Homerun privacy.

What this covers

Homerun is free, self-hosted software: the dashboard and its server, the installer, the command-line tool, and the MCP server built into every instance (what Claude and other AI clients connect to). There is no hosted version, no account with me and no analytics.

Who is responsible

Whoever runs a Homerun instance decides what it stores, so under the GDPR they are the data controller for it, including for the visitors of the apps it hosts. If it’s your server, that’s you. I have no access to it.

I write the software. For questions about what it does with data, email orochibraru@gmail.com.

What stays on your server

• accounts: name, email, profile picture, password hash, passkeys, two-factor secrets, API keys and the date of the last sign-in
• sessions, with the IP address and browser they were opened from
• an audit log of API requests made with service accounts, including their IP address
• banned IP addresses, and the requests they made while banned
• what your services produce: logs, error events and traces from your apps, traffic and uptime numbers

Most of it is trimmed on its own:

• traces: 7 days by default, up to 90
• finished jobs: 7 days
• error events: 30 days
• traffic and uptime samples: 1 year
• the audit log, app log and notification feed: the latest 20,000, 5,000 and 200 entries

Deleting an account deletes its sessions, sign-in methods and notification channels.

What leaves your server

• Update check: when an admin opens the dashboard, the server asks GitHub for the latest Homerun release, at most every 10 minutes. GitHub sees the server’s IP address, nothing else. The command-line tool only checks when you run its update command.
• Features you use: service icons from jsDelivr, image tags from Docker Hub, the vulnerability database for image scans, extensions from Open VSX, and Docker and Homerun downloads when installing a node. These requests come from your server and carry no personal data.
• What you connect: DNS providers, GitHub, GitLab or Bitbucket, single sign-on providers, S3 storage for backups, and notification channels (email, webhooks, Discord, Slack, Telegram, browser push). Each gets what you send it, under its own privacy policy.

No telemetry, no crash reporting to anyone, no fonts or scripts from a CDN in your browser. The error tracking in Homerun receives errors from your apps; it sends nothing out.

Claude and other AI clients

Connecting an AI client signs it in to your instance with OAuth: you approve it on your own server, which gives it a token for the MCP endpoint only. It can ask for your profile, email and groups, and acts with your account’s permissions.

Through it, the client can read and change what you can: services, configs, deployments, logs, errors, monitoring, DNS records, users and notification channels. Values that look like secrets, such as passwords, tokens and keys, are redacted before it sees them. Revoke access on the identity provider page or under Profile → API Keys.

Whatever it reads goes to the AI provider and is then covered by their privacy policy (for Claude, Anthropic’s). Nothing goes through me.

Your browser

The dashboard sets a session cookie to keep you signed in, a cookie for apps behind its login wall, short-lived cookies (10 minutes) while connecting a Git provider or testing single sign-on, and a cookie with your time zone so charts match your clock. It keeps the theme, view modes, navigation state and diagram layouts in your browser’s storage.

Your rights

Under the GDPR you can ask to access, correct, delete or restrict your data, or object to how it is used. Ask the person who runs the instance: they hold the data. You can also complain to your data protection authority (in France, the CNIL).

Changes

If what Homerun collects or sends changes, this page changes with it, and the date at the top gets updated.