Updated 20261103 · checked against the source code, not written from memory
Beresta runs on your device. The app has no server of mine for your data — not for books, not for accounts, not for collecting reports. The Windows and Linux version contacts my licence server once per computer — here is exactly what it sends. Everything that leaves goes where you told it to, and it is all listed below by name.
This page is not a legal formality. It was assembled by going through the code: nine areas, 71 channels, each verified separately. Where a promise needs a caveat, the caveat is written down rather than hidden.
What does not exist at all
- Our server only on your tap. Beresta on Mac, iPhone and iPad never contacts a project address on its own. There are two exceptions, both below: the “Get the key for Windows and Linux” button in Settings → Purchase (from version 1.9.1) and, on Windows and Linux, registering a computer under a key. Few external addresses are hard-coded: the book directories Open Library and Google Books (the app calls them only when you tap, see below) and Apple’s promo-code page.
- No analytics, telemetry or crash collectors. No Sentry, no Crashlytics, no Firebase, no counters — none.
- No advertising and no tracking. No ad networks, no advertising identifier, no tracking prompt.
- No account, no sign-in. There is nowhere and no one to register with. Only the Windows and Linux version has a key — a signed string, not an account.
- No notifications. A device token is never requested.
- No “phone home” update checks. The app reports itself to nobody.
- A book cannot reach the network while you read. The reader is forbidden to call outward by a content policy; images in saved articles are replaced with local ones at save time.
What leaves the device even if you turned nothing on
Not one network request goes to anybody’s host without a setting of yours. But three things run always, and two of them are uncomfortable to say out loud honestly.
1. Handoff — “what you are reading right now”. When you open a book, the app advertises it to your own nearby devices on the same Apple account: the book title and where you stopped. No text, no highlights, no author. The channel is Apple’s, over the air or via iCloud.
A caveat worth knowing: for a file without metadata the “title” is the file name, and for a saved web article without a heading it is the site’s domain. There is no switch inside the app yet — it can only be turned off by the system-wide Handoff setting. That is an oversight of ours and will be fixed.
2. The app listens to the App Store. At launch it subscribes to your account’s transactions to know whether updates are paid for, and confirms received ones to the store. Apple sees your account, device and country — the same it sees without us. No receipt is sent anywhere; we learn nothing about the buyer.
3. The app writes to your device’s system log. The log stays on the device and does not leave on its own. But it is written in the clear, and it picks up book and article titles, full URLs of pages saved from the browser, paths containing your account name, and reading positions. It leaves only by your action: a diagnostic report or a system log export.
What leaves once you turn it on yourself
Sync through a folder
You choose a directory — on a disk, a flash drive, a Syncthing folder or inside iCloud Drive. What goes there: your field-level change journal (titles and metadata, highlights with your own thoughts, bookmarks, reading sessions, RSS subscriptions), reading positions, whole book files and covers for the entire library, plus your device’s name as the system reports it and marks of when you used that device.
Everything in that folder is in the clear. Beresta adds no encryption there: it is your directory, and it is protected by whatever you protected it with. Anyone with access to that directory — or to the cloud it sits in — will see what you read, where you stopped, what you highlighted and what you thought about it.
If the directory is inside iCloud Drive, all of the above sits with Apple.
Sync through S3 / Backblaze B2 or WebDAV
The same content, but encrypted with a key only you hold (ChaCha20-Poly1305). The storage operator sees encrypted objects, their sizes and access times — and not their contents. We do not know the key and cannot recover it: lose your recovery code and nobody can read that storage, including us.
Feed subscriptions
The app fetches the feed, the article page and its images itself. The owner of each of those hosts sees a request from your address — the same as opening the page in a browser. No cookies are sent.
Browser clippings, OPDS catalogue
The browser extension talks only to your own computer (127.0.0.1) and nowhere else. It collects nothing and sends nothing to the internet. If Beresta is not running when you clip a page, the page waits in the extension’s own storage inside your browser, on this computer — at most 20 pages — and is deleted from there as soon as Beresta takes it (or turns it down, saying why). The OPDS catalogue, if you enable it, serves your library to whatever network the machine is currently on, behind a password. Highlights are not served through it.
Export to Obsidian
A snapshot of your highlights is written into your vault folder. From there it lives by the rules of whatever syncs that vault — iCloud, Obsidian Sync, Dropbox, Syncthing, git.
What leaves on a tap of yours
- Share (iPhone/iPad) — a whole book file, or a file of highlights. Highlights carry quotes, your own notes, and a link with the exact position and the file’s fingerprint.
- The diagnostic report — shown to you in full before sending; you send it. There is no endpoint on our side. It does contain personal details — see the support page.
- Copying to the clipboard. On a Mac any program can read the clipboard, and with Universal Clipboard on it travels to your other devices. Keep that in mind when copying your recovery code: that code is the key to your encrypted storage.
- “Open the original” and links inside a PDF — the address opens in your browser, with all your cookies and every tracking parameter that was in the saved address.
- Purchase and “Restore purchases” — an ordinary conversation with the App Store.
- Details from the Web (since version 1.6) — the button on a book’s card opens a sheet, and a request goes out only when you press Search in it. The app never asks on its own, on import or in the background. There are two directories: Open Library (run by the Internet Archive) and Google Books (Google).
- What goes out: the book’s title and author, and the ISBN if one is typed in; Open Library also gets the book’s language code. Google Books also gets your key, if you entered one; the key lives only in the device’s Keychain and never goes to Open Library. Like any server, a directory sees the address the request came from. Showing the covers it found means more requests to books.google.com or covers.openlibrary.org.
- What does not: your library, your other books, your highlights, your reading and your place in it. The request carries no device identifier; no cookies are sent or kept.
- What happens next: what a directory does with the request is governed by its own rules — the Internet Archive’s and Google’s. The answer stays on your device, and only the fields you tick go into the book’s card.
Beresta for Windows and Linux: purchase and key
Unlike the Mac version, the Windows and Linux version has a licence server of mine — because I sell it, not the App Store. It learns exactly what it takes to sell a key and keep it from spreading to a hundred computers. It does not and cannot see your books, highlights or reading: the program never sends them there.
- When you buy — your email (the key goes there), your name and phone if you gave them, the product, the amount and the order number. That is the order log (Google Sheets) and a notification to me in Telegram, as for every purchase on Second Brain sites. Payment is taken by the payment provider — Robokassa.kz, YooMoney or ProEducation; I never see your card number. The key is emailed through Resend.
- The key ledger — order number, the key itself, its kind (program, renewal, comeback), purchase date and email. It is there to resend your keys when you ask and to revoke a key after a refund.
- Once per computer the program sends the key itself and an anonymous fingerprint of the computer — 16 bytes of a hash of the system's machine ID mixed with the key number. The fingerprint can't identify the computer or its owner, and the same computer under two keys gives two unrelated fingerprints. With it goes a machine secret — another hash of the same ID — by which the server knows that a request to free the computer comes from that computer; the server keeps only a hash of the secret, never the secret itself. The system's machine ID itself is never sent. It also sends the computer's name as the system shows it (say, “Anna's laptop”), so you can recognise your machine in the list when you free a slot — and the interface language, so the answer comes back in it. Your account and network details are not in the request; the server sees the address the request comes from, as any server does. What is stored: the fingerprint, the hash of the secret, the receipt, the computer's name, the day of registration, the time of the last request and the time the computer was freed. The program contacts the server again only when you press “Register this machine” or “Free this machine” yourself: the key and the receipt are checked offline.
- “Send me my keys” — the email you entered; keys go only to it.
- A key for App Store buyers (Mac, iPhone, iPad, from version 1.9.1) — only on the “Get the key for Windows and Linux” button. It sends Apple’s signed record of your Beresta purchase (the server checks it is genuine without contacting Apple) and your email, if you typed one, to send a copy of the key. Stored is the same as in the key ledger above: purchase number, key, date and email. One purchase, one key: pressing again returns the same key.
The server and its hot standby are in Kazakhstan (Selectel and Hoster.kz); backups of the ledger are encrypted on the server before they go anywhere. To have your email removed from the ledger, write to me; your key keeps working, but I won't be able to resend it.
Who learns what — by name
| Who | What they learn | When |
|---|
| Apple | your account, device, country; via Handoff — what you are reading; with a folder in iCloud Drive — everything in the exchange | always / if the folder is in iCloud |
| Backblaze, an S3 or WebDAV operator | encrypted objects, their sizes and access times | if you connected it |
| Feed, page and image hosts | a request from your address | if you added a subscription |
| Open Library (Internet Archive), Google Books (Google) | the title, author and ISBN of one book, its language code (Open Library), your key (Google, if entered), a request from your address | when you press Search in the Details from the Web sheet |
| The source site | a visit from your browser, with your cookies | when you tap “Open the original” |
| Anyone with access to the sync folder | everything in the exchange — it is unencrypted there | if the folder is shared |
| Us, on Mac, iPhone and iPad | nothing | — |
| Us, Windows and Linux | purchase email, the key, an anonymous computer fingerprint, the computer's name, the days of registration and requests | when you buy, and once per computer |
About this website
The site is not the app, and the promise “no server of mine” does not hold here.
- The waiting-list form sends your address, and your name if you gave one, to my newsletter server (Listmonk, Hetzner, Germany); Resend delivers the mail. You can unsubscribe from any letter.
- The forms on the Beresta for Windows and Linux page send what you typed to my payment and licence server (Selectel, Kazakhstan) — see above. The “Send me my keys” form checks that you're not a robot with the Cloudflare Turnstile widget: it loads from challenges.cloudflare.com and sees your browser and address, as any site your browser talks to does. No other page of the site has the widget.
- Fonts come from this site. Literata and Fira Mono are served from beresta.page itself, under the SIL Open Font License; opening a page sends no request to Google or any other font service.
- The site carries Yandex Metrica (counter 112548209). It counts visits, referrers and events: whether you scrolled down to the Windows and Linux block on the home page, whether you submitted the new-versions email form, and which buttons you clicked — App Store, program download, press kit, forum, GitHub, going to payment. An event carries only what tells events apart: the page, the language, which button or file, and for going to payment, the chosen key and payment method. Session recording (Webvisor) is off, field contents are not recorded, and the site shows no ads. The Metrica script itself, like any Metrica counter, matches its visitor identifier with Yandex services (a request to yandex.ru): Yandex does this, not us, and we make no use of that data. Any blocker turns it off, and the page works fully without it.
Your rights and how to use them
Your data is yours and sits with you. You can take it without us: the database format is documented openly under CC0, highlights export to open JSON-LD and Markdown, and books are stored byte for byte as you put them there. To delete it, delete the files; we hold no copy, and there is nobody to send a deletion request to.
If you joined the waiting list and want your address gone, write to me and it will be gone.
How you will know about changes
The date at the top is the date of the last check against the code. Material changes will be named here rather than slipped in silently. Changes to the app itself are listed on the what’s new page.
Who is responsible
Second Brain Production (sole proprietorship), Karaganda, Kazakhstan. Questions and requests: laukhin@dementiy.com.