Privacy Policy

Effective 19 October 2026. BLExpand is in beta. This policy describes how we handle data during the beta.

1. Who processes your data

The controller is Miroslav Fedurco ("we"). Contact for all privacy questions: mfedurco@gmail.com.

2. What data we process

• Account: when you sign in with Google we receive an account identifier, your email address, name and profile picture (scopes openid, email, profile). We never see your Google password.
• Operational data: names of your hubs and phones, phone model, app version, last connection time and online status. One-time pairing codes and sign-in tokens are stored only as irreversible hashes.
• Technical data: to operate the service, Cloudflare processes IP addresses and request metadata (security, abuse protection, diagnostics).

What we do NOT store: the list of your Bluetooth devices, their names and addresses, the content of communication between a manufacturer's app and a device, your location or any images. Recorded actions are stored only on your hub phone, not on our server.

3. Important notice about the beta

Communication between your phones and your browser passes through our relay server (Cloudflare) protected by transport encryption (TLS) but not yet by end-to-end encryption at the application level. We neither store nor log the content of this communication, but technically it would be readable on the server while in transit. We are preparing end-to-end encryption and will introduce it before a public launch. Until then, use the service only with your own devices.

4. Why we use data and legal basis

• Providing the service (sign-in, managing hubs and devices, relaying commands): performance of a contract (Art. 6(1)(b) GDPR).
• Security, abuse prevention and bug diagnostics: our legitimate interest (Art. 6(1)(f) GDPR).
• Compliance with legal obligations, if they arise.

We do not sell your data and do not use it for advertising or profiling.

5. Mobile app and permissions

• Bluetooth: communicating with your devices and making them available remotely.
• Location: Android 10 and 11 require it to scan for Bluetooth devices. We do not determine, store or transmit your location.
• Notifications and foreground service: the app must run in the background to keep the connection.
• Battery optimization exemption: so the system does not put the app to sleep and the hub stays reachable.
• Internet: connection to the server.

The app contains no ads and no third-party analytics.

6. Who we share data with

• Cloudflare, Inc.: hosting, network and database of the service.
• Google: sign-in with a Google account.

These providers may process data outside the EU based on standard contractual clauses or the EU–US Data Privacy Framework. In addition, the website loads a font from Google Fonts, which transmits the visitor's IP address to Google.

BLExpand's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only for sign-in and to display your name and email in the portal.

7. How long we keep data

We keep account and hub data as long as your account exists. Removed phones remain in the database as inactive records only until the account is deleted. A browser sign-in lasts 30 days. You can request deletion of your account and all related data by email; we handle it within 30 days at the latest.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object. Exercise them by email at mfedurco@gmail.com. You also have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic or your local supervisory authority.

9. Cookies

We use only strictly necessary cookies: the portal sign-in session (__Host-bx_session) and a short-lived cookie during sign-in. We use no tracking or advertising cookies, so the website does not ask for consent.

10. Children

The service is not intended for persons under 16.

11. Changes

We may update this policy. The current version is always on this page with its effective date. For material changes we will notify you in the portal or by email.