Privacy policy

• Account details: your email address, your name, and whether the address is confirmed. If you sign in with Google or GitHub, we receive your name, email address and an account identifier from them; we never see your Google or GitHub password.
• Sign-in and security data: a hash of your password (held by our identity service), your second factors (passkey public keys, an encrypted authenticator-app secret, hashed recovery codes), your sessions with the browser or phone name, IP address and times, and a log of security changes such as a new passkey.
• Organization data: organizations, projects, members and invitations, devices, credentials (stored as hashes), dashboards, alert rules and webhooks, and an audit log of changes made in them.
• Device data: the telemetry your devices publish (metrics and attributes you choose), their connection status, and rejected messages kept briefly to help you debug.
• Billing: your credit, the usage charged each hour, statements and invoices, and the identifiers of your Razorpay payments. Card and bank details are entered with Razorpay and never reach us.
• Notifications: your notification settings, and for browser push the subscription address your browser gives us.
• Email delivery: a record of the account emails we send you (kind, time, delivery status).

The IoTAPS app asks for internet access only. It does not read your contacts, location, photos or files, has no advertising, and contains no analytics or crash-reporting SDKs. It keeps its session token in the app's private storage.

This website sets no tracking or advertising cookies. It keeps your light or dark theme choice in one cookie, iotaps_theme. The console uses session cookies to keep you signed in.

• To provide the service: sign you in, run your organizations, receive and store device data, show it, evaluate your alert rules and send the notifications you set up.
• To keep accounts and the platform secure: second factors, rate limits, the audit and security logs, and investigating abuse.
• To send account emails: invitations, sign-in and security notices, alerts you subscribe to, and billing notices. We do not send marketing email.
• To bill usage and keep each organization within its credit.

We do not sell personal data, and we do not use it for advertising or to train machine-learning models.

• DigitalOcean hosts the platform and its database in Bengaluru, India.
• Our email provider (Google's Gmail API or Amazon SES) delivers account emails.
• Razorpay processes payments for credit and invoices.
• Google and GitHub, only if you choose to sign in with them.
• Your browser's push service (for example Google, Mozilla, Apple or Microsoft) carries browser notifications, encrypted end to end.
• Webhooks your organization adds (for example Slack, Discord or Microsoft Teams) receive the alerts it sends there.
• Other members of your organizations see your name and email address, and its admins see its audit log.

We disclose data to authorities only when the law requires it.

• Account and organization data: while the account or organization exists.
• Device telemetry: at most 90 days, less when an organization keeps a shorter history. Rejected messages: 7 days.
• Sessions: until they end (12 hours on the web, 30 days in the app, or when you sign out).
• In-app notifications: 30 days. Resolved alert incidents: 90 days. Sent-email records: 30 days.
• Audit logs of organizations: while the organization exists. After your account is deleted they no longer contain your name or email address.
• Backups taken before platform updates are kept by us and deleted as they are replaced.