I would assume it’s based on TURN or STUN, since you don’t need to log in. What makes it suspicious?

Edit: I did some reading on their blog, and they only mention something like STUN and specifically say it’s only for connection, not for relaying, so I don’t think they use TURN. In that case, the camera is streaming video directly to your phone, so it sounds like it’s not ever passing through a ReoLink server. The benefit to ReoLink is they only have to run a STUN server, which is incredibly cheap (bandwidth wise), and the benefit to you is that the video never goes through anyone else’s server. The drawback is if you have a really restrictive firewall, or some funky address translation, you might not be able to establish a connection.