Privacy Policy
The Thomas Family Dashboard ("the dashboard") is a private application used by one household to show information on a picture frame in our home. This policy explains what Google user data the dashboard accesses, how it is used, stored, shared and retained, and how to remove access.
1. Google data the dashboard accesses
The dashboard requests one Google permission: the Smart Device Management scope
(https://www.googleapis.com/auth/sdm.service), granted by the account holder through Google's Nest
permission screen. Using it, the dashboard reads only the following for the thermostats the
account holder chooses to share:
- thermostat name and room name;
- current indoor temperature and humidity;
- heating/cooling mode, target temperature(s) and Eco mode;
- whether the system is currently heating or cooling, and whether the thermostat is online.
The dashboard does not access email, contacts, files, location history, camera or doorbell video, or any other Google data. It does not currently send commands to the thermostats.
2. How the data is used
The readings are used for one purpose: to display the current status of our own thermostats on our private family dashboard. They are not used for advertising, profiling, analytics, or training machine-learning models.
3. Where data is stored and for how long
| Item | Where | Kept for |
|---|---|---|
| Google refresh token and OAuth client secret | Encrypted secret settings of our private Cloudflare Worker | Until access is revoked or the setting is deleted |
| Short-lived Google access token | Memory of the Worker only (never written to storage) | About one hour, then replaced |
| Latest thermostat readings | Temporary cache of the private Worker | About one minute |
| Latest thermostat readings | The picture frame in our home (local browser storage), so the screen can recover after a restart | Replaced at each update; deleted if the dashboard is removed |
No history of readings is kept. No readings are stored in any database, log file or third-party service by the dashboard.
4. Sharing
Google user data is not sold, rented, or shared with anyone. It is not published on this website. The private Worker that reads the data answers only requests that carry a secret key held by our own picture frame. Cloudflare, Inc. hosts the Worker as a service provider and processes data only to run it.
5. Limited Use
The dashboard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Security
- All connections use HTTPS.
- Credentials are stored only as encrypted secrets, never in source code, on this website, or on the picture frame.
- Access to the private Worker requires a long random device key.
7. Removing access and deleting data
The account holder can withdraw the dashboard's access at any time in Google's Nest Partner Connections Manager (nestservices.google.com/partnerconnections) or under Google Account → Third-party connections. After that the dashboard can no longer read any thermostat data. Deleting the Worker's secret settings removes the stored tokens; cached readings expire within about a minute.
8. Children
The dashboard is not directed to children and collects no information from them.
9. Changes
If the dashboard ever accesses additional data or starts sending thermostat commands, this policy will be updated first, with a new effective date.
10. Contact
Questions about this policy: CONTACT_EMAIL