Privacy Policy

1. Overview

This project is a demonstration IoT control platform. It showcases how a secure frontend and backend can manage users and devices using modern web technologies. It is designed for testing, learning, and demonstration — not for handling sensitive personal data or production-grade use.

2. Data Collected

• Account Information: Username, email, and (optionally) phone number entered at signup.
• Device Data: Each device or switch name you add (label, state, timestamps).
• Session Info: Temporary login sessions stored securely using JWT.
• Recovery Code: A one-time generated code for account recovery purposes, stored securely (hashed) and visible only once during signup.

3. Security & Data Handling

• Database (D1): All user and device data is stored in a D1 database managed by Cloudflare. Each user record is isolated and linked via a unique identifier.
• Key-Value (KV): Used for session handling or lightweight caching when required.
• Password Hashing: User passwords are never stored in plain text. Each password is securely hashed using an algorithm such as bcrypt or similar salted hash before saving to D1.
• JWT Authentication: After login, a signed JSON Web Token (JWT) is issued to verify user identity for each request without exposing credentials.
• Recovery System: A unique one-time recovery code is generated on signup and shown once. It is stored in hashed form; the original is never retrievable by anyone (including the admin).
• Data Transmission: All communication is handled via secure HTTPS when deployed. For local demo mode (e.g., 0.0.0.0:8080), SSL is not enforced — this is expected in a development environment.

4. Usage & Retention

• User accounts and device entries remain stored until manually deleted or until the demo database is reset.
• Switch states are only retained for demonstration and testing purposes.
• JWT sessions automatically expire after a set time (e.g., 24 hours) or upon logout.

5. Limitations

This project is intended for testing and learning. While strong encryption and hashing practices are used, it is not a production-ready system. Do not store or use sensitive or personal data. Any data loss due to database resets or local testing is not permanent or recoverable.

6. Your Control

• You can delete your account or remove devices at any time.
• Upon deletion, your related entries in D1 (user + device) are permanently removed.
• To reset your password, use your recovery code or contact the project maintainer (for demo support only).

7. Transparency

For demo purposes, we do not collect personal data. Passwords and recovery codes are hased. Even unreal Email addresses are allowed, example like "test@gmail.com" or "t@gmail.com".