Updated 20260906 · checked against the source code, not written from memory

Beresta runs on your device. The app has no server of mine — not for data, not for accounts, not for collecting reports. Everything that leaves goes where you told it to, and it is all listed below by name.

This page is not a legal formality. It was assembled by going through the code: nine areas, 71 channels, each verified separately. Where a promise needs a caveat, the caveat is written down rather than hidden.

What does not exist at all

• No server of ours. No request the app makes goes to a project address. The only external address hard-coded anywhere is Apple’s promo-code page.
• No analytics, telemetry or crash collectors. No Sentry, no Crashlytics, no Firebase, no counters — none.
• No advertising and no tracking. No ad networks, no advertising identifier, no tracking prompt.
• No account, no sign-in, no licence keys. There is nowhere and no one to register with.
• No notifications. A device token is never requested.
• No “phone home” update checks. The app reports itself to nobody.
• A book cannot reach the network while you read. The reader is forbidden to call outward by a content policy; images in saved articles are replaced with local ones at save time.
• No metadata lookups on the internet. Not a single line: no Open Library, no Google Books.

What leaves the device even if you turned nothing on

Not one network request goes to anybody’s host without a setting of yours. But three things run always, and two of them are uncomfortable to say out loud honestly.

1. Handoff — “what you are reading right now”. When you open a book, the app advertises it to your own nearby devices on the same Apple account: the book title and where you stopped. No text, no highlights, no author. The channel is Apple’s, over the air or via iCloud.

A caveat worth knowing: for a file without metadata the “title” is the file name, and for a saved web article without a heading it is the site’s domain. There is no switch inside the app yet — it can only be turned off by the system-wide Handoff setting. That is an oversight of ours and will be fixed.

2. The app listens to the App Store. At launch it subscribes to your account’s transactions to know whether updates are paid for, and confirms received ones to the store. Apple sees your account, device and country — the same it sees without us. No receipt is sent anywhere; we learn nothing about the buyer.

3. The app writes to your device’s system log. The log stays on the device and does not leave on its own. But it is written in the clear, and it picks up book and article titles, full URLs of pages saved from the browser, paths containing your account name, and reading positions. It leaves only by your action: a diagnostic report or a system log export.

What leaves once you turn it on yourself

Sync through a folder

You choose a directory — on a disk, a flash drive, a Syncthing folder or inside iCloud Drive. What goes there: your field-level change journal (titles and metadata, highlights with your own thoughts, bookmarks, reading sessions, RSS subscriptions), reading positions, whole book files and covers for the entire library, plus your device’s name as the system reports it and marks of when you used that device.

Everything in that folder is in the clear. Beresta adds no encryption there: it is your directory, and it is protected by whatever you protected it with. Anyone with access to that directory — or to the cloud it sits in — will see what you read, where you stopped, what you highlighted and what you thought about it.

If the directory is inside iCloud Drive, all of the above sits with Apple.

Sync through S3 / Backblaze B2 or WebDAV

The same content, but encrypted with a key only you hold (ChaCha20-Poly1305). The storage operator sees encrypted objects, their sizes and access times — and not their contents. We do not know the key and cannot recover it: lose your recovery code and nobody can read that storage, including us.

Feed subscriptions

The app fetches the feed, the article page and its images itself. The owner of each of those hosts sees a request from your address — the same as opening the page in a browser. No cookies are sent.

Browser clippings, OPDS catalogue

The browser extension talks only to your own computer (127.0.0.1) and nowhere else. The OPDS catalogue, if you enable it, serves your library to whatever network the machine is currently on, behind a password. Highlights are not served through it.

Export to Obsidian

A snapshot of your highlights is written into your vault folder. From there it lives by the rules of whatever syncs that vault — iCloud, Obsidian Sync, Dropbox, Syncthing, git.

What leaves on a tap of yours

• Share (iPhone/iPad) — a whole book file, or a file of highlights. Highlights carry quotes, your own notes, and a link with the exact position and the file’s fingerprint.
• The diagnostic report — shown to you in full before sending; you send it. There is no endpoint on our side. It does contain personal details — see the support page.
• Copying to the clipboard. On a Mac any program can read the clipboard, and with Universal Clipboard on it travels to your other devices. Keep that in mind when copying your recovery code: that code is the key to your encrypted storage.
• “Open the original” and links inside a PDF — the address opens in your browser, with all your cookies and every tracking parameter that was in the saved address.
• Purchase and “Restore purchases” — an ordinary conversation with the App Store.

Who learns what — by name

Who	What they learn	When
Apple	your account, device, country; via Handoff — what you are reading; with a folder in iCloud Drive — everything in the exchange	always / if the folder is in iCloud
Backblaze, an S3 or WebDAV operator	encrypted objects, their sizes and access times	if you connected it
Feed, page and image hosts	a request from your address	if you added a subscription
The source site	a visit from your browser, with your cookies	when you tap “Open the original”
Anyone with access to the sync folder	everything in the exchange — it is unencrypted there	if the folder is shared
Us	nothing	—

About this website

The site is not the app, and the promise “no server of mine” does not hold here.

• The waiting-list form sends your address, and your name if you gave one, to my newsletter server (Listmonk, Hetzner, Germany); Resend delivers the mail. You can unsubscribe from any letter.
• Fonts are loaded from Google (fonts.googleapis.com and fonts.gstatic.com) on every page view — so Google sees your address and browser before you have clicked anything. This will be fixed by hosting the fonts here.
• The site carries Yandex Metrica (counter 112548209): it counts visits, referrers and two events — whether you scrolled to the waiting-list form and whether you submitted it. Session recording (Webvisor) is off, field contents are not recorded, and there are no advertising cookies. Any blocker turns it off, and the page works fully without it.

Your rights and how to use them

Your data is yours and sits with you. You can take it without us: the database format is documented openly under CC0, highlights export to open JSON-LD and Markdown, and books are stored byte for byte as you put them there. To delete it, delete the files; we hold no copy, and there is nobody to send a deletion request to.

If you joined the waiting list and want your address gone, write to me and it will be gone.

How you will know about changes

The date at the top is the date of the last check against the code. Material changes will be named here rather than slipped in silently. Changes to the app itself are listed on the what’s new page.

Who is responsible

Second Brain Production (sole proprietorship), Karaganda, Kazakhstan. Questions and requests: laukhin@dementiy.com.