Getting Started

To get started, see the Installation section.

Who develops Nextcloud?

The development of the Nextcloud platform is a cooperative endeavor overseen by the core maintainers -- primarily employed by Nextcloud GmbH -- along with thousands of partners, providers, collaborators, project members, and community participants.

The Nextcloud community includes everyone -- from individual users and independent developers to large organizations.

Community members share and discuss their experiences with the platform every day. They suggest improvements, collaborate on design, write code, create documentation, test for bugs, triage bug reports and enhancement ideas, support others, improve translations, and help fund and organize the logistics of a project this size. Most importantly, they use Nextcloud in their daily lives and work.

GDPR compliance

Nextcloud is designed to be operated fully on-premises, keeping personal data under your organisation's control. This chapter provides guidance for administrators on meeting their obligations under the General Data Protection Regulation (GDPR).

提示

This documentation describes Nextcloud's built-in capabilities. It does not constitute legal advice. Consult your Data Protection Officer or legal counsel to confirm that your specific deployment meets your regulatory obligations.

Personal data stored

This page gives an overview of the categories of personal data that Nextcloud stores, to help you prepare your Records of Processing Activities (RoPA) and privacy notices as required under GDPR Article 30.

Account data

Every user account holds the following data:

Username — the unique identifier used to log in.
Display name — the name shown to other users.
Email address — used for notifications, password resets, and sharing invitations.
Password hash — stored using a one-way hash; the plaintext password is never stored.
Last login timestamp — the date and time of the user's most recent login.
Account creation timestamp — when the account was created.
Authentication tokens — long-lived tokens created for clients and app passwords.

Profile data

Nextcloud stores additional profile fields that users may populate:

Phone number
Address
Website URL
Fediverse handle, Bluesky handle
Biography
Profile picture (avatar)

Each field has a configurable scope that controls who can see it: private, local (visible to other users on the same instance), federated (shared with trusted federation partners), or published (shared with the public lookup server). Administrators can restrict or enforce these scopes server-wide. See Profiles for details.

Files and metadata

File contents — all files stored by users, including files in external storage mounts.
File metadata — filename, path, size, MIME type, creation time, modification time, and owner.
File share records — who has shared what with whom, including public share tokens and passwords.
Trash bin — deleted files and their original paths, retained according to the configured retention policy.
File versions — previous versions of modified files, retained according to the configured retention policy.

Activity and audit logs

Activity log — a per-user record of file and sharing events (uploads, downloads, shares, edits). Retained for the number of days configured via activity_expire_days (default: 365 days).
System audit log — if the admin_audit app is enabled, a server-wide log of administrative actions and login events is written to the Nextcloud log file.

Groupware data

When the groupware apps are enabled:

Contacts — vCards including names, email addresses, phone numbers, physical addresses, photos, and any other fields users add.
Calendar events — event titles, times, locations, descriptions, and attendee lists.
Tasks — task titles, descriptions, due dates, and completion status.

Talk (chat and calls)

When the Talk app is enabled:

Chat messages — text messages and reactions in one-to-one and group conversations.
Call metadata — call participants and timestamps (call recordings, if enabled, are stored as files in the initiating user's storage).
Conversation membership — which accounts belong to which conversations.

Server and web server logs

Personal data is also present in server logs, independent of what users intentionally store:

Web server access logs — your web server (Apache, nginx) records the IP address, timestamp, and URL of every request. IP addresses are personal data under GDPR.
Nextcloud application log — records errors, warnings, and (at higher log levels) user actions including IP addresses.
Brute-force protection list — Nextcloud temporarily stores the IP address of failed login attempts. These are deleted automatically after 24 hours or upon a successful login.

Storing logs indefinitely is not considered legitimate usage under GDPR. Rotate logs at a reasonable interval and consider encrypting them, as they contain personal data you are responsible for securing. See Data retention for guidance on log rotation.

Session data

Nextcloud stores the following data client-side as cookies (see Cookies for the full list) and server-side in the session store:

PHP session data — a random session identifier and an encrypted session passphrase.
Remember-me tokens — stored if the user selected "Remember me" at login. Lifetime is controlled by remember_login_cookie_lifetime (default: 15 days).

Data held by third-party services

Some optional features transmit personal data outside the server:

Public lookup server — profile fields with "Published" scope are sent to lookup.nextcloud.com (or a custom server configured via lookup_server) to enable cross-instance user discovery. This can be disabled by setting lookup_server to an empty string.
Push notifications — Talk and other apps may route notification payloads through Nextcloud's push notification proxy. The payload contains the account name and a notification message.
Federated sharing — when sharing files with users on other Nextcloud instances, the sharer's display name and email are transmitted to the remote server.

Responding to data subject requests

You must respond to subject access requests within one month. If a request is complex or you receive a high volume, you can extend this by a further two months, but you must inform the requester within the first month that an extension is needed and explain why. You cannot charge a fee for complying unless a request is manifestly unfounded or excessive.

Right of access (Article 15)

A user can view most of their own personal data directly in Nextcloud:

Profile and account info — Personal Settings → Personal Info.
Files — the Files app shows all stored files.
Activity log — the Activity app shows file and sharing events.
Sharing history — the Sharing section in Personal Settings.
Connected clients and app passwords — Personal Settings → Security.

As an administrator you can retrieve a summary of an account's metadata using:

sudo -E -u www-data php occ user:info <uid>

This outputs display name, email, last login, quota, groups, and backend.

Right to erasure (Article 17)

To permanently delete a user account and all associated data:

sudo -E -u www-data php occ user:delete <uid>

This removes the account, all files owned by the user, their profile data, authentication tokens, and groupware data (contacts, calendars).

注意

Comments must be deleted manually before running user:delete. File comments and Talk messages are stored in oc_comments and oc_comments_read_markers. These are not removed by user:delete and will be left attributed to "unknown/anonymous user" if not cleaned up first. Run these SQL queries before deleting the account:
DELETE FROM oc_comments
  WHERE actor_type = 'users' AND actor_id = '$USERID';

DELETE FROM oc_comments_read_markers
  WHERE user_id = '$USERID';
Replace $USERID with the account's username. To find all comment types on your instance (file comments, Talk, etc.) run:
SELECT DISTINCT object_type FROM oc_comments;

提示

What else is not automatically removed:

Files the user has shared with others remain accessible to recipients until the recipient or an administrator deletes them.

Federated shares the user accepted from other instances are held on those remote servers and must be removed there separately.

Entries in the system audit log (admin_audit) are retained as they form part of the administrative record. Consult your legal team on the appropriate retention period for audit logs.

Chat messages in Talk conversations are retained in the conversation history. Use the Talk admin panel to delete individual conversations if needed.

Data in backups — see Data retention for guidance.

Before deleting the account you may want to transfer file ownership to another user so that shared files remain available:

sudo -E -u www-data php occ files:transfer-ownership <uid> <destination-uid>

Right to data portability (Article 20)

Users can export their own data directly from Nextcloud:

Files — downloadable as a ZIP from the Files app, or accessible in full via WebDAV at https://<your-server>/remote.php/dav/files/<uid>/.
Contacts — exportable as a .vcf file from the Contacts app (select all → Export).
Calendar — exportable as an .ics file from the Calendar app (Calendar settings → Export).
Personal data export — users can request a full data export in Personal Settings → Personal Info → scroll to the bottom → Download your data. This produces a ZIP archive containing files, contacts, and calendar data.

As an administrator you can export a user's calendar from the command line:

sudo -E -u www-data php occ dav:export-calendar <uid> <calendar-name> <output-file>

Right to rectification (Article 16)

Users can correct their own profile data in Personal Settings → Personal Info. Administrators can update display name, email, and other profile fields using:

sudo -E -u www-data php occ user:setting <uid> settings email <new-email>
sudo -E -u www-data php occ user:setting <uid> settings displayname <new-name>

For fields stored in a connected LDAP or SAML directory, corrections must be made in the upstream directory rather than in Nextcloud.

Right to restriction of processing (Article 18)

To suspend processing without deleting an account, disable it:

sudo -E -u www-data php occ user:disable <uid>

A disabled account cannot log in and no background jobs run for it. The account and all its data remain intact and can be re-enabled at any time:

sudo -E -u www-data php occ user:enable <uid>

Data retention

Nextcloud retains several categories of data beyond the point when a user considers them "deleted." This page describes the configurable retention periods and how to align them with your data minimisation obligations under GDPR Article 5(1)(e).

All settings below are configured in config/config.php. See Configuration Parameters for the full parameter reference.

Trash bin

When a user deletes a file it moves to the trash bin. The retention policy is controlled by trashbin_retention_obligation:

'trashbin_retention_obligation' => 'auto',

Available values:

auto (default) — keep deleted files for at least 30 days; remove sooner if the user is running low on quota.
D1, auto — keep for at least D1 days; remove sooner if quota is low.
auto, D2 — remove sooner if quota is low; guarantee deletion after D2 days regardless.
D1, D2 — keep for at least D1 days; guarantee deletion after D2 days.
disabled — never automatically empty the trash bin.

For GDPR purposes, disabled means deleted files are retained indefinitely — avoid it unless you have a specific reason. Setting a firm maximum (e.g. '30, 60') gives users a predictable deletion guarantee.

Users with the appropriate permissions can empty their own trash bin at any time from the Files app, or an administrator can run:

sudo -E -u www-data php occ trashbin:cleanup <uid>

To expire files across all users according to the current policy:

sudo -E -u www-data php occ trashbin:expire

File versions

The Versions app stores previous copies of modified files. Retention is controlled by versions_retention_obligation:

'versions_retention_obligation' => 'auto',

Available values:

auto (default) — versions are pruned according to a built-in schedule (more versions kept for recent changes, fewer for older ones). See Controlling file versions and aging.
D, auto — keep versions for at least D days, then apply the automatic schedule.
auto, D — apply the automatic schedule; guarantee deletion after D days.
D1, D2 — keep for at least D1 days; guarantee deletion after D2 days.
disabled — never automatically remove versions.

To remove versions immediately:

sudo -E -u www-data php occ versions:cleanup <uid>
sudo -E -u www-data php occ versions:expire <uid>

Activity log

The activity log records file and sharing events per user. Entries older than the configured number of days are deleted by the daily cron job:

'activity_expire_days' => 365,

Set this to a lower value to reduce the personal data footprint. Setting it to 0 disables automatic expiry (entries are kept indefinitely).

提示

The activity log is distinct from the system audit log produced by the admin_audit app. Audit log retention is controlled by your log rotation configuration, not by this setting.

Remember-me tokens

When users select "Remember me" at login, Nextcloud stores a long-lived authentication cookie. Its lifetime is controlled by:

'remember_login_cookie_lifetime' => 60 * 60 * 24 * 15,

The default is 15 days. Reducing this value means users must re-authenticate more frequently but limits the exposure window for stolen tokens.

Session lifetime

Active sessions expire when the browser is closed (session cookies). There is no server-side session expiry setting in core; sessions are invalidated when the user logs out or an administrator revokes them via:

sudo -E -u www-data php occ user:auth-tokens:delete <uid>

Server and web server logs

Web server access logs and the Nextcloud application log contain IP addresses and other personal data. Storing them indefinitely is not considered legitimate usage under GDPR. Rotate logs regularly and encrypt archived logs to protect the personal data they contain.

A minimal logrotate configuration that rotates daily and keeps logs for a limited period:

/var/log/nextcloud/*.log {
    daily
    rotate 90
    compress
    shred
    missingok
    notifempty
}

Adjust the rotate value to match your legal obligations and security requirements. If you are legally required to retain logs for a specific period (e.g. for compliance with national cybersecurity laws), that overrides the minimisation principle — but you must disclose the retention period in your privacy policy.

提示

Nextcloud's brute-force protection stores IP addresses of failed logins, but these are automatically deleted after 24 hours or upon a successful login and do not require manual management.

Backups

When you fulfil a right-to-erasure request by deleting an account, the data also exists in any backups you hold. GDPR's right to erasure extends to backup copies unless retaining them is required by law or necessary for legal defence.

Practical approaches:

Time-limited backups — set a backup retention policy (e.g. 90 days) so that personal data is eventually purged from backups automatically, even if you cannot remove it on demand.
Isolated backups — ensure backups can never be restored to a live production instance without a deliberate recovery procedure, so that deleted data cannot accidentally reappear.
Encrypted backups — encrypt backup media so that the data cannot be read if the media is lost or transferred.

提示

Removing a specific user's data from an existing backup is technically complex (often impractical for tape or snapshot-based backups) and may require rethinking your backup strategy if you are subject to frequent erasure requests at scale.

Summary table

Data category	Config key	Default retention	Minimum recommended
Trash bin	`trashbin_retention_obligation`	30 days (auto)	Set a firm maximum (e.g. `auto, 60`)
File versions	`versions_retention_obligation`	auto schedule	Set a firm maximum (e.g. `auto, 180`)
Activity log	`activity_expire_days`	365 days	90–180 days
Remember-me tokens	`remember_login_cookie_lifetime`	15 days	7–15 days

Helpful apps

Several apps are available from the Nextcloud App Store to help you meet specific GDPR obligations.

Imprint (Theming app)

The right to be informed (GDPR Article 13/14) requires you to make your privacy policy accessible to users. The built-in Theming app includes an Imprint feature that lets you add links to your imprint and privacy policy on the Nextcloud login screen and in the footer.

To configure it:

Go to Administration Settings → Theming.
Fill in the Imprint URL and Privacy policy URL fields.
Save. The links appear on the login page and in the web interface footer.

This ensures all users — including those accessing public share links — can find your privacy policy without needing to be logged in.

Drop Account app

The Drop Account app allows users to delete their own Nextcloud account directly from Personal Settings, without needing to contact an administrator.

Install it from the Apps page or via occ:

sudo -E -u www-data php occ app:install drop_account

Once installed, users see a Delete account button in Personal Settings → Personal Info. They must confirm their password before the deletion proceeds.

注意

Account deletion via this app also removes all of the user's files. Make sure users are aware of this before they proceed. Consider adding a note in your privacy policy explaining what is and is not removed (see Responding to data subject requests for the full list of what user:delete does and does not clean up, including the comments tables which require manual cleanup).

Data Request app

The Data Request app gives users a self-service way to invoke their GDPR rights directly from their Personal Settings, without needing to contact an administrator by email or through an external channel.

Once installed, two buttons appear in every user's Personal Settings → Personal Info page:

Request data export — sends an email to all administrators notifying them that the user is requesting a copy of their data.
Request account deletion — sends an email to all administrators notifying them that the user wants their account deleted.

Both actions require the user to confirm their password and are rate-limited to one request per action per hour.

The app is a notification bridge only. It does not perform the export or deletion automatically — administrators must act on each request manually using the steps described in Responding to data subject requests.

提示

Administrators receive the notification at the email address configured for their account. Make sure all administrator accounts have a valid email address set, otherwise notifications will be silently dropped.

Install it from the Apps page or via occ:

sudo -E -u www-data php occ app:install data_request

No further configuration is required after installation.

Handling incoming requests

When a request email arrives:

For a data export request:

Export the user's files via WebDAV, or ask the user to use the Download your data button in their Personal Settings.
Export contacts and calendars from the Contacts and Calendar apps, or use occ dav:export-calendar.
Deliver the exported data to the user securely.

For an account deletion request:

Optionally transfer file ownership before deleting:

sudo -E -u www-data php occ files:transfer-ownership <uid> <new-owner>

Delete the account:

sudo -E -u www-data php occ user:delete <uid>

See Responding to data subject requests for full details on what each operation removes and what data may remain after deletion.

Cookies

Nextcloud only stores cookies that are necessary for it to function. All cookies are set by your Nextcloud server directly — no third-party cookies are involved.

提示

The __Host- prefix is applied to the same-site cookies only when Nextcloud is accessed over HTTPS. On plain HTTP the prefix is omitted and the cookies are named nc_sameSiteCookiestrict and nc_sameSiteCookielax.

Cookies stored by Nextcloud

Type	Name	Purpose	Personal data	Lifetime
Session cookie	`<instance_id>`	Carries a random PHP session ID used to identify the user's session on the server.	No	Until browser is closed.
Session cookie	`oc_sessionPassphrase`	Carries a random token used to decrypt the session data stored on the server.	No	Until browser is closed.
Same-site cookie	`__Host-nc_sameSiteCookiestrict`	Used to detect whether a request originates from the same site (`SameSite=Strict`). Helps prevent CSRF attacks. Contains no user information.	No	Expires 2100-12-31 (effectively permanent).
Same-site cookie	`__Host-nc_sameSiteCookielax`	Used to detect cross-site navigation requests (`SameSite=Lax`). Helps prevent CSRF attacks. Contains no user information.	No	Expires 2100-12-31 (effectively permanent).
Remember-me cookie	`nc_username`	Stores the user's login name to enable persistent login across browser sessions.	Yes — contains the username.	Defaults to 15 days. Configurable via `remember_login_cookie_lifetime`.
Remember-me cookie	`nc_token`	A random token paired with `nc_username` to authenticate the persistent login without storing the password.	No	Same as `nc_username`.
Remember-me cookie	`nc_session_id`	The original session ID, retained to allow session continuity when the remember-me token is used.	No	Same as `nc_username`.
Download helper	`ocDownloadStarted`	A short-lived random token set when a file download begins, used to signal the browser that the download has started (e.g. to hide a loading indicator).	No	20 seconds.

Remember-me cookies

The remember-me cookies (nc_username, nc_token, nc_session_id) are only set when the user explicitly selects Remember me at login. They are cleared immediately when the user logs out.

Because nc_username contains the user's login name, it is personal data under GDPR. The legal basis for storing it is typically legitimate interest or contract performance (enabling the service the user has requested), provided the user has been informed of this in your privacy policy.

The lifetime defaults to 15 days and can be shortened in config/config.php:

'remember_login_cookie_lifetime' => 60 * 60 * 24 * 15,

Declarations

Energy consumption

Energy consumption

The Nextcloud server is certified under the Blue Angel for Software DE-UZ 215.

This page contains the typical energy consumption according to the Standard Usage Scenarios used in the certification.

Initial Certification 2024/2025

Download Report 2024/2025

Certification Extension 2025/2026

Download Report 2025/2026

Getting Started

Introduction

Target Audience

Core Components

Editions

Further Resources

Getting Started

GDPR compliance

Personal data stored

Account data

Profile data

Files and metadata

Activity and audit logs

Groupware data

Talk (chat and calls)

Server and web server logs

Session data

Data held by third-party services

Responding to data subject requests

Right of access (Article 15)

Right to erasure (Article 17)

Right to data portability (Article 20)

Right to rectification (Article 16)

Right to restriction of processing (Article 18)

Data retention

Trash bin

File versions

Activity log

Remember-me tokens

Session lifetime

Server and web server logs

Backups

Summary table

Helpful apps

Imprint (Theming app)

Drop Account app

Data Request app

Cookies

Cookies stored by Nextcloud

Remember-me cookies

Declarations

Energy consumption

Initial Certification 2024/2025

Certification Extension 2025/2026