Privacy Policy

Last updated: 17 October 2026

Who we are

Offbeat-IoT ("Offbeat-IoT", "we", "us", "our") runs the Offbeat-IoT platform: the service, the public website, the device protocol, and the integrations that connect your devices to third-party cloud services. For the processing described in this policy, Offbeat-IoT is the data controller.

We have not appointed a Data Protection Officer. For any question about this policy, or to exercise your rights, contact us at soerensejr+privacy@gmail.com.

This is a small project. We do not list a registered company name or postal address here; if you need those details to identify the controller, contact us at the address above.

Scope

This policy applies to personal data we process when you:

• create and use an Offbeat-IoT account and sign in;
• register a device and connect it to the platform;
• link a third-party service (for example Spotify, Todoist, Google Calendar or Google Health);
• link your device to Alexa or Google Home;
• visit the public website, documentation and status pages; or
• contact us for support.

How the service works, and our role

Offbeat-IoT sits between your device and the cloud services you connect. Your device opens a WebSocket connection to our servers and sends small JSON or CBOR messages. Our backend receives those messages, processes them, and either answers your device directly or calls the connected provider on your behalf and returns the result on the same connection.

Transport to our servers is encrypted with TLS, and we use TLS to talk to the providers. We do not provide end-to-end encryption between your device and a provider: because our backend performs the integration on your behalf, message content is readable by our servers while it is being processed.

For data held at a connected provider, that provider is usually an independent data controller for its own service, and its privacy policy applies to your account there. We only call the provider to carry out the commands and queries you or your device initiate.

Data we process

Account and sign-in

Sign-in and account management are handled by our identity provider (Keycloak). It processes the username, email address, display name and credentials you provide and issues a subject identifier that identifies your account. On our side we keep a small local user record keyed to that subject identifier, and for some features a coarse country derived from your request IP address. We do not store your email address or name in the application database.

Integrations and access tokens

When you link a service, the provider redirects you back to Offbeat-IoT with an authorization code, which we exchange for an access token (and, where the provider issues one, a refresh token). We store these tokens, their expiry and the linked service in our database so we can call the provider for you. Tokens are stored server-side and are not sent to your devices.

Data from connected services

To carry out the commands you or your device send, we read from and, for some services, write to the providers you connect. This can include:

• Spotify — playback state, devices, your saved tracks and playlists;
• Todoist — your projects and tasks, and the ability to create and complete tasks;
• Google Calendar — your calendar list and events, and the ability to create events;
• Google Health — health and fitness data points (see the section on health data below); and
• Alexa and Google Home — the link between your assistant account and your devices, so the assistant can control them.

We process provider data to answer your requests and do not keep a copy of provider content such as your calendar entries, tasks or health data points. There are two exceptions where we keep integration-related metadata: Google Calendar "watch" channels (so we can be notified of changes) and a Google Health notification subscription, both of which are removed when you unlink the service.

Some built-in features use third-party services without an account link: the weather feature calls a weather API with the location your device sends, and the time feature can estimate a country from your device's IP address. The encouragement and ponder features use built-in text only.

Devices, settings and telemetry

• a device identifier (endpoint id) and the friendly name, description and manufacturer you provide;
• the capabilities and settings you configure, the mapping between a device and the integrations you link to it, and any device images or firmware files you upload;
• the latest value reported for each device property (for example a sensor reading), stored as a single value per property with a timestamp and capped in length — we do not keep a history of readings; and
• network metadata such as the device's remote IP address and connection times, used for connectivity and for location-based features.

We also keep a small in-memory buffer of the most recent device events (about fifty per device) so that the user interface and AI assistant can show recent activity. This buffer is not written to disk and is lost when the service restarts.

Webhooks you configure

You can configure webhooks that call a URL you choose when a device event happens. We store the URL and any basic-auth username and password you provide, in order to make the call.

Diagnostics, logs and monitoring

We run the platform on our own servers and monitor it with Prometheus, Grafana and Loki. Our application logs and metrics can include account identifiers, device identifiers and friendly names, IP addresses, and — depending on the configured log level — the content of device messages and integration requests and responses. We do not currently apply automated redaction to these diagnostic records; access to them is limited to the operators of the platform. Some monitoring metrics carry labels such as your username and the device endpoint id or name; the internal monitoring strips the username label before showing metrics to you.

Cookies and website resources

The application sets one session cookie (SESSION) to keep you signed in. It is marked http-only and SameSite=Lax, and is used only for your authenticated session. We do not use advertising or third-party tracking cookies.

Some pages load resources from third-party content networks — for example the Bootstrap stylesheet and Google Charts on certain pages, and provider logos on the landing page. When your browser loads these, the operator of that content network can see your IP address and the page you came from.

Why we use your data, and our legal bases

Where the EU/EEA General Data Protection Regulation (GDPR) or the UK GDPR applies, we rely on:

• Performance of a contract — to create and run your account, to route device messages, and to call the providers you connect;
• Consent — to link an integration and grant it access to your provider account, and for any special-category data (see below). You can withdraw consent at any time by unlinking the integration;
• Legitimate interests — to secure, monitor and improve the platform, prevent abuse and keep it reliable, balanced against your rights; and
• Legal obligation — where we must retain or disclose data to comply with the law.

The EU/EEA GDPR and the UK GDPR are separate regimes, and each applies where it governs your use of the platform. The EU/EEA GDPR does not itself extend to the UK.

Health and other special-category data

The Google Health integration can process health-related information, which may be special-category personal data under Article 9 GDPR (for example activity, sleep, nutrition, symptoms, reproductive health and heart-rhythm data). We rely on your explicit consent for this processing: you choose to connect Google Health, you see the permissions Google asks you to grant, and you can withdraw consent at any time by unlinking the integration. We process this data only to carry out the health commands and queries you or your device initiate, and we do not keep a copy of your health data points.

How long we keep data

• Account data — until you ask us to delete your account (see "Deleting and unlinking");
• OAuth tokens — until you unlink the integration, or your account is deleted;
• Integration metadata (Google Calendar channels, Google Health notification subscription) — until you unlink the integration;
• Device data (latest values, settings, images and firmware) — until you change or delete them, or delete the device;
• Diagnostic logs and metrics — for a limited operational period set by our infrastructure; the exact period is being confirmed;
• Audit events — we keep only a small fixed number (currently five) of the most recent authentication events per account;
• Session data — your session expires thirty minutes after your last activity.

Where personal data remains in logs, metrics or backups, it is removed as those are rotated. Backups and their retention are managed as part of our infrastructure.

Deleting and unlinking

Unlinking an integration (in the platform, or in the provider) deletes the linked connection and its tokens from our database and removes the link between that integration and your devices. Where the provider supports it, we also revoke the token at the provider; this is currently done for Todoist. For the other services (Spotify, Google Calendar, Google Health, Alexa and Google Home) we delete the token from our side but do not call a provider revocation endpoint, so you may also want to remove Offbeat-IoT's access in that provider's own settings.

Deleting a device removes the device, its latest values, its integration mappings and its firmware images.

Deleting your account is not currently available as a self-service option. To delete your account and the data associated with it, contact us at soerensejr+privacy@gmail.com. We will delete your account and its data, except for data that remains for a limited period in logs, metrics and backups.

Sharing and international transfers

We share personal data only with the parties needed to run the platform:

• the third-party services you choose to connect, so we can carry out your commands;
• our own infrastructure (hosting, database and monitoring), which we operate ourselves; and
• authorities, where we are legally required to disclose data.

The providers we connect (for example Spotify, Google and Todoist) and the assistant platforms (Alexa and Google Home) are generally independent controllers of the data they hold. Some of them process data outside the EU/EEA. Where personal data is transferred internationally, we will put appropriate safeguards in place as required by law.

Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data;
• request restriction of, or object to, certain processing;
• receive your data in a portable format;
• withdraw consent at any time; and
• lodge a complaint with your local supervisory authority (the Information Commissioner's Office in the UK, or your national data protection authority in the EU/EEA).

You can exercise some of these rights directly in the platform (for example by unlinking an integration or deleting a device), or by contacting us at soerensejr+privacy@gmail.com.

Security

We protect personal data with technical and organizational measures, including TLS in transit, access controls and monitoring. No method of transmission or storage is completely secure, and this policy does not promise a particular security outcome. If you become aware of a security problem, please tell us at the contact address above.

Children's privacy

The platform is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will revise the "last updated" date above and, for significant changes, provide additional notice where appropriate. We encourage you to review this page periodically.

Contact

For questions, requests or complaints about this Privacy Policy or your personal data, contact:

Offbeat-IoT
soerensejr+privacy@gmail.com