Privacy Policy — HueFlow

HueFlow ("the app", "we") is an application developed by Sinus for backing up, restoring and automating Philips Hue bridges. This policy explains what data the app collects, how it is used, and how you can get in touch about it.

HueFlow does not require an account or an email/password login. It connects directly to your Philips Hue Bridge, a physical device on your local network.

Data controller

The data controller is Jefferson Medeiros, an individual resident in Brazil who develops HueFlow under the name Sinus. Contact: sinus.dev.app@gmail.com.

As a small-scale processing agent under Brazilian law (ANPD Resolution CD/ANPD No. 2/2022), no data protection officer is appointed; the email above is the contact channel for data subjects.

Data we collect

Data	What it is and how it is used
Your bridge's IP and Application Key	Stored only locally on your device. Used solely so the app can talk to your own bridge, on your own local network. Never sent to HueFlow servers.
Usage and diagnostics data (Firebase Analytics)	Navigation and feature-usage events, plus device and app information, to understand how the app is used and improve it. Processed by Google under the Google Privacy Policy.
Crash reports (Firebase Crashlytics)	When the app fails: device model and OS, app version, the technical trace of the error (stack trace) and an installation identifier. It includes no data about your home or your bridge. Used only to find and fix the error. Processed by Google under the Google Privacy Policy.
Advertising identifiers (Google AdMob)	Used to show ads on the free plan. Processed by Google under Google's advertising policy. Premium subscribers see no ads.
Purchase data (Google Play Billing)	Subscription/purchase status (monthly, lifetime, donations), processed entirely by Google Play. HueFlow neither receives nor stores credit card data.
Tester sign-up (Google Forms, optional)	Only if you choose to fill in the sign-up form for testers — for example, for the upcoming iPhone and iPad version: name, email, country/time zone, and answers about your Hue setup and the devices you would test on. Used only to pick testers, invite them through Google Play or TestFlight, and ask them for feedback. Processed by Google under the Google Privacy Policy.
Backup file you send to support (optional)	Only if you email us an exported backup so we can recover it — for example, because you forgot its password. Every exported backup file, with or without a password, can also be opened by a recovery key that only we hold, offline: that is how recovery works. The file carries the names of your rooms, lights, scenes and automations, but no bridge credentials. Used only to recover the file and send it back to you.

What HueFlow does not do

Does not sell your data to third parties.
Does not collect your geographic location (GPS).
Does not require registration with a name, email or password.
Does not send your home's configuration (rules, automations, room names) to any HueFlow server — backups are stored locally on your device. You can export a backup file yourself; it goes only where you choose to send it.

Legal basis for each processing

Data	Legal basis
Bridge IP and key, backups	No processing by us: this data stays on your device. An exported backup file goes only where you send it.
Firebase Analytics	In the European Union/EEA, the UK and Switzerland: consent (GDPR Art. 6(1)(a)), requested on first launch. Elsewhere, including Brazil: legitimate interest in understanding and improving the app (GDPR Art. 6(1)(f); LGPD Art. 7, IX) — you can object at any time by turning off Usage statistics in the app.
Firebase Crashlytics	Legitimate interest in keeping the app stable and fixing failures (GDPR Art. 6(1)(f); LGPD Art. 7, IX). You can object by turning off Crash reports in the app.
Google AdMob	In the European Union/EEA, the UK and Switzerland: consent, requested through Google's privacy form and reviewable under Ad privacy options. Elsewhere: legitimate interest in funding the free plan — you can turn off Personalized ads in the app; ads keep showing, without using your interest profile.
Purchases (Google Play Billing)	Performance of the purchase or subscription contract (GDPR Art. 6(1)(b); LGPD Art. 7, V).
Tester sign-up (Google Forms)	Consent (GDPR Art. 6(1)(a); LGPD Art. 7, I), given by submitting the form. You can withdraw it at any time by writing to sinus.dev.app@gmail.com.
Backup file sent to support	Your request: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V).

Sharing and international transfers

Usage, crash, advertising, purchase and tester sign-up data are processed by Google (Google LLC and Google Ireland Ltd.) as a processor — for the purposes described above and no other. If you are invited to test the iPhone and iPad version, your email is also given to Apple (Apple Inc. and Apple Distribution International Ltd.) so that TestFlight can send the invitation, under the Apple Privacy Policy. We share data with no one else and do not sell data.

Your data may therefore be processed in the United States and other countries where Google — and, for invited iOS testers, Apple — operates. For users in the European Union, this transfer relies on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses (GDPR Arts. 45 and 46); under Brazilian law, on the standard contractual clauses adopted by these companies (LGPD Art. 33, II; ANPD Resolution CD/ANPD No. 19/2024).

Your rights

Because HueFlow is developed in Brazil, the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018, Art. 18) applies to every user. It gives you the right to:

confirmation that we process your data;
access to your data;
correction of incomplete, inaccurate or outdated data;
anonymization, blocking or deletion of unnecessary or excessive data, or of data processed unlawfully;
data portability;
deletion of data processed with your consent;
information about whom we share your data with;
information about the possibility of refusing consent and its consequences;
withdrawal of consent;
objection to processing based on another legal ground (such as legitimate interest).

If you are in the European Union/EEA, the General Data Protection Regulation (GDPR, Arts. 15–21) gives you equivalent rights: access, rectification, erasure, restriction of processing, portability, objection, and withdrawal of consent at any time, without affecting processing carried out before it.

How to exercise them: objection and withdrawal of consent are in the app itself, in the Privacy card of the Purchases tab (the switches and Ad privacy options). For the other rights, write to sinus.dev.app@gmail.com. We reply within 15 days.

You can also lodge a complaint with the data protection authority of your country in the European Union/EEA, or with Brazil's National Data Protection Authority (ANPD).

Data retention and deletion

Bridge connection data and local backups stay on your device until you disconnect the bridge or uninstall the app, at which point they are removed. Usage data (Firebase Analytics) is kept for up to 14 months and crash reports (Firebase Crashlytics) for 90 days; after that, Google deletes them automatically. To request deletion sooner, see the data deletion page.

A backup file you export stays wherever you saved it. One you send us for recovery is deleted, along with the recovered copy, as soon as we send it back to you.

Tester sign-up answers are kept until the test program they apply to ends — for iOS, until the app is published on the App Store — and are then deleted; sooner, if you ask.

Children's privacy

HueFlow is not directed at children and does not knowingly collect data from anyone under 13.

Changes to this policy

We may update this policy as the app evolves. The date at the top of this page indicates the most recent version.

Contact

Questions about this policy or your data? Write to sinus.dev.app@gmail.com or use the button below.

✉️ Get in touch