Telemetry and privacy

Updated: 9 November 2026 · Consent notice idm-telemetry-v3.

Controller, purpose and legal basis

Sebastian Blüml (Xerolux), Ulmenweg 6, 85604 Zorneding, Germany. Contact for privacy, withdrawal and data rights: git@xerolux.de. Legal notice.

Voluntary Home Assistant integration telemetry is used exclusively for defect resolution, compatibility checks and improving the IDM integration. Processing relies on consent under GDPR Article 6(1)(a). One switch enables the complete scope below. Off by default; using the integration does not require telemetry.

Why share plant observations?

Voluntary reports help identify firmware compatibility, connection problems and recurring faults, improving the IDM integration. Matching firmware versions may be shown to others without myIDM IDs or operating data. Telemetry consent is not required for the independent firmware query service.

Independent voluntary firmware sharing and comparison

Notice idm-firmware-v1. Reconfigure → Share and compare firmware has separate consent, off by default and independent of telemetry or a myIDM ID. Existing consents remain valid; this update does not reset them or enable disabled features. The controller/contact above and data rights below apply.

Only Navigator family, controller/plant model and installed firmware are sent over HTTPS, after up to 30 minutes of random startup delay and then every six hours plus up to 30 minutes of random delay. No myIDM ID, serial number, operating counters, temperatures, credentials or other HA data are included. Technical sightings are aggregated by cohort, firmware version and UTC day without a plant identifier, encrypted outside the web root and automatically deleted after twelve calendar months. Repeat submissions within that group/day do not create individual plant reports. The integration keeps only its current result; HA may retain sensor states according to local Recorder/backup settings. Existing aggregate sightings remain until expiry after sharing is disabled; without a plant identifier an individual contribution cannot be located in the aggregate. Contact git@xerolux.de about data rights, specifying technical version/date if useful, without credentials.

The catalog also uses authorized telemetry and explicit firmware metadata from private diagnostic ZIPs. Diagnostic-derived sightings retain their original 90-day expiry and are excluded when the original is deleted or marked as a test. Telemetry retention/erasure is unchanged. Source counts are observations, not unique plants. The operator-only telemetry page lists versions, sources and classification. No individual reports or identities are public.

A single matching observation already supplies Latest reported firmware; if equal to the installed version it does not create a newer-version notice. Known plant models, controller series, firmware prefixes and major versions stay separate. NAV10_ and T_NAV10_ do not cross-match. NAVIGATOR Pro is room control; a generic Pro label shows the latest reported version only in its own unconfirmed component group and cannot trigger a heat-pump firmware update repair. Missing or conflicting identity remains unconfirmed. This is not manufacturer release information or suitability approval; only iDM or the installer can assess and install an update. No firmware image is uploaded or installed.

Disable to stop future firmware contacts and remove the sensor/result; local control continues. Consent revision and time stay local; old clients send the same four technical fields. The connection IP is technically visible; keyed rate counters expire within two hours at hourly cleanup, and API access logs are disabled. Telemetry and firmware sharing can be enabled/disabled independently. Existing telemetry consent is unchanged.

Strictly limited to the IDM plant

Telemetry concerns only the connected IDM plant and its connection through this integration. No other Home Assistant devices, entities, rooms, people, presence, unrelated integrations, household meters, files or data outside this scope are collected. No means no telemetry collection, local telemetry queue, test contact or transmission. Disabling cancels in-flight telemetry tasks; data already received can be requested for erasure.

Personal data, without anonymization

Your entered myIDM ID is transmitted unchanged and links reports to your plant. Reports also contain consent time and notice revision, random report ID to prevent duplicate counting, integration version, Navigator family and model labels, firmware, configured connection mode/web variant, detected capabilities, register count, observed hours, Modbus polls and failures, observed web outages and alarm-code transitions, plus already available aggregate compressor starts, mode operating times and electrical/thermal energy. These identifiable reports can reveal plant usage. Credentials, PINs, local network addresses, entity names, free text and individual temperature histories are excluded. Missing sources remain absent. Telemetry never adds plant queries or commands.

Transfer, recipients and retention

The first attempt is randomly 24–48 hours after activation, then every 24–25 hours. The next slot survives restarts. Overdue reports receive up to one hour of random recovery delay after downtime. Failures never trigger immediate retries. Plant aggregates and at most one pending report are persisted locally across restarts, using delayed saves after changes and a flush on clean unload. Abrupt power loss can lose unsaved changes. Failed reports remain for the next daily slot; report identifiers prevent duplicate counting. Aggregates cover observed time without inventing runtime while HA was stopped. Disabling deletes the local collection. Firmware/source claims are unverified.

The controller receives reports over HTTPS at idmtools.xerolux.de. Server-side encrypted storage is outside the web root; the operator can decrypt for the stated purpose. No public individual reports, external AI processing or automated decisions with legal effect. No third-country transfer is intended. Hosting and backups are provided by netcup in Nuremberg, Germany. The operator retains complete netcup server snapshots for six months. These may contain older copies of the private data directory. Processing agreements and the erasure/restoration procedure for these copies require separate verification before general availability.

Each report is automatically deleted from the active dataset twelve calendar months after receipt at the next successful hourly cleanup. This does not remove copies in existing server snapshots. At service startup, expired data are removed using their original receipt dates before the HTTP listener opens; cleanup failure prevents access from starting. A dedicated unprivileged container on the operator-owned Proxmox system maintains an independent erasure history. It contains only random report/request identifiers and erasure/expiry timestamps, without myIDM IDs, email addresses or measurements. Transfers are authenticated and encrypted through a private SSH tunnel. Entries are retained for six calendar months plus one day of safety margin to cover the six-month server snapshots. A verified erasure is completed only after the history is durably stored. Earlier erasures are replayed before service startup; unsuccessful reconciliation blocks access. This does not remove data from existing snapshot files themselves. Restoring an older software version requires installing the current service and this protection before enabling access. Diagnostic ZIP retention is separate. The server technically sees the public connection IP. The API configuration suppresses access logs; short-lived rate-limit identifiers expire within two hours at the next cleanup. Operator copies and backups must not circumvent expiry or confirmed erasure.

Withdrawal and your rights

Turn telemetry off under Reconfigure → Telemetry to stop future submissions. Withdrawal does not affect earlier lawful processing. Request erasure below or by email; also disable telemetry to prevent new submissions.

Your statutory rights include access, rectification, erasure, restriction, portability and complaints to a supervisory authority such as the Bavarian State Office for Data Protection Supervision. Contact git@xerolux.de for any data rights. Requests are normally handled within one month; we will explain any statutory extension. A myIDM ID alone does not prove entitlement.

Request erasure

This form sends your unchanged myIDM ID and email only to Xerolux for matching, contacting you and verifying identity. It sends no automatic email and does not immediately erase records. The operator will contact you for verification. The request and contact details are removed from the active queue after completion and in any case within twelve months. Any subsequent email correspondence is kept separately only for handling the request. Do not submit PINs, passwords or identity documents.

Evaluation quality

The private summary flags short observations, missing sources and inconsistent timing. Reports shorter than one hour are excluded from energy and operating-time comparisons. Operating durations exceeding the observation window are excluded from operating shares. Comparisons show matching source coverage and distinguish integration version, controller and firmware. Original reports remain unchanged; quality flags are not a plant diagnosis.