4Tech-IoT privacy policy

Last updated 25 September 2026

4Tech-IoT is the app for 4Tech smart home devices. This policy explains what the app and the server behind it collect, why, how long we keep it, and the choices you have. It covers the app and its server only, not the rest of this website.

Who we are

We are 4Tech, based in Amman, Jordan. We make the 4Tech-IoT app, run the server it connects to, and are responsible for the information described here. You can reach us at info@4thtechjo.com

What we collect, and why

Your account

Your email address, which identifies your account. If you sign up with an email address, also your password, stored only as a bcrypt hash — we never see the password itself.

Signing in with Google or Apple

We receive the email address Google or Apple has verified for you and the ID they use for you, and nothing else: no name, photo or contacts. If you use Apple's Hide My Email, we only ever see the relay address Apple gives us. For Apple we also keep a token, so that deleting your account can end the app's access to your Apple ID.

Signed-in phones

A record for each phone you are signed in on — when it signed in and when it was last used — so that signing out ends that phone's access.

Sites, rooms and members

The names you give your sites and rooms, and who belongs to each site. This is what lets you share a home with the people you live with.

Your devices

The identifier, name, room and site of each device you add, its firmware version, when it was last online, and the credentials it uses to reach our server. Without these the app cannot show or control anything.

Readings and activity

What your devices report (temperature, water level, on or off, and so on), the commands sent to them, the alert rules you set and the alerts they raise. This is what draws your history charts and makes alerts work.

Notifications

A notification token for each phone you sign in on, and whether it is an Android phone or an iPhone, so alerts can reach you when the app is closed. Signing out removes the token.

Device setup records

When a device is first set up, we record the IP address the request came from, along with what was done and when. This is a security measure: it is how we would spot someone trying to claim devices that are not theirs.

Crash reports

When the app closes unexpectedly it sends a report so we can fix what went wrong: what the app was doing, the type of phone, its software version, and a random ID for this installation of the app. A report is not linked to your account: it carries no email address and nothing about your devices or your home.

Server logs

Like any web server, ours records the IP address and time of each request it receives. We use these logs only to keep the service running and to look into faults and abuse.

What stays on your phone

• Your home Wi-Fi name and password. You type them in when you set up a device, and the app passes them straight to the device over an encrypted Bluetooth connection. They are never sent to our server, and the app does not keep them.
• Your sign-in, and the keys that let the app control your devices over Bluetooth. They are kept in the phone's secure storage (the iPhone Keychain or the Android Keystore) and left out of phone backups.
• A copy of your sites, rooms and devices, your favourites and the site you opened last, so the app starts quickly and can work without internet.
• The demo, which runs entirely on your phone. Nothing in it is sent to our server, and nothing is kept once you leave it.

Permissions the app asks for

Bluetooth

To find and set up your devices, and to control them when the internet is down.

Notifications

To show your devices' alerts. You can say no; everything else still works.

Location (Android 11 and earlier only)

Older versions of Android only let an app scan for Bluetooth devices if it holds location permission. The app never reads your location, and newer versions of Android and iPhone do not ask for it.

The app does not use your camera, microphone, contacts, photos or location.

How long we keep it

• Device readings: 7 days.
• Command history: 90 days.
• Alerts, once resolved: 90 days.
• Device setup records, including the IP address: 30 days.
• A notification token: 270 days after a phone stops opening the app.
• Records of phones that signed out: 30 days.
• A crash report: 90 days, which is how long Crashlytics keeps one.
• Server logs: up to 30 days.
• Your account and its sites, rooms, devices and alert rules: until you delete them. Deleting your account removes them, and everything above, straight away.
• Backups of our server: up to 30 days. Something you delete can remain in a backup until it expires; we use backups only to recover from a failure.

Who else sees it

• People you share a site with see that site's devices, their readings and alerts, and the email addresses of its members. That is the point of sharing, and you choose who joins.
• Google, through Firebase. Firebase Cloud Messaging delivers notifications (on iPhone, through Apple's push service), and Firebase Crashlytics receives crash reports. Google gets your phone's notification token, the text of each alert it delivers, and the contents of crash reports.
• Google or Apple, if you sign in with them. They know that you signed in to 4Tech-IoT; we receive only what is described above.
• 4Tech staff who run the service can see account, device and site records in our admin tools. They use that access only to keep the service working, to help you when you ask, and to deal with abuse.
• Anyone the law requires us to disclose information to, such as a court with a valid order.

That is the whole list. We do not sell your data or share it for advertising, the app shows no ads, and it carries no analytics or tracking software — crash reporting is the only thing it sends about itself, and it is there so the app can be fixed.

Where it is stored, and how it is protected

On a server we run ourselves, hosted by DigitalOcean in Frankfurt, Germany — so if you live elsewhere, your data is stored outside your country. Traffic between the app and the server is encrypted, and the app trusts only our server's own certificate. Passwords are hashed, each device has its own certificate, and setting a device up over Bluetooth is encrypted end to end.

Your choices

You can delete your account, and everything in it, from inside the app at any time, and turn notifications off in your phone's settings. To get a copy of what we hold about you, to correct it, or to have it deleted, email us — we answer within 30 days.

Children

4Tech-IoT is not aimed at children under 13, and we do not knowingly collect anything from them.

Changes to this policy

When we change this policy we update the date at the top. If a change affects what we collect or how we use it, we will tell you in the app or by email before it takes effect.

Contact

Questions about this policy, or about your data: info@4thtechjo.com