Your information

Privacy notice

Effective date: 19 October 2026

This policy covers the Node & Nerve website, development app, connected-switch service and optional Google Home integration.

Who operates the service

Node & Nerve is a smart-home project operated by Mahesh, an individual operator. Mailing address: No. 18, Nethaji Nagar, opposite Pughal Avenue, Kayarambedu, Guduvanchery, Chengalpattu, Tamil Nadu 603202, India. Privacy questions can be sent to info.nodeandnerve@gmail.com.

Information processed

• Account information: email address, a password hash and authentication records needed for sign-in.
• Device information: device identifiers, model, firmware and connection information, channel names, home and room assignments, reported on/off state and diagnostic or security events.
• Control and sharing information: commands, their results, timestamps, ownership and device-sharing permissions.
• Support correspondence: information you choose to include when emailing us.

Why information is used

The service uses these records to authenticate users, associate devices with their owners, route commands, display reported state, manage sharing, investigate faults and protect the service against misuse.

Google Home linking

If you choose to link your account to Google Home, the integration shares identifiers, names, room assignments, supported capabilities and reported state for eligible devices you own. Google can send control requests to the service. App-shared devices are not exported by the current integration. Linking uses authorization records and tokens; the linking page asks for your Node & Nerve account credentials, not your Google password.

Unlinking stops the linked integration’s access; it does not by itself delete your Node & Nerve account or historical records. Google handles information under its own privacy policy.

Hosting and service providers

Our backend server and primary database are hosted in Oracle Cloud’s Hyderabad, India region. Vercel hosts the website and proxies the current Google account-linking and fulfillment routes, so it processes traffic for those routes, not only static website visits. Gmail handles support email. Google Home processes linked-device information when you enable that integration. Provider infrastructure, logs and support systems may process data outside India; Hyderabad hosting does not mean that all service data remains in India. Our database backups are currently stored on that server. Vercel and Google operate their own infrastructure and retain platform records under their applicable policies; we do not represent that their processing is limited to India. We share data with these services to host the service, handle support and provide integrations you choose.

Website storage and cookies

This website’s code does not include advertising trackers, analytics scripts or browser-storage features. The interactive switch illustration runs in your browser and sends no device commands. The account-linking service uses a temporary security cookie to protect the sign-in flow. Hosting providers may maintain operational and security logs.

How long information is retained

• Accounts and configuration: retained while your account is active, until a verified deletion request is fulfilled.
• Completed command history and Google request records: eligible for deletion after 30 days.
• Security events and completed firmware-update records: eligible for deletion after 90 days. Unresolved firmware updates and their command evidence are retained for recovery until resolved or removed during account deletion.
• Device state: updated as new reports arrive; the latest stored state becomes eligible for deletion after 90 days without reports.
• Authentication: linking sessions expire after 10 minutes, authorization codes after 5 minutes and access tokens after 1 hour. Expired records are cleaned hourly. Revoked Google grants become eligible for deletion after 30 days, except while referenced by retained recovery records.
• Cleanup timing: database cleanup runs hourly in batches. Processing failures or a backlog may delay removal; records do not disappear at the exact moment they become eligible.
• Backups: completed local database backups older than 30 days are removed after a successful new daily backup. If backups fail, the latest valid recovery copy is preserved until it can be replaced. Deleted account information may therefore remain in restricted backups temporarily. Before a restore is opened to users, a separate deletion journal is replayed to remove previously deleted accounts.
• Minimal security records: device identifiers and certificate/revocation inventory may remain after account deletion without the account association, for device security. A restricted journal of deleted account UUIDs and request dates is kept while recovery copies could restore those accounts.
• Operational logs: nginx logs rotate daily with up to 14 rotated files; container logs rotate by size, up to three 5 MB files per container. These are rotation settings rather than guaranteed exact retention times. Hosting and email providers maintain their own service records under their policies.
• Support correspondence: email is retained while a request remains open and as needed to document its handling or resolve related disputes. There is no automatic mailbox expiry schedule. You may ask for deletion of correspondence; any reason for retaining particular records will be explained.

Your choices and privacy requests

For access, correction or deletion, email info.nodeandnerve@gmail.com from your registered account address. Mahesh handles these requests. We verify control of the account before providing records or performing deletion. Never send passwords, Wi-Fi credentials, claim codes or private keys.

Account deletion is handled by a verified administrative process, not an automatic in-app button. It removes account identity, home and room configuration, sharing, linked authorization and associated personal control records from the active database, and disables cloud access for owned devices. Other users lose shared access to those devices. This does not reset the physical switches or change their relay state. Commands already sent may have taken effect.

You can unlink the integration in Google Home. Unlinking revokes access but is separate from account deletion; ask us to delete the account if that is what you want. Google handles information it receives under its own privacy policy.

We will communicate verification requirements and the outcome of a request, including any remaining backup or security records. We do not promise immediate removal from backups. If you disagree with how a request is handled, contact Mahesh at the address above with the subject “Privacy complaint”.

Use restrictions

We do not sell Google integration data, use it for advertising, or use it to train AI models. Our use of account and device data is limited to providing, supporting and securing the service as described in this notice.

Security

The app uses HTTPS, the backend stores password hashes, and device connections use authentication. These measures reduce risk but do not guarantee absolute security.

Changes and questions

This page will be updated as the service develops. The effective date above identifies the current version. Material changes will be reflected here; where required, we will request consent or provide additional notice. Contact Mahesh at the email above with questions about these practices.