Privacy Policy

This policy explains what we collect, why, and how we protect it. We only collect data we need to run the service.

What we collect

Account details (email, timezone, notification preferences), pool controller credentials (encrypted at rest with AES-GCM), booking calendar URLs and derived check-in/check-out times, controller state history, weather data for your pool's location, and standard log data.

How we use it

To automate your pool heater, send alerts, calculate savings, and provide support. We do not sell your data or share it with advertisers.

Credentials

iAquaLink and Pentair passwords are encrypted with a project-wide key and decrypted only in server memory immediately before an authorized call. They are never logged.

Third parties

We use Stripe for billing, Supabase for database and auth, and Cloudflare for hosting. We call the iAquaLink cloud API and your ScreenLogic relay only to control your equipment.

Retention & deletion

You can delete your account at any time; all associated data is removed within 30 days. Aggregated, non-identifying metrics may be retained.

Contact

Questions? privacy@poolarrival.com.