Privacy and data use

Account and system data

Account records include your email address, password hash, verification state and session records. Abuse-prevention counters use hashed account or network identifiers rather than storing raw addresses in those counters.

• Connected systems include a name, serial number, app username, encrypted controller password and auth code, firmware information and connection state.
• Room and sensor names, temperatures, humidity and observed activity support the wall and enabled history collection.
• Saved walls, favourites, schedules, timed-away jobs, personal alert rules and events are stored for their features. Control activity includes who requested a change, its values and its outcome.

Households and shared links

Household records include members, roles and invitation email addresses. People with current access can view the system, its history and control activity. Personal alert rules and events remain private to their account.

Display records include a token hash, name, permission, appearance settings and last-opened time with browser/device information. Anyone holding the URL can use the display's permission. Pausing or revoking it prevents further access, but cannot retrieve a screenshot someone already took.

Optional electricity meter

A system owner can connect a Moj elektro API token and metering-point identifier. Hydrum stores the token encrypted, verifies the metering point once and then requests 15-minute import and export energy from api.informatika.si about once a day. Owner names, addresses, contract details and meter serial numbers returned by that service are not stored. Disconnecting the meter deletes the token and every stored reading.

Optional weather and background photos

A weather widget stores the city coordinates you choose. City searches and forecast coordinates are sent to Open-Meteo, using GeoNames place data. Hydrum does not request browser geolocation or infer your home address. Remove the weather widget if you no longer want those forecast requests.

Unsplash photos are optional. Using them involves provider requests for suggestions, images and photo-use reporting; image delivery can expose ordinary connection details such as your IP address to the image provider. A photo selected from your device stays in that browser and is not uploaded to Hydrum. Remove the background in Settings to stop using it.

Service providers and operational logs

Fly.io hosts the application and database. Harreither supplies the relay connection. A configured SMTP provider processes email recipients and message contents, including account links or alert details. A configured web proxy such as Cloudflare also handles website requests.

Hosting, proxy, mail and optional content providers may retain standard operational logs under their own policies. These can include network addresses and request details. The limits on optional public-site metrics below do not describe those provider logs.

Browser storage and optional public-site metrics

Signing in uses a session cookie. Language and appearance choices can use cookies or browser storage, and device background photos stay in browser storage. This is separate from optional public-site measurement.

If public-site metrics are enabled, they are limited to daily aggregates of page views, signup-link clicks and Web Vitals. They use no analytics cookies or visitor identifiers and store no IP addresses, referrers, raw URL paths or query strings. Fixed public-page identifiers and language may label the totals; account and secret-link pages are outside this measurement.

How long records remain

Temperature and other telemetry history, together with alert events, have 30-day retention. Older records are excluded from history reads while bounded deletion catches up. The last-known system snapshot is stored separately and can remain while the system exists. Electricity intervals from a connected meter are kept for 13 months so heating seasons can be compared.

The control-activity log has no automatic 30-day expiry. System settings, saved layouts and other feature records remain until the relevant account, system or record is deleted. Activity on someone else's system can retain your actor label and identifier after you leave or delete your account.

Deleting a record from the live database does not immediately erase physical copies in backups or operational logs. Their retention depends on the operator and provider; this page does not promise an immediate backup purge or a fixed log-deletion deadline.

Limit sharing or delete your account

In account settings, Delete account requires your current password. It removes your account, sessions, personal feature records and memberships, plus systems you own and their related displays, history and settings. Systems owned by someone else remain. The heating controllers themselves are not reset or changed.

• An owner or manager can pause history collection. This stops new monitoring collection, not ordinary wall reads or an already confirmed timed-away return.
• Disable personal alert emails or remove rules you no longer want.
• Pause, replace or delete display links, and remove household access when it is no longer needed. Members can leave a household.
• Remove optional weather widgets and background photos to stop using those features.
• Disconnect an electricity meter to delete its token and stored readings.

Questions about your data

Use the account and system controls above where available. For records outside those controls or questions about provider and backup retention, contact your service administrator through a contact method they have supplied. Do not include passwords, auth codes or private links in the request.