Dirigo — Privacy Policy — Bit 0100 Bit Software

What we collect

Nothing. Dirigo has no analytics, no identifiers, no telemetry, no advertising and no third-party tracking code. There is no Dirigo account and no Dirigo server. An iCloud backup of your settings goes to your own private iCloud storage, which we cannot read — see iCloud Backup. The only information that ever reaches us is a diagnostic report or an email you choose to send — see Diagnostic reports and support.

What stays on your device

Saved receivers (name, local address, model), your input names and pictures, Custom Remotes, Activities and app preferences are stored in an on-device database. Nothing is uploaded to us. While iCloud Backup is on, a copy is kept in your private iCloud storage — see iCloud Backup.
Apple TV and Android TV pairing credentials are stored in the iOS Keychain. They are encrypted by the system, accessible only to Dirigo, and are never copied to iCloud Keychain, to an iCloud backup or to another device. A pairing only works on the device it was made on: after restoring your settings on another iPhone or iPad, you pair those devices again.
A picture you choose for an input comes from the system photo picker, which hands Dirigo only the picture you pick. It is cropped and, if you ask, has its background removed on the device. It is stored on the device.
A picture you choose as a background for a Custom Remote also comes from the system photo picker, which hands Dirigo only that picture. Dirigo keeps its own smaller copy on the device; the photo in your library is not changed.
Music lists and album art you have browsed are cached on the device so they load faster. Deleting the app removes them.
The Home Screen and Lock Screen widgets read the receiver's state from a private App Group container shared between Dirigo and its widget extension. It is not accessible to any other app.
The Apple Watch app receives your receiver's name, address and current state from your iPhone over Apple's own iPhone-to-watch link.
The names of your receivers, paired devices, inputs and Activities are offered to Siri and Shortcuts on your device so you can say or pick them. Siri requests are handled by Apple under Apple's privacy policy.

iCloud Backup

Dirigo can keep a copy of your settings in iCloud, so that a new or reset iPhone or iPad can have them back. It is on unless you turn it off, under App Settings › iCloud Backup, and it works only while the device is signed in to iCloud.

The copy is stored in your private iCloud storage, in the part of iCloud that belongs to your Apple Account. We have no access to it and cannot read it. Apple stores it under Apple's privacy policy.
It holds what is listed above as stored in the on-device database, plus your Home screen layouts, the icons you chose for remotes, your saved remote templates, and your Custom Remotes' backgrounds, including any pictures you chose for them. It records the names and kinds of your paired televisions, so that Dirigo can ask you to pair them again after a restore.
It never holds an Apple TV or Android TV pairing, and it holds no password or access token.
Each device has its own backup; a newer backup replaces that device's older one. Nothing is backed up while Demo Mode is on.
To stop, turn off Back Up Automatically. To delete a backup from iCloud, swipe it in the list under App Settings › iCloud Backup and choose Delete.

What travels over your local network

All receiver, Apple TV, Android TV and Home Assistant control happens on your local network. Power, volume, input switching, surround mode, pairing and remote-control commands travel between Dirigo (or its widget, or the watch app) and your own hardware — they do not leave your Wi-Fi.
Apple TV now-playing artwork is delivered by the paired Apple TV itself. Android TV artwork is loaded from the media server on your own network that published it.
If you sign in to a HEOS account inside Dirigo, the email address and password you type are passed to your receiver over your local network so the receiver can sign in. Dirigo does not store them.
Dirigo finds receivers, televisions and Home Assistant servers with Bonjour and SSDP, which are local-network broadcasts.

When Dirigo uses the internet

Album art and service logos. When you browse a HEOS streaming source (Qobuz, TIDAL, Amazon Music, TuneIn, and so on), or show a Home Assistant media player whose cover image is hosted by a music service, iOS loads the picture directly from the image address that service publishes. These loads are anonymous: no user identifier, no account information and no analytics are attached. The service sees an ordinary image request from your internet address.
Purchases. Dirigo is try-then-buy: a trial period, then a one-time unlock. The purchase is handled entirely by Apple through the App Store. We receive no name, email address or payment details from it.
iCloud Backup. While it is on, Dirigo saves the copy of your settings to your private iCloud storage and reads it back when you restore, through Apple's iCloud.
Nothing else. Dirigo makes no other internet requests of its own.

Home Assistant (optional)

If you choose to connect Dirigo to a Home Assistant server that you run yourself, Dirigo stores the following on your device only:

The server's name and address and, if you approved one, the fingerprint of its security certificate. These are kept in the on-device database.
The access token you create in your Home Assistant profile and enter in Dirigo. It is kept in the iOS Keychain, readable only by Dirigo. While iCloud Backup is on, a second copy is kept in iCloud Keychain, so that another iPhone or iPad signed in to your Apple Account can use it after you restore your settings there. With iCloud Backup off, it is not copied to iCloud Keychain, and a copy already there is removed.
The Custom Remotes and Activities you build: their layout and which Home Assistant devices they control.

Dirigo sends the access token only to the Home Assistant server you connected, and only to authorise its own requests: reading the state of your devices and sending the commands you tap. Dirigo connects to Home Assistant over your local network. It does not use Home Assistant Cloud and refuses an address that leads to the internet instead of your own network.

None of this is sent to us. Apart from the iCloud copies described on this page, which only your Apple Account can open, none of it leaves your device. Home Assistant is software you operate; what your server does with its own data is governed by your configuration and by the Home Assistant project, not by this policy.

To remove it, open Home Assistant in Dirigo and choose Forget This Instance. That removes the stored address and deletes the access token from the Keychain on that device and its copy in iCloud Keychain. Another device of yours that already uses the token keeps its own copy until you choose Forget This Instance there too. Your Custom Remotes stay on the device until you delete them. Deleting Dirigo removes everything above. You can also revoke the token at any time in your Home Assistant profile, which stops it working immediately.

Permissions

Local Network. Asked on first launch so Dirigo can find and control your receivers, televisions and Home Assistant server. Granting it does not let the app reach anything beyond your local network.
Camera. Asked only if you choose to scan the access-token QR code that Home Assistant shows, so you do not have to type the token. Nothing is recorded or saved.

Diagnostic reports and support

Dirigo keeps a short log on your device of recent commands and the responses your hardware returned. It goes nowhere unless you choose to send it. If you tap a Send Diagnostic or Share button, the report is placed in an email or share sheet that you review and send yourself. A report contains the app version, your iOS version and device model, the kind of network you are on, and recent receiver, music-service and television connection activity. Network addresses and what you were playing are removed, and the names of your paired televisions are replaced with generic labels unless you choose to include them. A report can include your receiver's model and the names of its inputs. A HEOS password is never recorded.

If you email us, we receive your email address and whatever you write or attach. We use it only to answer you.

Contact

Questions about this policy? Email support@bit0100bitsoftware.com.