Your NAS, on WhatsApp
Rtorrent 16 can tell you what it finished, what broke and when a certificate arrived — as a WhatsApp message from one shared bot number, +48 690 760 663. You pair once with a code. Nothing is installed for it, and the bot never writes to anyone who did not ask it to.
Pair it in a minute
- In the Rtorrent 16 panel open Notifications. The WhatsApp card is at the top.
- Press Get a pairing code. You get something like
G34S-JT6R, a link and a QR code. - On the phone, tap the link (or scan the QR) and send the message it prepares:
START G34S-JT6R. - The card turns to paired by itself. Press Send a test message to see one arrive.
Why a code, not your number You type your number nowhere. Your own message is what tells the service which number to use, which is also what WhatsApp requires before a business may write to you.
What you can send back
| Message | What happens |
|---|---|
STOP | Delivery to your number stops at once. Nothing else is needed. |
START | Switches it back on. |
START <code> | Links another NAS (or this one again) to the same number. |
HELP | Lists what this number is linked to, and these commands. |
Security: what the NAS holds, and what it cannot do
The bot's Meta credentials live on this server and never leave it. Your NAS is given a token of its own, and that token is deliberately weak on purpose:
- One random token per NAS (32 hex characters), written to
etc/wa-cloud.jsonon that NAS. It is created by the service when you press the button; you never copy or paste it. - A token can do exactly two things: ask for a new pairing code, and post a notification to the number that paired with that token. It cannot name a recipient, so a stolen token cannot message anyone else, and it cannot read anything back beyond that NAS's own delivery log.
- No Meta credentials on any NAS. The access token, the phone-number ID and the app secret exist only here. A package that is unpacked, decompiled or shared contains none of them.
- Unlink deletes it. Press Unlink the number in the panel (or ask us) and the token, the number and that NAS's events are removed from the database. A fresh token is a fresh pairing.
- Limits. 30 messages per NAS per day, which is also what keeps the shared number's standing good.
So yes — the package can be handed to anyone. Every install pairs itself, holds only its own token, and one person's misuse of it can only reach that person's own phone.
Let the whole NAS use it, not just Rtorrent 16
QTS can send its own warnings — a failing disk, a degraded RAID, a firmware update — through any SMS provider. Point it at this service and those warnings arrive on WhatsApp too.
Control Panel → Notification Center → Service Account and Device Pairing → SMS → Add SMSC service → Custom, then paste the URL template the panel shows you under Notifications → WhatsApp. It looks like this, with your NAS's own token:
https://pub.qnaputilities.com/rtorrent16/wa/api/smsc.php?token=<your token>&phone=@@PhoneNumber@@&text=@@Text@@
QTS insists on a phone number in that form; it is ignored. The token decides who receives the message, so no number typed there can reach anybody else.
What is stored
Your WhatsApp number, your NAS's token and name, the last events it sent, and the delivery status WhatsApp returns. Nothing else — no torrent contents, no file lists beyond what the event text itself carries. Events older than 30 days are deleted. The privacy policy says it in full.
The other way: your own bot
If you would rather not share a number at all, the rtorrent16-whatsapp add-on pairs with
your own WhatsApp account by QR, like WhatsApp Web, and answers commands from your phone
(status, list, add, pause). No shared bot, no Meta account,
and nothing about it passes through this server.