Here's a myth that trips up almost every new self-hoster: "If I host it myself, my data is private."

Private from Google, maybe. But most self-hosted apps are pack rats. They keep every search, every deleted note, every login timestamp — forever. Nobody outside sees it. But it's still a growing pile waiting for the day your server gets stolen, backed up to the wrong place, or handed to a family member.

Privacy isn't just about who sees your data. It's about how little of it exists at all.

The hoarding you never notice

Run a few of these and check for yourself:

  • Nextcloud keeps deleted files in a trash bin and old versions of every file — sometimes for months.
  • Vaultwarden logs every login event and keeps them by default.
  • Immich (photos) keeps deleted images in a recycle bin, not gone.
  • Home Assistant records every sensor reading — including when you're home — for 10 days out of the box.
  • Pi-hole logs every single DNS query your whole house makes.

None of this leaves your network. But it's a diary you didn't mean to write.

Fix it in three moves

1. Shrink the trash window. In Nextcloud, open your config.php and set:

'trashbin_retention_obligation' => 'auto, 7',
'versions_retention_obligation' => 'auto, 14',

That clears deleted files after a week and old versions after two.

2. Cut logging you don't need. In Home Assistant's configuration.yaml, tighten how long history sticks around:

recorder:
  purge_keep_days: 3

Three days is plenty to spot a problem. You don't need a permanent record of your bathroom light.

3. Turn off DNS query logging when you're not debugging. In Pi-hole, go to Settings → Privacy and pick Anonymous mode or Hide domains. Your ad-blocking still works. It just stops writing down every site everyone visits.

Why this beats "just encrypt it"

Encryption protects data at rest. Great. But encrypted data you never needed is still a liability the moment it's decrypted — during a backup restore, a shared screen, or a curious teenager on the family server.

Data that doesn't exist can't leak. That's the whole game.

The one thing to check tonight

Pick your most-used self-hosted app. Find its "trash," "history," or "logs" setting. Ask one question: do I actually need this going back this far?

If the answer is no, shorten it. You'll be surprised how much invisible history you've been keeping — and how good it feels to make your own server forget.