Repository navigation
Privacy: FTW Cloud as the app's one door - #20
Conversation
…y while we move The app and the watch reach the box through FTW Cloud in Stockholm. From the FTW release that carries srcfl/ftw#1635, every box with a paired phone links to it, so the page now says what FTW Cloud sees for every home (a fixed home id, the box's and phone's addresses, the signed device list, timing), what it keeps on disk, and what the optional readable copy holds. The Frankfurt relay stays as a fallback while clients move. Assistants and support access are named as later work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Deploying ftw with
|
| Latest commit: |
af54ea2
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://214f3388.ftw-613.pages.dev |
| Branch Preview URL: | https://content-privacy-ftw-cloud-do.ftw-613.pages.dev |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 01b6d7df9b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| <p>The app reaches your box through Sourceful's relay at relay.ftw.energy, which runs in Frankfurt, Germany, on Amazon Web Services. The app and the box encrypt everything end to end (Noise protocol) before it leaves them. The relay has no key and cannot read what it carries.</p> | ||
| <p>To carry a connection the relay sees:</p> | ||
| <h2>FTW Cloud</h2> | ||
| <p>The app and the watch reach your box through FTW Cloud at cloud.ftw.energy, which runs in Stockholm, Sweden, on Amazon Web Services. Your box connects to FTW Cloud once you pair a phone. The app and the box encrypt the connection end to end (Noise protocol) before it leaves them. FTW Cloud has no key for it and cannot read or change what it carries.</p> |
There was a problem hiding this comment.
For Apple Watch users, this paragraph says that both the app and watch reach the box through FTW Cloud and immediately describes the connection as end-to-end encrypted, but line 80 says the watch receives readings from the optional readable copy, which line 81 explicitly says is not end-to-end encrypted. This can lead users to believe the watch works through the unreadable tunnel without enabling Cloud-readable data; describe the app-to-box tunnel and the watch's readable-copy path separately in both translations.
Useful? React with 👍 / 👎.
| <li>when you connect, for how long, and the size and timing of encrypted messages.</li> | ||
| </ul> | ||
| <p>The relay keeps none of the traffic. Its access log holds counts, not addresses or codes. If the relay fails to pass on a connection, its error log may record the address and code; that log replaces itself and stays small. We use what the relay sees only to carry your connection, which you ask for when you use the app.</p> | ||
| <p>On disk FTW Cloud keeps your home id, your box's public key, the signed device list, the phones registered for notifications and the hashes of access tokens. It keeps none of the traffic and logs no addresses. We use what it sees only to carry your connection.</p> |
There was a problem hiding this comment.
When a user revokes the last phone, deletes the app, or retires the home, the notice never says when the persisted home ID, public key, device list, push registration, and token hashes are erased; the one-hour and opt-out deletion rules below apply only to the in-memory readable copy. Because the page later identifies the home ID as personal data, omitting a retention period or the criteria that determine it leaves the new Cloud processing without the information required by GDPR Article 13(2)(a); document the lifecycle for these on-disk records in both translations.
Useful? React with 👍 / 👎.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 participant
The privacy page (English and Swedish) for the one-door move.
Merge when the FTW release with srcfl/ftw#1635 goes to beta, because from that release every box with a paired phone links to FTW Cloud. The date says 15 October 2026; move it to the merge day if that is later.
Facts checked against ftw-cloud
CLAUDE.md(what SQLite holds, no addresses logged),internal/store/store.go(ReadingsKeptFor = time.Hour),deploy/README.md(eu-north-1), and srcfl/ftw#1635 (link from pairing, grant off sends only roster and tunnel).🤖 Generated with Claude Code