Privacy Policy
This policy explains what personal data IG Doorbell processes — the video doorbell, its iPhone and Android apps, its web interface, and the Islautopia services that connect them — and what data never leaves the device in your home.
First, because it is what actually matters: not one frame of video and not one second of audio from your doorbell is stored on any server, ours or anyone else's. Recordings live on the doorbell's own microSD card and nowhere else. AI detection runs inside the device: no image is ever sent to the cloud to be analyzed. And your user account — your email and password — lives on the doorbell, not on our servers.
Contents
- Who the controller is
- Video, audio and recordings: where they live and what they cross
- What we process, why, and how long we keep it
- The apps: permissions and what each one is for
- Notifications on your phone
- The images of your door are yours, and you are responsible for them
- Who else is involved
- International transfers
- Your rights and how to exercise them
- Security
- Children
- This website: cookies and the waiting list
- Changes to this policy
1. Who the controller is
The data controller is Islautopia Garage (Madrid, Spain), the maker of IG Doorbell. For anything concerning your data — including a request for our full registered identification — write to garage@islautopia.com.
We process personal data under Regulation (EU) 2016/679 (GDPR) and Spanish data protection law.
2. Video, audio and recordings: where they live and what they cross
Where they are stored
On the doorbell's microSD card. The recordings, thumbnails and snapshots you see in the app are produced and stored on the device itself. We keep no copy of any video, audio or still image on our servers or on any third-party service. There is no optional mode that does.
What they cross
We want to be precise here, because "not stored" and "never goes near it" are not the same claim:
- At home (same Wi-Fi network): the app talks straight to the doorbell. Video and audio never leave your network, and everything — watching, talking, opening the door, recording — keeps working even if your internet connection or our servers go down.
- Away from home: we always try a direct connection between your phone and your doorbell. When your carrier's network does not allow one — which is the normal case on mobile data — the media does cross our relay server (TURN). It crosses it end-to-end encrypted with DTLS-SRTP: the server forwards opaque packets, holds no keys and cannot see what is inside. And it does not keep them: it forwards them and drops them.
- When you play or download a recording from outside: the TLS encryption terminates on your own doorbell. Our server splices the two ends of a tunnel whose contents it cannot decrypt, and stores nothing that passes through it.
Artificial intelligence
Person and package detection runs on the doorbell's own processor. No image is sent to any analysis service, ours or anyone else's, and we do not use any customer's images to train models.
3. What we process, why, and how long we keep it
What follows is the complete list of personal data that reaches our servers. The server is hosted by Hetzner in Nuremberg, Germany.
Before the list, what does not reach us: the user accounts on your doorbell — the email, password and permissions of each person in your household — are stored only in the doorbell's own memory, never on our servers. Passwords are never transmitted or stored in the clear anywhere. That is what lets you sign in to your doorbell at home even when our servers are down.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Purchaser record: name and email address of whoever buys the doorbell, linked to its serial number. | Warranty, support, and being able to establish who owns a unit. We enter it from the purchase; neither the doorbell nor the app sends it. | Performance of a contract and legal warranty obligations (Art. 6(1)(b) and (c) GDPR). | For the length of the relationship and the statutory warranty periods. It survives a factory reset of the device — it is what evidences the original purchase — and is erased on request. |
| Doorbell identifiers: MAC address, device identifier, the name you gave it, firmware and hardware versions, and the IP address it holds inside your own network. | Issuing its certificate, letting your phone find it at home by name, and offering it the right updates. The address inside your network is published in a DNS record tied to that identifier; it is a private address and cannot be used to reach your home from the internet. | Performance of a contract. | For as long as the doorbell is registered. |
| Activation and connection data: date of first and latest activation, approximate city and country, session count, and when it was last seen online. | Technical support, abuse detection and knowing whether a unit is up to date. City and country are derived from the doorbell's public IP address using a database installed on our own server (MaxMind GeoLite2): that IP is sent to nobody and is not stored in the device record. | Legitimate interest (Art. 6(1)(f)): keeping the service, its security and the warranty working. | For as long as the doorbell is registered. |
| Paired apps: one identifier per installation, the label that identifies it (for example "Ana's iPhone"), the hash of its pairing credential, and the dates it was added and last used. | Letting your phone reach your doorbell from outside, and letting you see and revoke access. We store the hash of the credential, never the credential. | Performance of a contract. | Until you revoke that app or unregister the doorbell. |
| Push notification tokens from Apple and Google, your phone's platform, and your notification preferences. | Ringing your phone and alerting you only about what you chose. | Performance of a contract. | Until you revoke the app or turn notifications off. They are also deleted automatically as soon as Apple or Google tell us a token is no longer valid. |
| Pending event queue: doorbell identifier, event type (call, visitor, package, door opened, device offline…), timestamp, call identifier and, where the event needs it, a short field used to word the alert, which may include the email or app label of whoever performed the action (for example, who opened the door). If there was a recording, a reference to a file that lives on the SD card. | Delivering the alert and letting the app catch up on what happened while it was closed. It contains no image and no audio. | Performance of a contract. | 30 days at most, deleted automatically, and sooner once every recipient has collected it. |
| Invitations: the invited person's email address and a single-use code. | Sending the invitation email so somebody else can use your doorbell. | The inviter's legitimate interest and performance of a contract. | Neither the address nor the code is written to any database: they exist only in memory for the duration of the request, and they are not written to logs either. All that remains on the server is the doorbell identifier and the invitation's expiry date. |
| Server technical logs: connection metadata, including IP addresses, timestamps and session identifiers. | Fault diagnosis, security and abuse prevention on the relay service. | Legitimate interest (Art. 6(1)(f)). | System logs: 1 month. TURN relay logs: 7 days. Abuse alerts: up to 12 months. Deletion is automatic. |
| Support emails you send us. | Answering you. | Legitimate interest / performance of a contract. | As long as needed for the enquiry and any legal obligations arising from it. |
If you run your doorbell in local-only mode — without registering it with our cloud — none of the above reaches our servers: the doorbell works inside your network, and you will have no phone alerts and no access from outside, which is exactly what those servers provide.
4. The apps: permissions and what each one is for
Every permission is used for what it says and nothing else. They are requested when they are actually needed, and you can withdraw them from your phone's settings.
- Microphone — to talk to whoever is at the door. The audio travels encrypted to the doorbell and is not recorded on any server.
- Notifications — so the doorbell can ring your phone.
- Local network — to find your doorbell at home and talk to it directly, without going through the internet.
- Wi-Fi — to join the network the doorbell broadcasts during setup, and to hand it back to your own network afterwards.
- Location (Android only, and only during setup) — Android requires the location permission before an app may scan for Wi-Fi networks and join the doorbell's. It is an operating-system requirement, not something we need: we do not collect, store or transmit your location anywhere, and the app never asks for background location. The iPhone app does not request location at all.
The apps do not request access to your phone's camera, your photos or your contacts, and contain no advertising, no behavioral analytics and no trackers.
5. Notifications on your phone
When somebody rings your door, the doorbell tells our server, and the server asks Apple (APNs) or Google (FCM) to wake your app. That alert carries the doorbell's name, its identifier and a call identifier: nothing else. No image, no audio, and not even the text you read, which your own phone composes. If you see a snapshot in the notification, it is your phone that fetched it straight from your doorbell — it did not travel through Apple, through Google, or through us.
6. The images of your door are yours, and you are responsible for them
A video doorbell records whoever comes to your door. Because those images never leave the device, we are not the controller for them: you are — just as you are for the drawer where you keep your photographs. Two things worth knowing:
- If you use the doorbell for household purposes and it only covers your own property (your door, your entrance), you fall within the GDPR's household exemption and the regulation imposes no further obligations on you.
- If the frame reaches a public street or shared areas, or the use stops being purely domestic, the law may treat you as the controller. That is why the product lets you adjust the framing and decide what gets recorded and when.
7. Who else is involved
We do not sell personal data and we do not share it for advertising. These are all the providers involved, and what for:
| Provider | Purpose | Where |
|---|---|---|
| Hetzner Online GmbH | Signaling server, relay (TURN), device registration and firmware updates. | Nuremberg, Germany (EU) |
| Apple (APNs) | Delivering notifications to iPhone. | EU / USA |
| Google (Firebase Cloud Messaging) | Delivering notifications to Android. Its library also generates a Google installation identifier, which the delivery requires. | EU / USA |
| Amazon Web Services (Route 53) | The DNS that lets your phone find your doorbell by name and validate its certificate. | Global |
| Let's Encrypt | The HTTPS certificate of each doorbell. | — |
| Google (Firebase Hosting, Cloud Functions, Firestore) | This website, sending invitation emails, and the waiting list. | USA |
| Google Workspace / Gmail | Sending invitation emails and our own correspondence. | EU / USA |
| Cloudflare | Aggregate analytics for this website, with no cookies and no profiles. | Global |
| MaxMind (GeoLite2) | A geolocation database queried inside our own server. We send it nothing. | — |
If you connect your doorbell to Home Assistant, that traffic happens inside your own network, between your doorbell and your installation: we are not involved and receive nothing.
8. International transfers
Data for the doorbell service is processed in the European Union (Germany). There are two exceptions, and we say them plainly:
- Notifications: Apple and Google may process them outside the EU. What travels is exactly what section 5 describes.
- This website, the invitation emails and the waiting list: they rely on Google Firebase, whose database and functions are in the United States.
Those transfers rely on the EU-U.S. Data Privacy Framework and, failing that, on the European Commission's Standard Contractual Clauses.
9. Your rights and how to exercise them
You may ask us for access to your data, its rectification or erasure, restriction of or objection to processing, and portability. Write to garage@islautopia.com from the address you used to buy or register the doorbell, or tell us how we can verify it is you. We answer within the one month the GDPR allows.
Two practical notes, which follow directly from how the product is built:
- We can neither give you nor delete your recordings, because we do not have them: they are on your doorbell's SD card and you control them from the app, which also lets you delete them one by one or format the card entirely.
- You can revoke access for any paired phone yourself, and you create and delete your doorbell's user accounts yourself, without asking us.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) or with the supervisory authority in your country.
10. Security
- All traffic between the apps, the doorbell and our servers is encrypted (TLS), and video and audio are end-to-end encrypted with DTLS-SRTP. There is no cleartext path.
- Passwords are stored derived (PBKDF2 with a salt) and pairing credentials as a hash, never in the clear. The doorbell validates them offline, which is what keeps your home working when our servers do not.
- The server has restricted access and abuse protection, and its logs are deleted automatically within the periods in section 3.
11. Children
IG Doorbell is a household product intended for adults. We do not create accounts for children under 14 and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.
12. This website: cookies and the waiting list
- We use no tracking or advertising cookies — in fact no first-party cookies at all. Analytics is Cloudflare Web Analytics: aggregate, cookieless, and it builds no profiles.
- We store the language you pick in your browser (localStorage) so we do not have to ask again. It never leaves your device.
- Typefaces are loaded from Google Fonts, which receives your browser's IP address as a consequence of serving the file.
- Waiting list: if you leave us your email address, we store only that — the address and the date — to tell you when we launch. Legal basis: your consent. You can withdraw it at any time by writing to us, and we delete it.
13. Changes to this policy
If anything material changes we will update this page and its effective date, and we will tell you in the app or by email when the change actually affects you. This page is always the version in force, and it lives at islautopia.com/privacy.