Privacy

Your account. Your email address. If you sign in with Google or GitHub, also the name and profile picture they share, and the sign-in tokens they return. The console doesn't use those tokens for anything and stores them encrypted. When you created the account and when you last signed in. When you accept the Terms and the Safety notice, which version you accepted and when.

No passwords. You never set a password here: you sign in with Google, GitHub or a 6-digit code emailed to you. Codes are stored only as a one-way hash. Each works once, and an unused code expires after 10 minutes.

Your sessions. For each device you are signed in on: the IP address and browser name it signed in from, and when the session expires (after 7 days without use).

Your switches and Bridges. What your switches send when they check in: each switch's hardware address (MAC), firmware version and label, and your Hue Bridge's id, local IP address and its list of rooms, zones, lights and scenes with their names. Also what you set up in the console (pages, buttons, scenes) and when each switch last checked in. The key your switch uses to talk to your Hue Bridge stays on the switch; the console never receives it and never talks to your Bridge.

Device API keys. The name you gave each key and a one-way hash of it. The key itself is shown to you once and not kept.

Sign-in safety records. When a sign-in code is sent or a wrong code is entered: the email address, IP address and time. These limit abuse and are deleted after 7 days.

Waitlist. If you join the waitlist: your email and the date. It is kept while you wait, then for 90 days after you get your invite, leave the waitlist, or are removed from it. The email saying you're on the list has a link to leave. If Resend tells us an email to you bounced or was marked as spam, the address comes off the waitlist; that notice is kept for 30 days.

On Setup you type your Wi-Fi network name and password so the switch can join your network. They go from your browser straight to the switch over the USB cable and are saved on the switch. They are never sent to the console: not stored in its database, not in its logs, and not in the USB debug panel on Setup. When Setup reads a connected switch, it shows the network name the switch reports over USB; that also stays in your browser.

The switch keeps them in its own memory, like any Wi-Fi device. Before giving a switch away, plug it in on Setup and click Erase settings (under Reset board): the switch forgets your Wi-Fi name and password, its link to the console and to your Hue Bridge, and its button settings. If a switch is lost, change your Wi-Fi password.

Only to run the service: to sign you in, keep your account secure, send your switches their settings, show you your home's rooms and lights, and send the emails you ask for (sign-in codes, waitlist updates, invites, and a notice when your email changes). The admin page shows the operator counts per account (switches, Bridges, last sign-in), never your rooms, lights or button settings.

One cookie keeps you signed in. A second, short-lived cookie (one hour) holds an invite code while you sign up. Your browser also remembers your theme and which switch model the How-to page shows; that stays on your device. The email sign-in and waitlist forms use Cloudflare Turnstile to tell people from bots, which runs a check in your browser. It loads only once you start filling in one of those forms, not when you sign in with Google or GitHub.

These companies process data for the console, each for its part only:

• Vercel: hosting (United States). Keeps request logs for a short time.
• Neon: the database (United States, AWS us-east-1).
• Resend: sends the console's emails (United States).
• Cloudflare: DNS for hue.tineira.com and the Turnstile bot check.
• Google and GitHub: only if you choose to sign in with them.

Your data stays until you delete your account. On the Account page you can change your email, sign out everywhere, or delete your account. Deleting removes your account, sign-in methods, sessions, API keys, Bridges, switches and settings from the database at once. The database keeps a rolling 6-hour history for recovery, so deleted data is gone from it within 6 hours. Your switches keep their saved settings on the device until you reset them; they can no longer reach the console.

The operator can also delete an account, for example one that has had no switch and no sign-in for a long time. Accounts are never deleted automatically.

To ask what is stored about you, to get a copy, or to have something corrected or deleted, contact privacy@tineira.com or @tomneira on X.

If this page changes in a way that matters, the new version is posted here with a new date.