Privacy Policy

Effective 10 November 2026

This policy covers a private, self-hosted Home Assistant installation and its Google Assistant SDK integration ("the application"). The application is used by one household, on one privately owned server, and is not offered to the public.

What the application stores

Two things, both on the owner's own private server:

• OAuth credentials — an access token and a refresh token issued by Google to the homeowner's own Google account, plus a client ID and client secret for the homeowner's own Google Cloud project. These are stored in the Home Assistant configuration database on the local server.
• Command history — the short text commands the homeowner sends to the application (for example "turn on the living room lights") may appear in the local Home Assistant log and in the local Google Assistant conversation history associated with the homeowner's Google account.

What the application does not do

• It does not collect analytics, telemetry, usage statistics, or crash reports.
• It does not use cookies, advertising identifiers, or any third-party tracking scripts.
• It does not create profiles, and it does not share, sell, rent, or disclose any information to any third party.
• It does not upload data to any server other than Google's own Assistant API endpoint, which is inherent to relaying a command to Google.
• This website sets no cookies and runs no scripts.

How information reaches Google

When the homeowner issues a command, the application sends that command text, authenticated with the homeowner's own Google credentials, to Google's Assistant API. Google's handling of that request is governed by the Google Privacy Policy. The application requests only the assistant-sdk-prototype scope, which allows it to send commands and receive responses; it is not granted access to Gmail, Drive, Calendar, Contacts, or any other Google account data.

Where data lives

All application data lives on hardware owned and physically controlled by the homeowner, on a private local network. Communications with Google are made over HTTPS.

Retention and deletion

Credentials are retained only while the integration is connected. To revoke access and delete all stored credentials:

• Visit myaccount.google.com/permissions and remove the application's access, and
• delete the integration entry in the Home Assistant interface, which removes the stored tokens from the local database.

Local logs can be deleted from the server at any time.

Children

The application is not directed at children and is not used by anyone outside the owning household.

Changes

If this policy changes, the revised version will be published on this page with a new effective date. There is no mailing list and no notification mechanism, because there are no users to notify.

Contact

Privacy questions can be raised with the address registered as the owner of the associated Google Cloud project.