Privacy Policy

This policy explains how Hearthlight handles information when you visit our website, sign up or use the connected-home dashboard. For privacy questions or requests, contact the operator:

Faisal Rafiq · New York, United States
contact@psychvisit.today

Hearthlight is independent of Google, Home Assistant and Nabu Casa. This is Hearthlight’s policy, not a privacy notice or certification issued by its hosting platform.

Google sign-in provides an account identifier, email address and profile information such as your name and profile image when supplied by Google. Our authentication service maintains your account and session so you can sign in and access your own dashboard. Hearthlight does not receive your Google password.

Signup information is used to provide account access. Using optional connected features also involves the information described below; signup information is not the only information processed by the service.

If you connect a location, Hearthlight stores its name, Home Assistant address, access token and account ownership in server-side storage. Tokens are used by the server to contact your installation and are not returned to the dashboard. Optional personal AI keys are separately encrypted at rest.

Hearthlight retrieves device names, states, attributes and available controls to show your dashboard and sends commands you initiate to Home Assistant. Camera images pass through the service when you view a connected camera. Confirmed routines and schedules are saved in your Home Assistant installation, which runs them.

Account checks separate each user’s locations and controls. An explicit demo uses sample information rather than your connected devices. Do not connect installations you are not authorized to control or enter sensitive personal information in device names or voice requests.

The website and dashboard may request your browser’s location permission for local weather. Coordinates are cached in browser storage and sent to Open-Meteo for forecasts; location names may be resolved through OpenStreetMap’s Nominatim service. If no cached location is available and browser location is unavailable or denied, the browser may contact ipwho.is to estimate an area from your IP address. That service receives your IP address.

Your connected Home Assistant weather information takes precedence in the dashboard when available. You can change location permissions in your browser and clear site storage to remove cached coordinates; denying precise location does not prevent the approximate-IP fallback.

Voice features require microphone access and are optional. Browser speech recognition may send audio to the browser vendor’s recognition service. “Hey Home” listening is opt-in for the open session and pauses when the page is hidden, during manual voice input and during spoken replies; recognition may process speech before the wake phrase is detected.

If you connect your Deepgram key, Hold to Talk sends the bounded recording to Deepgram for transcription. If you connect your Claude key, Anthropic receives your request text, including any device names or other information you mention, to interpret it before a Home Assistant command is executed. Without personal Claude, requests are handled through the app’s Home Assistant conversation path. Providers and your Home Assistant integrations may have their own processing practices.

Spoken reply text is sent to Deepgram using your personal key to generate audio. Without a connected Deepgram key, replies are text only; there is no Hearthlight-funded speech fallback. Personal-provider usage is billed separately to your provider account; a personal-provider error does not silently switch to Hearthlight-funded processing.

The app processes recordings, transcripts and reply audio for the interaction; it does not create a saved conversation-history or recording archive in its application tables. This does not mean hosting logs or providers retain nothing. Their logging and retention are governed by their own policies and settings.

Lovable Cloud provides hosting, authentication and application storage. Google provides sign-in and hosted fonts. Weather and optional voice providers receive the information needed for the features above. Cloudflare’s DNS service receives your Home Assistant hostname when the server checks connection safety. These services receive technical request information, such as IP addresses, and may process information outside your state or country.

Browser storage maintains your sign-in session, cached weather coordinates and preferences such as the selected location and muted replies. Temporary session storage holds the destination after sign-in. Signing out ends the session but does not delete your account or necessarily clear all preferences.

Hosting and service providers may maintain operational, security and error logs. This policy does not claim that platform analytics or logging is absent. Access controls and encryption for personal AI keys reduce risk, but no online service can guarantee absolute security.

Account records and saved connections persist unless removed; there is no published fixed retention schedule or automatic account-expiry period. You can remove saved locations and personal AI connections in Settings. Removing a connection deletes its saved application record, not data held by Home Assistant, external providers, operational logs or backups.

To request access, correction or deletion of your account information, email the contact below from your registered address. Requests require identity verification and are handled subject to applicable law and any lawful retention requirements. Account deletion is requested by email rather than a self-service account-deletion button. We do not promise immediate erasure of provider logs or backups or a retention period that has not been established.

Faisal Rafiq · New York, United States
contact@psychvisit.today

Where applicable law provides additional privacy rights, those rights are preserved. You can stop optional voice processing by turning off listening and microphone permission, and disconnect providers in Settings.

Updates to this policy will appear here with an updated effective date. Material changes will be identified on this page. Contact us if you have questions before using a connected feature.

Read the Terms and Conditions.