Privacy Policy
Last updated: September 27, 2026
Introduction
SmartHomeQR ("we", "our", or "the app") is committed to protecting your privacy. This Privacy Policy explains how we handle information when you use our iOS and Android applications.
Data Collection
We take nothing from your vault for ourselves. Your homes, rooms, devices, codes, photos and notes stay on your devices and in the sync and backup services you choose, unless you export or share them yourself. What the App itself sends us, on both iOS and Android, is anonymous usage events and crash reports through PostHog, so we can see how the App is used, how well scanning works, and which crashes to fix. They never include your codes, photos, or the names of your devices, rooms and homes, and you can turn them off (see Usage and crash reports). On iOS, SmartHomeQR otherwise works on your devices and your personal iCloud account; we run no servers of our own and have no way to access your vault. Besides what the App sends through PostHog, what can reach us from an iPhone or iPad is limited to a crash report you chose to share with Apple, the App Store's record that you bought Premium, any review you choose to post, and any email you choose to send us. On Android, your vault stays on your phone unless you export or share it yourself; besides what the App sends through PostHog, what leaves the phone is described under Third-Party Services: ML Kit scan diagnostics, the Google Play purchase check for Premium, the rating and review text you choose to submit through the in-app review prompt, and crash reports if you opted in to sharing them on your device; Android's own backup and a transfer to a new phone can also copy App data other than your vault, such as its preferences and settings (see Data Storage), and any email you choose to send us reaches us. The feedback row in the App's settings opens an email to us in your own mail app, filled in with the App's version and, on Android, your phone's manufacturer, model and Android version; nothing is sent unless you send it. The current Android release does not offer Cloud Sync. When a future release adds it, it will be off by default; if you turn it on, your homes, rooms, devices, QR images and setup codes will be stored in a Google Firebase database operated for this app, tied to your Google sign-in, and used only to sync your devices. They will not be end to end encrypted at first; a later update will add that. We do not look at, analyze, or share this data.
Data Storage
All data you create in SmartHomeQR is stored:
- Locally on your device - Your homes, rooms, devices, and QR code images are stored in your device's local storage.
- iOS, in your iCloud account - If you have iCloud enabled, your data syncs privately through Apple's iCloud service to your other devices. This sync is encrypted and managed entirely by Apple.
- iOS, on your Apple Watch - If the SmartHomeQR Apple Watch app is installed, your iPhone sends it your devices with their names, room and home names, QR contents and setup codes, and the watch stores them locally so it can show your codes.
- iOS, in your device backups - The App does not exclude its data from your iPhone or iPad backups, so depending on your backup settings, an iCloud Backup or a backup to a computer can contain a copy of your vault. Apple keeps an iCloud Backup under your Apple Account.
- Android, in your Google backup - The database that holds your vault is never included in Android's backup or in a transfer to a new phone. If backup is on in your phone's settings, Android can copy the App's shared preferences, the small settings files kept by the App and the libraries inside it, to your Google account, and a transfer to a new phone can copy them too. They include whether the App has suggested upgrading, which saved device each home screen widget shows, by an internal identifier rather than its name or code, and the per-installation identifier ML Kit keeps. On Android 11 and earlier the backup and transfer can also include the App's other files, apart from the vault database and temporary files: its settings files (settings such as dark mode and the app lock, whether Premium is unlocked, and when the App last asked for a rating) and data kept by the libraries inside it, such as ML Kit diagnostics waiting to be sent to Google. Versions with usage and crash reports leave the PostHog installation identifier out of both.
- Android, in Firebase when Cloud Sync is on - not offered in the current Android release. When a future release adds Cloud Sync it will be off by default; if you turn it on, your data is copied to a Google Firebase database for this app so your devices can sync. Turning it off stops syncing immediately and keeps your local data.
Data We Do NOT Collect
- Your name, email address or phone number: the App never asks for them. If you email us, including through the App's feedback row, we receive your email address and what you write. Cloud Sync, once an Android release offers it, is tied to your Google sign-in, as described above
- Location data: the App never reads your device's location, and PostHog is set not to work out a location from your IP address (usage events and crash reports do carry your device's time zone setting, described under Usage and crash reports)
- Usage analytics beyond the anonymous usage events and crash reports described under Usage and crash reports, which you can turn off (Google's ML Kit software on Android also reports scan diagnostics and usage events to Google, described below)
- Advertising identifiers: the App does not use your device's advertising identifier. The usage events and crash reports it sends carry no name or account, only random identifiers that PostHog's library creates for the installation, the session and each event. On Android, ML Kit sends Google a per-installation identifier, and the Google Play purchase token identifies your Premium purchase, both described below
- Your QR codes and setup codes leave your device only when you export or share them yourself, through iCloud sync, a device backup, or your paired Apple Watch on iOS (see Data Storage), or, in a future Android release that offers it, through Cloud Sync; usage events and crash reports never include them
- Your photos, the names of your homes, rooms and devices, your notes, and the text the App reads from a label are never included in usage events or crash reports
Third-Party Services
SmartHomeQR includes no advertising services, does not use your device's advertising identifier, and does not track you across apps or websites owned by other companies. On iOS and Android it sends anonymous usage events and crash reports to PostHog, described under Usage and crash reports. On Android, Google Play Billing handles the one-time Premium purchase: Google Play keeps your payment details; the app receives the purchase record (the product and a purchase token, never card details) when it checks with Google Play at launch and confirms the purchase back to Google Play. The optional in-app review prompt sends the rating and any review text you choose to write to Google Play, where you can edit or delete it. If you opted in to sharing diagnostics on your device, Google Play (Android) or Apple (iOS) also forwards crash reports to us. On iOS, the Premium purchase goes through Apple's App Store (StoreKit) and the rating prompt through the App Store's review sheet, both operated by Apple. Beyond those and PostHog, the external services involved are Apple's iCloud (iOS, optional); Google ML Kit on Android, which performs barcode and text recognition on your phone and whose software sends Google diagnostics and usage data about its own work: device information (such as manufacturer, model, OS version and build, and the phone's machine learning hardware), the app's package name and version, a per-installation identifier that Google says is not intended to uniquely identify a user or physical device, performance measurements such as timing, the image format and resolution and the input and output sizes it handled, its own version, and events such as starting up, reading an image and releasing resources, with their error codes, as described in Google's ML Kit disclosure, and never your codes or photos; and Google Firebase (Android, only in a future release and only when you enable Cloud Sync; see Firebase privacy). iCloud is governed by Apple's Privacy Policy, and PostHog by PostHog's privacy policy.
Usage and crash reports (iOS and Android)
The iOS and Android apps send anonymous usage events and crash reports to PostHog, Inc., a product analytics service, which holds them for us in its United States cloud, where we can read them. We use them to see how the App is used, how well scanning works, how many people go on to add a device or unlock Premium, and which crashes to fix. The Apple Watch app and the widgets on iPhone and iPad do not include PostHog's library and send nothing to PostHog.
Usage events. A usage event records that one of these things happened in the App: the App was installed, updated, opened (recording whether it was launched fresh or returned from the background) or sent to the background; a screen was shown, by a fixed name from the App's own list (homes, all devices, settings, rooms, devices, device details, scanner, Unlock Premium, export and import), never by its title, so never by the name of a home, room or device; a scan started, recording whether it used the camera, a photo you picked, or a rescan of a saved device; a scan finished, recording the same source, how it ended (a code was read, the reading needs your check, nothing was read, or it was cancelled), the kind of code it found (HomeKit, Matter, Z-Wave, Thread, Zigbee, unknown or none), how confident the reading was (high, medium, low or none), and whether it found a code symbol, such as a QR code, and whether it found printed text, each only as yes or no; a new device was saved, recording its category from the App's fixed list, the kind of code, whether it came from a scan, and how many devices the App holds after saving it; the Unlock Premium screen was shown, recording what opened it (reaching the free limit on devices, homes or rooms, an import that would go past the free limits, the NFC tag feature, the App's suggestion to upgrade, or the upgrade row in settings); a purchase was started or completed, recording what opened the Unlock Premium screen it came from, or, for a purchase that went through later, such as one waiting for Ask to Buy approval, only that it completed outside that screen; a purchase failed, recording why (cancelled, pending approval or payment, already owned, not available, or an error); a restore of an earlier purchase finished, recording how (restored, nothing to restore, failed, cancelled, or pending); a backup export was handed to the share sheet or saved; an import finished, recording whether it worked, was refused because it would go past the free limits, or failed; a device was opened from a widget, an NFC tag or a shortcut, recording which of the three; the app lock or dark mode switch was changed, recording which one and its new on or off value; the App asked the store to show its rating sheet; Share App was tapped; or the reporting switch described below was turned off. Some of these happen on only one platform.
What reports never carry. Neither usage events nor crash reports carry your setup codes, the contents of a QR code, decoded HomeKit or Matter values, lock user or programming codes, serial numbers or MAC addresses, any text the App reads from a label, your photos, the names of your homes, rooms or devices, your notes, the manufacturer or model you saved for a device, which home, room or device was involved, the links stored in widgets, NFC tags or shortcuts, the contents or error messages of an import or export, anything you copy, your Google Play purchase token, or any sync account identifier.
Details on every report. Usage events and crash reports include these details where available: the time it happened, a random identifier for the event itself, the random identifier for the installation, a session identifier, the App's name, package identifier, version and build, whether Premium is unlocked, the name and version of PostHog's library, the device's manufacturer and model, the device category (phone or tablet), the operating system and its version, the screen size, the time zone, and the type of network connection (for example Wi-Fi or cellular). On iOS they also include your language setting (the language only, not the region), whether the App was installed from TestFlight or from outside the App Store, and whether it runs on a simulator or on a Mac. On Android they also include your language and region setting, the screen density, whether it runs on an emulator, the name of the mobile network operator when the phone reports one, and the system's standard user-agent string, which repeats the Android version and device model; they also carry the fixed name of the last screen shown, when the current session started and how long it has lasted, a marker that screen recording is off, and how many reports are waiting to be sent. The device model is sent as a model name or hardware code, never as the personal name you give your device. Reports also carry markers PostHog's library uses to process them, such as whether the installation has been identified to PostHog, which in this App it never is. Reports never carry your phone number, your Apple Account or Google Account, or your device's advertising identifier. When the App has just been updated, the update event also carries the version and build it was updated from.
Crash reports. While reporting is on, the App can report crashes: on iOS a crash is saved on the device and sent the next time the App starts with reporting on; on Android reports cover crashes in the App's Java and Kotlin code, not crashes inside native code. A report of the same kind may also be sent for an error the App catches and chooses to record. On iOS it carries the kind of error, how it was caught and how severe it was, the number of the thread it happened on, and the stack trace (the list of the App's functions that were running at the time, with their memory addresses). So that the trace can be turned back into readable function names, it also carries a description of each piece of program code involved: its build identifier and where it was loaded in memory, and it can carry the code's file path on the device, which includes the folder name the system assigns to the App's installation. On Android it carries the kind of error, how it was caught and how severe it was, the number of the thread it happened on, and for each step of the stack trace the name of the class and function, and the source file name and line number where available, together with an identifier for the App's build that lets the names be read; it carries no memory addresses or list of loaded code. On both platforms the App removes the error's message from every crash report before it leaves the device, because a message written by the system can quote a value the App was handling, such as part of a setup code. The report also carries the details above.
The installation identifier. The random identifier is created by PostHog's library inside the App the first time it runs with reporting on. It is not taken from your device, your Apple Account or your Google Account. It lives in the App's own storage on the device and is kept out of backups on both platforms: on iOS PostHog's library marks its files as excluded from device backups, and on Android the App's backup leaves them out. Uninstalling the App removes it, and a reinstall, or a restore from a backup, starts a new one. The App never tells PostHog who you are, so PostHog keeps no profile of you, only events under that identifier.
IP address. Every connection to PostHog, like any internet connection, gives PostHog your device's IP address. Our PostHog project is set to discard client IP addresses, so the address is not stored with the reports, and no location is worked out from it or stored. PostHog's library also contacts PostHog to fetch its settings for the App; that request names only our PostHog project, not your installation, and reaches PostHog from your IP address in the same way. When surveys are enabled in a version of the App, the library also asks PostHog whether a survey applies to this installation, whether or not one is then shown; that request carries the installation identifier, the App's version and build, its package identifier, the operating system and its version, the device category, the time zone, and the name and version of PostHog's library.
How long they are kept. PostHog keeps these events available to us for seven years, the retention period of PostHog's paid plans, as its events retention page sets out. PostHog describes that period as the window within which events can be queried, not as a date on which they are erased, so we do not promise that reports are deleted when it ends. We may delete data sooner by deleting it from our PostHog project. PostHog handles them under its privacy policy.
Turning them off. You can turn usage events and crash reports off in the App with the switch Share anonymous usage and crash reports: on iPhone and iPad under More > Privacy, and on Android under Settings > Privacy. The switch is on when you install the App, and when you first update to a version that has it. Turning it off while reporting is running sends one last event recording that the switch was turned off, together with any reports still waiting on the device, for up to five seconds; then it stops all usage events and crash reports at once and deletes any report that was not sent. While it stays off, the App does not start PostHog's library at all, and a crash that happens while it is off is never reported, even after you turn it back on. On iPhone and iPad, turning it back on resumes usage events straight away; crash reports, and the events recording that the App was opened or sent to the background, may resume only from the next time the App starts. On Android, if reporting already ran earlier while the App was running, turning it back on takes effect the next time the App starts, and turning the switch off again before then sends nothing; if reporting has not run since the App started, turning it on resumes usage events straight away. Reports already sent carry no name or account, only the random installation identifier, which the App never shows you, so we cannot look reports up by name or account, or find the ones that came from your device. The one exception is a survey answer you wrote whose exact text you give us, when that text is distinctive enough to match a single answer, as described under Feedback survey. Email support if you have questions about them.
Feedback survey. The App may show a short, optional survey inside the App, asking for your feedback on SmartHomeQR. Answering is up to you, and you can dismiss it. Your answers are sent to PostHog with the same random installation identifier as the usage events, and we read the written answers ourselves. Showing the survey and dismissing it are recorded as events too, with the survey's identifier, and if you dismiss it after answering part of it, the answers you had given are sent with the dismissal. Please do not put your name, email address, setup codes or other personal details in your answers; a written answer can identify you if you write something identifying. The survey is shown only while usage and crash reports are switched on. The check for whether a survey applies, described under IP address above, may itself be recorded as an event naming the survey rule and its result, and that result may be attached to later reports from the same installation, even when no survey appears. If you tell support the exact text of an answer you wrote, and that text is distinctive enough to match a single answer, we can find that answer and the other events sent under the same identifier. If other people gave the same answer, for example a short common phrase, we cannot tell which answer is yours and cannot act on it. PostHog's deletion tools work on person profiles, which these anonymous events do not have, so we will remove them as far as those tools allow, and a complete removal before the retention period ends may not be possible.
Earlier versions. Versions of SmartHomeQR that do not have the Share anonymous usage and crash reports switch do not include PostHog's library and send nothing to PostHog: no usage events, no crash reports and no survey answers. Everything else in this policy applies to them as written.
Camera and Photo Library
SmartHomeQR requests access to your camera and photo library solely to read QR codes and printed setup labels. On iOS the images you capture or import are stored on your device and, if enabled, in your iCloud account. On Android the source image of a scan is decoded and discarded, and the app stores a freshly generated QR image of the code instead; importing a backup also stores any pictures the backup contains, including photos saved by the iOS app. These images are kept on your phone (and, once a future Android release offers Cloud Sync and you turn it on, in Firebase). Beyond the storage you chose, they leave your device only if you export or share them yourself. We do not transmit them anywhere else.
Data Deletion
You have control over the vault you build in the app; records held by Google or Apple (ML Kit diagnostics, Google Play purchase records, crash reports you opted to share) are governed by their policies, and usage events, crash reports and survey answers sent to PostHog are handled as described below:
- Delete individual items within the app at any time
- Uninstall the app to remove all local data, including the random installation identifier used for usage and crash reports
- Manage iCloud data through your device's Settings > [Your Name] > iCloud
- Deleting items in the app or uninstalling it does not remove copies already in a device backup. iCloud and Google backups follow Apple's and Google's own rules for replacing and expiring backups and can be managed in your backup settings; a backup made to a computer is managed on that computer
- On Android, once Cloud Sync is offered, turn it off at any time; deleting a device in the app also deletes its cloud copy, and you can email us to have all your cloud data removed
- Usage events, crash reports and survey answers: turning the switch off stops new reports at once. Deleting items in the app or uninstalling it does not remove what was already sent; it stays under the retention terms described under Usage and crash reports. Reports already sent carry only a random installation identifier, so we cannot look them up by name or account. The one exception is a survey answer you wrote whose exact text you give us, when that text is distinctive enough to match a single answer: then we can find the answer and the events under the same identifier and remove them as far as PostHog's deletion tools allow; if other people gave the same answer, we cannot tell which one is yours and cannot act on it
Children's Privacy
SmartHomeQR does not knowingly collect personal information from children under 13. The App needs no account and asks no one for a name, age or email address. It stores the vault a user builds themselves, on their own device or in the storage service they choose, and its usage events and crash reports carry no name or account, as described above.
Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated revision date.
Contact
If you have questions about this Privacy Policy, please contact us at: