Privacy

Who this policy covers

Elunava is developed and published by Obelisco Talentoso - Unipessoal, Lda. Our company address and contact details are on the Legal information page.

This policy covers the Elunava Android application and this website. Elunava is an independent Home Assistant client and is not affiliated with or endorsed by the Open Home Foundation or Home Assistant.

Direct connection to your Home Assistant

You provide the local or remote address of your own Home Assistant installation. The app uses that address to authenticate, retrieve states and media, and send the control actions you request. Elunava does not proxy these connections through a developer server.

Depending on your configuration, traffic may travel over your local network, a VPN, a remote-access provider, or the public internet. The operator of your Home Assistant and any network or remote-access provider you choose control their own data practices.

Information stored on your phone

• Home Assistant access and refresh credentials, protected using Android secure storage.
• Your selected server addresses and trusted Wi-Fi network names.
• Dashboard choices such as visible areas, controls, order, names, icons, and profiles.
• Cached device states, names, timestamps and selected registry information for offline display.
• Local preferences, trial information and signed Pro access receipts.

Configuration exports never include Home Assistant credentials or the local editing PIN. They can include server addresses, Wi-Fi names and device references; do not publish them. Android normally removes the app's private storage when Elunava is uninstalled.

No automatic household data uploads

The licensing service does not receive your:

• Home Assistant addresses, tokens, usernames, or passwords;
• area names, entity names, device states, or control history;
• camera images, video streams, calendars, or media;
• saved Home Assistant IP addresses, Wi-Fi network names, or VPN settings; or
• configuration exports or locally generated diagnostic reports.

Trial verification

The app automatically contacts license.elunava.com over HTTPS to establish and check the 14-day Pro trial. It sends an app-specific device identifier derived by hashing Android's app-scoped Android ID together with the app identifier. The raw Android ID is not sent to Elunava. This identifier is pseudonymous, not anonymous: it lets the service recognize the same app/device after an ordinary reinstall.

The service stores a further keyed hash of that identifier, the trial start and end dates, and any support correction references and dates. These records prevent repeated trials after reinstalling and support corrections when verification goes wrong. We do not use the identifier for advertising or to track your activity in other apps.

Google Play Integrity checks that requests come from the expected app and an eligible device. Google processes request information, app metadata, Play licensing status and device attestation information; Elunava receives the verification result. The app sends the Integrity token to the licensing service for verification with Google. We do not store raw Integrity tokens in the licensing database or application logs. Google explains this processing here.

Pro purchases and restoration

If you buy or restore Pro, the app sends the Google Play purchase token, the app-specific device identifier and an Integrity token to the licensing service over HTTPS. The service verifies and acknowledges the purchase with Google Play, then returns a signed receipt tied to the device. The app stores this receipt securely to support verified Pro access offline.

The service stores a hash of the purchase token, ownership status and the last verification time. The raw purchase token is used to contact Google but is not stored in the licensing database or application logs. Elunava does not receive your full payment-card details. Google handles payment, refunds and your Play purchase history.

Service providers and connection information

Our hosting provider processes licensing requests to operate the service. As with other internet services, the connection exposes a source IP address and request metadata to the hosting and network infrastructure. These are distinct from the Home Assistant addresses saved in your app. We do not use them to infer your location. The licensing application does not record request bodies, credentials or purchase tokens in logs.

Google processes Integrity and purchase verification, and Fastmail hosts this website and our contact mailboxes. These providers may process information in countries other than yours under their applicable privacy and data-protection arrangements. We do not sell your personal information or send licensing information to advertising services.

Retention

Trial records and correction history are currently retained for the life of the licensing service to prevent repeated trials and resolve access problems. Purchase token hashes, ownership status and verification dates are retained to support the lifetime purchase and prevent abuse. These records do not automatically expire when a trial ends, when you sign out of Home Assistant, or when you uninstall the app.

One-use verification challenges expire after two minutes and are removed when used or during subsequent challenge cleanup. Raw verification and purchase tokens are processed in memory for the request. Google applies its own retention policies to information it processes. Contact us to request deletion of records held by Elunava; see Your choices below. We do not promise that uninstalling removes records or copies held by service providers.

Wi-Fi and location permission

Android requires location permission before an app can read the current Wi-Fi network name. Elunava uses the network name only on the device to choose between your configured local and remote Home Assistant addresses. It does not request coordinates or transmit a location value to the developer.

Google Play services and platform statistics

Elunava contains no additional product-analytics SDK, developer telemetry endpoint, or third-party crash-reporting service. The licensing service is used for access verification, not usage analytics. When you install Elunava from Google Play, Google processes distribution information and may provide the developer with aggregated store, installation, device, crash, and application-not-responding (ANR) statistics through Play Console.

Google Play also processes purchases, entitlement restoration, licensing, and refunds. These services are operated by Google under the Google Privacy Policy. Elunava does not receive your full payment-card details.

Advertising

The current application does not include an advertising SDK. If advertising is introduced in a future free version, this policy and the Google Play Data safety declaration will be updated before that version is released. Home Assistant credentials, addresses, names, states, camera content, Wi-Fi names, and control actions will never be supplied to an advertising provider.

Exports and support

Configuration and diagnostics files are created locally only when you request them. They leave the app only through the destination or sharing action you choose. Review any file before sending it to another person.

If you email support, the message and information you voluntarily include are processed by the email provider to answer your request. Never send an access token, password, private camera image, or household address.

Notifications and external services

Optional notification permission lets Elunava show local doorbell alerts. Reliable alerts when Elunava is closed can be configured through the separate Home Assistant Companion app. That app and its push providers have their own data practices; this does not create an Elunava notification server.

This website

This static site has no analytics scripts, tracking pixels, cookies, embedded forms or remote fonts. Visiting it is separate from using Elunava to control your home.

Fastmail hosts the site and processes web requests under its privacy policy. Its hosting service makes the preceding two weeks of access times and browser user-agent information available to the website owner. This is hosting information, not smart-home telemetry from the app. Fastmail describes its website logs here.

Your choices

You can sign out to remove the stored Home Assistant credential, revoke Elunava from your Home Assistant profile, delete local configuration inside the app, or uninstall Elunava. Data held by your Home Assistant installation remains under its administrator's control. Signing out or uninstalling does not delete the licensing records described above or cancel a Google Play purchase.

You can request access, correction or deletion of your Elunava licensing and support records by emailing privacy@elunava.com. Include the support reference shown in the app if available, so we can locate the relevant record. Never send Home Assistant credentials, raw purchase tokens or Integrity tokens. We may need to verify that a request concerns your records.

We may retain limited records where necessary to protect a lifetime entitlement, prevent fraud or meet legal obligations, and will explain any limits when responding. Deletion is handled through support, not an automatic in-app account deletion process; Elunava does not create a separate user account. Google Play purchase records and Home Assistant records must be managed with their respective operators.

Why we process information and your rights

We process information needed to provide and restore the Pro access you request, and rely on our legitimate interests in preventing fraud and securing the service for licensing checks and trial-abuse prevention. Support messages are used to respond to your request. Where applicable, you may object to processing based on legitimate interests, request restriction or portability, and complain to your data-protection authority. Contact us using the address below to exercise these rights.

Contact

Privacy questions can be sent to privacy@elunava.com.