Plex bumped Remote Watch Pass from $1.99 to $2.99/mo on June 1, 2026 (50% jump), on top of the 2025 lifetime-pass move from $120 to $250 and the Discover Together opt-out fiasco. The wave of users actually trying to leave is the largest in Plex's history. Existing migration tools (PlexToJellyfin, JellyPlex-Watched, watchstate) sync watched state and that's it. Demand is for a one-installer tool that ALSO migrates per-user libraries (managed users), share permissions to friends/family, playlist structure, and 'continue watching' position offsets, plus generates the Jellyfin user accounts in the same flow.
builder note Time-box to ship before June 1. The marketing is the news cycle, not the product. Free download with an optional $19 'one-time concierge' Discord support upsell, no SaaS. People migrating from Plex to escape a subscription will not pay you a subscription.
landscape (4 existing solutions)
Watched-state migration is solved. The full-fidelity household migration (users, shares, playlists, libraries, continue-watching) is not. With the June 1 price hike landing, this is a 60-day window.
JellyPlex-Watched Watched-state sync only. No per-user library migration. No share-permission migration. Requires a Python toolchain to operate. watchstate Same gap as JellyPlex-Watched: state sync, not user/share/library/playlist migration. Trakt as a hop point Workable but adds an account, doesn't preserve granular per-user offsets, and gets stale on TV-show season metadata mismatches. sources (4)
plexjellyfinmigrationmedia-serveranti-subscription
YouTube Kids' channel-allowlist feature is gone or buried in 2026, and parents who want 'my 7-year-old can watch only these 14 channels, no shorts, no autoplay, no recommendations' end up paying $3.99/mo for browser-extension-shaped solutions like WhitelistVideo, which still proxy through YouTube and harvest watch data. The real ask: a household-server appliance (or a Pi image) that downloads the allowlisted channels nightly via yt-dlp and serves them as a local Plex/Jellyfin-style channel-grid that reads as a TV experience to a kid, with parent overrides via phone.
builder note Sell it as a $99 box with a tablet UI on the home Wi-Fi, not as a Pi image. Parents do not want to assemble. The bigger trap is licensing: 'we download YouTube videos on your behalf' is a copyright thicket. Frame it as a personal-use TiVo-shaped offline-cache, not a redistribution service, and put the burden of 'allowed channels' on the parent.
landscape (3 existing solutions)
Online allowlist tools all proxy through YouTube and feed Google data. Local-first allowlist setups (yt-dlp + Jellyfin) work, but the homelab assembly cost is too high for the parent who just wants a tablet experience.
WhitelistVideo Browser extension and apps that proxy through YouTube. Free tier limited; paid $3.99+/mo. Watches still flow through Google/YouTube. Parent has no offline option. sources (3)
parentingkidsyoutubelocal-firstprivacy
Cross-platform households (one parent on iPhone, kids on Android tablets, school Chromebook in the mix, Switch and Fire TV on the wifi) cannot use Apple Screen Time and Google Family Link together — the two ecosystems don't talk, and Family Link doesn't even run on parents' iPhones with feature parity. Third-party tools like Qustodio and Boomerang work but are $50-100/year subscriptions that ship traffic through their cloud. Demand is for a Pi-Hole-shaped router-or-NAS appliance that does household-wide DNS filtering, per-device screen-time windows, app-category blocking through DNS, and a parent-phone app that does NOT route through a vendor cloud.
builder note The win is the time-window and per-device reporting overlay on top of DNS. Pi-Hole already does the blocking; nobody has shipped 'kid devices off the wifi between 9pm and 7am, console games allowed Saturday only, parent gets a Slack-able Friday digest.' Don't market it on privacy first... market it on 'Family Link broke for the third time this month' and let privacy be the bonus.
landscape (4 existing solutions)
Big Tech tools are walled-garden-only; cross-platform paid tools are surveillance-shaped. A local-first appliance that works on every device on the wifi (consoles, TVs, tablets, school Chromebook) by living at the network layer, with a non-cloud admin app, is a real gap.
Apple Screen Time Apple-only. Multi-guardian still half-broken. Parent-on-Android cannot meaningfully manage a kid-on-iPhone. Google Family Link Android-only on the kid side; iPhone parent has degraded controls; Chromebook has separate quirks. No coverage for game consoles or smart TVs. Pi-Hole + NextDNS DNS-level blocking only. No per-device time windows, no app-level reporting, no parent-friendly UI for sniff-test of a kid's day. sources (3)
parental-controlfamilyprivacylocal-firstdns
Strava has been getting picked apart in 2026 for hoovering 21 categories of data (most not needed to run the app), and journalists keep using its heatmap data to track government officials. Privacy-conscious athletes who still want the social parts (kudos, club leaderboards, route-sharing with friends) are stuck choosing between Strava-the-spy and FitNotes-style local-only solo tools. The gap is a Strava-style social tracker where the social graph is end-to-end encrypted between the people you actually invite, no public heatmap, no firehose for advertisers.
builder note The hard problem is route privacy, not auth. Even if your friend list is E2E, a route polyline starting at your house doxxes you. Build in fuzzing the start/end of every route by N meters by default, and make 'share full polyline' an explicit per-friend choice. That's the differentiator that justifies a switch.
landscape (4 existing solutions)
Either fully local and asocial, or hosted and surveilled. The 'private-by-architecture social fitness app' is a real product hole, and federation/Matrix-shaped solutions haven't been tried in this niche.
FitNotes Strictly local, single-user. No clubs, no kudos, no shared rides. Solves privacy by removing the social graph entirely. Wandrer.earth Niche (gamified road-coverage) and depends on syncing FROM Strava. Doesn't replace Strava socially. BikeCompanion Cycling-only, social features private by default but it's still a hosted service with a single vendor controlling the social graph. sources (3)
fitnessprivacylocal-firstsocialstrava-alternative
Plex's Discover Together (rolled out late 2025) defaulted users to sharing their watch history with their 'Plex friends' via weekly emails. The r/selfhosted thread hit 1.7k upvotes and became the canonical example of 'self-hosted does not mean privacy-respecting, it just means you own the box.' Demand is for a tool that scans a self-hosted app's first-run config (Plex, Immich, Jellyfin, Nextcloud, etc.) and flags every default that opt-outs to a more public state, plus monitors changes to those defaults across upgrades and yells when an upgrade re-flips a switch.
builder note Start as a CLI that ships a YAML rule pack per popular self-hosted app, scans the running config, and tells you which switches are 'leaky'. Donate the rule packs to selfh.st. Monetize the auto-monitor-and-alert SaaS that watches your stack across upgrades. Don't try to be Wiz; try to be a homelab nag.
landscape (3 existing solutions)
The space is editorial (Privacy Guides) and security-oriented (OWASP). Nobody is shipping a runtime privacy-defaults linter for self-hosted apps.
OWASP ASVS / app config scanners Security oriented, not privacy-defaults oriented. They check whether TLS is enforced, not whether 'share watch history with friends' defaults to true. sources (3)
privacyself-hostedauditcomplianceplex
Discord's facial-age-verification rollout (postponed to H2 2026 after backlash but coming) is driving knitting circles, church groups, school PTAs, and indie game communities to look for a way out. The existing self-hosted candidates (Element/Matrix, Stoat, Fluxer, Mumble) each fail the same audience: they assume the operator will install Docker, configure a TURN server, and explain to grandma what a homeserver is. Demand is for a Stoat-or-Fluxer-class product packaged as a 5-minute hosted-or-self-host install where the community admin clicks 'invite link' and the pastor can join without a 12-step tutorial.
builder note Don't pitch this to redditors who already love Matrix. Pitch it to the church youth-group admin who currently runs a Discord they hate. Win on 'invite link works on grandma's iPhone' first... federation can wait.
landscape (4 existing solutions)
The self-hosted-Discord race is at the same place self-hosted-Slack-replacements were in 2018: technically viable, narratively stuck. The polished managed-or-self-host hybrid for non-tech admins is wide open.
Element / Matrix Notifications are still inconsistent in 2026; voice-chat UX is hit-or-miss; setting up a self-hosted Synapse/Conduit and federation is a homelab-only experience. Stoat Self-hosted repo 'still heavily under construction' as of April 2026; auth doesn't share with main Stoat. Voice basic. No managed-host story. Fluxer Cleanest docs of the bunch, voice channels feel Discord-like, but federation and mobile push are immature, and there's no SaaS option for non-DevOps community admins. Revolt Closest to Discord polish but the self-hosted path is a Rust-stack pile, not a one-button install. sources (3)
chatself-hosteddiscord-alternativecommunitiesprivacy
Reddit confirmed paywalled subreddits are coming this year (CEO Steve Huffman, late 2025) and admins keep tightening API and search access. Self-hosters who use bookmark-everything tools (Karakeep, Linkwarden, Wallabag) are running into the same wall: snapshotting a Reddit thread today returns 'just a small blurb' or an empty shell because Reddit's mobile-web layout strips comment trees behind a 'see more' button. Demand is for a self-hosted archiver that uses a real-browser engine (Playwright/Chromium) plus Reddit-specific tree expansion, captures the full comment tree to a single static HTML, and can replay archived threads when the original goes paywall-locked or 404.
builder note The unsexy play is being a Karakeep plugin, not a competing app. Ship a 'site adapter pack' (Reddit, Twitter, Substack, Hacker News) that drops into Karakeep/Linkwarden via their plugin or sidecar API. Adapter packs as a recurring product. Open-source the engine, charge for the maintained adapter set as a $3/mo signal that pays for the headless-Chromium upkeep.
landscape (4 existing solutions)
Generic web archiving tools are getting outflanked by site-specific anti-archiving techniques (Reddit's lazy-loaded comments, Twitter's auth-walling, Substack's truncation). A self-hostable archiver with site-specific extractors is a legitimate product gap.
Karakeep Uses monolith for snapshots which works on most pages, but Reddit's tree-collapsing JS defeats it. Open issue #739 has been parked since early April 2026. ArchiveBox Pumps URLs through wget + chromium + youtube-dl. Reddit threads frequently come back as login-walled landing pages or empty bodies. No Reddit-specific extraction. Linkwarden Same root cause: generic page snapshot. No comment-tree expansion. No deduplication if a thread gets re-archived after edits. archive.today / Wayback Hosted, not self-hosted. Wayback skips JS-rendered content; archive.today rate-limits hard and is a single point of failure. sources (3)
self-hostedarchivingredditbookmarksanti-paywall
The two leaders in self-hosted photo backup split the market wrong... Immich has the polished mobile app and ML face/object search, but stores files unencrypted on the server. Ente has zero-knowledge E2E encryption, but the self-hosted variant is rough and the ML features depend on Ente's infra. Self-hosters want both: 'I want my server compromised and the attacker still can't see my kids' photos, AND I want the daily-backup UX of Immich.' This is the loudest unmet ask in 2026 photo-backup discussions.
builder note The non-obvious play is client-side indexing + encrypted index sync to server, so search 'just works' across devices without the server ever seeing pixels. Trying to do server-side ML on encrypted data is a research project. Don't compete on ML quality, compete on 'your photos cannot be exfiltrated even if I'm pwned.'
landscape (3 existing solutions)
It is a true polarity: encryption OR mobile UX, never both. Server-side ML on encrypted blobs is hard but no longer impossible (homomorphic search, client-side index sync). No project is shipping it.
Immich Server reads plaintext to do ML. No E2E mode. Encryption-at-rest is the user's problem (LUKS, ZFS native encryption, etc.) and dies the moment Immich is decrypted to serve. Ente Photos (self-hosted) E2E is real, but the self-host story is meaningfully behind Immich on mobile UX, daily-backup reliability, and album-sharing flow. ML happens locally on the client which is power-hungry. PhotoPrism No E2E. Strongest as an organizer for an existing archive, weakest as a daily mobile backup. sources (3)
self-hostedphotose2e-encryptionprivacymobile
BookLore's solo maintainer ACX got caught merging 20,000-line AI-slop PRs, banned community members who flagged it, then nuked the GitHub, Discord, and website overnight in March-April 2026. The community refloated as Grimmory, but every self-hoster running selfh.st-popular apps now has the same nervous question: 'how do I tell, before I deploy this, whether it's a one-person time bomb?' Demand is for a continuously-updated health score per self-hosted project (bus factor, AI-PR ratio, license stability, fork-readiness, last-90-days incident log). Think Snyk for trust, not vulnerabilities.
builder note The trap is trying to be a security scanner. The win is the soft signal... PR turn-around variance, contributor count trend, the ratio of AI-shaped PRs, plus a public 'maintainer-banned-a-contributor' incident log scraped from GitHub blocks/issue locks. Sell to the homelab+selfh.st audience, not enterprises (Snyk owns that).
landscape (3 existing solutions)
Existing tools score security and license, not governance and bus-factor. The actual question self-hosters ask before adoption ('is this a one-person project that's about to nuke itself?') has no public signal.
OpenSSF Scorecard Aimed at supply-chain security signals (signed releases, branch protection, SAST). Doesn't model 'maintainer hostility,' AI-slop ratio, or 'this person bans contributors who critique their PR'. selfh.st Curated weekly newsletter and app catalog, but it's editorial. No score, no per-project history, no alert when a previously-good project goes off the rails. sources (4)
self-hostedopen-sourcegovernancetrustsupply-chain
Apartment dwellers and anyone behind CGNAT (most US cellular ISPs, T-Mobile Home Internet, many fiber muni-builds) cannot expose a homelab service to the internet without renting a VPS and hand-rolling a WireGuard tunnel. Demand is for a $5-15/mo managed ingress: bring your own domain, point a single CNAME, get TLS, get a public IPv4 endpoint that backhauls to a tiny home agent. Pangolin solves this for self-hosters willing to run their own VPS, but the non-DevOps majority still falls off the cliff at 'rent a Hetzner CX22 and configure WireGuard'.
builder note The gap isn't the tech (it's WireGuard plus Caddy), it's the boring billing-and-support business. Sell it as 'one CNAME and a tiny home daemon' priced like PikaPods-for-ingress. Don't try to compete with Cloudflare on price... compete on 'no Cloudflare ToS surprises and your TLS isn't theirs.'
landscape (4 existing solutions)
Every existing option asks the user to either run a VPS, accept a vendor-locked subdomain, or pay per-GB. A managed ingress that owns the VPS and the WireGuard config but lets you bring your own domain is a real product hole.
Pangolin You still have to rent and provision the VPS yourself, install the binary, point DNS, manage SSL renewal. Excellent for self-hosters, an absolute brick wall for the audience that just wants the tunnel. Cloudflare Tunnel Free and turnkey, but ToS prohibits media streaming and large file transfer (the actual reason most homelabbers want ingress). Also, every TLS session terminates at Cloudflare. Tailscale Funnel No custom domains; you get a *.ts.net hostname. Repeated complaint that custom-domain support has been 'coming soon' for years. ngrok / LocalXpose Bandwidth-throttled at the price points self-hosters tolerate; ngrok caps the free tier at 1GB/mo and Personal at 5GB/mo with $0.10/GB overage. sources (3)
self-hostedcgnatnetworkinghomelabwireguard