Privacy policy

Effective date: to be set at launch

Draft for legal review. This describes how the Domaris service is built today. It must be reviewed by counsel for the US (including CCPA/CPRA), Canada (PIPEDA and Quebec Law 25) and the UK (UK GDPR) before launch.

Domaris is provided by Verath LLC ("we"). This policy explains what we collect when you use the Domaris apps, website and service, and what we do with it.

What we collect

• Account: your name, email address and a one-way hash of your password. We never store your password itself.
• Your home: home and room names, the people you invite and their roles, your plan, and, if you set it, your home's location (used only for sunrise and sunset automations).
• Devices: the devices you connect, their names, types and current state (for example "thermostat set to 21°C"), and the commands you send.
• Brand connections: the access tokens or API keys that let Domaris talk to each brand for you. These are encrypted with a key unique to your home and are never sent to your phone.
• Activity: a history of device events, commands and automation runs, kept for 30 days on the Free plan and 365 days on paid plans.
• Notifications: a push token for each phone where you allow notifications, and your notification preferences.

How we use it

• To run the service: show and control your devices, run your automations and send the alerts you asked for.
• To keep connections working: we monitor errors with each brand's service and fix our integrations when brands change.
• To support you when you contact us. Support staff can see your homes, devices and connection health, never your brand passwords or tokens, and every lookup is logged.

We do not sell your personal information or use it for advertising.

Who we share it with

• The brands you connect, to carry out your requests (for example, telling your thermostat brand to change the temperature).
• Service providers who run parts of Domaris for us: hosting, push notification delivery (Expo, Apple and Google) and payments (App Store, Google Play or our web checkout).
• AI-assisted engineering: when a brand's service changes and breaks an integration, our engineers may use Anthropic's Claude to help draft a fix. The diagnostic data sent can include recent responses from that brand's service, which may contain device names and states. It never includes your brand passwords or tokens.
• Arriving and leaving (optional): if you turn it on in the app, your phone tells us when you arrive home or leave. Your location is checked on your phone; we receive only "home" or "away" and the time. Other members of your home can see whether you are home. You can turn it off at any time.
• The home assistant: when you ask the assistant a question, we send your question, your recent questions in that conversation, and the home information needed to answer it (device names, types, rooms and states, recent home activity, automations) to Anthropic's Claude. Brand passwords and tokens are never sent.
• Describing automations in words: if you type a description of an automation, we send it to Anthropic's Claude with your home's device names, types, rooms and current states so it can draft the automation. You review the draft before it is saved. Brand passwords and tokens are never sent.
• When the law requires it.

Your choices and rights

• Disconnect a brand at any time; its devices and saved connection are removed.
• Delete your home: the key that protects its brand connections is destroyed, so they can no longer be read.
• Delete your account yourself, in the app or on the web (how, and what is deleted).
• Turn notifications on or off per home and per event.
• Ask for a copy of your data, correction or deletion by contacting us (below). Depending on where you live, you may have further rights under local law.

Security

Connections are encrypted in transit. Brand credentials are encrypted at rest with per-home keys. Each brand integration runs isolated from the others and can only reach that brand's own servers.

Children

Domaris is not directed to children under 13 (under 16 in the UK), and we do not knowingly collect their personal information.

Contact

Verath LLC. Privacy contact: to be confirmed before launch.