Privacy Policy

1. Scope

This Privacy Policy describes how LarsCo LLC handles personal information in connection with ROAMiQ Cloud (the "Service"), including cloud.roamiq.com, the ROAMiQ Connect Home Assistant add-on (including ROAMiQ panels that sign in through it), the ROAMiQ app for iPhone (the "App"), and supporting APIs.

2. Who we are

LarsCo LLC, a South Dakota limited liability company, is the controller of the personal information described in this policy. Contact us at [email protected].

3. What we collect

Account data. Email, full name, password hash (managed by Supabase Auth using Argon2id), optional TOTP secret and backup codes if you enable multi-factor authentication.

Signing in with Apple, Google or GitHub. If you sign in with one of these providers, it gives us the identifier it uses for you, your email address, and the basic profile details it shares, such as your name and a link to your profile picture. We use them only to create your account and sign you in. We never receive your password for that provider.

Sign in with Apple. Wherever we offer Sign in with Apple, Apple gives us:

• a user identifier that Apple issues for your Apple Account and that is unique to ROAMiQ. We store it with your account to recognise you when you sign in again;
• an email address. If you chose Hide My Email, this is a private relay address from Apple, and Apple forwards the mail we send to it to you. We use it as your account email;
• your name, only the first time you sign in and only if you choose to share it. We save it as your account name only if your account does not already have one.

Apple also issues ROAMiQ a token for your Apple sign-in. We keep it encrypted (AES-256-GCM) and use it for one purpose: to revoke ROAMiQ's access to your Apple Account when you delete your ROAMiQ account, as Apple requires. If you have used Sign in with Apple in more than one place, such as the App and cloud.roamiq.com, we attempt to revoke every token we hold for you. To protect your account from takeover, we do not join an Apple sign-in to an existing ROAMiQ account when the match is not certain, and we keep a record of which Apple identifiers our checks have allowed or refused for your account. You can stop using Sign in with Apple with ROAMiQ at any time in your Apple Account settings, under Sign in with Apple. The App then signs you out.

Billing data. Stripe customer ID, payment-method token (we never see PAN), billing address, invoice history, and any free-text cancellation reason / feedback you provide.

Device telemetry. From the ROAMiQ Connect add-on: an instance UUID, Home Assistant Core version, IP address as reported by HA, Cloudflare edge headers (cf-connecting-ip, cf-ipcountry — country-level geo), heartbeat status every 60 seconds, and tunnel-connected boolean.

Backup data. Full Home Assistant partial backups encrypted client-side with AES-256-GCM before upload. Each backup is accompanied by a manifest listing entity IDs, integration domains, automation / script / scene IDs and hashes, a hash of the user secrets file, and add-on slugs and versions. The manifest itself is not encrypted by design — it is the only way support can help you restore selectively.

Security and audit events. Event type, severity, source IP, instance and customer IDs, geo, IP-change deltas, and structured details.

AI usage metadata. When you use the AI features (ROAMiQ AI), we log usage metadata only: request counts, input/output token counts, the model used, the feature level (Assistant or Builder), the associated instance and customer IDs, and timestamps. We do not store the content of your AI prompts or the generated responses. Your requests are relayed to third-party model providers to generate a response; we retain only the usage metadata described here to operate, secure, bill, support, and improve the Service and to apply fair-use limits and usage caps (see Terms § 9).

Cookies and local storage. Supabase SSR session cookies, MFA challenge cookies, and the legal_acceptance_* records. No third-party trackers on cloud.roamiq.com.

Communications. Transactional email via Microsoft 365 / Graph from [email protected]. Marketing email via Klaviyo only when you have opted in.

3A. The ROAMiQ iOS app

The App lets you control your ROAMiQ system and receive its alerts. Some of what it handles stays on your phone, some goes only to your own hub, and some goes to ROAMiQ Cloud. This section covers each.

What the App sends to ROAMiQ Cloud.

• Your account. The App uses the same ROAMiQ account as the website, so the account data and sign-in details in Section 3 apply. In the App you can create an account with your email, a password and an optional name, or sign in with Apple, Google or GitHub.
• Notifications and Live Activities.For each hub you turn alerts on for, the App registers with ROAMiQ Cloud. We store Apple's push token for your phone, a random identifier the App creates for this installation, the hub it belongs to, the App and iOS versions, and the push environment. If you use Live Activities, we also store Apple's Live Activity push tokens, the kinds of Live Activity the App supports and, for each Live Activity that is running, its identifier and type. Your hub never receives these tokens. It receives only a random handle that ROAMiQ Cloud can match to them.
• Delivery.When your hub sends an alert or a Live Activity update, ROAMiQ Cloud passes it to Apple's Push Notification service (APNs), which delivers it to your phone. We do not store the content of your notifications. We keep daily counts of delivery attempts, successes and errors per registration, to apply the daily notification limit and to detect outages.
• App activity counts. Each time the App checks your account with ROAMiQ Cloud, for example when it opens, we count that your account used the App, in five-minute periods. These counts contain nothing about what you did in the App. We use them to detect outages that affect iPhone users.
• Legal and marketing choices.When you accept our terms and policies in the App, we record which documents and versions you accepted, when, the App installation identifier, the App version, your IP address and your device's user agent. Your marketing email choice is recorded separately, and email marketing stays off unless you opt in.
• Security events. Sign-ins, account deletion and notification registration changes are recorded as security and audit events, as described in Section 3.

What the App sends only to your own hub.When you connect the App to a hub, it registers your phone with that hub's Home Assistant. The registration request carries a name for your phone (by default its model, such as "iPhone", or a name you choose), the App's installation identifier, the App and iOS versions, and the address ROAMiQ Cloud uses to deliver your hub's notifications to your phone. This request is protected by HTTPS (TLS) but not by the App's own encryption described below. If it reaches your hub through a remote-access route, such as the ROAMiQ Cloud tunnel (carried by Cloudflare) or another route your hub is set up to use, the provider of that route ends the TLS connection at its edge and can technically see these registration details. ROAMiQ Cloud's own servers do not receive or store them. Your hub answers with an encryption key for this phone. After that, the App sends your hub:

• updates to your phone's name, the App and iOS versions, and the notification address;
• phone status you can use in automations: battery level, whether the phone is charging, whether Low Power Mode is on, whether ROAMiQ notifications are allowed, the App's location permission, and the App version;
• the buttons you press on its notifications and Live Activities;
• your location, if you turn it on for that hub, as described below.

The App encrypts everything in that list with the key shared only between the App and that hub (XSalsa20-Poly1305). That is true whether it travels over your local network, through the ROAMiQ Cloud tunnel, or through another remote-access route your hub is set up to use, so neither ROAMiQ Cloud nor our tunnel provider can read it. ROAMiQ Cloud does not store anything the App sends to your hub, including the registration details above. Your hub's Home Assistant keeps it the way Home Assistant normally does, including location history. That data stays on your hub, under your control. By default, ROAMiQ Rewind backups leave out Home Assistant's history database, where location history is kept. If you choose to include it, it becomes part of your encrypted backups (Sections 3 and 8). If you give someone temporary access to your Home Assistant, such as a technician or ROAMiQ support, they can see what your Home Assistant shows, which can include location history.

Location: per hub, arrive and leave only. Location is off until you turn it on, and you choose for each hub separately:

• Off. The hub receives no location.
• Places.The hub receives only the name of the place you are in, chosen from that hub's own Home Assistant places you selected, or that you are not in any of them. No coordinates are sent.
• Exact.The hub receives your coordinates and their accuracy, plus altitude, speed and heading when iOS provides them, and your phone's battery level.

If you turn off Precise Location for the App in iOS, any coordinates sent are approximate. With "While Using the App" permission, the App sends location only while you are using it. With "Always" permission, the App can tell your hub that you arrived or left while it is closed. It does this with two iOS services: region monitoring, which notices when you enter or leave the places your hubs know about, and, for hubs set to Exact, the significant-change location service, which notices larger moves. Each of them wakes the App briefly to take one location reading. Starting with build 38 of the App (version 0.2.1), the App does not track your location continuously in the background. It uses standard location updates only while it is on screen and a hub is set to Exact. Earlier pre-release builds, distributed for testing through Apple's TestFlight, could keep standard location updates running in the background when a hub was set to Exact and the App had "Always" permission. You can change any hub's setting in the App, or turn location off for the App in iOS Settings, at any time.

What stays on your phone.

• Face ID, Touch ID and passcode. If you turn on App lock, iOS checks your face, fingerprint or passcode on your phone. The App learns only whether the check succeeded. ROAMiQ never receives or stores biometric data. See also our Biometric, Audio and Video Notice.
• Local network. With your permission, the App looks for your hub on the network your phone is using, so it can connect directly without the internet, and checks that the hub it found is really yours before connecting. The results of that search stay on your phone. The App does not read your Wi-Fi network name.
• Diagnostics, shared only if you choose. The App keeps a log of its own activity on your phone and receives crash, hang and performance reports from iOS. Nothing is uploaded. If you tap Send diagnostics, the App puts the log and those reports, along with the App version, iOS version and phone model, into a text file and opens the iOS share sheet. You choose where it goes, and nothing is sent until you do. If you send it to us, we use it only to help with your request.

Who handles App data.Supabase stores your account and the App's notification registrations. Vercel hosts the ROAMiQ Cloud service the App talks to. Cloudflare carries traffic to cloud.roamiq.com and the tunnel to your hub. Apple delivers notifications and Live Activity updates (APNs) and, if you use it, provides Sign in with Apple. Stripe handles billing on our website; the App takes no payments and sends no payment details. The sub-processor list in Section 7 names each of them.

No advertising and no tracking.The App contains no advertising, analytics or crash-reporting software from other companies, and it does not track you across other companies' apps or websites. We do not use App data for advertising, and we do not sell it or share it for cross-context behavioral advertising.

4. How we use it

You grant LarsCo a limited, worldwide, royalty-free license to host, transmit, secure, analyze, and process Customer Content solely to provide, maintain, protect, improve, and develop the Service.

LarsCo may create and use aggregated, de-identified, or anonymized data for analytics, benchmarking, diagnostics, product development, and AI/ML model training, provided LarsCo does not attempt to re-identify it and contractually requires sub-processors to observe the same restriction. LarsCo will not use identifiable Customer Content to train AI/ML models without separate opt-in consent.

We also use personal information to:

• Operate, secure, bill, and support the Service.
• Comply with law, prevent fraud, and respond to lawful requests.
• Communicate with you about your account (transactional, always).
• Send marketing email if you opted in (you may unsubscribe any time).

5. California CPRA categories

For California residents, we collect the following CPRA-defined categories of personal information:

• Identifiers (email, full name, account UUID, sign-in provider identifiers including the Sign in with Apple user identifier, Apple push and Live Activity tokens, and the App installation identifier).
• Internet or other electronic network activity (IP address, country, request logs, App activity counts).
• Commercial information (Subscription, invoices).
• Sensitive personal information — account log-in credentials and MFA secret, and the precise location you choose to send to your own hub through the App, which travels encrypted and which ROAMiQ Cloud does not read or store. Used solely to provide and secure the Service; no further uses requiring opt-out under Civ. Code § 1798.121(a).

We do not sell personal information or share it for cross-context behavioral advertising. We have a 30-day right-to-cure period under Civ. Code § 1798.150(b) for non-personal-injury claims.

6. Legal basis

Where applicable law requires it, our legal bases are: performance of a contract (operating the Service for you); legitimate interest (security, fraud prevention, product development); legal obligation (tax records, lawful requests); and consent (marketing email, identifiable AI training, optional features). You may withdraw consent at any time.

7. Sub-processors

We share personal information with sub-processors in the following categories to operate the Service:

• Hosting and edge-compute providers (application hosting, edge functions).
• Database, authentication, and object-storage providers.
• DNS, edge-proxy, and tunnel-transport providers.
• Payment processors and billing-address services.
• Push-notification delivery for the App (Apple Push Notification service).
• Transactional-email providers.
• Marketing-email and email-engagement platforms (only when you have opted in).

The current named set of sub-processors is published on our sub-processor list and changes are announced via /subprocessors.rss. We update that list as the set changes; this Privacy Policy is not re-versioned each time.

8. Internal access

LarsCo employees with the admin or support role can view security events, IP addresses, country-level geo, and backup manifests (the entity-ID / integration list — by design unencrypted) when supporting an active customer ticket.

Backups are encrypted client-side with AES-256-GCM before upload. Support staff do not have access to the keys required to decrypt backup contents. Managed-mode backups can be decrypted by LarsCo operations personnel using the REWIND master key, held under restricted control, for purposes consistent with this Privacy Policy — restoring your data on request, security incident response, lawful requests, and the analytics and development uses described in Section 4 (which use aggregated or de-identified data unless you have opted in to identifiable use).

9. Retention by category

10. Your rights

• Access & portability — download a JSON dump of your data at /account/legal.
• Correction — update profile fields from /account.
• Deletion (RTBF) — in the App under Account › Delete account, or at /account/delete. Deletion also attempts to revoke ROAMiQ's Sign in with Apple access and removes the App's notification registrations and tokens. We issue a signed deletion receipt.
• Restriction / objection — email [email protected].
• Withdraw consent — unsubscribe from marketing email; disable MFA; opt out of identifiable AI training (when the toggle ships); turn off location or alerts for any hub in the App, or the App's location and notification permissions in iOS Settings.
• Complaint — to the FTC, your state Attorney General, or the appropriate data-protection authority.

11. Children

The Service is not directed to anyone under 16 and we do not knowingly collect personal information from a child under 13. If we learn that an account belongs to a child under 13, we will terminate the account and delete the data within 14 days as required by COPPA (16 C.F.R. Part 312). Parents or guardians may contact [email protected] to request immediate deletion.

12. International transfers

The Service is currently offered only to US residents. A country-level geo gate at the network edge returns HTTP 451 to requests originating outside the US during sign-up. Limited incidental anycast routing through Cloudflare's global network may briefly process packets outside the US; payload contents are not stored at those edges. If and when we expand internationally, standard contractual clauses (SCC Module 2 / 3) and a transfer-impact assessment will be put in place.

13. Security

We use TLS 1.3 in transit; AES-256-GCM client-side encryption for backups; Argon2id password hashing; signed session cookies; CSP; rate-limiting; security-event monitoring; and least-privilege access controls.

California SB 327 (Cal. Civ. Code § 1798.91.04). Connected devices manufactured or sold by LarsCo include unique pre-programmed credentials and require new credentials before first access; no default shared passwords; security features appropriate to the function and to the information collected.

Wiretap Act, 18 U.S.C. § 2511(2)(a)(i). Processing of communications by the Service occurs solely in the ordinary course of providing the Service; LarsCo does not intercept communication content except as required by law or expressly consented to by all parties.

PCI-DSS scope.LarsCo does not store, process, or transmit cardholder data; all payment processing is performed by Stripe via Stripe Elements (Payment Element and Address Element). LarsCo's environment is in PCI-DSS SAQ A-EP scope.

To report a vulnerability, see our Vulnerability Disclosure Policy or email [email protected]. We commit to acknowledging reports within 5 business days.

14. Health, medical, and life-safety exclusion

ROAMiQ Cloud is not a medical device under 21 U.S.C. § 321(h), is not HIPAA-covered (45 C.F.R. Parts 160 / 164), and is not certified for use as a fire, smoke, CO, intrusion, freeze, oxygen, refrigerated-medication, CPAP, BiPAP, or other life-safety alarm. You must not rely on the Service for such purposes. If you connect medical or safety-critical equipment to your Home Assistant, you do so at your own risk and must maintain independent UL-listed alarms and clinically-appropriate monitoring. See Terms § 11 for the full safety-critical disclaimer.

15. Changes to this Privacy Policy

For material changes, we will provide at least 30 days' advance notice by email and via an in-product banner, and we may require an in-product re-acceptance gate before the effective date. Non-material edits update the version history below.

• Version 3, 2026-10-01 (non-material).Added Section 3A on the ROAMiQ iOS app and the Sign in with Apple details in Section 3, named Apple's Push Notification service in Section 7, and corrected retention periods in Section 9. These describe how the Service already works; nothing you agreed to changed.
• Version 2, 2026-07-07. Added ROAMiQ AI usage metadata.

16. Contact

LarsCo LLC · Sioux Falls, South Dakota · [email protected]