Your data stays with you.
Cupola has no server, so your data has nowhere else to go. It talks straight to your services, keeps their keys on your device, and contacts two other hosts, each for one reason. On Android, its code scanner also reports to Google.
Cupola
Your server
- radarr.lan:7878
- sonarr.lan:8989
- seerr.example.net
- nas.home.arpa
A Cupola server There isn't one, so your data has nowhere else to go.
image.tmdb.org
plex.tv
Nothing collected by us
No sign-up, no analytics, no crash reports. Your services keep their own logins.
On Android, the code scanner reports to Google
To read the code in Copy from another device, Cupola for Android uses Google's ML Kit. ML Kit sends Google diagnostic and usage data: the device model and Android version, the app's name and version, an identifier for this installation, and how the scanner ran (speed, image settings, errors). Google offers no way to turn it off, so we plan to replace it with a scanner that sends nothing. On iPhone and iPad the scanner is Apple's and runs on the device; on a Mac you paste a link instead.
The two other hosts
image.tmdb.orgfor posters and cast photos, because that is where Seerr points. No credentials are sent, but TMDB sees your IP address.plex.tv, once, if you sign in to Seerr with Plex. Cupola does not keep the token.
Everything else comes from your own servers.
Keys stay on your device
API keys, tokens and passwords live in the Keychain on Apple devices and in the Keystore on Android. A Seerr invite shares the server's address, never its key. Moving to a new phone is encrypted and stays on your Wi-Fi.
Self-signed certificates
Cupola asks before trusting a certificate it has not seen, then pins it to that host. Services behind the same proxy are trusted together. Review or remove them in Settings › Security › Trusted certificates.
Away from home
A connection can have a second address for when you are out, through your VPN or reverse proxy. Cupola never sends a key over plain http across the internet. Cloudflare Access, proxy passwords and custom headers are supported.
Background search is off by default
A search that keeps running after you leave the screen hands the request, key included, to the operating system. That is why it starts off. Tasks expire after 11 minutes, and finished ones are cleared at every launch.
This website
No cookies, and fonts served from this site. Visits are counted with Cloudflare Web Analytics, which uses no cookies and does not track you across sites.
All of the certificate handling is in one file you can read in the source.
Questions
What data leaves my network?
Two things, and on Android a third. Posters and cast photos come from TMDB, where Seerr points, with none of your credentials attached. A Plex sign-in to Seerr goes through plex.tv once. And on Android, the code scanner in Copy from another device is Google's ML Kit, which sends Google diagnostic and usage data; we plan to replace it. We collect nothing ourselves: no analytics, no crash reports. See privacy.
My services are behind a reverse proxy with a self-signed certificate. Will it work?
Yes. Cupola asks once before trusting a certificate, then pins it to that host. Cloudflare Access tokens, proxy passwords and custom headers work too.
Does Cupola need a server or an account?
No. There is no Cupola account and no Cupola server. The app talks straight to your own services, and their keys and passwords stay on your device, in the Keychain or the Android Keystore.