WristDash for Home Assistant Privacy Policy

# WristDash for Home Assistant Privacy Policy Last updated: September 10, 2026 ## Overview WristDash for Home Assistant ("WristDash") is a paid utility app for Android phones and Wear OS watches that lets you trigger actions on your own Home Assistant instance. WristDash is designed so the developer does not operate an account system, application backend, analytics service, advertising service, crash-reporting service, or tracking service for the app. ## Data Collected By The Developer The developer does not collect your Home Assistant credentials, dashboard configuration, entity states, or action history on developer-operated servers. WristDash has no developer account system, cloud backend, ads, analytics SDK, crash-reporting SDK, or third-party tracking SDK. The developer does not sell personal information or share app data with advertisers or data brokers. WristDash does communicate with services necessary to perform the user-requested functionality, as described below. Google Play's Data Safety terminology may classify some user-directed or device-to-device transfers as collection even when the developer never receives that data; the Play Console declaration for the installed release provides the release-specific classification. ## Data Stored On Your Devices ### Android phone WristDash stores the following in app-private storage on your phone: - Your Home Assistant base URL. - Your Home Assistant long-lived access token. - Your authoritative favorites, curated wrist panels, dashboard layout, Tile selection, service configuration, confirmation requirements, and watch-enable state. - Non-secret configuration, synchronization, and reset-ordering metadata. - A bounded replay-protection journal used to prevent a duplicated watch request from automatically causing a second Home Assistant mutation. The Home Assistant access token is encrypted at rest using AES/GCM with a non-exportable key protected by Android Keystore. It is not stored in the normal settings DataStore, included in app logs, placed in URLs, displayed in error messages, exported by the app, or included in Android backup. If encrypted token material is incomplete, corrupted, no longer decryptable by the device-local Keystore key, or decrypts to a blank value, current releases treat the credential as unavailable and clear the unusable local token state instead of treating the app as configured. ### Wear OS watch The watch stores a non-secret dashboard snapshot used for display and routing. That snapshot can include favorite identifiers, labels, curated panel information, icons, entity identifiers, confirmation hints, the phone-owned configuration revision, Tile selection, and cached entity-state observations. The watch snapshot does not contain the Home Assistant access token. It also strips the authoritative Home Assistant service domain, service name, service data, and executable Home Assistant URL from the synced watch snapshot. Current Wear builds remove any legacy WristDash token copy that may remain from an older release. Cloud backup and Android device-to-device transfer of WristDash app data are disabled by the app's backup configuration. ## Home Assistant Access Token Security Your Home Assistant long-lived access token is treated as a credential and is stored on the Android phone only in current releases. When the phone communicates with your Home Assistant instance, the token is sent only as a Bearer token in the HTTP Authorization header. The token is not synchronized to the watch through Wear OS Data Layer. A Home Assistant long-lived access token can grant significant control over your Home Assistant instance. Treat it like a password and revoke tokens you no longer use. ## Communication With Your Home Assistant Instance Only the Android phone connects to the Home Assistant base URL that you configure. The phone uses that connection to: - Test the connection. - Read supported entity states and service information. - Populate and refresh the dashboard configuration you choose. - Refresh watch-visible entity state when requested through the paired phone. - Execute Home Assistant service calls after phone-side authorization of a watch action. Connections use HTTPS when you configure an HTTPS URL. Plain HTTP is permitted only for validated local-network addresses and is not TLS-encrypted. Current releases revalidate the persisted destination again before authenticated Home Assistant requests, so a stale or corrupted remote cleartext URL is rejected even if it did not pass through the normal setup flow. WristDash does not automatically follow HTTP or HTTPS redirects for Home Assistant requests. If your Home Assistant address redirects, configure the final URL directly. This avoids forwarding authenticated traffic to an unreviewed destination and preserves the app's exactly-one HTTP mutation-dispatch boundary for watch-triggered actions. Successful Home Assistant response bodies are bounded before they are materialized and parsed. Oversized or malformed responses fail as application errors rather than being read without a size ceiling. WristDash does not offer a bypass for invalid HTTPS certificates. The Home Assistant instance is controlled by you or your chosen Home Assistant provider. WristDash is not affiliated with, endorsed by, or sponsored by Home Assistant or the Open Home Foundation. ## Phone And Watch Sync WristDash uses Google Play services Wear OS Data Layer to synchronize a non-secret dashboard snapshot between your paired Android phone and Wear OS watch and to exchange minimal action/state requests and sanitized results. A watch execution request identifies a previously configured favorite by ID and includes control metadata such as protocol version, request ID, phone-owned configuration revision, and confirmation state. It does not contain the Home Assistant token or authoritative Home Assistant service domain, service name, entity ID, or service data. The phone resolves the current authoritative favorite and revalidates the current revision, watch enablement, confirmation requirement, supported action, and replay state before making a Home Assistant request. Phone-to-watch configuration payloads are bounded below the Wear Data Layer transport ceiling. Oversized watch configurations are rejected visibly on the phone instead of being queued as if the watch were guaranteed to accept them. Configuration and reset ordering use monotonic logical timestamps that remain newer than the last known ordering value even if the phone's wall clock moves backward. This prevents an old watch snapshot from becoming authoritative merely because of a clock correction, manual time change, restore, or similar clock rollback. Read-only state refreshes are routed through the phone. The watch does not have a direct Home Assistant network fallback. Google Play services may process technical information required to provide the Wear OS Data Layer under Google's own privacy terms. ## Built-In Demo Mode The Wear OS app includes a clearly labeled demo using fictional local data so the dashboard, panels, action feedback, Tile, and complication entry point can be evaluated without a Home Assistant instance. Demo actions are simulated locally on the watch and return before phone discovery or Home Assistant network access. The demo uses no Home Assistant credential and does not control real devices. ## Reset And Data Deletion The phone app includes **Forget token and reset app**. Using this action: - Deletes the saved access token and user-owned WristDash configuration from the phone. - Deletes connection settings, favorites, curated panels, and related local application state. - Publishes a durable reset marker for paired watches so a watch that is offline when the reset occurs is instructed to clear the old WristDash configuration when it reconnects. If the remote reset cannot be queued, current releases still clear the credential and user configuration from the phone. A non-secret logical ordering floor may remain locally so a later reset attempt or reconfiguration cannot move backward relative to an older watch snapshot. This ordering metadata contains no Home Assistant token, entity state, service data, or user-authored dashboard content. Current watch builds also scrub any legacy watch-side WristDash token storage left by an older version. You can also remove local WristDash data from an individual device by clearing the app's storage or uninstalling WristDash from that device. You can independently revoke the long-lived access token in your Home Assistant profile. Revocation immediately invalidates the credential held by the phone. Because WristDash has no developer account database or developer-operated cloud backend, there is no server-side WristDash account data held by the developer to delete. ## Permissions The current WristDash apps use a minimal permission set: ### Android phone - INTERNET, to communicate with the Home Assistant instance you configure. - ACCESS_NETWORK_STATE, to support connectivity handling and useful connection feedback. ### Wear OS watch - VIBRATE, to provide direct user-facing haptic feedback. The Wear OS release does not request INTERNET or ACCESS_NETWORK_STATE and does not connect directly to Home Assistant. WristDash does not request location, microphone, camera, contacts, calendar, files/photos, health data, body sensor, notification, or advertising ID permissions for its current functionality. ## Background Behavior And Battery WristDash is designed around user-triggered actions rather than continuous monitoring. The app does not use continuous sensor collection, location tracking, background polling of Home Assistant, wake locks, or a persistent foreground service for dashboard operation. The Wear OS complication is a launcher surface and does not periodically poll Home Assistant. User-initiated watch refreshes are relayed through the phone using one bounded Home Assistant state request for the curated controls. ## Security Limitations The security of WristDash also depends on the security of your devices and Home Assistant deployment. For remote Home Assistant access, use HTTPS with a valid certificate, keep Home Assistant and your devices updated, configure WristDash with the final non-redirecting Home Assistant URL, and avoid exposing Home Assistant directly to the public internet without appropriate security controls. Android Keystore-backed encryption protects the phone token at rest, but hardware backing depends on the device's Keystore implementation and no application can guarantee protection on a compromised, rooted, or otherwise hostile phone. Wear Data Layer application isolation is supplemented by WristDash's phone-side authorization and replay protection before Home Assistant execution. ## Children WristDash is a utility for configuring and controlling a self-hosted smart home and is not directed to children. The developer does not knowingly collect personal information from children through a WristDash backend because no such backend exists. ## Changes To This Policy This policy may be updated if WristDash functionality or data practices change. The effective date will be updated when material changes are made. ## Contact For privacy questions or support, contact quazmoz@vivaldi.net. Do not send Home Assistant access tokens or other credentials in support messages.