Stratorama

Privacy policy

Last updated: 6 August 2026

This policy explains what personal data Stratorama processes when you use the service, why, on what legal basis, who has access to it, and what rights you have under the GDPR.

Data controller

The data controller is JULIEN GUEDON CONSEIL, registered at 24 rue René Viviani, 44200 Nantes, France. Full company information is in the Legal notice.

For any privacy-related question or to exercise your rights, contact contact@stratorama.app.

What we collect, and why

Account data

  • Email address
  • Password (stored hashed - bcrypt - on our own servers; we never see it in plain text)

Purpose: create your account and authenticate you. Legal basis: performance of the contract (Art 6(1)(b) GDPR). Providing this data is required - without it, we can't create your account.

Sign in with Google, GitHub or Discord (optional)

If you choose to sign in with one of these providers, it shares with us:

  • Your account identifier at that provider
  • Your email and name

Purpose: authenticate you without a password. Legal basis: performance of the contract. Alternative: use email + password sign-up instead.

Service content

  • Floor plans (stages/floors, rooms, walls, doors, windows, lights, outlets, shutters - with positions and labels)
  • User settings
  • Bindings between your floor elements and your Home Assistant entities (entity identifiers)
  • A long-lived token (agent_token) issued when you pair your Stratorama Agent add-on

Purpose: deliver the service - store your plans and let you control your linked devices through your own Home Assistant. Legal basis: performance of the contract.

We do not store your Home Assistant credentials or the live state of your devices. Device states flow live from your add-on to your browser via our tunnel and are never persisted on our servers.

Shared homes

A home can be shared with other people and with wall panels. When it is, we store:

  • Who belongs to which home, and the level of access each person or panel has been given
  • The email address an invitation was sent to, before that person has accepted it - even if they never do, and even if they have no Stratorama account
  • A label and a long-lived token for each wall panel, so a tablet can stay signed in to a home without belonging to a person

Purpose: let several people use one home and let its owner decide who sees what. Legal basis: performance of the contract, and legitimate interest (Art 6(1)(f) GDPR) for the invited address, which we hold on behalf of the person inviting you.

If somebody invites you to their home, they can see your name and the email address they invited, and they decide what you may see and control inside that home. They cannot see anything in your own home.

Device actions

We record an entry each time a device we classify as consequential is switched - today that means electro-valves, because opening one starts water running. Each entry holds who did it (a person or a named wall panel), which device, and when. This applies to every home, shared or not.

Purpose: so a home's owner can see who acted on it. Without that record every action in a shared home is anonymous, which is a worse outcome for everyone in it. Legal basis: legitimate interest (Art 6(1)(f) GDPR).

Ordinary actions - a light, a shutter - are not recorded. The list of consequential types is ours and is the same for every home; it is not something an owner configures. Only the home's owner can read these entries.

Technical logs

  • IP address, user-agent, request paths, timestamps (in HTTPS access logs at our hosting provider)
  • Authentication sessions (an identifier in an httpOnly cookie in your browser, matched against our database; the session row records the IP address and user-agent it was created from)
  • Failed authentication attempts (anti-bruteforce, fail2ban)

Purpose: keep the service running, prevent abuse, investigate incidents. Legal basis: legitimate interest (Art 6(1)(f) GDPR) - operating a secure service.

Service emails

We send transactional emails such as account confirmation and password reset via Resend. We do not send marketing emails.

How long we keep your data

  • Account and content: as long as your account is active. After 3 years of inactivity (no sign-in), the account and its content are deleted or anonymized. If you share a home with somebody, read Deleting your account when you share a home below - the home itself may outlive your account.
  • HA pairing token: until you disconnect the add-on (the user_agents row is deleted on disconnect).
  • Server access logs: up to 12 months (the maximum recommended by French law for connection logs, LCEN Art 6-II).
  • Auth failure logs: rolling window of about one week (fail2ban defaults).
  • Device actions: kept for 90 days, then deleted automatically.
  • Invitations: the invited email address is kept until the invitation is accepted or cancelled. Cancel one and the address goes with it.
  • Wall panel tokens: until the panel is revoked or removed from the home.
  • A home nobody owns: kept for 30 days, then the home and everything in it is deleted. This happens when the last person who could inherit it is gone (see below). A paired wall panel does not postpone this: it is a device, not a member who could ask us to keep anything, and its connection to Home Assistant is cut as soon as the home becomes unowned.

Deleting your account when you share a home

Deleting your account always deletes you: your sign-in details, your sessions, your settings, and your membership of every home. What happens to a home you own depends on who else is in it.

  • Somebody else is in it: the home passes to them, and its floor plans, devices and history stay. They become its owner. We do this so that a shared home does not disappear from under the people still living in it - but it does mean the content you created there remains, under their control rather than yours.
  • Nobody else is in it: the home is marked as unowned and deleted 30 days later, together with its floor plans, its device library, its pairing token and its action history. The delay exists so that an account deleted by mistake can be recovered by contacting us inside those 30 days. A wall panel does not inherit a home and does not keep one alive: if a panel is still paired, the home is deleted on the same timetable and the panel simply stops working. The home's link to Home Assistant is cut immediately, not after 30 days, so nothing in the house is being read during the delay.

A wall panel never inherits a home, and neither does an invitation nobody has accepted.

You can delete your account at any time from inside the app: open the settings FAB (top-right gear icon) and choose Account → Delete my account. If you cannot sign in for any reason, you can also email contact@stratorama.app to request deletion.

Who has access to your data (processors)

To operate Stratorama, we rely on a small set of carefully chosen processors:

OVHcloud SAS
VPS hosting (our backend, PostgreSQL database, and the static site), in Gravelines, France. Daily database backups are stored on the same VPS.
Resend, Inc. (United States)
Transactional email delivery (account confirmation, password reset). Only your email address and the message content transit their systems. Transfers are safeguarded by EU Standard Contractual Clauses in their data processing agreement.
Let's Encrypt
Automatic issuance of TLS certificates. We share with them only the public domain name - no personal data.
Google LLC, GitHub, Inc., Discord Inc. (United States, optional)
Only if you choose to sign in with one of them. Each provider's own privacy policy applies to that flow, and transfers are covered by the EU-US Data Privacy Framework or equivalent safeguards.

Your data is never sold or rented to anyone. We don't use third-party analytics or advertising trackers.

Where your data is stored

All your core data (account, plans, HA bindings, tokens) stays in the European Union, on our own infrastructure at OVH in Gravelines, France.

Two flows leave the EU: the optional social sign-in (Google, GitHub or Discord), and transactional emails delivered through Resend (United States). Both are covered by the safeguards listed in the processors section above.

Security

  • Traffic between your browser, our tunnel, and the add-on runs over HTTPS / TLS 1.2+.
  • Passwords are hashed (bcrypt) on our servers - we never see or store the plain text.
  • The Home Assistant add-on opens an outbound connection to our tunnel; we never connect inbound to your Home Assistant. You don't need to expose Home Assistant on the public Internet.
  • Server access is key-only with fail2ban throttling repeated attempts.
  • Daily backups of the database and TLS state, retained 30 days.

Your rights

Under the GDPR, you have the right to:

  • Access the data we hold about you
  • Correct inaccurate data
  • Request erasure ("right to be forgotten")
  • Restrict processing
  • Receive your data in a portable format
  • Object to processing based on legitimate interest
  • Lodge a complaint with the French data protection authority (CNIL) at cnil.fr/en/plaintes

To exercise any of these rights, email contact@stratorama.app. We aim to respond within 30 days.

Cookies and local storage

Stratorama does not use tracking cookies, advertising cookies, or third-party analytics. The only data your browser stores locally is:

  • An authentication session cookie (httpOnly, first-party) - required to keep you signed in.
  • An anonymous boolean display hint (strat-authed in localStorage) that avoids a visual flash while the app boots. It contains no personal data.

Both are strictly necessary for the service and don't require a consent banner under French and EU rules (CNIL, ePrivacy).

Children

Stratorama is not designed for children under 16. We do not knowingly collect data from minors. If you are a parent or guardian and believe a minor has signed up, contact us and we'll delete the account.

Automated decision-making

We do not perform automated decision-making that produces legal effects on you, including profiling.

Changes to this policy

When this policy changes, we update the "Last updated" date at the top. For material changes that affect your rights, we'll also notify active users by email.

Contact

For any question about your personal data:

← Back to home