Syncthing Privacy Review: Is This Self-Hosted Sync Tool Safe?

Syncthing Privacy & Security Review

Syncthing is highly secure and privacy-respecting because it uses end-to-end encryption (TLS) and has no central server. Your data never touches third-party infrastructure, and the open-source code is auditable. However, privacy depends on your configuration—default settings may expose metadata.

What Syncthing Offers (Pros & Cons)

Pros: Decentralized (no cloud provider), E2EE with TLS, open-source, no file size limits, cross-platform, no account required, no data mining.

Cons: No built-in zero-knowledge encryption (files are encrypted in transit but not at rest on devices), requires technical setup, no official mobile app (third-party only), metadata (device names, IPs) visible to peers, no file versioning by default.

Privacy & ToS Analysis

Encryption: TLS 1.3 for all traffic (E2EE). No zero-knowledge at rest—files are stored unencrypted on your devices unless you add Cryptomator or similar. Data Centers: None—Syncthing is peer-to-peer. File Scanning for AI: No. Telemetry: Optional usage reporting (disabled by default). CLOUD Act: Not applicable—no US-based servers. However, if you sync with a device in the US, data may be subject to local laws.

How to Protect Your Privacy on Syncthing

1. Enable 2FA on device access (if using Syncthing’s web UI, set a strong password and use HTTPS).
2. Encrypt files at rest using Cryptomator or Rclone before syncing.
3. Disable telemetry: In Settings > Connections, uncheck "Send usage data".
4. Use a VPN or Tor to hide your IP from peers.
5. Share only with trusted devices and use folder encryption (password-protected shares).

CCPA / CPRA Comparison

Syncthing is not subject to California CCPA or CPRA because it is self-hosted and does not collect personal data. Unlike US cloud providers (e.g., Google Drive, Dropbox), Syncthing has no central authority to comply with data access requests. This gives you full control, but you must manage your own data retention and deletion policies.

FAQ

Is Syncthing truly private?

Yes, because it uses end-to-end encryption and has no central server. However, your IP and device name are visible to peers.

Does Syncthing collect my data?

No. Optional telemetry is disabled by default. The open-source code can be audited.

Can I use Syncthing with Cryptomator?

Yes. Encrypt your files with Cryptomator before adding them to a Syncthing folder for extra security.