HAkiosk Privacy Policy

Last updated: 27 August 2026

This policy explains what HAkiosk ("we", "us", "our") collects, why, where it's stored, and your rights over it. HAkiosk is the iOS / iPadOS and Android kiosk app published by Priit Pärna (Estonia) and the companion web dashboard at hakiosk.com/control.

Two modes of using HAkiosk are covered: standalone (just the app, no cloud features) and Fleet Control (opt-in cloud-based remote management). Both are covered below.

1. Standalone app (no Fleet Control)

If you never pair the app with hakiosk.com/control, the app stores your settings (URL, dark mode, zoom, screensaver options, schedules, optional local PIN) only on your device — via iOS UserDefaults / Keychain on iPhone and iPad, and via app-private DataStore on Android. Nothing is sent to our servers. The PIN is stored as a one-way PBKDF2 hash.

MQTT — if you enable MQTT, the app connects directly to the broker you name. Broker address, credentials and topics are stored on the device only and are never synced to our cloud, and neither are the messages: they travel between your tablet and your broker. This includes the optional "Announce to Home Assistant" discovery messages.

Photo screensaver — when you point the screensaver at an Immich album or a folder on the device, the tablet fetches those photos directly from your own server or local storage. The Immich server address and API key stay on the device, and no photo ever passes through us.

The standalone app uses Google Firebase for two background services — Firebase Analytics (anonymous app-instance events such as launches) and Firebase Crashlytics (anonymous crash reports). These do not collect personally identifying information.

2. Fleet Control (opt-in)

If you pair your device with hakiosk.com/control we use Google Firebase to sync state between the device and your web dashboard. The data described below is stored in Firebase Firestore in the europe-west region.

2a. Device-side data

  • Anonymous Firebase UID — assigned by Firebase Authentication's Anonymous sign-in. No email, name or contact information is collected from the device user.
  • Device descriptor — a user-chosen device name, iOS / Android platform string, app version, device model name (e.g. "iPad"), and an opaque device ID. No serial numbers or advertising IDs.
  • Settings ("desiredState" / "overrideState") — the URL you're displaying, dark-mode and zoom preferences, screensaver settings, optional camera face-detect flag, lock state, and the hash of your PIN (PBKDF2-SHA256, 100 000 iterations + 16-byte random salt). The PIN itself is never transmitted in plain text.
  • Status ("reportedState", lastSeen, lastHeartbeat) — updated every five minutes so the dashboard can show online / offline state.
  • FCM token — used in future versions to wake the app via a silent push.

2b. Admin-side data (hakiosk.com/control)

To sign in to the dashboard you authenticate via Google, Apple, or email/password. We store your email address, display name (if provided by the auth provider), and your Firebase Auth user ID. We use these to attach devices to your workspace and to authorise dashboard actions. We never sell or share this data.

2c. Screenshots

When you press Capture screenshot in the dashboard, the device renders one JPEG of the visible web page (max 1024 px wide), uploads it to a temporary Firestore document, the admin's browser reads it, and the browser deletes the document immediately. A 5-minute Firestore TTL also reaps abandoned documents. Screenshots never persist server-side and never reach a permanent storage bucket.

2d. Camera usage

The camera is used only when you opt in to (a) the face-detection screensaver, or (b) QR-code pairing. In both cases imagery is processed locally on the device and immediately discarded. No frames, faces or scanned QR contents are stored or transmitted.

3. Subprocessors

We rely on the following data processors. Each operates under its own privacy policy:

  • Google (Firebase) — Authentication, Firestore, Analytics, Crashlytics, Cloud Messaging. firebase.google.com/support/privacy
  • Apple — Sign in with Apple (web /control only). apple.com/legal/privacy
  • Google (OAuth) — Sign in with Google (web /control only). policies.google.com/privacy
  • Google Play Billing — processes the one-time HAkiosk Pro purchase on Android. Google handles the payment; we receive no card or billing details, only whether this install is entitled to Pro. policies.google.com/privacy
  • DigitalOcean — hosts the static hakiosk.com website only (does not see your account data).
  • IndieBob + Google Analytics (gtag) — anonymous traffic analytics on the public hakiosk.com pages, not on /control.

4. Retention & deletion

  • Standalone-app data lives only on your device. Uninstall the app to delete it.
  • Fleet Control device data is deleted when you disconnect the device from inside the app Settings → Remote control → Disconnect, or when you remove the device from the dashboard.
  • Admin account data persists while your /control account exists. To delete your account and all associated workspace + device data, email [email protected] from the address you signed in with. We action requests within 30 days.
  • Transient screenshots are deleted within ~1 second; abandoned ones within 5 minutes via Firestore TTL.

5. Your rights (GDPR / UK GDPR)

If you reside in the European Economic Area, the UK, or another jurisdiction with similar rights, you may request access to, correction of, deletion of, or a portable copy of your personal data. Email [email protected]. You also have the right to lodge a complaint with a supervisory authority — in Estonia that's the Estonian Data Protection Inspectorate (AKI).

Legal basis: Fleet Control data is processed under contract (the service you've opted into) and legitimate interest (running and securing the service). Standalone-app analytics and crash data are processed under legitimate interest.

6. Security

  • All data is transmitted over TLS.
  • Firestore security rules limit data access to your own workspace and devices.
  • PIN values are stored only as PBKDF2-SHA256 hashes; the plaintext PIN never leaves your device or browser.
  • The HAkiosk PIN is independent of the iOS Guided Access passcode and the Android Screen Pinning unlock (both of which the operating system stores on the device only).

7. Children

HAkiosk is not directed at children under 13 (16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has used HAkiosk, please contact us so we can delete the data.

8. Cookies and similar technologies

hakiosk.com/control uses essential cookies / local storage to keep you signed in via Firebase Auth. Public marketing pages (everything outside /control) use a Google Analytics tag and IndieBob for anonymous traffic analytics. No advertising or cross-site tracking cookies are set.

9. Third-party content

HAkiosk renders web pages you choose to display. We do not control or moderate that content. Their privacy practices are governed by the operators of those sites.

10. Changes

We may update this policy as the service evolves. Material changes will be flagged on this page and on the /control dashboard. The "Last updated" date above always reflects the latest revision.

11. Contact

Email [email protected]. We usually reply within 24 hours.

HAkiosk is operated by Priit Pärna, an Estonian sole trader. This policy is not legal advice. Consult a qualified privacy lawyer for advice specific to your jurisdiction.