Overview
VarApps ("we", "our", or "us") built the VarThings app as a local-first smart home platform. This policy explains what information we collect, why we collect it, and how we protect it.
VarThings is local-first. Your smart home devices are discovered and controlled entirely on your local network. Device state, commands, and automation data never leave your home or pass through our servers.
Information We Collect
Account information
When you create a VarThings account, we collect:
- Email address — used for account authentication and password reset emails
- Password — stored as a secure hash; we never see your plain-text password
Local network data
VarThings scans your local Wi-Fi network to discover compatible smart home devices (Shelly, VarAudio, and others). This scan operates entirely on-device and on your local network. No network topology, IP addresses, or device identifiers are transmitted to our servers.
App usage
We do not collect analytics, crash reports, or behavioural data from within the app. We do not use any third-party analytics SDKs.
VarAudio orders
If you buy VarAudio, we collect what is needed to complete and deliver your order:
- Name, email address, delivery and billing address, and phone number
- Order details (product, price, shipping, date)
- Payment is handled by Stripe. We receive confirmation of payment and the last digits and type of the card, but we never see or store your full card number.
VarAudio
When using the VarAudio feature, internet radio streams are fetched directly from the station's URL on your device. We do not proxy or log your listening activity.
How We Use Your Information
- To create and manage your VarThings account
- To send password reset emails when you request them
- To respond to support requests you send us
- To deliver OTA firmware updates to your VarAudio devices
- To process, ship and support VarAudio orders, send order and tracking emails, and handle returns and refunds
- To meet legal duties such as tax and accounting records
We do not sell, rent, or share your personal information with third parties for marketing purposes. We share order data only with the service providers needed to complete your order, listed below.
Third-Party Services
Supabase (Authentication)
We use Supabase to handle account authentication and password reset emails. Your email address is stored in a Supabase-hosted database. Supabase is SOC 2 Type II compliant. You can review Supabase's privacy policy at supabase.com/privacy.
Stripe (Payments)
Orders are paid through Stripe. Stripe receives your payment details, email, name and address to process the payment and prevent fraud, and acts under its own privacy policy.
DHL (Delivery)
To deliver your order, we give DHL your name, delivery address, phone number and, where needed, email address.
No other third-party services have access to your account data.
Data Retention
We retain your account data (email address) for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us at support@varthings.com. We will process deletion requests within 30 days.
Order Records
We keep order records for as long as tax and accounting law requires. Other order data, such as delivery details, is deleted when it is no longer needed for delivery, returns or support.
Security
All communication between the app and our authentication service uses TLS encryption. Passwords are hashed using industry-standard algorithms and are never stored in plain text. We regularly review our security practices.
Children's Privacy
VarThings is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and data
- Object to or restrict how we process your data
- Data portability — receive your data in a machine-readable format
To exercise any of these rights, contact us at the address below.
Changes to This Policy
We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.
Contact Us
If you have any questions about this privacy policy or how we handle your data, please reach out: