Privacy Policy

1. Introduction

Darak provides managed smart-home services and integrations, including the Darak Smart Home Alexa skill. This Privacy Policy explains how Darak processes information when you use the Darak website, a Darak customer account, a managed smart-home service, or the Alexa integration, as applicable.

In this policy, “Darak,” “we,” “us,” and “our” refer to the Darak service and brand.

2. Information Darak processes

Account information

We may process your email address, account and user identifiers, tenant or home membership information, and authentication-related identifiers. This connects you to the correct Darak account and determines which home you may access.

Smart-home information

To operate the service, Darak may process a home or customer-environment identifier, device and control identifiers, friendly names, supported capabilities, current device states, and commands needed to provide smart-home control.

Alexa account-linking information

When you link Alexa, Darak processes OAuth identifiers and authorization state needed to associate Alexa with the correct Darak account. Darak also processes Amazon Alexa Event Gateway authorization material required for proactive events. Where implemented, access and refresh token records for proactive events are encrypted at rest. Separate integration credentials are stored under restricted access controls.

Sensitive OAuth and Event Gateway credentials are used only to provide and maintain the integration and are protected using Darak’s implemented credential-storage, access-control, revocation, and rotation measures.

Operational information

Darak and its hosting infrastructure may process request identifiers, timestamps, success or error status, performance and timing information, security or audit records, and IP address, network, or browser information automatically supplied when you access the service. Darak designs application logging to avoid recording secret credentials.

Support information

We process information you voluntarily provide when contacting Darak, such as your contact details, description of an issue, and relevant troubleshooting information.

3. Alexa voice data

Amazon processes your spoken Alexa request and sends Darak structured Smart Home directives necessary to perform the requested operation. Amazon independently controls its processing and retention of Alexa data. Review Amazon’s privacy notices and Alexa privacy settings for information about Amazon’s practices.

4. Darak Voice

Darak Voice is an optional voice assistant for your home. Audio from your home's voice device is sent to Darak's voice service, which uses Cohere, Google Cloud Speech-to-Text, Microsoft Azure AI Speech or Deepgram to turn it into text.

To understand a request, Darak sends the transcript and the home context it needs (room and device names, which devices are in which room, spoken aliases and device categories) to OpenRouter, which passes it to the model provider (currently DeepSeek), and to Jev (typesafe.ai), which checks whether the request is about your home. If your household enables general questions, they are answered through OpenRouter (currently Alibaba's Qwen model), and Brave Search receives a search query when an answer needs current information. Spoken replies use Google Cloud Text-to-Speech, or ElevenLabs when your home uses an ElevenLabs voice.

Darak does not sell voice data or use it for advertising. By default Darak does not keep recordings. Staff can turn on a detailed voice log for an individual home, for example to diagnose a problem; it stores the audio, the transcript and what the assistant did, and is deleted after 90 days.

5. How information is used

Darak uses information as needed to:

• authenticate users, support account linking, and identify the correct Darak tenant;
• route requests to the correct isolated Darak smart-home environment;
• discover compatible devices, report device state, and carry out Alexa commands;
• send proactive ChangeReport updates through the Alexa Event Gateway where enabled;
• operate, maintain, monitor, and improve Darak;
• support service reliability, diagnostics, and troubleshooting;
• prevent fraud, abuse, unauthorized access, and other security threats; and
• provide customer support and respond to requests.

6. Alexa and Amazon integration

The integration operates at a high level as follows: Amazon Alexa → voluntary Darak account linking → the Darak Alexa service → your isolated Darak smart-home instance → a compatible device or entity. Darak resolves the authorized account on the server and routes the directive to that account’s selected instance.

Linking Darak to Alexa is optional. You can unlink Darak through the Alexa app. Unlinking stops future Alexa access through that linkage. Related records may remain where reasonably necessary for security, backup operation, dispute resolution, or legal obligations. Darak does not control information retained independently by Amazon.

7. Google Calendar and iCloud Calendar

Connecting a calendar is optional. If you choose to connect Google Calendar, from your Darak home dashboard or from Home Assistant’s Google Calendar integration (Settings → Devices & services), Darak requests the Google Calendar scope (https://www.googleapis.com/auth/calendar). Darak uses this access only to read your calendar events so they appear on your own Darak home dashboard, and to create events that you add from that dashboard.

Information received from Google is not used for advertising, profiling, or training artificial-intelligence models, and it is not sold, rented, or shared with third parties, except the storage provider that holds Darak’s backups on our behalf. For a cloud home, the Google OAuth tokens and calendar data are stored only in your isolated Darak home and in that home’s backups, which are kept on Darak’s servers and copied off-site to Darak’s storage provider (Cloudflare R2); backups may retain them for a limited period before routine rotation, as described in section 10. For a locally hosted home, they are stored on your own Home Assistant device; Darak keeps no other copy except in the backups it makes of that home, which are kept and rotated in the same way. Darak staff do not read your calendar data.

For every home, Google token requests (when you connect, and the periodic token refresh) pass through Darak’s server, which adds Darak’s Google application credential before forwarding them to Google. Darak does not store or log the tokens it relays.

You can disconnect Google Calendar at any time. For a cloud home, use your home dashboard (Manage calendars → Google → Delete); for any home, delete the Google Calendar integration in Home Assistant (Settings → Devices & services → Google Calendar → Delete). Either removes the stored tokens. You can also revoke Darak’s access at myaccount.google.com/permissions. Deleting your Darak account deletes your home and everything stored in it, as described in section 12.

If you connect iCloud Calendar using an Apple app-specific password, that password and your calendar data are likewise stored only in your own Darak home and its backups. You can revoke the app-specific password at any time at account.apple.com.

8. Data sharing and service providers

Darak does not sell personal information. We disclose or make information available only as necessary to operate, secure, and support the service, respond to lawful requests, protect rights and safety, or complete a transaction you request.

Darak uses Supabase for hosted account authentication, OAuth account linking, and associated customer-routing records. Cloudflare R2 stores off-site copies of customer home backups on Darak’s behalf. Amazon provides Alexa, Login with Amazon authorization for proactive events, and the Alexa Event Gateway; Amazon services transmit structured directives and events for the integration. These providers process information under their own terms and privacy policies where applicable.

Darak also operates hosting, networking, and web infrastructure needed to deliver the website, Alexa service, and customer smart-home instances.

9. Tenant isolation and security

Darak uses technical and organizational safeguards appropriate to the service. Implemented measures include HTTPS/TLS for public endpoints; an isolated smart-home environment and private network for each customer; server-side customer-environment resolution; separate integration credentials for each customer environment; restricted credential storage; encrypted Alexa Event Gateway token records; OAuth and JWT validation; access controls; logging designed to avoid secrets; and credential revocation or rotation processes.

No security control eliminates every risk. Customers should protect their account credentials and tell Darak promptly if they suspect unauthorized use.

10. Data retention

Darak retains information only for as long as reasonably necessary to provide the service, maintain account and security records, resolve disputes, and satisfy applicable obligations. Retention depends on the information, why it is processed, and operational or legal needs; one fixed retention period does not apply to every category.

Alexa authorization credentials are removed, revoked, or rendered unusable when appropriate through unlinking, revocation, account deletion, or credential-lifecycle processes. Backup copies may temporarily retain deleted information for a limited operational period before normal rotation.

11. Customer choices and rights

Depending on available features and applicable law, you may unlink Darak from Alexa, update or correct supported account information, request account or data deletion, stop using the service, or contact Darak with a privacy question. Email contact@darak.ps. We may need to verify your identity and authority over the account before acting.

12. Account deletion

You may request deletion by contacting contact@darak.ps. Darak will verify the request and use its managed deletion process to disable or remove the relevant account linkage and customer environment as appropriate. This can include revoking dedicated Alexa credentials, disabling Alexa routing, removing stored Alexa authorization records, stopping customer services, and deleting the customer’s service data.

Deleting a Darak account or home makes its smart-home functionality and Alexa integration unavailable. Limited records or backup copies may remain where reasonably necessary for security, operational recovery, dispute resolution, or legal obligations before normal deletion or rotation.

13. International processing

Darak uses third-party infrastructure and services that may operate in different countries. Information may therefore be processed outside your country of residence as necessary to provide, secure, and support the service.

14. Children

Darak is not directed to children under 13, and the Alexa skill is not intended to collect personal information from children under 13.

15. Changes to this Privacy Policy

Darak may update this Privacy Policy as the service or its practices change. When material changes are made, we will update the “Last updated” date and provide any additional notice required by applicable law.

16. Contact

For privacy questions, requests, or concerns, contact Darak at contact@darak.ps.