Privacy policy

BluConnect lets you control the smart devices in your home from a single app. This policy explains what data we process and why, where we store it, and your rights under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the GDPR. Questions: contact@bluconnect.app.

Data we process

• Account: email address, your name (if Apple/Google sign-in provides it), sign-in method.
• Home configuration: home and room names, names you give your devices, favorites, routines, home members and invitations, and the approximate location and time zone of the home for sunrise/sunset routines (only if you enter them).
• Linked accounts: authorization keys (access/refresh tokens) for accessing manufacturer clouds. They are stored in an encrypted vault (Supabase Vault); the phone only ever receives a short-lived access key.
• Device summary: the type, brand, model and connection method of the devices in your home. This is used to measure which devices are supported and used most; device states, usage history, camera images and audio recordings are not collected.
• Installation info: a random identifier the app generates on first launch, platform (iOS/Android), app and operating system version, phone model. No advertising identifier is used.
• Error reports: when the app crashes or a device connection fails, the type of error, the brand and device model involved, app and operating system version, and installation identifier. Messages are stripped of information such as IP/MAC addresses, email addresses and keys before they are sent; device names, room names and device values are not sent. Used only to find and fix errors.
• Usage statistics: daily counts of which app features are used and how often — for example the sign-in method, whether a brand could be connected, whether commands succeeded and whether they went over the local network or the cloud, and use of scenes, Siri and remotes — together with the brand involved and the installation identifier. Device names, room names, device states and location are not sent; daily totals are sent, not individual actions. Records tied to an installation are deleted after 90 days. Used to improve the app and to find problematic integrations.
• Subscription: the product, status and expiry date of your BluConnect Plus subscription and the store's transaction identifier (verified with the App Store / Google Play). Your card and payment details stay with Apple or Google only; they never reach us.
• Notifications: the Apple/Google notification token, used to deliver routine notifications.
• Feedback and contact: the message you write, your email address, if you choose, the name/brand/model of the device concerned, and the app/phone version. On the website form, an irreversible hash of the IP address is kept to limit abuse; the IP address itself is not stored.

Website and cookies

www.bluconnect.app uses Google Analytics 4 to measure visits anonymously. Analytics cookies are set only if you give consent in the cookie banner; without consent, Google receives cookieless, identifier-free count pings. Advertising and personalization permissions are always off. You can change your choice at any time via the "Cookie settings" link at the bottom of the page. What you write in the contact form is used only to reply to you. Google Analytics is not used in the app.

Passwords

Wherever possible, manufacturer accounts are connected through the manufacturer's own sign-in page. For brands that ask for a password, the password is passed to the manufacturer only at sign-in; it is not stored on our servers and is not logged. The only exception is the Arçelik/Beko/Grundig (HomeWhiz) account, which provides no refresh key, so the session has to be renewed with the password: the password is kept in the keychain of the phone you connected it from (not backed up) and, so that your routines keep running while the phone is off, encrypted only on your Home Hub if your home has one, or otherwise in the encrypted vault on our server (Supabase Vault). The password is never sent back to phones and is not logged; when you disconnect the account, all copies are deleted. The Ariston NET account has no refresh key either (the session expires after about 5 days), so its password is kept only in the keychain / secure storage of the phone you connected it from (not backed up, never sent to our servers) and is deleted when you remove the account. For local devices: AVM FRITZ!Box provides no long-lived key, so its user name and password are kept in your phone's secure storage (Keychain/Keystore), in your account's encrypted backup (Supabase Vault) like other local pairings so the other phones in your home can use it without pairing again, and on your own Home Hub if you have one; they are deleted when you delete your account; the Bosch Smart Home system password is used only once during pairing and is not stored.

Local network

Devices with a local protocol are controlled directly from your phone or from the Home Hub in your home; this traffic does not pass through our servers. Local pairing keys (including Matter network keys) are kept on your phone and (if you use one) on your Home Hub; they are saved encrypted to your account so they can be shared among your home members, and are not given to members with guest access. Bluetooth device records stay on that phone only.

Service providers

• Supabase (authentication and database)
• Cloudflare (API and website hosting, email delivery)
• Google Analytics (website only, with consent)
• Apple Push Notification service and Firebase Cloud Messaging (notifications)
• App Store and Google Play (subscription purchase and verification)
• The cloud services of the manufacturers you connect (only for the accounts you connect)

Your data is not sold, not used for advertising and not shared with third parties.

Retention and deletion

Your data is kept for as long as your account is open. In the app, Account → Delete account permanently deletes your account and the homes you own; linked account keys are deleted too. If you signed in with Apple and delete your Apple account, your BluConnect account is deleted in the same way upon Apple's notification (if you also have another sign-in method, only the Apple link is removed); if you remove Sign in with Apple for BluConnect in your Apple ID settings, your sessions are signed out. When you disconnect a manufacturer account, that account's keys are deleted. If you cannot access the app, send an email with the subject "Account deletion" from your account's email address to contact@bluconnect.app; your account and all your data will be deleted within 30 days at the latest.

Deleted when your account is deleted: your email address, your name and your sign-in links; the homes, rooms, device names, routines and favorites you own; the keys of linked manufacturer accounts; arrival/departure (home/away) information; notification tokens; BluConnect Plus purchase records. Your payment records remain with Apple and Google under their rules.

Retained: daily usage counts tied to the installation identifier, unlinked from your account, are deleted within 90 days at the latest; error reports are stripped of personal data and are not associated with your account; feedback and contact messages you have sent are kept, separated from your account, so that we can reply, and you can have them deleted as described below.

Deleting data without deleting your account: in the app you can individually delete a home (My homes), a linked manufacturer account (Linked accounts › Disconnect), a routine, a room or a paired device; you can turn off arrival/departure sharing in Home settings › Location. For your other data (e.g. feedback, usage counts), send an email with the subject "Data deletion" from your account's email address to contact@bluconnect.app; the requested data will be deleted within 30 days at the latest.

Your rights

Under Article 11 of the KVKK and the GDPR, you have the right to access, rectify and erase your data, to object to processing and to data portability. You can send requests to contact@bluconnect.app; they are answered within 30 days at the latest.

Children

BluConnect is not intended for children under 13; family members invited by the home administrator are the home administrator's responsibility.

Changes

When we update this policy, we change the last updated date and announce significant changes in the app.