Skip to content
ChannelWatch

Privacy

ChannelWatch app privacy

Section titled “ChannelWatch app privacy”

The self-hosted ChannelWatch app does not send usage analytics or telemetry to a ChannelWatch-operated service.

The app still makes outbound requests for its documented features: DVR connections, configured notifications, update checks and downloads, and support reports you choose to submit. An optional error-reporting DSN can be saved, but v1.6.0 does not wire a crash-reporting client to it.

Local artifacts under /config

Section titled “Local artifacts under /config”

The self-hosted app keeps its local state in the /config volume. The main artifacts are:

Path What it stores Notes
/config/settings.json Main app settings, DVR connection details, thresholds, provider configuration, and shared secrets Persistent config file used by both the core service and the web UI
/config/channelwatch.log Rotating application log file Local log file, operator-readable, rotated with retention configured in app settings
/config/channelwatch.db SQLite activity history, delivery records, user accounts, and sessions Watch History and notification logs read persisted operational records
/config/activity_history.json Legacy local activity history store Older installs may still have this file; current installs also use channelwatch.db
/config/session_state_<dvr_id>.json Per-DVR alert and session state One file per DVR identity
/config/watchdog_status.json Persisted watchdog and freshness state Used to retain health snapshot information across restarts
/config/migration.journal Migration progress and recovery metadata Used during schema and storage migrations
/config/backups/* Local backup zips and migration backup files Includes migration backups, archived legacy state files, and pre-restore snapshots
/config/env_overrides.json Environment-derived overrides surfaced to the UI Created by the container entrypoint when env overrides are present
/config/encryption.key Encryption key used for protected DVR and custom webhook credentials This does not mean every secret in settings.json is encrypted at rest
/config/channelwatch-runtime/* Downloaded signed app bundles, update policy and jobs, and runtime-selection metadata Kept locally for in-app updates and compatible rollback

Credential storage, masking, and encryption scope

Section titled “Credential storage, masking, and encryption scope”

Per-DVR API keys and custom webhook URL/secret fields use /config/encryption.key for local Fernet encryption before they are written to the settings store.

That protection does not apply to every secret or provider setting. Sensitive values are masked in the UI and sanitized debug output where supported, but filesystem permissions on the /config volume still matter.

Outbound traffic, what leaves your machine

Section titled “Outbound traffic, what leaves your machine”

The ChannelWatch container can contact:

  • configured Channels DVR servers
  • configured notification destinations such as Apprise-backed providers, Discord webhooks, or other webhook endpoints
  • official public ChannelWatch release metadata and download URLs, during manual checks or scheduled checks governed by the Update Center policy
  • the configured support intake service when you submit Report a Problem

When the app displays program or channel artwork, your browser may request the image directly from the DVR-supplied URL. This contacts the image host from your browser, separately from the container’s requests.

Notification payloads contain alert content from your DVR environment, such as channel name, program name, and device name. They do not send the full ChannelWatch configuration file or the local database.

Saving an error-reporting DSN does not send crash reports in v1.6.0. The setting is reserved for future use.

Backups, logs, and manual exports

Section titled “Backups, logs, and manual exports”

ChannelWatch uses local backups, not a cloud backup service. The app creates backup artifacts in /config/backups/, including timestamped migration backups and pre-restore snapshots created before a restore operation.

Backup zips and local export flows are operator-controlled. They stay on disk until you move, copy, or share them yourself.

The debug bundle is also a local manual export. It produces a zip for manual sharing and does not transmit anything automatically.

The in-app Report a Problem flow is also operator controlled. It prepares a public-safe issue preview from details you enter plus a diagnostics summary. Screenshots, debug bundle ZIPs, private email addresses, attachment filenames, raw logs, API keys, webhook secrets, notification credentials, DVR API keys, and private config values are not placed into the public issue body. If direct submit is unavailable, the app can create a support code or offline package for the hosted upload portal.

Update checks

Section titled “Update checks”

The in-app Update Center supports manual checks and scheduled checks under its automatic or notify-only policy. The default maintenance window is 03:00–05:00 in the configured timezone; a release can still require manual installation. Review Settings > Updates for the active policy and next check.

Update checks do not send analytics, DVR settings, notification settings, activity history, install identifiers, debug bundles, or usage data.

Compatible application updates are downloaded from trusted public release URLs and verified locally with the signed manifest, bundle signature, and SHA256 hash before activation. Compatible newer launchers can also activate a signed Python package generation. Python itself and image-owned system libraries still use the image update path. See Updating ChannelWatch for the exact version paths.

Users and permissions

Section titled “Users and permissions”

Fresh installs choose secure login or trusted-network no-auth before DVR setup. The backend exposes admin, operator, and viewer roles, session-based auth, and a security-status endpoint. Upgraded deployments can also remain in legacy shared API-key mode, or in an RBAC mode that still keeps the shared API key as a fallback.

The main privacy boundaries are local storage, operator-controlled sharing, and limited encryption scope. For current auth and role behavior, see Security modes and Users and permissions.

This website, not the self-hosted app

Section titled “This website, not the self-hosted app”

The ChannelWatch docs and marketing site can use Cloudflare Web Analytics when it is enabled for the Pages project. Cloudflare describes that service as cookieless. Its data practices are covered by the Cloudflare Privacy Policy.

The site serves Plus Jakarta Sans and JetBrains Mono from this domain and uses a system serif stack for headings. It stores the selected theme in your browser and offers a /report support form. That form can submit your description and optional contact email through the report-intake Worker. Turnstile is used when the site key is configured. Public issue content is kept separate from private contact details and attachments; private delivery uses the configured Resend path.

The deployed website also loads HolyDash analytics through its edge service. It records page paths, visible section identifiers, visit timing and activity, browser, operating system, device category, IP address, and approximate city and country supplied by Cloudflare. It stores a random visitor identifier in local storage and a visit token in session storage. The current integration does not record session replay and skips collection when the browser sends Do Not Track or Global Privacy Control.

The collector is configured to remove visit and event records older than 30 days through scheduled cleanup. Clearing this site’s browser storage removes local identifiers, but does not itself delete collector records. See the website privacy page for the website and support-report details.

For questions about the website’s privacy behavior, use the ChannelWatch issue tracker linked from the site footer.

This website analytics setup is separate from the self-hosted ChannelWatch app. The app does not send analytics to Cloudflare or HolyDash.

Section titled “Related pages”