Privacy Policy

CasaRay is a local-first smart-home controller for Home Assistant. It is designed to control your own smart-home devices through your own Home Assistant instance and Apple devices.

Data CasaRay handles

CasaRay may store Home Assistant server settings, server metadata, app preferences, rooms, device state, camera state, energy state, favorites, display preferences, and compact companion snapshots for widgets and Shortcuts.

Sensitive data

Home Assistant long-lived access tokens are stored locally in the Apple Keychain. CasaRay does not intentionally include Home Assistant tokens in widgets, Shortcuts, App Intents, notification relay requests, screenshots, or support messages.

Provider connections

CasaRay connects to the Home Assistant URL you provide. It may use HTTPS, WebSocket, and standard Apple networking APIs to test the connection, load state, receive live updates, show camera snapshots or streams, and send service calls.

No CasaRay cloud account

CasaRay does not require a CasaRay account. CasaRay does not sell your data, run advertising tracking, or upload your Home Assistant token, device list, camera data, energy data, or preferences to a CasaRay-operated backend.

CasaRay notification relay

CasaRay can receive Home Assistant notifications while the app is not running. When you enable this feature, CasaRay sends a random installation identifier, the Apple Push Notification service device token, the app identifier, and the APNs environment to the CasaRay notification relay. The relay stores a one-way hash of the installation identifier, a random receiver identifier, the APNs device token, a receiver authentication token, the app identifier, the APNs environment, update timestamps, and daily delivery counters.

Home Assistant sends notification titles, messages, and notification metadata to the relay. The relay processes this content in memory, forwards it to Apple Push Notification service, and does not persist the notification content. Notification receiver paths are excluded from reverse-proxy access logs. Registration and health requests may produce operational logs containing an IP address, timestamp, request path, status code, and user agent. Production relay access logs are configured for deletion after 14 days.

The app renews active registrations periodically. Replaced receiver credentials remain active for up to 15 minutes. Active registrations expire after 180 days without renewal. CasaRay requests deletion when notification delivery is disabled or Home Assistant setup is cleared.

Data use

CasaRay does not operate an advertising network, sell your data, or use your data for third-party tracking. It does not upload your Home Assistant token, device inventory, camera data, energy data, or preferences to the notification relay.

Purchases and Apple services

CasaRay Plus subscriptions are processed only by Apple through StoreKit and the App Store. CasaRay does not operate a separate web checkout or other store for CasaRay Plus. Apple may process purchase, download, crash, diagnostics, and analytics information according to Apple's policies and your Apple settings.

Feedback and support

If you contact support or send feedback, the information you provide may include your email address, screenshots, crash logs, device model, operating system version, Home Assistant version, CasaRay version, and details you choose to include. Do not send production Home Assistant tokens in support requests.

Data deletion

You can remove CasaRay's local app data by deleting the app from your devices. You can revoke Home Assistant long-lived access tokens in your Home Assistant profile. Disabling CasaRay notification delivery or clearing Home Assistant setup requests deletion of the relay registration. For the fastest removal, perform one of those actions before deleting CasaRay; otherwise the registration expires under the retention period above.

Contact

For privacy questions, use the CasaRay support page.

Publisher: Evotec Services sp. z o.o., Poland