RemalApps
Back to Knocker

Privacy Policy

Knocker Updated 10 Nov 2026

Privacy Policy for Knocker

Last updated: 10 November 2026

Knocker is an Android app that works as a client for Knocker, a self-hosted single-packet authorization (“knock”) gateway for home servers. The app connects to the Knocker server that you host and configure yourself.

In short: Knocker only ever talks to two places. One is the Knocker server you set up yourself. The other is Sentry, which receives crash reports and which you can switch off in the app under Settings → Crash reports. We run no account system and no backend of our own, so we never receive your server addresses, API keys or whitelist status.

This Privacy Policy explains what data Knocker processes, where it is stored, what is sent off your device, and how to contact us about privacy. Knocker is open source, so you can check what it does at github.com/FarisZR/Knocker-app.

1. Controller and contact

The person or entity responsible for Knocker is:

Developer / controller: RemalApps Address: 23442 Jeddah, Saudi Arabia Privacy contact: [email protected]

For privacy questions or data protection requests, contact us at the email address above.

2. What Knocker does

Knocker sends “knock” requests to the Knocker server you configure, so that your server can temporarily whitelist your device’s public IP address. Depending on the features you use, Knocker can:

  • knock automatically when the app opens, or from Android Quick Settings tiles;
  • renew whitelists automatically before they expire;
  • show the status and expiry of active whitelists;
  • show local notifications when a whitelist expires.

3. No account and no developer backend

Knocker does not require an account. We do not run a backend server that receives your server addresses, API keys, whitelist status or app settings. Your app data is either:

  1. stored locally on your device; or
  2. sent directly from your device to the Knocker server you configure.

The only data we receive from the app is the crash and diagnostic data described in Section 6.

4. Data stored on your device

Knocker stores data locally so the app, notifications and Quick Settings tiles can work.

This includes:

  • profile settings, such as a profile name, server endpoint URL, optional IP address override, requested TTL, and options such as knock-on-open, automatic renewal, home-screen pinning and Quick Settings tile assignment;
  • the API key for each profile, kept in encrypted storage backed by the Android Keystore;
  • whitelist status returned by your server, such as the whitelisted address, expiry time, last knock result and last error;
  • a local identifier of your current network connection (its type, such as Wi-Fi or cellular, and an internal Android handle), used only on the device to notice when you switch networks. It is not the Wi-Fi name and not location data;
  • app settings, such as the wallpaper-colors setting on Android 12+ and your crash-report choice.

Knocker opts out of Android cloud backup and device-to-device transfer, so this data is not copied to your Google account or to a new phone. After moving to a new device, you set up your profiles again.

Local data is removed when you clear the app’s storage or uninstall the app.

5. Your self-hosted Knocker server

When you knock or renew, Knocker sends a request directly from your device to the server URL you configured. The request includes:

  • your API key, in a request header;
  • an optional IP address override and requested TTL, if you configured them.

When the app opens or your network changes, Knocker may also send an authenticated status request to your server. Your server answers with the device’s current public IP address, whether it is whitelisted, and when the whitelist expires. Automatic renewal can send further status requests and knocks in the background.

Your server necessarily sees your device’s public IP address, because whitelisting that address is the purpose of a knock. This communication happens directly between your device and your server. We do not receive it. The Knocker server is operated by you or by whoever hosts it, and its own privacy and security practices apply. The app only accepts HTTPS server addresses.

6. Sentry crash reporting

Knocker uses Sentry to receive crash reports and error diagnostics, so we can find and fix crashes and technical problems.

Sentry is operated by Functional Software, Inc. d/b/a Sentry. It processes this data on our behalf under its Data Processing Addendum. The app sends reports to Sentry’s German (EU) region.

You can turn this off. Go to Settings → Crash reports. Turning it off stops reporting immediately, and Sentry’s reporting code is not started the next time you open the app, so nothing is sent. Turning it back on takes effect after you restart Knocker. Crash reporting is on by default.

When it is on, a report can contain:

  • app version, build and release;
  • operating system version, device brand, manufacturer and model, and whether the device is rooted or the app was installed outside an app store;
  • device state at the time: battery level, temperature and charging state, free and total memory and storage, screen size, orientation, language and time zone, boot time, whether the device is online and the connection type (such as Wi-Fi or cellular), and processor details;
  • which of the app’s permissions are granted;
  • the crash’s stack trace, exception type and message, and the screen that was open;
  • breadcrumbs, which are the recent events before a crash: screens opened, the app moving to the foreground or background, network changes (the connection type, whether a VPN is active, and bandwidth estimates), low-memory and battery events, device rotation, and warnings or errors the app wrote to its log;
  • session information: when the app starts and whether the session ended in a crash, used to measure how many sessions are crash free;
  • a random installation ID generated by the Sentry software on your device. It identifies the installation, not you. We cannot tell who it belongs to, but it is still treated as personal data. It changes if you reinstall the app or clear its data;
  • an approximate location (country and region), which Sentry derives from the connection’s IP address when it receives the report.

Knocker is configured so that Sentry:

  • does not store your IP address (IP address storage is switched off for our whole Sentry organization);
  • does not receive names, email addresses, account details, contacts or precise location, because Knocker does not collect them and default personal data collection is disabled;
  • has its default data scrubbing enabled for our organization and project;
  • has screenshots, session replay, performance profiling and Sentry’s separate log collection switched off, and does not store native crash dump files;
  • does not receive user feedback forms. The app has none.

Knocker does not intentionally send server addresses, API keys or profile data to Sentry. Error messages and the log lines in breadcrumbs can still contain technical context, such as a server hostname, and scrubbing cannot catch everything.

We do not use Sentry for advertising, marketing, user profiling, or tracking users across apps.

7. Notifications and Quick Settings tiles

Knocker may use local notifications and Quick Settings tiles to show knock results and whitelist expiry. Their content comes from information stored on your device. We do not receive it.

8. Permissions

Knocker uses these Android permissions:

  • Internet and network state: to knock, and to notice when your connection changes. A library also adds Wi-Fi state. Knocker does not read your Wi-Fi name.
  • Notifications: to tell you when a whitelist expires.
  • Exact alarms: to renew a whitelist on time. You grant this in Android’s settings, and Knocker works without it.
  • Receive boot completed: to restore scheduled renewals after a restart.
  • Wake lock and foreground service: added by Android’s background-work library, so scheduled renewals can run.
  • Vibrate: for touch feedback.
  • Biometric and fingerprint: added by the secure-storage library. Knocker does not ask for biometric authentication.

Location, camera, microphone, storage and media, and display-over-other-apps permissions are blocked in the release configuration. Knocker does not read your location or contacts, and it does not look up DNS records to identify your connection.

9. Data sharing

We do not sell personal data and we do not share it for advertising.

Data leaves your device only in these cases:

  • directly to the Knocker server you configured, for status checks, knocks and renewals;
  • to Sentry, as described in Section 6, unless you turn crash reporting off;
  • to Google and the Android platform as part of normal app installation, updates and platform features, under Google’s own policies.

Knocker is published from Saudi Arabia. We handle personal data in line with the Saudi Personal Data Protection Law (PDPL), and, for people in the European Economic Area, the GDPR.

For users in the EU, we process data on these legal bases:

  • App functionality: Art. 6(1)(b) GDPR, because processing is needed to provide the app features you choose to use.
  • Crash reporting: Art. 6(1)(f) GDPR, based on our legitimate interest in keeping the app stable, secure and reliable. It is limited to fixing crashes, and we reduce its impact with the safeguards in Section 6 and by letting you turn it off.
  • Support requests: Art. 6(1)(b) or Art. 6(1)(f) GDPR, depending on the request.
  • Legal compliance: Art. 6(1)(c) GDPR, where processing is necessary to comply with legal obligations.

Under the PDPL we process personal data on the corresponding grounds it allows: to provide the service you asked for, and for our legitimate interest in keeping the app reliable. You can stop crash reporting at any time.

11. International transfers

Crash reports are stored in Sentry’s EU region in Germany. Sentry is a US company, and it and its subprocessors may process personal data outside Europe and outside Saudi Arabia. Sentry describes the safeguards it applies to such transfers in its international data transfers information.

12. Data retention

Local app data stays on your device until you replace or delete it, clear the app’s storage, or uninstall the app. API keys stay in encrypted storage until you delete the profile, clear the app’s data or uninstall the app.

Sentry keeps crash and diagnostic data for 30 days under our current plan and then deletes it automatically.

Support emails may be kept as long as needed to answer the request, handle follow-up questions, and protect legitimate interests such as abuse prevention or legal defense.

13. Data deletion

Because Knocker has no accounts and no backend that stores your app content, you delete your data on your device:

  • delete a profile, or change app settings, in the app;
  • clear the app’s storage in Android settings;
  • uninstall the app.

If deleting a profile reports an error, clear the app’s storage to be sure its API key is gone.

To stop crash reporting, turn it off in Settings → Crash reports. Reports already sent are deleted automatically after 30 days. You can also ask us to delete them earlier by emailing [email protected]. Because the installation ID is random and not shown in the app, tell us the approximate time of the crash, your device model and the app version so we can find the matching reports.

14. Security

Knocker uses technical safeguards intended to reduce privacy risk:

  • local-first processing and no developer-operated backend;
  • encrypted local storage for API keys, backed by the Android Keystore;
  • HTTPS-only server addresses;
  • no cloud backup of app data;
  • no Wi-Fi name, location or DNS-based connection identification;
  • blocked location, camera, microphone and storage permissions;
  • an off switch for crash reporting, and Sentry configured not to store IP addresses.

No app or network transmission can be guaranteed to be completely secure. Keep your device protected with a screen lock, keep Knocker updated, and keep your API keys confidential.

15. Your rights

Depending on where you live, under the PDPL or the GDPR you may have the right to:

  • access personal data;
  • correct inaccurate personal data;
  • request deletion;
  • restrict processing;
  • object to processing based on legitimate interests;
  • withdraw consent where processing is based on consent;
  • request data portability;
  • lodge a complaint with a supervisory authority, such as the Saudi Data and Artificial Intelligence Authority (SDAIA) or the data protection authority where you live.

To exercise your rights, contact us at [email protected]. You can also stop crash reporting yourself at any time in Settings → Crash reports.

Because Knocker does not operate user accounts and does not centrally store your app content, we cannot identify app data that exists only on your device. The most direct way to delete it is to clear the app’s storage or uninstall the app.

16. Children

Knocker is a technical utility for people who self-host a Knocker server. It is not directed at children, and we do not knowingly collect personal data from children.

17. Changes to this Privacy Policy

We may update this Privacy Policy when Knocker changes, when third-party services change, or when legal requirements change. The “Last updated” date at the top shows when it was last changed.