning level and keeps its delivery history for 7 days. The mail queue is your mail in transit, not a log.

This is the practical side of The Promise. Spotted something wrong or out of date? Tell us and we will fix the report.