Overview
VarApps ("we", "our", or "us") built the VarThings app as a local-first smart home platform. This policy explains what information we collect, why we collect it, and how we protect it.
VarThings is local-first. Your smart home devices are discovered and controlled entirely on your local network. Device state, commands, and automation data never leave your home or pass through our servers.
Information We Collect
Account information
When you create a VarThings account, we collect:
- Email address — used for account authentication and password reset emails
- Password — stored as a secure hash; we never see your plain-text password
Local network data
VarThings scans your local Wi-Fi network to discover compatible smart home devices (Shelly, VarAudio, and others). This scan operates entirely on-device and on your local network. No network topology, IP addresses, or device identifiers are transmitted to our servers.
App usage
We do not collect analytics, crash reports, or behavioural data from within the app. We do not use any third-party analytics SDKs.
VarAudio
When using the VarAudio feature, internet radio streams are fetched directly from the station's URL on your device. We do not proxy or log your listening activity.
How We Use Your Information
- To create and manage your VarThings account
- To send password reset emails when you request them
- To respond to support requests you send us
- To deliver OTA firmware updates to your VarAudio devices
We do not sell, rent, or share your personal information with third parties for marketing purposes.
Third-Party Services
Supabase (Authentication)
We use Supabase to handle account authentication and password reset emails. Your email address is stored in a Supabase-hosted database. Supabase is SOC 2 Type II compliant. You can review Supabase's privacy policy at supabase.com/privacy.
No other third-party services have access to your account data.
Data Retention
We retain your account data (email address) for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us at support@varthings.com. We will process deletion requests within 30 days.
Security
All communication between the app and our authentication service uses TLS encryption. Passwords are hashed using industry-standard algorithms and are never stored in plain text. We regularly review our security practices.
Children's Privacy
VarThings is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and data
- Object to or restrict how we process your data
- Data portability — receive your data in a machine-readable format
To exercise any of these rights, contact us at the address below.
Changes to This Policy
We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.
Contact Us
If you have any questions about this privacy policy or how we handle your data, please reach out: