Privacy Policy

Last updated: 26 October 2026

This policy describes how the applications and services operated by Victor Seiji Hariki (the "Services") handle information — in particular Home Hariki, a private, self-hosted Home Assistant instance reachable at hassio.seijihariki.com. The Services are personal, self-hosted projects made available to a small group of family members and friends by invitation, mainly at hostnames under seijihariki.com. They are not a commercial offering and there is no advertising, profiling or resale of data of any kind.

In short: I collect as little as possible, I use it only to run the Services for you, and I never sell it or share it with advertisers or data brokers. You can ask for a copy or deletion of your data at any time by email.

1. Who is responsible for your data

The Services are operated by Victor Seiji Hariki as an individual (the "operator"). For any privacy question, request or complaint, contact victorseijih@gmail.com.

2. Information that is collected

2.1 Google account data (only if you connect a Google account)

Google is not used to sign in to the Services and is never required. It is only involved when you deliberately connect your own Google account inside one of the self-hosted tools the operator runs — for example Home Assistant (Google Drive backups, Google Calendar, Google Nest, Google Assistant) or an n8n automation you built that uses a Google node. Nothing is connected unless you do it yourself.

When you connect an account, Google shares the following with that tool:

your Google account identifier (a numeric ID that is stable per application),
your name and, if present, your profile picture URL,
your email address and whether Google has verified it,
the OAuth access and refresh tokens for the permissions you approved.

The specific Google permissions (scopes) requested are the ones shown on Google's consent screen at the moment you approve, and they belong to the one feature or workflow you are setting up — for example permission to create files in your Drive, or to read your calendars. No other permission is requested, and approving one feature does not grant any other. You can review and revoke every grant at any time on the Google permissions page, or by disconnecting the integration inside the tool itself.

2.2 Content you put into the Services

Whatever you create, upload or configure inside a Service (for example media files, playlists, notes, settings or automations) is stored on the operator's own server so the Service can present it back to you.

2.3 Technical logs

Servers and reverse proxies keep ordinary access logs: IP address, timestamp, requested URL, user agent, response status. These exist to keep the Services running, to diagnose faults and to detect abuse.

3. How the information is used

to authenticate you and keep you signed in;
to run the Google feature or automation you connected your own account to, and only that;
to display your account and your content to you;
to operate, secure, debug and back up the Services;
to contact you if something is wrong with your account or the Services.

Your information is not used for advertising, profiling, marketing, credit scoring, or for training machine-learning models, and it is not sold or rented.

4. Google user data

Where the Services receive information from Google APIs — for example when you connect your own Google account to a Home Assistant integration or to an n8n workflow — the operator's use and transfer of that information adheres to the Google API Services User Data Policy, including its Limited Use requirements. Concretely:

Google user data is used only to provide or improve the user-facing features of the Service you are using — never for advertising, and never to build profiles unrelated to those features;
it is not transferred to third parties except as necessary to run the Service (e.g. calls back to Google's own APIs), to comply with applicable law, or as part of a merger or acquisition of the operator's assets (which is not foreseen for a personal project);
it is not used to determine creditworthiness or for lending purposes;
no human reads it, except where you give explicit consent, where it is necessary for security or abuse investigations, or where required by law.

5. Where the data lives

Everything is stored on privately owned hardware in the operator's home, reachable only through the operator's own network and secured with HTTPS. The data is not placed in public cloud storage and is not shared with other users of the Services unless a Service is explicitly designed to be shared (for example a shared media library).

6. How long it is kept

Account and content data: while your account exists on the Services.
Technical logs: normally a few days, at most 30 days, then deleted or rotated out.
Backups: overwritten on a rolling schedule (typically within 30 days).

If you ask for your account to be deleted, your personal data is removed within 30 days, except where a short retention is unavoidable (e.g. a backup not yet rotated out, or a legal obligation that does not normally apply to a hobby service).

7. Cookies and local storage

The Services use only the cookies and browser storage needed for the features you use: a session cookie that keeps you signed in, and local settings such as theme or volume. There are no advertising cookies, no third-party analytics and no cross-site tracking pixels.

8. Sharing

Your data is not shared with third parties, with these narrow exceptions:

a Service may call the third-party API it is built on (for example Google, Jellyfin metadata providers, or a music database) purely to deliver the feature you requested;
the operator may disclose data if required by a valid legal order. In that case you will be informed unless the order forbids it.

9. Your choices and rights

Ask for a copy of the data kept about you.
Ask for corrections or for deletion of your account and data.
Revoke a Service's access to your Google account at myaccount.google.com/permissions. After revocation the Service can no longer read your Google data, but content already stored in the Service remains until you ask for its deletion.
Stop using the Services at any time.

Send requests to victorseijih@gmail.com; they are answered within 30 days.

10. Children

The Services are meant for the operator's family and friends and are not directed at children under 13. Access is by invitation; if an account belongs to a child, it is expected to be set up and supervised by their parent or guardian.

11. Security

Reasonable, best-effort measures are taken: HTTPS everywhere, minimal exposure of services, private network access, regular updates and off-site backups. No system is perfectly secure, however, and this is a hobby setup without a security team or an uptime guarantee. Do not store highly sensitive information (medical records, government identifiers, financial credentials) in the Services.

12. Changes to this policy

This policy may be updated when the Services change. The date at the top of the page is updated accordingly, and material changes are announced to the users of the affected Service. The current version always lives at this URL.

13. Contact

Victor Seiji Hariki — victorseijih@gmail.com. See also the Terms of Service.