Privacy

Who is responsible

The HA NOVA maintainer is responsible for this site (the controller). Contact: GitHub Issues. Issues are public, so don’t put personal data in one. Say what you need, and the maintainer will set up a private channel.

Hosting of hanova.app (GitHub Pages)

GitHub Pages hosts hanova.app (GitHub, Inc., USA). When you open the site, GitHub handles the data it needs to send you the page. This is mainly your IP address, the date and time, and the page you asked for. GitHub says it stores the IP address for security. The purpose is to deliver the site safely. The legal basis is Art. 6(1)(f) GDPR: a legitimate interest in a safe, working website. The maintainer can’t see these logs. GitHub decides how long it keeps them.

This sends data to the USA. GitHub is certified under the EU-US Data Privacy Framework. The European Commission covers the Framework with an adequacy decision (Art. 45 GDPR). Details: GitHub's privacy statement.

Cookies and tracking

hanova.app sets no cookies. It uses no tracking and no analytics. No fonts, scripts, or images load from other services.

Demo house (demo.hanova.app)

The public demo house runs on a server at Amazon Web Services (AWS) in Frankfurt am Main. AWS runs it as a processor (Art. 28 GDPR). An access log is kept when you open the demo house or the page hanova.app/demo/. (That page asks the demo which Home Assistant version it runs.) The log holds your shortened IP address (last byte set to 0), the time, the address you asked for, and technical connection data. It holds no headers. A new log file starts every day at 00:00 UTC. No entry is older than 6 days, and older files are deleted. The purpose is to stop abuse. The legal basis is Art. 6(1)(f) GDPR.

Home Assistant gets only the shortened IP address (last byte set to 0). It stores it in the sign-in token and shows it in a notice after failed sign-ins. Other visitors can see both, and everything you enter in the demo house. The purpose is to run the demo. The legal basis is Art. 6(1)(f) GDPR. All of this is wiped at the top of every hour. Don’t enter personal data there.

You can add the demo house to Claude, an AI assistant by Anthropic, or to ChatGPT, an AI assistant by OpenAI. Then that company’s servers connect to the demo house for you. For the chat, the demo sees those servers’ addresses, not yours, and the access log keeps them shortened like any other. The login page opens in your own browser, so that visit is logged like any other. Home Assistant keeps the chat app’s sign-in until the top of the hour. The connection keeps the changes the chat app prepares and a log of which tool ran and if it worked. No chat text and no address are in that log. Both are deleted at every reset. What you type in Claude or ChatGPT is up to Anthropic or OpenAI and their privacy policies, not this demo. The purpose is to let you try HA NOVA in a chat app. The legal basis is Art. 6(1)(f) GDPR.

Your browser loads integration icons straight from brands.home-assistant.io. This is a service of the Open Home Foundation (Switzerland), delivered through Cloudflare. It gets your IP address. No referrer is sent. The purpose is to show the icons. The legal basis is Art. 6(1)(f) GDPR.

Install count of older versions

Older versions of HA NOVA could send a weekly install count, but only if you agreed (Art. 6(1)(a) GDPR). The count holds a random install ID (stored only as a hash), the HA NOVA and Relay versions, and the operating system. The times of the first and last report are stored too. Cloudflare, Inc. (USA, certified under the EU-US Data Privacy Framework) handles your IP address as a processor. The count itself does not store it. Current versions send nothing, so updating stops the reports. Entries with no new report are deleted after 60 days. Details: PRIVACY.md.

Do you have to give data?

No law or contract makes you give any data. But without an IP address, the site and the demo can’t be delivered to you.

Your rights

You have the right to see your data (Art. 15 GDPR) and to correct it (Art. 16). You can have it deleted (Art. 17) or limit its use (Art. 18). You can take back your consent at any time, for the future (Art. 7(3)). To do any of this, use the contact above. You can also complain to a data protection authority (Art. 77 GDPR). This can be the one in the EU member state where you live or work, or where the claimed breach happened.

Right to object

You can object at any time to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). Your reason must come from your own situation.

Last updated: 22 October 2026