Privacy Policy for Gen2

General Discussion
1

So I know this has been addressed in the past in these posts (won’t let me link them since my account is still new):

With the announcement of a Gen2 device that does most of its processing locally, what personal information will be sent back and stored in the cloud? Also, on that same topic, will there be an option to select whether to store IP cameras DVR recordings locally, as opposed to having them stored on 3rd party servers?

Ben, you had stated previously that SmartThings has not received any government requests for information. I’m glad to hear that, but I think as this technology becomes more mainstream, this won’t always be the case. A recent news article announced that DropCam and Nest have been providing user captured data when subpoenaed. I think with the vast amount of information that SmartThings captures, it’s only a matter of time until they find that it is a goldmine of information.

As one of the previous poster hypothesized, innocent situations can look bad when viewed out of context. I’d much prefer that for the Gen2 device, everything is kept locally without external logging of my private information. With that said, I’d be okay with information being logged,so long as it is aggregated data, and in no way traceable back to specific individuals. I understand that this information is used to improve services, so I’m okay with “anonymous” information collecting.

Also, slightly unrelated, but on the account security front, two factor authentication NEEDS to happen. I’ve seen many sites link up with Google’s Authenticator service to provide that additional security. This is really a must in today’s world.

What’s everyone else’s thoughts on this?

2

Unless I misunderstand things (which is entirely possible), I don’t think there will be a dramatic difference between information storage in Gen1 vs Gen2. While HubV2 will enable a substantial amount of local processing, I believe the idea is that the SmartThings cloud will still be informed of everything (and will still be running SmartApps that require internet access). So logging of everything will be very similar to the way it is now.

At this point if you are concerned about absolute privacy of events within your home, I suspect SmartThings (or any cloud connected solution) isn’t the right choice for you.

1 Like
3

Which is unfortunate because it seems like the SmartThings team really cares about what they do and their community. I’d just like to see them provide a solution where everything you do in your house isn’t reported back to some mother ship to be logged and monitored. I was hopeful that V2 would fill that gap by moving processing off of the cloud.

1 Like
4

I concur with earlier response that all data will still go to ST Cloud (I think storage is limited to 7 Days).

The way I word it, is Hub V2.0 is a local “cache” of SmartApps and data… A little like a browser cache or CDN (content distribution network).

I also have had the concern regarding personal data in the Cloud from the very beginning of the Kickstarter campaign, but considering that I use Gmail (etc.), that ship has sailed. Yet you are quite correct that this is not just a theoretical issue…

In the recent Silk Road trial, the defense tried to argue that evidence was obtained illegally. The judge disagreed because the Silk Road was hosted at a shared hosting company, not on a personal private server.

Of course, the police could still seize your personal Hub V2.0 with a warrant, but a bit harder, I presume, and you could delete event logs more frequently, etc…

Frankly, the US Constitution (or its interpreters) has not kept pace with technological change. The right to privacy and unwarranted search should automatically extend to all our satellites of personal information, however and wherever stored or transmitted.

1 Like
5

I work enterprise server and network admin, so I understand your analogy’s well. From what I’ve been reading, it sounds like you’re correct. Sounds like the local system will process the requests, but everything will still be logged to the cloud. Although, at this point, I haven’t been able to find any real technical details on how exactly the system will function, but that scenario sounds most likely.

In the recent Silk Road trial, the defense tried to argue that evidence was obtained illegally. The judge disagreed because the Silk Road was hosted at a shared hosting company, not on a personal private server.

Of course, the police could still seize your personal Hub V2.0 with a warrant, but a bit harder, I presume, and you could delete event logs more frequently, etc…

This is my main concern. I think most judges today believe that because someone’s not kicking down your door, and since you’ve agreed to another companies privacy policy which gives broad access to law enforcement, the information isn’t REALLY private

I’ve come to understand that vast amounts of my personal information are online (through services like Gmail, as you said), but it’s one thing to read my emails, and an entirely different thing to watch me through my home surveillance system.

I still love what SmartThings is doing, and the community seems great, but the prospect of having weeks, or months, or years worth of my logs available makes me a little apprehensive.

Off topic slightly, but also the fact that the Terms of Use provide an opening for requiring payment (with a 10 day notice of policy change) to utilize services, or forcing an upgrade to new hardware (at your cost) when they stop supporting older devices. While I have great trust in the SmartThings team, and don’t believe they would do such a thing, I’m not as trusting of their new parent company Samsung. In the end Samsung bought them to make money. You make money through “premium” services and new hardware.

6

They could also make money via selling of user data (probably just in aggregate form in order to avoid changing the current Privacy Policy, at first). I’m more worried about Google’s ownership of Nest in this regard, since Google’s profit model (including Android) is data mining and advertising.

Regardless, we are kindred spirits – I’ve had and expressed the exact same concerns regarding the Terms of Use for a couple of years.

My particular beef is that the Terms of Use are at the bottom of the page and customers can purchase the system without reading them, and realizing their legal implications. A $99 hub is no big deal, but the “cost” of installing and building out a large system based on SmartThings could be huge. And yet, not a single contract is signed by either party. I don’t even recall if “creating an account” explicitly forces you to “Agree” to the Terms.

Yet this is par for the course for practically “everything” these days, so it’s rather too distressing to worry about before the weekend. :sunny:

Hopefully there are some “Privacy Advocates” looking out for us!

Cheers,
…CP / Terry.

7

Haha, we definitely are kindred spirits.

Yeah, I always get nervous when companies have access to hoards of personal information, but especially when that information is coming from inside my home. Most people expect their houses to be sanctuaries from the privacy concerns of the outside world, but that’s changing very quickly. The Samsung Smart TV was the most recent shock to me. Learning that it records everything you say to be translated by a 3rd party, with VERY broad Terms of Use for that information.

Yes, exactly. I wasn’t even aware that the SmartThings hub utilized cloud based processing and logging when I first came across it. There isn’t anything in the product description that specifically states this. I knew there was an application for your phone, but I just assumed that the hub processed everything, and the app utilized some sort of SSH/RDP/HTTP reach-back to connect back to the device on your home network. It wasn’t until I spent some time here reading through the forums that I realized exactly how it worked.

While most mainstream customers probably wouldn’t care, or understand, the inner workings, I think it’s extremely important from a privacy aspect to be up front about how exactly the hardware functions.

Maybe someone from the SmartThings team will take notice of this thread and work to allay our concerns through some sort of opt-out option.

You are correct though, too heavy of a topic for the weekend. Have a good one and take care.

Cheers,
-Collin

1 Like
8

I opened the announcement email received yesterday on my iOS device.

I touched the link “our SmartThings app” I think.

An annoucement appeared (stating that it would only appear once) that the app worked using cookies, and that I was blocking cookies from sites that i had not visited. It explained that the app was designed to deliver personalized ads “based on my browsing habits” and extolled the benefits of keeping the internet free.

I was given the option to opt out. However, each time I clear cookies, i must go thru the same routine it said.

Then I was given the chance to comment via survey monkey.

I am not an expert. Details may be inconsistent. But it did not seem reassuring.

9

To me, that sounds like whatever web site you visited was using cookies, not the ST app.

10

@Ben I would like some clarity on @chilidog01’s comment. Preferably without having to dig through and decipher what i’m assuming is a lengthy disclosure. What information is tracked and/or sold by ST about it’s users. I have ordered 2- v2 hubs, but this is a concern.

11

@schapper05 @chilidog01

Our Privacy Policy

It’s actually really short :smile: (Compared to others i’ve seen)

12

Yeah, the link was tracking you, not the app. Big difference. Just download the app from the app store and not from the link. Problem solved.

13

@chilidog01 I truly think that ST should monetize the usage data from ST, make it anonymous but it is incredibly valuable. I had always assumed that ST would use my data that way so that I DIDN’T have to pay a monthly service fee like Iris or some of the other monthly subscription services.

I think ST should give the option to leverage the usage data for free subscribers, and people can pay a monthly amount to NOT use that usage data.

Just my opinion.

14

Thanks to others for pointing out that we are not selling your data or using cookies in the the app. If your concerns are not addressed, please let us know.

4 Likes
15

Peter pstuart typed:

“Yeah, the link was tracking you, not the app. Big difference. Just download the app from the app store and not from the link. Problem solved.”

Thank you for correcting my interpretation. I assume that those wiser than I in the community can verify that no tracking is taking place and would let us know.

However, I am left wondering why I should be reassured because it was only the link in the email from Smartthings and not the app. Did the sender at SmartThings not have control and was unaware that Credo was attempting to send third party ads to a community user?

16

If you have the iOS app, you can go to Settings-Privacy-Contacts to see which apps have access to Contacts. Not an Android user, so can’t comment on that one without my hands on it.

17

Everything you do on the web is tracked. Emails have open and click tracking. It appears that the warning you got is due to this tracking.

The App is not using cookies (that is not even possible) and not doing 3rd party tracking.

Credo is a 3rd party ad service, I don’t believe they are involved in this. I did not see any warnings nor did the link I got contain anything suspicious.

It is possible your system might be infected with what is called a link hijack trojan, which redirects your clicks to ads instead of what was supposed to be clicked.

Try running a malware / virus scan and see if anything turns up.

3 Likes
18

@Ben “we are not selling your data or using cookies in the app”

It appears that the only possible way to make this true is the words
"in the app" and a decidedly lawyerly take.

The privacy policy clearly states that you use cookies and collect all information that is provided to you and that you may “share” the information with third party partners who may send me ads for plumbers if i have a water leak detected by the network.

excerpt from the privacy policy:

"Advertisers: We may allow advertisers and/or merchant partners (“Advertisers”) to choose the users who will see their advertisements and/or promotional offers. You agree that we may provide any of the information we have collected from you in non-personally identifiable form to an Advertiser, in order for that Advertiser to select the appropriate audience for those advertisements and/or offers. For example, we might use the fact you are located in San Francisco to show you ads or offers for San Francisco businesses, but we will not tell such businesses who you are. In addition to the foregoing, if you have not opted out of our targeted advertising feature as described below, you agree that we may share your personally identifiable information with Advertisers in order to deliver specific targeted advertising or offers to you (“Targeted Advertising”). For example, we might share with our Advertisers the fact that a moisture sensor that you have connected to our Services has detected a flood in order to show you ads or offers for local plumbing services. If we enable Targeted Advertising for our users by default, you will be able to opt out of Targeted Advertising at any time by changing your personal settings.

We may deliver a file to you through the Services (known as a “web beacon”) from an ad network. Web beacons allow ad networks to provide anonymized, aggregated auditing, research and reporting for us and for advertisers. Web beacons also enable ad networks to serve targeted advertisements to you when you visit other websites. Because your web browser must request these advertisements and web beacons from the ad network’s servers, these companies can view, edit, or set their own cookies, just as if you had requested a web page from their site."

Third parties must exchange something of value in order for SmartThings to give them access to my personal data. That seems like selling to me. And sending beacon files to me through the system seems a lot like using cookies except in the narrowest definition.

I remain deeply concerned that SmartThings sells me and additionally am concerned with your disingenuous reply.

Others may be happy to allow such intrusive data collection and transfer, but I find it very dangerous.

1 Like
19

This has been rehashed many times over the past year. If you don’t want your info logged and potential sold in the aggregate. Then don’t go online.

I hope you don’t use anything Google or run a Microsoft os.

There is nothing nefarious going on inside the app, period.

Yes your data is your data. ST has addressed this many times. Even a nice white paper was shared with the community on it.

1 Like
20

You have done nothing but disparage me.

Did you even read my reply or just pull out the snark and have at it?

Where’s Ben and a direct answer? My bad for not reading the privacy notice. It clearly indicates that there is none. But don’t pretend thats a good thing or a necessary thing.