Privacy Policy

1. Who this policy is for

HoneyCore is a professional field tool, not a consumer application. It is issued to named technicians, engineers and operators who work for, or under contract to, an organisation that already operates a HoneyCore energy, water or Agri-PV site and a HoneyCore cloud EMS instance.

You sign in with an account that your organisation created for you. Your organisation decides who holds an account, what sites that account can see, and how long the account exists. In data-protection terms your organisation is normally the controller of that data and HONEYBEE IOT (PTE.) LTD. acts as processor on its instructions, except where this policy says otherwise.

There is no public sign-up, no consumer tier and no guest mode.

2. The short version

• The app talks to one server: your organisation's HoneyCore cloud EMS (by default https://cloud.ourhoneybee.xyz, or the address your build was configured with). Nothing is sent anywhere else, with the two exceptions named in section 7.
• There is no analytics SDK, no crash-reporting SDK, no advertising SDK and no third-party tracker of any kind in this application.
• The app does not collect your location. It never requests GPS. The Bluetooth scan is declared to Android as "never for location" and filters on the HoneyCore edge service identifier only.
• Nothing is sold, rented, or shared for advertising or profiling. There is no cross-app or cross-site tracking, and no Advertising ID is read.
• Sign-in credentials and site control keys are held in the platform keystore (Android Keystore / iOS Keychain), never in ordinary application preferences and never in the local database.

3. What the app collects, and why

3.1 Account and identity

Collected: your display name, your email address and your numeric user id, returned by the cloud EMS when you sign in.
Purpose: to show who is signed in, to attribute the actions you take, and to enforce which sites you may see.
Where it goes: held on the device in the platform keystore; already held by your organisation's EMS.

3.2 Authentication credentials

Collected: an access token, a refresh token and their expiry, or — on a server that does not yet expose the mobile gateway — the ordinary web session cookie.
Purpose: to keep you signed in between launches without asking for your password again.
Where it goes: platform keystore only. Access tokens are short-lived (one hour) and refresh tokens rotate on use. The server stores a hash of each token, never the token itself, together with a device label, the time it was last used, the originating IP address and its expiry, so that a lost handset's access can be revoked.

3.3 Sign-in with Google (only if your build enables it)

Collected: your Google email address and basic profile, as returned by Google's sign-in flow, plus the identity token that proves it.
Purpose: to sign you in without a separate password.
Where it goes: the identity token is sent to your organisation's cloud EMS, which verifies it with Google and matches it to your existing EMS account. If a build is compiled without a Google client id, the button is not offered at all.

3.4 Operational and site data

Collected: the information the app reads back from your organisation's EMS — fleet and site health, meter and sensor readings, sensor-health verdicts, alarms, device records, reports and readiness views.
Purpose: this is the substance of the product.
Note: this is industrial plant data, not personal data, but it is associated with the account that viewed or acted on it.

3.5 Records of what you do

Collected: the actions you take are attributed to your account — acknowledging an alarm, confirming an asset, sending a command to an edge box, provisioning a box, queueing any of these while offline.
Purpose: safety and accountability. Every command in this app is sent by a person who has just confirmed a sheet naming its consequence; the record of who confirmed it is the point.
Where it goes: your organisation's EMS audit log.

3.6 Camera — QR labels

Collected: nothing is retained. The camera decodes the QR label on a device and the app uses the decoded asset code or URL to open that device. No image from the scanner is stored on the device or uploaded.

3.7 Camera and photo library — nameplate and evidence photos

Collected: only a photo you deliberately take or choose, when you are attaching it to an asset record or an alarm.
Purpose: a nameplate photograph is often the only reliable record of what is physically installed.
Where it goes: uploaded to your organisation's EMS and attached to that record. Photos are size-limited (2 MB) and are not sent anywhere else.

3.8 Bluetooth — the local link to an edge box

Collected: the identifiers and advertised capabilities of nearby HoneyCore edge boxes, and the status the box reports once connected.
Purpose: to let a technician standing in front of an edge box read its state, restart a stalled poller, or provision it, without copying an API key out of a desktop browser.
Note: the scan filters on the HoneyCore service identifier and is never used to infer where the phone is. Control messages are signed (HMAC-SHA256) and expire after five minutes. On Android 11 and earlier the operating system itself requires a location permission before any Bluetooth scan is possible; the app requests it for that reason alone and reads no location from it.

3.9 USB / RS485 (Android only)

Collected: the responses of instruments on a Modbus RTU bus you have physically plugged into, via an OTG adapter.
Purpose: to ask an instrument directly whether it is alive.
Where it goes: nowhere. This exchange is entirely local to the handset and the cable.

3.10 Push notifications

Collected: the notification token issued to this installation by Firebase Cloud Messaging, the platform (android/ios) and a fixed device label.
Purpose: to deliver alarm notifications to this device.
Where it goes: registered with your organisation's EMS, and handled in transit by Google (see section 7). Notification payloads deliberately carry only identifiers and a deep link — never a site name, alarm text or reading — because notifications appear on a lock screen and are cached by the operating system. The substance is fetched only after you are authenticated. The registration is retired when you sign out, so a handset passed to another technician stops notifying its previous owner.

3.11 Data held on the device

• An offline cache of the responses the app has read, each stamped with the time it was fetched, so a site with no signal still answers.
• An outbox of changes you made while offline, held until they can be sent.
• Small display preferences (for example, projection-mode settings).
• Credentials, in the platform keystore, as described in 3.2.

Signing out deletes the credentials and the signed-in identity, and retires the push registration. The offline cache and any unsent outbox entries remain on the device until they are sent, or until the app is uninstalled or its data is cleared. On a shared handset, clear the app's data rather than relying on sign-out alone.

3.12 Device and build information

Collected: the application version and build number, and a device label shown in the session list.
Purpose: so a tester can say which build they are running, and so you can recognise your own devices in the list of active sessions.

4. What the app does not collect

• Location, GPS or any positioning data.
• Analytics, usage statistics, behavioural events or session recordings.
• Crash or performance telemetry sent to a third party.
• Advertising identifiers, and any form of advertising or profiling.
• Contacts, calendar, call logs, SMS, microphone or health data.
• Files from your device other than a photo you explicitly choose.

5. Legal bases (where the GDPR applies)

• Performance of a contract, and the legitimate interests of your employer in operating its plant safely: account data, authentication, operational data, and records of the actions you take.
• Legitimate interests in the security of the system: token records, IP address and device labels, revocation and audit logging.
• Consent, which you may withdraw at any time in your device settings: camera access, photo library access, Bluetooth access and notifications. Refusing any of these disables the corresponding feature and nothing else.

6. How long data is kept

• Access tokens: one hour. Refresh tokens: 90 days, rotated on each use, and revoked immediately on sign-out or by an administrator.
• Server-side token records, including IP and last-used time: for the life of the session and up to 12 months after it expires or is revoked, so that access can be investigated after the fact.
• Audit records of commands, acknowledgements and confirmations: as configured by your organisation in its EMS; where it configures no shorter period, these are kept for the life of the site record, as required for plant safety and accountability.
• Operational and telemetry data: as set by your organisation in its EMS.
• Photographs attached to records: for the life of the record they are attached to, unless deleted earlier.
• On-device cache and outbox: until sent, cleared, or the app is uninstalled.

7. Who else is involved

The app sends data to exactly three destinations:

7.1 Your organisation's HoneyCore cloud EMS

The primary and normal destination for everything described above. It is operated by your organisation, or by HONEYBEE IOT (PTE.) LTD. on its behalf, as stated in your organisation's agreement.

7.2 Google — Sign in with Google (only where enabled)

If you choose to sign in with Google, Google handles that authentication and receives the fact that you signed in to this application. Google's own privacy policy applies to that processing: https://policies.google.com/privacy

7.3 Google — Firebase Cloud Messaging (only where push is configured)

Notification delivery passes through Google's messaging service, which handles the notification token and the message payload in transit. The payload contains identifiers and a link only, never plant readings or site names. Google's privacy policy applies to that processing.

8. International transfers

Sites served by this application are located in Bangladesh, the European Union and Singapore. The cloud EMS is hosted in the region in which your organisation's instance was provisioned, as named in its agreement or order form.

Where personal data moves between the European Economic Area and a country without an adequacy decision, transfers are made under the European Commission's Standard Contractual Clauses, a copy of which is available on request. Google's transfers under sections 7.2 and 7.3 are governed by Google's own terms.

See also our Data Processing Addendum (DPA).

9. Security

• All communication with the cloud EMS is over HTTPS.
• Credentials and site control keys are held only in the platform keystore.
• The server stores hashes of tokens, never the tokens themselves.
• Failed sign-ins are rate-limited; repeated failures lock the account temporarily.
• Commands sent over the local Bluetooth link are signed and expire after five minutes, so a captured message cannot be replayed later.
• The edge device validates every command against its own interlocks and can refuse it. The application performs no autonomous control: there is no scheduler and no retry-until-success, and nothing in it touches certified protection or original-equipment safety systems.
• Access to a site is decided by the server, not by the application.

No system is perfectly secure. If a handset is lost, tell your administrator so that the device's tokens can be revoked immediately.

10. Your rights

Subject to applicable law, you may request access to the personal data held about you, correction of it, erasure, restriction of processing, a portable copy, or object to processing based on legitimate interests. You may also withdraw a device permission at any time in your device settings.

Because your account belongs to your employer, please raise these requests first with your organisation's administrator, who controls the account. If that is not possible, or is unsatisfactory, contact privacy@ourhoneybee.eu and we will respond within 30 days.

If you are in the European Economic Area or the United Kingdom you also have the right to lodge a complaint with your national data protection authority.

11. Children

The application is a workplace tool for qualified personnel and is not directed at, or intended for use by, anyone under 18. No account is issued to a child.

12. App store disclosures

For Google Play Data safety and the Apple App Store privacy label, the disclosed position is:

• Collected and linked to you: name, email address, user id, app interactions limited to the actions listed in 3.5, photos you choose to attach, and diagnostic identifiers limited to the push token, device label and IP address recorded against a session.
• Collected and NOT linked to you: none.
• Used for tracking: none.
• Shared with third parties: only as described in section 7.
• Data is encrypted in transit: yes.
• You can request deletion: yes, via your organisation's administrator or the contact address above.

13. Changes to this policy

If this policy changes materially — a new recipient, a new category of data, a new purpose — the change will be published here and the "Last updated" date raised before the change takes effect in a released build. Continued use of the application after that date means the current version applies.

14. Contact

Last updated: 23 August 2026