Where things are kept

Watchpost stores local configuration, hub routes and account information in different places. Keep local recovery and transfer copies separate from your account sign-in: signing in is not a backup of your device registry.

Your deviceThe app

• The router's private key
• Device passwords
• The hub's admin token
• The access tokens of your sites

Your serverThe hub

• Its own WireGuard key
• Sites, their networks and numbers
• The SHA-256 of each token
• People who have a token of their own

Watchpost serviceAccounts service

• Who a person is
• Which hubs and sites they may open
• Licenses and purchases

On your device

The app keeps the device registry, sites, event history and configuration backups locally. Apple devices use the Keychain for credentials and storage keys. The app can also retain router private keys and hub access tokens needed for the connections you configured. Check encryption and keep the recovery key.

An export for yourself can include connection secrets when you choose to include passwords. An export for another person excludes router private keys and the hub administrator token. Review the contents before transferring devices.

On your hub

The hub stores its WireGuard configuration, sites and their networks, and access information for its routes. For personal access tokens, it stores a hash rather than the original token. The router needs its own tunnel configuration to connect to the hub.

The relay carries device traffic. Do not treat it as unable to see that traffic: run a hub on a server you trust. A tunnel to the site’s router and the connection from your app to the relay are separate parts of the route.

In the Watchpost account service

The account service is used by builds with account support. It handles sign-in, licenses and installations, invitations and access records. Invitations and device packages appear in Inbox.

An invitation is not the device package itself. When access is granted, the app can create a package encrypted for the recipient’s installations. If the sender explicitly includes device passwords, those travel inside that protected package. The service is not a video relay and does not hold a copy of your recorder’s archive.

Signing in does not automatically restore every locally saved device, password or configuration snapshot. Use the relevant transfer, recovery or received-package action.

On the site’s router

The router retains the tunnel and network rules applied during site setup. Removing a local device or resetting Watchpost does not remove those rules. Review the relevant hub and router actions when disconnecting a site.