HeatAdapt Android App — Privacy Policy

Effective date: 10 June 2026

This privacy policy describes how the HeatAdapt Android application handles your personal data. It applies to the Android app distributed via Google Play under the package name ai.eleflex.heatadapt.

1. Who we are

The HeatAdapt Android app is provided by SoftProject OÜ (operating as HeatAdapt under the Eleflex.AI brand), registered in Tallinn, Estonia.

For privacy-related questions or to exercise your GDPR rights, contact info@eleflex.ai.

2. What the app does

The HeatAdapt Android app is a thin wrapper around our web application at app.eleflex.ai. It exists so that Android device owners can set up and control their HeatAdapt heat-pump controller, including the initial Bluetooth-based Wi-Fi provisioning step that the Android mobile browser does not support.

When you use the app you are interacting with the same web application a desktop or mobile browser would load, plus a small piece of native Android code that handles Bluetooth communication with your physical controller during setup.

3. What data we collect through the Android app

The Android app collects only what is strictly required to sign you in and let you communicate with your HeatAdapt controller.

3.1 Account information (when you sign in)

When you sign in using Google through Android's Credential Manager, we receive:

    • A unique user identifier (provided by Google)
    • Your email address
    • Your name and profile photo (only if you have made them available on your Google account — optional)
    • The installation address where your HeatAdapt controller is located. We use it to fetch local weather forecasts and enable other heat-pump control features.

We use this information only to create or restore your HeatAdapt account so you can access your heat-pump dashboard. It is not used for advertising and is not shared with third parties for marketing.

Email-and-password sign-in is also available; in that case we collect only your email address and a hashed password via Firebase Authentication.

3.2 Wi-Fi credentials during controller setup

When you add a HeatAdapt controller for the first time, the app sends your Wi-Fi network name (SSID) and password from your Android device to your physical controller over Bluetooth. The credentials travel only between your phone and the controller in your immediate physical vicinity; they are not transmitted to our servers, and the Android app does not log them or persist them after the setup step completes.

3.3 Bluetooth device information

During Wi-Fi setup, the Android app scans for nearby Bluetooth Low Energy devices and shows them in a chooser so you can pick your controller. We see the advertised name, signal strength, and Bluetooth address of devices in range only for as long as the chooser is open. Scan results are held in memory only and discarded when the chooser closes; the app does not store or upload device identifiers. The Bluetooth scan permission is declared with Android's neverForLocation flag, so the operating system does not provide the app with any location information derived from Bluetooth scan results.

3.4 Data the web application collects

Any data the HeatAdapt web application itself collects when you use it inside the app (for example, heat-pump telemetry, schedules, or settings that you configure) is governed by the existing HeatAdapt privacy policy at https://www.heatadapt.eu/privacy and is the same as if you used the web application from a regular browser.

4. What we do NOT collect or do

  • We do not track you across other apps or websites.
  • We do not use third-party advertising or analytics SDKs in the Android app.
  • We do not access your location, contacts, photos, microphone, camera, or any other on-device data except Bluetooth (described above).
  • We do not collect device identifiers such as the Android Advertising ID.

5. Third parties

The Android app integrates with the following third parties as part of its core function:

  • Google Sign-In via Android Credential Manager (Google LLC) — used when you choose "Sign in with Google". Google provides us only with the user identifier, email address, and (if you have set it) your name. Google's own privacy policy applies to their handling of the sign-in flow: https://policies.google.com/privacy.
  • Firebase Authentication (Google LLC) — manages your authenticated session in the web application. Subject to Google's privacy policy.

We do not use any other third-party SDKs in the Android app.

6. Permissions the app requests

  • Bluetooth (BLUETOOTH_SCAN and BLUETOOTH_CONNECT) — required to scan for and set up your HeatAdapt controller's Wi-Fi connection during initial provisioning. Used only when you initiate Wi-Fi setup; the app does not use Bluetooth in the background. The BLUETOOTH_SCAN permission is declared with the neverForLocation flag, so Android does not derive location information from Bluetooth scan results.

7. Where data is stored

  • Account information is stored by Firebase Authentication (Google LLC), in datacenters operated by Google. Your account record contains the identifiers described in section 3.1.
  • Heat-pump configuration and usage data entered or generated through the web application is stored on our servers in the EU. The HeatAdapt web app privacy policy at https://www.heatadapt.eu/privacy describes retention and data handling for that information.
  • Wi-Fi credentials entered during controller setup are transmitted to the physical controller only; they are not retained by the Android app or uploaded to any server.

8. How long we keep data

Account information is retained for as long as your HeatAdapt account is active. If you delete your account (see section 9), we delete the associated account record.

Heat-pump telemetry and configuration retention follows the same rules as the web application — see https://www.heatadapt.eu/privacy.

9. Your rights (GDPR)

Because we operate from Estonia (EU), you have the following rights under the GDPR regardless of where you live:

  • Access — request a copy of the data we hold about you
  • Correction — request that we correct inaccurate or incomplete data
  • Deletion — request that we delete your account and associated data
  • Portability — request your data in a machine-readable format
  • Restriction — request that we restrict processing of your data
  • Objection — object to specific processing
  • Withdrawal of consent — where processing is based on your consent

To exercise any of these rights, email info@eleflex.ai. We will respond within 30 days.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, https://www.aki.ee) or with the supervisory authority in your EU country of residence.

10. Children

The HeatAdapt app is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact info@eleflex.ai and we will delete it.

11. Security

Personal data is transmitted exclusively over HTTPS / TLS. Account credentials are managed by Firebase Authentication, which uses industry-standard practices including hashed password storage and OAuth-based federated sign-in.

We do not store Bluetooth-transmitted Wi-Fi credentials at any point — they travel directly from your Android device to your physical controller over a Bluetooth Low Energy connection that is established only during the moments you are actively setting up the device.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated in a future Android app update or via email if you have an active account. The "Effective date" at the top of this document reflects the most recent revision.

13. Contact

Questions, complaints, or rights requests:

  • Email: info@eleflex.ai
  • Postal: SoftProject OÜ, Tulika 19, 10613 Tallinn, Estonia