Privacy Policy

Effective date: 2026-10-12

Robota LLC operates Warblet at warbletiot.com. This policy covers our website, portal, APIs, device endpoints, and related support. Contact support@warbletiot.com about personal data or this policy.

Information we handle

• Account information. Clerk handles sign-in. We receive account identifiers and profile information such as your name, email, and profile image. A connected sign-in provider supplies the profile information it is authorized to share. We do not receive your sign-in password.
• Device content. We handle the data your devices send, including hardware identifiers, packet contents, arrival times, decoded fields, and latest device state. Payloads can include images, audio, or personal data if you choose to send them. We also handle queued commands.
• Configuration. This includes specs, decoder and routine code, dashboard settings, routine memory and run history, alerts, and optional alert addresses you provide.
• Credentials. We keep authentication records for claim codes, device tokens, signing keys, API keys, and integration secrets. Some credentials are stored as hashes; secrets that the service needs to use, such as an AI provider key you add, remain usable by the service. Protect the original credentials you hold.
• Unclaimed devices. We record limited sightings, including a hardware identifier and sample payload, so an owner can find and claim a device. Sightings are not publicly browsable.
• Support and security. We handle messages, reports, contact details, request metadata, and information needed to investigate problems, unauthorized access, or abuse. Hosting and delivery providers also process IP addresses and technical request data. A sender’s IP address is available to the decoder handling that sender’s data.

Public templates expose the code and display configuration you choose to publish. Spec secrets are excluded. Other users may install their own copies, which are not recalled if you later delete your template.

How we use information

We use information to authenticate users and devices, receive and decode messages, run routines, store and display data, deliver commands and configured alerts or webhooks, provide exports, and answer support requests. We also use it to secure the service, investigate abuse, meet legal obligations, and understand product use.

We do not sell personal data or use it for advertising. We do not train AI models on device payloads. Our rights to process customer content are limited by the Terms of Use.

Analytics and browser storage

We use PostHog for page views and page-performance information on the website and portal. Events can include the page URL, referrer, event time, browser and device information, approximate location derived from an IP address, and generated visitor or session identifiers. PostHog receives the IP address used to make a request. These identifiers are pseudonymous, not necessarily anonymous.

During browser setup, we also record progress steps, elapsed times, retry and cancellation outcomes, and categorized errors to understand where setup gets stuck. These events use random attempt identifiers and general board-family, connection-method, chip-type, and built-in-demo categories. They do not include Wi-Fi names or passwords, device identifiers or serial numbers, keys, uploaded filenames, raw console output, or free-form error messages.

Our integration disables session replay and automatic capture of clicks and form interactions. PostHog uses cookies and browser local storage to maintain identifiers and relate visits. Clerk uses browser storage and cookies needed for sign-in. We do not use advertising cookies.

You can use browser privacy settings or a tracker blocker to restrict analytics. Blocking necessary sign-in storage can prevent sign-in. Clearing identifiers does not delete events already sent. Where applicable law requires consent for analytics storage or collection, it must be obtained separately from acceptance of our terms.

Providers and recipients

We use hosting, database, storage, network-delivery, and security providers to run Warblet and handle its data. We also use:

Configured webhooks send the chosen payload to the destination you specify. Connected agents and integrations receive the access and information you authorize; their providers have their own terms and privacy notices. Check what a prompt or action will disclose before using it.

We may disclose information to comply with law, respond to valid legal requests, investigate abuse, or protect people, systems, and legal rights. We do not promise routine review of all payloads, but may access relevant content when needed for support, security, or legal obligations.

Retention and deletion

Device messages follow the spec’s retention setting, currently 1–3,650 days with a 30-day default, and are removed during daily cleanup. Devices without a spec use the default. Device state holds the latest values and is removed when a device is deleted; remaining messages from a deleted device are removed in the next daily cleanup.

Unclaimed sightings and claim codes expire after 72 hours. Sender blocks expire within 24 hours. Routine history holds roughly the latest 50 evaluations per routine. Alerts have no automatic expiry and remain until deleted or the account is deleted.

You can schedule account deletion in Settings. Your API keys are revoked, device traffic stops being accepted, and account changes are locked when deletion is scheduled. Deletion takes place seven days after the initial notice is accepted by our email provider; a refused email delays that period. You can cancel through the portal or the notice link before deletion. Cancelling does not restore revoked keys or data that expired during the wait.

Account deletion removes the account’s stored devices, messages, specs, decoders, routines and their history, alerts, reports, settings, templates, API keys, and associated sign-in. It cannot recall delivered emails or webhooks, downloaded files, or templates another user installed. Contact support to remove an account shared by more than one sign-in or to request help.

Operational logs, support correspondence, provider-held records, analytics, and records needed for legal or abuse matters have separate lifecycles. We retain these according to their purpose, security needs, applicable legal duties, and any relevant dispute. We do not promise a fixed deletion period for those categories or provider backups. You may ask us to review whether retained personal data is still necessary.

Exports and your choices

Request an export in Settings or through the supported API. A notice is emailed first; the download link follows after a 24-hour security delay measured from acceptance of that notice by our email provider. The link is single-use and expires at the time stated in its email, or when the account is deleted if sooner. You can cancel a request from the portal or its email.

An export includes devices, specs and decoder code, routines and saved memory, retained routine runs, alerts, reports, settings, and retained messages. It excludes credentials, device state, queued commands, sender blocks, usage history, published template assets, and the sign-in profile. Exports have volume limits; the archive identifies truncated data and the continuation point for messages. Contact support for help with omitted records or large exports. Retention continues while you wait, so export and download before data expires or deletion takes effect.

Email support@warbletiot.com to request access, correction, deletion, or an available portable copy of personal data. Identify the account or interaction involved; we may verify your identity and authority. Depending on applicable law, you may also object to or restrict processing, withdraw consent, appeal a denied request, or complain to a privacy regulator. We will respond within applicable deadlines and explain any lawful limits. Withdrawing consent does not undo earlier lawful processing.

Privacy roles and international processing

Robota determines how to handle account, support, security, and product-analytics data. Customers determine what their devices collect and how customer content is used through the service. Where we process personal data on a business customer’s behalf, that customer’s instructions and applicable data-protection duties also matter. If your use requires a data processing agreement, contact us before submitting that data so the necessary terms and arrangements can be established.

Where applicable law requires a legal basis, our own processing is based on providing the service under a contract, legitimate interests such as service security and support where permitted, legal obligations, or consent where required. Customer content may depend on the customer’s own lawful basis.

Robota is based in the United States. Providers may process information in the United States and other countries whose laws differ from yours. Contact us about the arrangements relevant to your data; this policy does not treat use of Warblet as consent to an international transfer or claim a particular transfer safeguard applies to every use.

Security, children, and updates

Warblet offers different device authentication levels. Plaintext device transports expose data to people on the network path; authentication and encryption are separate. Use the security documentation to choose an appropriate setup and test your device’s handling of keys and encrypted connections. No system is perfectly secure. If a personal-data breach requires notice, we will notify affected people and authorities within the time and in the manner required by applicable law.

Accounts are for people aged 18 or older. We do not knowingly invite children to open accounts. Contact us if you believe a child has provided personal data so we can investigate and take appropriate action.

We will post changes here and update the effective date. We will announce material changes in the portal or by account email, and provide any additional notice or request any consent required by law.

Robota LLC
5015 Voyager Dr #7
Dallas, TX 75237
United States
support@warbletiot.com