Effective date: 21 October 2026 Developer: John Paul Bizeray, trading as Mr-Bizzy, United Kingdom Contact:[email protected]
The short version
4Home is an app that works your own Home Assistant from your phone. It talks only to the Home Assistant address you enter, and to apps on the same phone: our own apps (4Dictate, 4Tasks, 4Screenshots and 4PDFs) automatically, and any other app only if you allow it.
There is no account with us, no analytics, no advertising, no crash reporting and no tracking. Nothing is sent to us.
Your Home Assistant token is encrypted with a key held in the Android Keystore.
Android's cloud backup and phone-to-phone transfer are switched off for 4Home, and 4Home's own backup file never contains your token.
4Home does not use the microphone. Voice control comes through 4Dictate.
1. What 4Home stores, and where
4Home stores, in its own private folders on your phone:
your Home Assistant address;
your long-lived access token, which is encrypted with a key held in the Android Keystore before it is saved, and which never leaves the phone except to your Home Assistant;
the list of your devices, with what each one can do, and your dashboards, as Home Assistant last reported them;
which Home Assistant device each of your entities belongs to;
your choices for each device (whether it is offered to voice commands, whether it always asks first, whether it is a shortcut, the name you gave it, and which of its states are links for keys and gestures);
your shortcuts and Quick Settings tiles;
the folder you chose for automatic backups, and a record of the last automatic copy (when it was saved, or why it could not be);
4Link's records for each app you allowed: its package name, its certificate, the functions it may use, when you allowed it and when it last used 4Home. They are kept until you remove the app in 4Home or it is uninstalled;
a log of the last 500 calls from other apps, including refused ones (section 4).
It stores nothing else. Android's Settings, Apps, 4Home, Storage, Clear storage deletes it all. When you uninstall 4Home, its data is deleted. A backup you saved to a folder of your own choosing stays where you put it.
The names of your shortcuts and devices are also shown by your launcher, and in Quick Settings for tiles. Quick Settings can be visible on the lock screen, and a tile works there without unlocking unless it is set to Always ask. When you use a shortcut or tile, its result appears briefly on screen, and a tile shows it under its name until it next updates.
4Home writes short diagnostic lines to Android's system log, such as which function was called and by which app. They never contain your token, your address or your devices.
2. Your Home Assistant
Home Assistant is home automation software that you run yourself. In Settings, Home Assistant you enter its address and a long-lived access token you created in Home Assistant.
What is sent: your token, and the requests you make: reading the list of your devices and dashboards, reading which device each entity belongs to, reading a device's state, and the actions you ask for, such as turning a light on or setting a temperature. If Home Assistant does not confirm an action, 4Home reads the state of that device, and of up to 10 devices in its group or scene, to tell you whether it was reached.
Where it goes: only to the address you entered. It is not sent to us or to anyone else. What Home Assistant does with it is up to your own Home Assistant and its settings. If your address is a Home Assistant Cloud address, or another remote access service, the connection passes through that service.
How: over an encrypted connection (HTTPS, and Home Assistant's secure websocket for the device list and dashboards). The certificate must come from an authority built into Android. Certificates you installed on the phone yourself are not accepted. Plain http:// is accepted only for a 192.168.x, 10.x, or 100.64.x to 100.127.x address, so the token is never sent unencrypted across the internet. 4Home does not follow redirects, so the token cannot be passed on to another address.
When: only when you use 4Home, a shortcut or a tile, or when one of our apps or an app you allowed asks it to (section 4). 4Home does not poll Home Assistant in the background.
3. Backups
Android's cloud backup and phone-to-phone transfer are switched off for 4Home, so nothing of 4Home's leaves the phone that way. Instead, in Settings, Backup, you can save a backup file, read one back, and turn on an automatic copy to a folder you choose.
The file holds your Home Assistant address, the list of your devices and dashboards as Home Assistant reported them, your choices and names, your shortcuts, tiles and links, and the app version and date it was saved.
It never holds your token, not even encrypted. If you restore on a phone with no token, 4Home asks you to enter it again.
If a restore changes the address, 4Home removes the token stored on that phone, so it is never sent to the new address without you. You paste it once afterwards.
It does not hold which apps you allowed through 4Link. You allow them again.
4Home does not upload backups anywhere. The file goes only to the folder you pick. If you choose a folder that a cloud service syncs, that service's policy applies.
4. Other apps (4Link)
4Home has one door for other apps on the same phone, called 4Link. It works only on this phone.
Any app on the phone can ask 4Home whether it is installed (its name and the 4Link version), and can open the screen where you allow apps. It gets nothing else unless you allow it.
Our own apps (4Dictate, 4Tasks, 4Screenshots and 4PDFs) are recognised by their signing certificate and can use 4Home without asking you first.
4Zones, also ours, uses 4Home only after you allow it on that screen.
Any other app can use 4Home only after you allow it on a screen that names the app, shows its certificate fingerprint and lists each thing it asks to do.
Our own apps, and any app you allowed, can use only the devices you switched on with Offer to voice commands. To stop them using a device, switch that off. For a device set to Always ask, 4Home tells the app to ask you to confirm before anything is done.
You can remove an app at any time in Settings, About, Apps allowed to use 4Home, which also shows what each app did and when.
4Home keeps a log of the last 500 calls, including refused ones (time, app, function, result). The log stays on your phone. The screen shows the newest 100.
An app that may use 4Home receives the names and Home Assistant ids of the devices you offered, what each can do and whether it always asks, the names of your shortcuts, the states you made links, and what the functions return: for example whether a light is on, a sensor reading, or what a media player is playing. What it does with them is governed by that app's own policy.
5. Voice control
4Home does not use the microphone and records no audio. Spoken commands are handled by 4Dictate, which passes 4Home the request it understood through 4Link. What 4Dictate does with your voice is described in 4Dictate's privacy policy.
6. Permissions, and why
Internet: only to reach the Home Assistant address you entered.
4Home asks you for no other permission. Android's own libraries add one internal permission that only 4Home holds, and it gives access to nothing of yours. 4Home does not ask for your location, contacts, calendar, camera, microphone or storage. Backups reach only the folder you pick.
7. Links
The About page can open our website in your browser. Your browser, not 4Home, connects to it.
8. Children
4Home is not directed at children and collects no personal information from anyone.
9. Deleting your data
On your phone: tap Remove token in 4Home, clear 4Home's storage, or uninstall it. Delete any backup files you saved where you saved them. To withdraw an app's access to 4Home, remove it in Settings, About, Apps allowed to use 4Home. To withdraw 4Home's access to Home Assistant, delete its token in Home Assistant. We hold nothing, so there is nothing to ask us to delete.
10. Changes
If this policy changes, the new version will be published on this page with a new effective date.
11. Contact
John Paul Bizeray, trading as Mr-Bizzy, United Kingdom, [email protected]