Smart Firefly Privacy Policy

App Name: Smart Firefly
Effective Date: July 1, 2026
Last Updated: July 1, 2026
Operator: Shenzhen Xiaoyang Technology Co., Ltd.

1. Introduction & Commitment

Shenzhen Xiaoyang Technology Co., Ltd. (“we”, “us”, or “our”) understands the importance of personal information and will take appropriate security measures as required by applicable laws to protect your information.

This Privacy Policy applies when you use the iOS application “Smart Firefly” (the “App”) for Bluetooth Mesh smart lighting control, home and device management, scenes and rhythms, firmware updates, optional cloud data sharing, and optional crash diagnostics.

Please read this Policy carefully before using the App. By starting or continuing to use the App, you agree to our processing of information as described here. If you do not agree, please stop using and uninstall the App.

Except as required by law, we do not sell your personal information to third parties. We use encryption, access controls, and other reasonable measures to protect information; however, no security measure is perfect. You should also safeguard your device and any share QR codes.

2. Scope

This Policy applies to:

• The App and its features and services;
• Our servers and APIs used to provide related features (currently including services under app.sunnyxiao.com);
• Information generated when you interact with Smart Firefly lights, remotes, and Mesh networks through the App.

This Policy does not apply to:

• Third-party websites, apps, or device vendors’ independent services (governed by their own policies);
• App versions obtained from unofficial channels.

3. Information We Collect

3.1 Information You Provide or Store Locally

• Home & device configuration: home/room/device names, device types, MAC addresses, Mesh network settings, scenes, rhythms, schedules, dimming preferences, etc., stored primarily on your iOS device;
• Language & UI preferences: such as display language, stored locally;
• Data sharing (optional): if you choose to upload in “Data Sharing”, we upload your home data model and Mesh network JSON to our server and generate a share ID/QR code for import on other devices;
• Crash reports (optional): if an uncaught exception or crash occurs, we may ask on next launch whether to submit diagnostics; only if you choose “Submit” may we collect device model, iOS version, app version, locale, crash type, stack addresses, binary image load info, etc., to diagnose issues.

3.2 Information Generated During Use

• Bluetooth & Mesh data: for device discovery, provisioning, connection, group subscription, dimming, power control, firmware OTA, etc.; communication occurs mainly between your phone and lights/gateway;
• Device status: online/offline, power state, firmware version, etc., for display and control in the App;
• Firmware services: when checking or downloading firmware, we may send device type/category and current firmware version to our server;
• Network & logs: when you use cloud features, our servers may log IP address, request time, API path, error codes, and similar routine logs.

3.3 Information We Do Not Actively Collect (Current Version)

• Precise or coarse location;
• Contacts, SMS, or call logs;
• Photo library (camera is used only for QR scanning, not photo library access);
• Microphone or health/fitness data;
• Cross-app advertising identifiers (the App currently has no ads or tracking).

4. System Permissions

The App may request or use the following permissions. You can manage them in iOS Settings. Denying a permission may disable related features but generally does not block other basic functions (e.g. local control of provisioned devices, depending on network state).

5. How We Use Information

We use collected information for:

1. Providing, maintaining, and improving the App and its core services;
2. Device discovery, provisioning, grouping, dimming, and scene/rhythm/schedule control;
3. Firmware version check, download, and OTA updates;
4. Cross-device data sharing and sync when you actively choose to do so;
5. Analyzing crashes and exceptions, with your consent, to improve stability and security;
6. Complying with applicable laws, regulations, or lawful requests from authorities;
7. Other purposes with your consent.

We will not use your personal information beyond the purposes stated in this Policy. If we need to use it for other purposes, we will inform you and obtain consent where required by law.

6. Sharing, Transfer & Disclosure

We do not sell your personal information. We may share, transfer, or disclose information only in the following circumstances:

1. With your explicit consent: e.g. when you upload data sharing or submit a crash report;
2. Service providers: we may engage Alibaba Cloud Computing Co., Ltd. or similar vendors for hosting, CDN, or operations, under contracts requiring confidentiality and security;
3. Embedded SDKs/libraries: third-party components integrated for networking, Bluetooth Mesh, etc. (see Section 11);
4. Legal requirements: to comply with laws, litigation, arbitration, or lawful government requests;
5. Corporate transactions: merger, division, acquisition, or bankruptcy; if personal information is transferred, we will require the successor to remain bound by this Policy or obtain your consent again.

7. Storage, Retention & Security

7.1 Location

Local data is stored on your iOS device. Data uploaded to our servers is stored in mainland China, on servers/domains such as app.sunnyxiao.com.

7.2 Retention

• Local configuration: until you delete it in the App, uninstall the App, or clear data;
• Cloud share data: until you request deletion, the share expires, or we discontinue the service, plus a reasonable period (90 days);
• Crash logs: retained for 12 months for analysis, then deleted or anonymized;
• Where law requires otherwise, we follow legal retention rules.

7.3 Security Measures

We take reasonable measures to protect your information, including:

• Appropriate encryption or de-identification for sensitive data in transit and at rest;
• Limiting access to personnel under confidentiality obligations;
• Security incident response procedures;
• Periodic review and improvement of safeguards.

Despite these measures, the internet is not absolutely secure. Please safeguard your device, share QR codes, and share IDs; do not show “Data Sharing” QR codes to untrusted parties.

Our safeguards apply only to this App. Other services you access after leaving the App are governed by their respective operators.

8. Your Rights

Depending on applicable law, you may have the following rights regarding your personal information:

1. Access & copy: view most local configuration in the App; contact us to access cloud share data;
2. Correct & supplement: edit home/device names and similar local data in the App;
3. Delete: delete local data or uninstall the App; contact us to delete cloud data;
4. Withdraw consent: for optional features such as crash reports or uploads, refuse submission or stop using the feature;
5. Clear data: uninstalling the App clears most local data.

Contact us using Section 14. We will respond within 15 business days where applicable. We may verify your identity before processing requests.

9. Exceptions to Consent

Under applicable laws, we may process personal information without your consent in circumstances including:

1. Where necessary to perform a contract to which you are a party;
2. Where necessary to fulfill legal duties or obligations;
3. Where necessary to protect life, health, or property in emergencies;
4. Processing within a reasonable scope for public interest news reporting or supervision;
5. Processing personal information you have made public or that was lawfully public, within reasonable scope as permitted by law;
6. Other circumstances provided by laws and regulations.

10. Consequences of Refusal

You may choose not to provide certain information or deny permissions, which may prevent us from offering corresponding features, for example:

• Deny Bluetooth: cannot provision or control lights;
• Deny camera: cannot import shared configuration via QR scan;
• Deny network: cannot use online firmware upgrade, cloud sharing, or crash reporting;
• Decline crash reports: other features remain available, but we may be unable to diagnose your issue.

To the extent permitted by law, we are not liable for feature limitations resulting from your choices.

11. Third-Party SDKs & Libraries

The App may integrate the following third-party components, which may process necessary information under their own policies:

If we add SDKs in the future, we will update this list or notify you in the App.

12. Children

The App is intended primarily for adults. If you are under 18, please read this Policy with a guardian and use the App only with guardian consent. Guardians with questions about a minor’s information may contact us under Section 14.

If we learn that we collected a minor’s information without verifiable guardian consent, we will delete it promptly.

13. Policy Updates

We may revise this Policy from time to time. For material changes (e.g. purposes, methods, types of information, or how rights are exercised), we will notify you via in-app notice, dialog, release notes, or by posting an updated Policy on this page. The updated Policy takes effect when published. Continued use constitutes acceptance; if you disagree, please stop using and uninstall the App.

14. Contact Us

For questions, comments, complaints, or to exercise your rights regarding this Policy or our processing of information, contact us at:

Copyright © Shenzhen Xiaoyang Technology Co., Ltd. We reserve the right to interpret this Policy to the extent permitted by law.