Your homes stay yours

Who we are

Breez is made and published by Embedded Tech Consulting Pte. Ltd., a company in Singapore. In this policy “we” and “us” mean that company. We are responsible for the personal data described here under Singapore’s Personal Data Protection Act 2012 (PDPA). For people in the European Union and the United Kingdom, we are also the “controller” of that data under the GDPR and the UK GDPR.

Contacting us also reaches our data protection officer under the PDPA. Use it for any question in this policy. Our terms of use and licence agreement are separate documents.

What stays on your device

Breez keeps these on your device, and does not send them to us:

• your homes, rooms, groups and the names you give them;
• your air conditioners: their names, make and model, where they are on your Wi-Fi, and the details Breez needs to talk to them, which are stored locked (encrypted);
• your last-seen readings and settings, such as the temperature unit you prefer;
• the Wi-Fi password, if you type it to connect an air conditioner’s adapter to your Wi-Fi. It is sent to that adapter and then forgotten. It is not stored, synced or logged.
• the keys that lock your homes, held in your device’s secure storage.

Breez also keeps a short log on your device to help find faults. It is cleaned before it is written, so keys, codes and the identifying numbers of your equipment are left out. It is not sent anywhere unless you choose to send it to us yourself.

Removing the app removes all of this from your device. Copies you chose to keep in iCloud or Google Drive (below) stay in your own account until you delete them there.

What Breez asks your device for

• Local network. To find your air conditioners and control them over your Wi-Fi. It is only used on your own network.
• Camera. To read the setup code on an air conditioner’s sticker, to scan a code that shares a home with you, and to take a photo of a label if you choose to read it that way. The camera opens only when you ask. Photos of a label are read on your device, the app’s copy is deleted as soon as it has been read, and neither the photo nor what was read from it is saved or sent. If you pick a photo instead, your device hands Breez that one picture only; Breez gets no access to your photo library.
• Location (while you use the app). Only if you scan a Guest Pass and Breez cannot find the property’s air conditioners on the network, and then only to read the name of the Wi-Fi network you are on, so Breez can check you are at the property. If you are a host, Breez asks for your precise location once when you make or replace a Guest Pass card, only to read the Wi-Fi name the same way. Breez does not use or store where you are, and never asks for location in the background. Your device asks you before Breez can use the camera, location or local network, and you can turn each off in its settings.

Keeping your homes in step on your own devices

So that a new device has your homes, Breez can keep a copy in your own cloud account: iCloud on an Apple device, and, if you choose to sign in, Google Drive on Android. Breez uses a private area of that account made for the app (on Google Drive, only the hidden app folder). These copies belong to your Apple or Google account. We do not have access to them. The details Breez needs to control your equipment are locked before they are saved there, and the keys travel through iCloud Keychain on Apple devices or your Google Drive on Android. Apple and Google handle that storage under their own terms.

When you share a home

You can give someone control of a home with a short code or a QR code. This is how it works, and why we cannot read what you share:

• Your device makes a one-time code and uses it to lock the home’s details (names, rooms, your air conditioners and their access details) into a file. The code never comes to us.
• The locked file is uploaded to a small service we run on Cloudflare, so the person who has the code can collect it. We hold the locked file only. We cannot open it, and we keep no account, name or other detail about who sent or collected it.
• A household share is deleted when it runs out (you choose one hour, 24 hours or seven days), when you cancel it with Stop sharing, or, if you chose single use, once the other person has opened it. Anything left is removed by an automatic clean-up after seven days at the latest.
• A Guest Pass card, made by a host for a rental or holiday home, stays until the host revokes or replaces it. Revoking deletes the locked file and leaves only an empty marker, so the old code cannot be used again.
• Anyone who has your code can open what it unlocks, so share it only with people you trust. You can also send the locked file yourself, for example by AirDrop or email, and then it travels by the route you pick, not through us.

A guest’s copy of a home lives only on their device. It is not saved to iCloud or Google Drive. It ends when the stay ends, or usually after three days away from the property, which Breez checks when the app is next opened. To check a guest is at the property, Breez looks for the air conditioners on the local network or, if that does not work, compares the Wi-Fi name with the card. The Wi-Fi name is turned into a one-way code and the name itself is not stored.

When your device connects to our service, Cloudflare, which runs it, sees the technical details any web connection carries, such as your internet address and the time. We use these only to run and protect the service, for example to limit how often one internet address can use it. We do not store them. Cloudflare’s security tools may keep a short record of a request they block or slow down, under Cloudflare’s own retention.

Signing in to an air conditioner maker’s cloud

Breez controls most air conditioners directly. Some can only be controlled through their maker’s cloud. If you choose to connect one of these, you sign in with your account with that maker, either on the maker’s own page or by typing your account details into Breez. Breez then talks to the maker’s cloud from your device, and keeps the sign-in pass locked on your device and in your home’s data. It does not keep your password where the maker gives it a lasting pass instead. Those connections are marked Beta in the app and are always your choice.

When a maker’s sign-in page sends you back to Breez, it goes through a small page we run on Cloudflare that hands the one-time sign-in code straight to the app. It stores nothing and logs nothing. Cloudflare’s security tools may keep a short record of a request they block or slow down, which can include its internet address and that code, which expires within minutes. This page and our sharing service keep no log of requests. The sharing service records only totals from its clean-up, such as how many expired files were removed, and those totals are deleted within 7 days. The maker’s own privacy policy applies to what the maker does with your account.

The one-time check for certain Daikin air conditioners

To control some Daikin air conditioners, Breez needs a small set of model data that we release only to genuine devices running the real, unmodified Breez app. So, the first time you set one up, your device connects to our service on Cloudflare and proves it is genuine (using Apple App Attest on Apple devices, or Google Play Integrity on Android; Android devices need Google Play services for this). You need to be online for this once. After that it renews quietly whenever you are online, about every two months. Breez keeps working without a connection for a little over two months; after that, those air conditioners wait until your device has been online again.

To make the check, we receive from Apple or Google their verdict about the device and the app, and, when a device needs a paid plan, the store’s signed proof of the purchase, which we check with Apple or Google.

To do this, we keep a record linked to a key your device makes, and to nothing else. It holds the public part of that key, technical proofs about the device and app (Apple’s signed receipt for the key, and short fingerprints of the rest), counters, which model sets we released to it, and whether we have flagged or blocked it. It holds no name, email address, phone number, account, location or home details, and we cannot link it to your name or contact details. Apple and Google check the device as part of their own services. We use the record only to run this check, to stop abuse, and to trace any leak of the model data. It is not used for advertising and not shared or sold. Like the sharing service, the check service sees your internet address so it can limit abuse, and does not store it.

We delete the record automatically 90 days after the last unlock your device received runs out. If we have flagged or blocked a key, we keep a note of that for one year, then delete it. Our service writes only a one-line note per request, with the kind of device (Apple or Android), the version of the check, the Android version, the number of model sets and the result, and no identifiers. These notes are deleted within 7 days.

This check is automatic. If it decides a device is modified, or that a key has been misused or blocked, Breez will not control those Daikin air conditioners on that device, and says so in the app. Nothing else in the app is affected. Part of the check for a modified device runs on the device itself, and its result is not sent to us. If you think we got it wrong, write to us and a person will look at it.

You do not have to take part, but without this check Breez cannot control those Daikin air conditioners.

Payments

Breez is free to download. If you buy Breez Pro or Breez Host, Apple (App Store) or Google (Google Play) processes the payment. Your card and payment details go to them and never to us, and we do not receive your name or email address from them.

To tell the app what you have bought, Breez uses RevenueCat, a service run by RevenueCat, Inc. It works for us as a service provider. When you open the app or buy a plan, the app sends RevenueCat:

• an anonymous app user ID that the app makes for itself. It is a random ID, not your name or email, and it is kept on your device;
• which product you bought, and whether the purchase is active, has renewed, has ended or was refunded;
• the store’s own records of the purchase: Apple’s receipt and transaction identifiers, or Google’s purchase token;
• the details its software collects from your device: the kind of device and its operating system, your language setting and the store’s currency, and the last time the app contacted it.

Like any online service, RevenueCat also sees the technical details of the connection, such as the internet address. Breez does not send RevenueCat your name, email address, homes, rooms, air conditioners or Wi-Fi details. RevenueCat uses what it receives to confirm the purchase is genuine, to keep your plan up to date, and to show us purchases and their status so we can run and support the plans. We can see them against the anonymous ID only, not against your name. It is not used for advertising or tracking and is not sold. RevenueCat’s own privacy policy applies to what it does with this information. You do not have to buy a plan, but without this, Breez cannot switch on a plan you bought.

RevenueCat does not publish a fixed time for how long it keeps this information. It keeps it while it is needed to run the service and to meet its legal obligations, and Apple and Google keep their own purchase records under their own policies. If you want us to have a purchase record deleted, write to us and we will ask RevenueCat to delete it. Deleting Breez from your device does not cancel a subscription: do that in the App Store or Google Play account settings.

For a device that adds more than three Daikin model sets, our check service may check the store’s proof that your plan is active. It then keeps, with the device’s record, when the plan ends and a one-way fingerprint of the purchase’s transaction ID, and deletes them with that record. To apply the household limit, it will also note which devices’ keys (up to ten) used that purchase, and delete that note 90 days after the plan ends or, for a one-time purchase, 90 days after the last of those devices’ records is deleted.

Why we may use it

If you are in the European Union or the United Kingdom, the law asks us to say why we are allowed to use each piece of information:

• To do what you ask (sharing a home, signing in to a maker’s cloud, the genuine-device check, switching on a plan you bought): because it is needed to provide Breez to you.
• To keep our services safe and stop abuse, including rate limits, blocking a modified or abusive device, and tracing a leak of the model data: because we have a legitimate interest in protecting Breez and its users. We have checked that this does not outweigh your rights, given how little we hold.
• To answer your emails and contact-form messages, and to keep short service logs: because we have a legitimate interest in supporting Breez and keeping it running.
• To keep records the law requires: to meet a legal obligation.

We do not rely on your consent for any of these. Your device asks you before Breez can use the camera, location or local network, and you can turn those off in its settings.

What we do not do

• We do not ask you to make an account or sign in to use Breez.
• We do not use advertising, usage analytics or tracking tools, in the app or on this website. (RevenueCat receives purchase information, as set out under Payments, and the video player is covered under This website.)
• We do not read your advertising identifier or follow you across other apps or websites.
• We do not sell your information, or share it for anyone else’s marketing.
• We do not collect your location. When Breez reads a Wi-Fi name, it keeps only a one-way code of it, on your device or inside a locked card we cannot open.

Because neither Breez nor this website tracks you over time or across other websites and apps, we treat every visitor the same whether or not their browser sends a “Do Not Track” or Global Privacy Control signal. No other company is allowed to track you across sites through Breez or this website.

Apple and Google may send us anonymous crash or usage reports if you have turned on sharing with app developers in your device’s settings. We cannot tell who they come from.

This website

This website is plain pages. It sets no cookies, runs no scripts of its own and loads nothing from other sites, not even fonts, with two exceptions. The videos on the home page and the Rental Hosts page are served by Cloudflare Stream, and only after you press Play Video; until then nothing is requested from Stream. And the support page loads Cloudflare Turnstile, the check that the contact form is being sent by a person. Cloudflare delivers the pages and, like every web host, handles your internet address and browser details as it does so. Our website logs nothing.

Once you press Play Video, the player sets no cookies. It may keep a note of your connection speed in your browser’s storage, and Cloudflare’s player includes error and performance reporting that may send reports about the player to Cloudflare’s service provider. You can clear the note in your browser’s settings.

If you use the contact form on our support page, or email us, we receive your email address, your name if you give it, and whatever you write. The form’s message reaches us as an email: our website sends it on through Cloudflare’s email service and keeps no copy. To keep bots out, the form uses Cloudflare Turnstile, which looks at technical details of your browser and device to tell a person from a bot; Cloudflare processes them only to run that check. Our website uses your internet address only for that check and to limit how often one address can send the form, and does not store it. We use what you send to reply and to follow up, and delete it 2 years after our last message, unless we need it for longer for a legal claim.

Who else is involved

• Apple: the App Store and its payments, iCloud, iCloud Keychain and App Attest, under Apple’s own privacy policy.
• Google: Google Play and its payments, Google Drive if you choose it, and Play Integrity, under Google’s own privacy policy.
• RevenueCat (RevenueCat, Inc.): tells the app which plan you have bought, as set out under Payments, under its own privacy policy.
• Cloudflare: runs this website and our sharing, sign-in and check services for us, and serves the website videos through Cloudflare Stream once you press Play Video, and passes messages from the contact form on to our mailbox. It processes data only to do that.
• Air conditioner makers: only if you choose to connect a cloud account of theirs, under their own privacy policies.

These companies run networks around the world, so information they handle for us may be processed outside Singapore, including in the United States. We use providers that protect it to a standard comparable to the PDPA. For information about people in the European Union or the United Kingdom, we rely on the European Commission’s standard contractual clauses (with the UK addendum), which RevenueCat and Cloudflare include in their data processing terms with us, or on a provider’s certification under the EU–US Data Privacy Framework and its UK extension. Write to us for a copy of the safeguards.

Keeping it safe

Homes and their access details are locked with strong encryption, and the keys are kept in your device’s secure storage. Anything sent to us over the internet is encrypted in transit. No system is perfectly secure, but we have built Breez so there is very little for us to lose.

How long things are kept

Children

Breez is not made for children under 13, and we do not knowingly collect personal data from them. If you think a child has sent us personal data, write to us and we will delete it. In-app purchases need the permission your app store asks for from a parent or guardian.

Your rights

Wherever you live, you can ask us for a copy of the information we hold about you and how it has been used, ask us to correct it, and, where Singapore law treats our use as based on your consent, withdraw it. If you are in the European Union or the United Kingdom you can also ask us to delete it, to limit how we use it, and to give it to you in a form you can take elsewhere, and you can object (see below). You can also ask us anything about this policy.

You can object. Where we rely on our legitimate interests, you can object at any time to us using your information, and we will stop unless we have strong legitimate grounds that override yours, or need it for a legal claim.

Contact us. We will answer within one month (30 days under the PDPA). Most of what Breez handles is on your device, where you are already in control. The records on our side are not tied to your name or account, so we may not be able to tell which one is yours. They also delete themselves on the schedule above.

If you have a complaint, tell us first. We will acknowledge it within 30 days and tell you what we did. You can also complain to a regulator: in Singapore, the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg; in the European Union, the data protection authority where you live or work (the list is at edpb.europa.eu); in the United Kingdom, the Information Commissioner’s Office (ico.org.uk).

If you live in the United States

We collect the kinds of information described above: identifiers (an anonymous purchase ID, a device key, an internet address), purchase records, technical details of your device and app, and anything you email us. We use them only for the purposes above. We share them only with the service providers listed under “Who else is involved”, for those purposes.

We do not sell personal information, share it for targeted advertising, or use it to profile you. Depending on your state, you may have the right to know, get a copy of, correct and delete your information, and to opt out of sale, targeted advertising and profiling. You can use these rights by contacting us, which is also our designated address for requests not to sell your information. If we refuse a request, you can appeal by replying to our answer with “Appeal” in the subject. We will reply within 45 days, and if you are still unhappy you can contact your state attorney general.

We will not treat you differently for using these rights.

Changes to this policy

If we change what Breez does with information, we will change this page first and update the date at the top. If a change matters to you, we will say so in the app. We keep earlier versions and will send you one if you ask.

Contact

Embedded Tech Consulting Pte. Ltd., 160 Robinson Road, #14-04, Singapore (068914). Contact us.

Back to top