Direct by design
Security
Elunava does not place a developer cloud between your phone and your home.
Connection architecture
There is no Elunava-operated account service, data relay, camera proxy, or telemetry backend. Your selected network route determines how the phone reaches your Home Assistant.
A separate HTTPS licensing service verifies the Pro trial and Google Play purchases using a pseudonymous device identifier and Google Play verification. It does not receive Home Assistant credentials, server settings, camera content or dashboard data. Read the privacy policy for the information processed and retained.
Credentials
Home Assistant OAuth credentials and long-lived token fallbacks are stored using Android secure storage. Elunava excludes credentials from configuration exports, profile QR codes and diagnostic bundles. Do not share screenshots of credentials you have chosen to reveal.
Transport security
HTTPS is recommended for remote connections. Elunava also permits HTTP addresses because some homes intentionally use them only on a trusted local network or through an encrypted VPN. The user controls the server address and network path.
Security reports
If you discover a security issue, email security@elunava.com with the affected version, impact, and reproduction steps. Do not include real credentials or private household data.