Privacy Policy

1. Introduction

SwitchNest operates the smart home platform at onlineswitch.bhartitechnical.com and the API at api.switchnest.com. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our services — including the web application, mobile application, IoT device platform, and ChatGPT integration (via Model Context Protocol - MCP).

By using SwitchNest, you consent to the data practices described in this policy.

2. Information We Collect

Account Information

Username, email address, and password (stored as a cryptographic hash — never plaintext). Optional profile information such as display name and avatar.

Smart Home Device Data

Device names, hardware identifiers, room assignments, on/off status, offline state, and a log of every toggle action (timestamp, triggering user, and platform).

Home & Room Data

Home/property names, member lists, member roles (Owner, Admin, Member), and room configurations.

Usage Analytics

Toggle counts, estimated device on-time, and daily activity patterns — used for energy summaries and automation suggestions. Only accessible to members of the relevant home.

OAuth & Integration Tokens

When you authorize a third-party integration (such as ChatGPT), we store an OAuth 2.1 Bearer token containing your user ID, home ID, granted scopes, expiration date, and resource binding. Authorization codes are short-lived (10 minutes) and deleted immediately upon exchange.

Technical & Log Data

HTTP request method, URL path (sensitive parameters redacted), response status, and response time. Sensitive values (api_key, token, password, secret) are never written to server logs.

3. How We Use Your Information

• Provide the core SwitchNest service: authenticate users, display devices, and process control commands.
• Control your smart home devices via encrypted MQTT commands to connected ESP32 hardware.
• Deliver push notifications for device status changes and schedule executions.
• Generate analytics and automation suggestions based on your usage patterns.
• Maintain security: detect unauthorized access, rate-limit requests, and prevent abuse.
• Respond to customer support inquiries and deliver transactional notifications.

4. ChatGPT / OpenAI Integration (Model Context Protocol - MCP)

What SwitchNest shares with ChatGPT

Device names, types, status, room/home assignments, automation rules, and usage statistics — within the scopes you explicitly grant. SwitchNest does NOT share your password, raw JWT secrets, payment information, or other users' private data.

Access Control & Tenant Isolation

ChatGPT can only access and control devices in homes where your authenticated account is explicitly an owner or member. It cannot access other users' homes or devices.

Revoking Access

You can revoke ChatGPT's access at any time from SwitchNest Settings → Voice & Integrations → Revoke MCP Access, or directly from ChatGPT's Connected Apps settings.

5. Security & Authentication

• All communications use modern TLS/HTTPS encryption — no plaintext transmission.
• Passwords are cryptographically hashed using industry-standard bcrypt — never stored in plaintext.
• OAuth access tokens are 64-character cryptographically random hex strings with strict expiry.
• All API endpoints require authentication; the MCP endpoint enforces multi-tenant home membership verification.
• Strict rate limiting is applied per OAuth token (60 requests/minute for MCP).
• Sensitive query parameters and tokens are always redacted from application logs.

6. Data Retention & Your Rights

Data Retention

Account data is retained while your account remains active. Device execution logs are retained up to 90 days by default. OAuth tokens are retained until expiration or explicit revocation.

Your Rights

You have the right to access, correct, export, or delete your personal data. You may also request account deactivation and removal of all associated home configurations.

7. Contact Information