Respira mejor. Vive con inteligencia.
Privacy Policy
Version 2.2 · Effective October 15, 2026 · Aerodyne Inc., doing business as Terrestream
This policy explains what personal information Terrestream collects, why, who receives it, how long we keep it, and your choices and rights. Our plain-language summary is at terrestream.com/legal/summary. If the two differ, this policy controls.
1. About this policy
1.1 Who we are
Terrestream is a brand of Aerodyne Inc., a Delaware corporation at 8 The Green, Ste A, Dover, DE 19901, USA ("we", "us"). We are the "business" or "controller" of the personal information described here under US state privacy laws, the accountable organization under Canadian privacy law, and the person carrying on an enterprise under Quebec privacy law.
1.2 What this policy covers
This policy covers personal information we collect through the Terrestream air-quality sensor (the "sensor"), our iPhone and Android apps, the web dashboard at app.terrestream.com, our website at terrestream.com (including the shop, support pages and privacy portal), Terrestream Facilities (section 14) and our support channels.
It doesn't cover services you connect to Terrestream, such as Home Assistant or a webhook address, once information reaches them; app stores; or the payment partners you choose at checkout (section 5.3). Their own policies apply. When we process building information for a business customer, that customer's privacy notice and our Data Processing Agreement apply.
1.3 How to read this policy
We treat any information about an identified or identifiable person as personal information, wherever you live. Where your local law gives you more protection, we follow it. If our Terms of Service and this policy conflict about personal information, this policy controls. "Readings" means the measurements your sensors take.
2. What we collect
Section 9.1 lists the same information in the categories California law uses.
2.1 Your account
- Your email address and password. We store passwords only as Argon2id hashes.
- If you sign in with Apple or Google: the account identifier, email address (which may be an Apple relay address) and name that they share with us.
- Your settings, such as language, units and notification choices, and your two-step verification settings if you turn it on.
- Records of what you accepted or agreed to: the document or choice, its version, the time and the app or site you used. This includes your confirmation that you are 18 or older, or the guardian-consent confirmation for an eligible invited minor.
- Sign-in security records: your sessions and the app or browser each one uses, and the IP address and browser of each two-step sign-in attempt.
2.2 Your home and household
- Home and room names, where each sensor is placed (for example, "bedroom") and your home settings.
- Journal notes you add, and actions you report in the app, such as "cooking" or "opened a window".
- Family Circle: the email addresses of people you invite, their roles and, for members under 18, an age range (section 12). A Family Circle has up to six people, including the owner.
- A log of changes made in the home, such as who added a room.
2.3 Sensor readings and device information
When it's connected to our cloud, your sensor sends us, about every 15 seconds:
- readings: carbon dioxide (CO₂), particulate matter (PM1 to PM10) and particle counts, VOC and NOx indexes, temperature, relative humidity, barometric pressure and light; and
- device information: device ID and serial numbers, hardware and firmware versions, sensor status, Wi-Fi signal strength, uptime, last restart reason, and settings such as brightness, language and time zone.
During setup, you give the sensor your Wi-Fi details over Bluetooth (from the app or the web dashboard) or through the sensor's own setup hotspot. The sensor does not send us your Wi-Fi network name or password during normal operation; diagnostic memory in a crash report may contain such information, as described below.
No audio or video collection. The service does not capture, transmit to us or process audio or video from the sensor. We receive the environmental measurements described above.
Crash reports. After a software crash, the sensor may send us its firmware version, crash reason and a full diagnostic core report containing task stacks, registers and related memory contents. These memory contents can include readings, identifiers or credentials present when the crash occurred. The report is not a copy of all device memory. We use these reports to investigate and fix bugs, encrypt them in transit and at rest, restrict access to authorized operators, and delete them after 90 days. Firmware clears temporary credential and upload buffers, but this does not guarantee that a crash report contains no personal information. In local-only mode, crash reports are not sent to our cloud.
Updates and time. The sensor checks our servers for firmware updates and sets its clock with public time servers (pool.ntp.org, NIST and Google), which see your network's IP address.
Connection states (firmware 4.1 and later):
| State | What leaves the sensor |
|---|---|
| Standalone (no Wi-Fi) | Nothing. Readings stay on the sensor's screen. |
| Connected (the default once Wi-Fi is set up) | Readings and device information go to our cloud about every 15 seconds. The sensor may also send crash reports and checks for updates, as described above. |
| Local-only (turned on through the sensor's Home Assistant link) | No readings or crash reports go to our cloud. The sensor still sends signed update-health checks (its device ID, firmware version, a restart identifier and a fingerprint of the installed firmware), checks for firmware updates and contacts time servers. |
Local-only mode can be turned on only through the Home Assistant link, and a factory reset turns cloud upload back on. If you connect the sensor to Home Assistant or an MQTT broker, it sends readings directly to them on your network, and we don't receive them. The Home Assistant link announces the sensor on your network (service _terrestream._tcp, with its device ID) and exchanges data only with systems you pair using a code shown on the sensor.
Unclaimed sensors. Readings from sensors nobody has claimed, such as factory or freshly reset units, are kept for no more than 24 hours, never build a history and are left out of all statistics. When a sensor is removed from an account, we stop storing its readings until someone claims it again.
2.4 Location and time zone
Home location. Adding a home location is optional. We use it to show outdoor conditions and forecasts for your area, and we store it rounded to about 1 km (two decimal places of latitude and longitude). We note how it was set: from your phone, from an estimate based on your IP address that you confirmed, or typed in. We make IP-based estimates with a database on our own servers (DB-IP), without sending your IP address to anyone. Only the home's owner and co-owners can see the coordinates.
Your phone’s location. If you choose to use it, the app takes one location reading and rounds it to about 1 km before uploading or using the platform reverse geocoder. Earlier client versions could send a more precise reading, which our servers round before storage. The apps do not track your location in the background.
To show a place name, the iPhone app may use Apple’s reverse geocoder and Android may use the phone’s platform geocoder. Current clients send only the rounded coordinates; these providers may receive them.
Time zone. So that days and schedules match your home, we set its time zone from, in order of preference, your own choice, your home location, your sensor's setting, the time zone your phone or browser sends with each request, or an IP-based estimate from the same on-server database. We record the source and don't store your IP address for this.
Outdoor data. Weather and air-quality providers never receive your home's location, only the centre of a grid square 11 to 55 km wide that is shared by everyone in that area.
2.5 Insights we derive
Our software analyzes your readings to produce your home's Air Score and trends, building conditions such as condensation or mold-growth risk, and inferences about your household:
- whether a room seems occupied, and your home's usual daily routine;
- whether the home seems empty for a while (away or on vacation);
- whether someone seems to be asleep in a bedroom right now; and
- likely activities and sources, such as cooking, cleaning products, a shower or a window being opened ("airing"), with the readings behind each conclusion (the evidence).
These are estimates, not facts. Light and CO₂ patterns can't establish on their own whether people are present, asleep or away, and "airing" is a pattern in the readings, not a measurement of a window or of your heating and cooling.
The separate presence and routine insight views are limited to the home's owner and co-owners. Air-quality alerts and their detailed evidence remain visible to all members of the home's Family Circle. That evidence may indicate cooking, cleaning or presence, and may include activities a member reports. We never use them for decisions with legal or similarly significant effects, such as decisions about housing, credit, insurance, employment or health care, never for advertising, and we don't sell them.
Optional household pattern analysis. Occupancy and recurring-routine analysis are enabled by default outside Quebec. In Quebec, or if we cannot determine the home’s applicable region, they remain off until an owner or co-owner explicitly activates them. An owner or co-owner can turn these two functions on or off in the web dashboard. An enabled default is not a record of affirmative consent. This choice does not turn off environmental readings, air-quality alerts or their detailed activity/source evidence, which remain available to all household members as described here. Turning the functions off does not by itself delete retained readings; account and retention controls remain available.
2.6 Purchases and payments
- Orders: your name, email and shipping address, what you bought, the amounts, tax and currency, and the order and shipping status. Stripe collects your payment details and calculates sales tax; we never see your full card number.
- Currency: we show prices in US dollars, Canadian dollars or Mexican pesos, based on the country Cloudflare associates with your IP address, unless you pick one.
- Campaigns: we keep the labels of the campaign link you arrived from (such as
utm_source) with your order. If you allowed ad measurement, the order also holds the advertising identifiers we send (section 4.3), which we delete within 48 hours after sending. - Shipping: we send your name and shipping address to EasyPost to buy a FedEx label.
- Pro: Stripe handles your card and billing. We keep your Stripe customer and subscription identifiers, plan, status, and trial and renewal dates.
- Other sellers: a third-party seller handles its own sale under its terms and shares the fulfillment information needed for the order.
2.7 Support and requests
- Contacting us: your name, email address, message and anything you include. Our web forms also record your IP address and browser to prevent abuse, and our forms and support assistant use Cloudflare Turnstile, which checks your browser, to block bots.
- Privacy requests: your email address, the type of request, any details you add and how we verified it.
- Support assistant: the help-page search sends your question (up to 300 characters) and matching help articles to a language model from Anthropic. We do not store the question; its answer may be cached for up to 24 hours. When you press Send in the support conversation, we send your question (up to 1,000 characters), up to six recent messages (6,000 characters total), the public page category and relevant help content to Anthropic. We do not store a conversation transcript on our server or cache conversation answers. Recent conversation messages are held in the current browser tab. Start over clears them; after 30 minutes without interaction they expire and are removed when the support code next runs, including when a suspended tab resumes. Please do not include personal information or passwords. If you choose WhatsApp, you can review and edit a short summary of your own messages before opening a draft there; nothing is sent to our team until you send it in WhatsApp. WhatsApp processes the information under its own terms and privacy policy. Support analytics record only fixed action and placement labels, with analytics consent; they do not include questions, transcripts, summaries or WhatsApp draft URLs.
2.8 Information collected automatically
- Technical data: when your app, browser or sensor contacts us, we receive its IP address, the request, the time and the app or browser version. Our servers and Cloudflare log this for security and troubleshooting.
- Notification tokens, stored encrypted.
- App checks: the apps use Firebase App Check from Google, with Apple's App Attest or Google Play Integrity, to show our servers that a request comes from a genuine app.
- Product activity: your feedback on insights, which notifications you have read, and the notifications we sent you.
- Android updates: the Android app comes from our website, not Google Play. When you open it, it checks terrestream.com for a newer version.
The apps contain no advertising or analytics software, don't use your phone's advertising identifier and don't track you across other companies' apps or websites. For website visits, see section 4.
2.9 What we don't collect
We do not collect medical or wearable-health records, and we do not connect to fitness trackers, health apps or medical devices. Environmental readings can support estimates of apparent sleep, routines and occupancy as described in section 2.5; they are not medical measurements or findings. Readings measure your home's air; the inferences described above can concern household activity. We aren't a health care provider, and the sensor isn't a medical device. We don't collect audio, images or video (the app reads the setup QR code on your phone and doesn't send us the image), your contacts or photos, government ID numbers or full payment card numbers.
3. How we use information
3.1 Purposes
We use personal information to:
- provide Terrestream: readings, history, insights and outdoor information; the notifications and emails you choose; Family Circle; the integrations you set up; and firmware updates;
- run accounts and orders: sign-in, orders, shipping, subscriptions, billing and support;
- keep the service secure: protect sign-in, verify genuine apps and sensors, and prevent fraud and abuse;
- fix and improve our products, using aggregate or de-identified information where we can;
- measure our website and, only if you opt in, our advertising (section 4); and
- meet legal duties: comply with the law, respond to lawful requests, keep tax records, handle privacy requests and enforce our terms.
Before we use personal information for a new purpose that needs your consent, we ask for it.
Emails. We send service emails: account verification, security alerts, Family Circle invitations, order and shipping updates and legal notices. The weekly brief email is off unless you turn it on. We don't send marketing emails. If we start, we will ask for your consent first and honor unsubscribe requests within 10 business days.
3.2 Limited human review
Our staff don't routinely look at an individual home's readings or insights. Authorized staff look at them only to answer your support request, investigate a security incident or abuse, respond to legal process, carry out an audit, or with your permission.
3.3 Language models
We use a language model only for the support assistant (section 2.7). Where a regional public-news summary is enabled, it may use Anthropic or an OpenAI fallback with public news text rather than household data. Discovery cards, the Year in Air recap and our other text are written by our own software from fixed templates. We don't train language models or other machine-learning models on your personal information. Provider processing is governed by its applicable service terms and privacy policies; we do not assert account-specific zero-retention or no-training terms that have not been verified. Our Language Model Disclosures page lists the models we use.
3.4 Aggregate and de-identified data
We may combine information from many homes into statistics that can't reasonably be linked to a person, household, sensor or location. We use them to improve our products, and we may publish them or share them with researchers. We never sell or license them. We keep de-identified information in de-identified form, we don't try to re-identify it, and we require anyone we share it with to do the same.
4. Website cookies, analytics and ad measurement
4.1 Your choices on our website
Optional measurement on terrestream.com is off until you turn it on. On your first visit, a panel offers three separate choices, none pre-selected: site analytics, Pinterest measurement, and Meta and Reddit ad measurement. You can change them at any time with the Your Privacy Choices link at the bottom of every page. If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, we treat it as a refusal of all optional measurement, and our server ignores measurement cookies when you check out.
Optional measurement never runs in the apps or on the web dashboard. Ad measurement runs only on our public pages. It doesn't run on receipts, order pages, contact or support pages, Facilities pages or our articles about health topics.
4.2 Site analytics and the visitor log
If you allow site analytics, we use:
- Matomo, hosted on our own servers. It records the pages you visit, how you arrived (including campaign labels), your device and browser, and actions such as starting checkout. It sets no cookies. It uses your full IP address to estimate your city and region, then masks two bytes before storing the address. Raw analytics retention depends on configured retention limits and the need to measure visits and campaigns, investigate errors and honor applicable deletion requests; we do not represent a verified fixed raw-data period here. We sometimes compare visit summaries (approximate city, device, browser and campaign) with the ad platforms' cost reports, to see which campaigns work; these reports contain no IP addresses.
- Google Analytics, which uses the
_gacookies, with Google signals and ad personalization turned off. When you buy, our server also reports the purchase to Google Analytics with your Google Analytics browser identifier, so the sale counts even if the receipt page doesn't load. Google processes and retains this data under its applicable Analytics settings and policies; we do not represent a verified fixed period here.
Visitor log. If you allow optional measurement and the request carries valid analytics-consent proof, our server may look up your IP address in a database on our own servers (DB-IP). It records the date, the page, a traffic class (such as "suspected automated traffic"), and the location (country, region, city, and coordinates rounded to about 1 km), organization, internet provider, network number (ASN) and connection type linked to that IP address, but not the IP address itself. We use the log to understand our traffic, filter out automated traffic and see which regions and organizations visit us, and we keep it for 13 months. GPC or DNT suppresses this optional log; withdrawing consent prevents further capture. Visits without valid consent proof are not recorded in it. Essential security logs are separate.
Local content. Some pages show outdoor conditions near you, using Cloudflare's IP-based estimate of your city, which we don't store.
4.3 Optional ad measurement
If you turn on Pinterest measurement, or Meta and Reddit ad measurement:
- Pinterest receives your page visits, cart additions and purchases (value, currency and quantity) through an image tag. It may read its own cookies to match this activity to a Pinterest account.
- Meta and Reddit scripts run on our product and shop pages. They receive page visits, product views, cart activity, browser information and advertising identifiers, and they set the
_fbp,_fbcand_rdt_uuidcookies. - Server-side purchases: when you buy with Meta or Reddit measurement on, our server reports the purchase to Meta's and Reddit's Conversions APIs. The report contains the value, currency and quantity, an identifier that prevents double counting, and Meta's browser identifiers or Reddit's click identifier (if you came from a Reddit ad). We send it only if you consented within the 30 days before the purchase, and only within 47 hours after it.
We never send these platforms your name, email address, phone number, postal address, payment details or receipt links.
Because the platforms can use this information for their own advertising, California law treats it as "sharing" for cross-context behavioral advertising, and other state laws may treat it as targeted advertising. It happens only if you opt in. Turning a choice off stops future collection but can't recall what was already sent; to ask a platform to delete it, use the privacy tools of Meta, Reddit or Pinterest.
4.4 Cookies and local storage
terrestream.com
| Name | Set by | What it does | Lifetime | Needs your consent? |
|---|---|---|---|---|
csrf_token |
Terrestream | Protects our forms against cross-site request forgery | 1 hour | No (strictly necessary) |
lang |
Terrestream | Remembers the language you picked | 1 year | No (functional) |
ts_currency |
Terrestream | Remembers the currency you picked; not readable by page scripts | 1 year | No (functional) |
ts_theme |
Terrestream | Remembers light or dark display | 1 year | No (functional) |
ts_attribution_v1 |
Terrestream | Keeps campaign labels (utm_*) to link a purchase to the campaign visit |
30 days | Yes: site analytics |
ts_ga4_conversion_v1 |
Terrestream | Keeps your Google Analytics browser and session identifiers for server-side purchase reporting | 30 days | Yes: site analytics |
_ga, _ga_<ID> |
Google Analytics | Up to 13 months | Yes: site analytics | |
ts_meta_conversion_v1 |
Terrestream | Keeps Meta's browser identifiers and when you consented, for server-side purchase reporting | 30 days | Yes: Meta and Reddit |
ts_reddit_conversion_v1 |
Terrestream | Keeps Reddit's click identifier and when you consented | 30 days | Yes: Meta and Reddit |
_fbp, _fbc |
Meta | Meta ad measurement | Set by Meta (90 days by default) | Yes: Meta and Reddit |
_rdt_uuid |
Reddit ad measurement | Set by Reddit | Yes: Meta and Reddit | |
| Pinterest cookies (on pinterest.com) | Match activity to Pinterest accounts | Set by Pinterest | Yes: Pinterest | |
Stripe cookies (such as __stripe_mid) |
Stripe | Fraud prevention on the checkout form | Set by Stripe | No (strictly necessary) |
Cloudflare security cookies (such as __cf_bm) |
Cloudflare | Distinguish people from bots | Set by Cloudflare | No (strictly necessary) |
Local storage on terrestream.com keeps your three choices (ts_ga4_consent, ts_pinterest_consent_v1, ts_meta_reddit_consent_v3) and, if you allowed Pinterest measurement, ts_pinterest_ts-purchase-<order> so a purchase isn't counted twice. These entries stay until you change your choices or clear your browser's storage.
app.terrestream.com and sign-in (all strictly necessary)
| Name | What it does | Lifetime |
|---|---|---|
ts_session |
Your signed-in session, shared across Terrestream sites | 1 hour |
ts_refresh |
Keeps you signed in | 30 days |
ts_2fa_challenge |
A two-step sign-in in progress | 5 minutes |
__Secure-ts_home, ts_living_brief |
Web dashboard session | Browser session; 8 hours |
csrf_token |
Protects the sign-in forms | 1 hour |
ts_locale, ts_theme (local storage) |
Your language and display choices | Until cleared |
Google Customer Reviews
On a recent paid-order confirmation page, Google Customer Reviews may offer an optional post-delivery survey. To display its opt-in, we share with Google your checkout email, order reference, delivery country, estimated delivery date, and product identifier. We do not share your name, street address, payment details, or sensor data for this program. Google may place or read cookies or use similar technologies in its survey module. Google sends the survey email only if you opt in through its prompt. Participation is optional and does not affect your order. We do not load this module when your browser sends Global Privacy Control or Do Not Track. You can manage cookies in your browser and use the privacy choices described in section 8. Google processes this information under its Privacy Policy.
5. Who we share information with
We share personal information only as this section describes.
5.1 Service providers
We use these companies for the listed service purposes. Their applicable terms and privacy roles depend on the service; payment, authentication and security providers may also process information for their own legal or security purposes. Processing on our behalf is subject to applicable data-protection obligations and, for covered customer data, the DPA. The current list is at terrestream.com/legal/sub-processors. For business customers, we give at least 30 days' notice of new sub-processors, as our Data Processing Agreement describes.
| Provider | What it does for us | Personal information involved | Where |
|---|---|---|---|
| Vultr | Hosts our servers, databases and backups | All information in our systems | United States |
| Cloudflare | Network delivery and security, bot protection (Turnstile), country and city estimates from IP addresses | IP addresses and request data | Global network |
| Proton | Our support and privacy mailbox | Emails you send us; order notifications | Switzerland |
| Mailgun | Sends our emails | Email addresses and content | United States |
| Stripe | Payments, sales tax and fraud prevention | Name, email, addresses, payment and order details | United States and European Union |
| EasyPost (with FedEx) | Shipping labels and delivery | Name and shipping address | United States |
| Apple | Push notifications (including Live Activities), Sign in with Apple, App Attest, and the Apple Maps base map in the iPhone app | Notification tokens and content, sign-in identifiers, the map area you view | United States |
| Android push notifications (Firebase Cloud Messaging), Firebase App Check and Installations, Google sign-in, and Google Analytics if you allow it | Notification tokens and content, app instance identifiers, sign-in identifiers, analytics data | United States | |
| Twilio | Text messages for Terrestream Facilities alerts | Mobile numbers and message content | United States |
| Anthropic | Language model for the support assistant | Questions you type | United States |
Some services receive no personal information from us. Google's Air Quality and Pollen services, Open-Meteo (in the European Union) and the US National Weather Service receive only the centre of a grid square. We download NOAA and NASA smoke and fire data without sending any location. DB-IP is a database we run on our own servers; we send DB-IP nothing.
The product viewer’s decoder is served from our own site.
5.2 Advertising partners, only if you opt in
Meta, Reddit and Pinterest receive the information in section 4.3, and only if you opt in. They are third parties, not our service providers, and can use the information under their own privacy policies.
5.3 Payment partners you choose
At checkout, you can pay by card or a payment method actually displayed there. Availability depends on the provider, your location and device. The partner you choose receives your order details and the information it asks you for, and its own terms and privacy policy apply. Pay-later partners may run their own eligibility checks. Refunds go back through the method you used.
5.4 People and services you choose
- Family Circle: members can see the home's rooms, current and past readings, alerts and insights, within the limits in sections 2.4 and 2.5. They can also see the names and email addresses of the people in the Family Circle, including the owner. They can't see your billing.
- Integrations: if you connect Home Assistant, an MQTT broker or another smart-home system, or create a webhook or an API token, you direct us or your sensor to send information to the destination you choose. That service's terms then apply, and it may combine the information with other information it holds.
- Facilities organizations: see section 14.
5.5 Notifications and messages
To deliver a notification, we send its content through Apple Push Notification service (iPhone, including Live Activities) or Firebase Cloud Messaging (Android). The content can include room names, your home's status, the alert text and some readings. Apple and Google receive it to deliver it, and we keep a copy in your notification history. We send email through Mailgun. Terrestream Facilities alerts go by email (Mailgun) and text message (Twilio) to staff who sign up (section 14).
5.6 Legal reasons, advisers and business transfers
We may disclose personal information:
- when the law requires it, or in response to valid legal process;
- to protect anyone's rights, property or safety, including ours, or to enforce our terms;
- to our lawyers, accountants and auditors, who must keep it confidential; and
- in a merger, acquisition, financing, reorganization or sale of all or part of our business. The recipient must honor this policy, and we will give notice where the law requires.
5.7 Sale and sharing choices
We do not exchange personal information for money; optional advertising disclosures may be a sale or sharing under California law. The only sharing for cross-context behavioral advertising is the optional ad measurement in section 4.3, which stays off unless you turn it on. We have no actual knowledge of selling or sharing the personal information of anyone under 16. We don't disclose personal information to third parties for their own direct marketing.
6. Where we store information
We store and process personal information primarily in the United States, with Vultr as our main hosting provider. Some service providers process it elsewhere: Proton in Switzerland, Cloudflare on its global network, and Stripe in the United States and the European Union. Open-Meteo, in the European Union, receives only grid-square coordinates, never personal information. The sub-processor list shows where each provider processes information.
Information in another country is subject to that country's laws, and its authorities may be able to access it. For example, US authorities can seek data held in the United States under laws such as the Stored Communications Act and the CLOUD Act. We protect transfers with contracts and the measures in section 13. Section 10.3 covers people in Canada and Quebec.
7. How long we keep information
7.1 Retention periods
We keep personal information only as long as we need it for the purposes in this policy. Then we delete it or de-identify it. A legal hold or a record-keeping duty can extend these periods.
| Information | How long we keep it |
|---|---|
| Account profile, sign-in identities, settings and two-step verification | Until you delete your account, or we delete it as inactive (section 7.3) |
| Raw sensor messages, as received | 24 hours |
| Reading history, Free plan | 90 days |
| Reading history, Pro | While you have Pro. If Pro ends, we keep your older history in case you return, but show only the last 90 days; it's deleted with your account or under section 7.3. You may delete your account or use any available explicit retention control; the inactivity-deletion rule also applies. |
| Insights, Air Score history, alerts, reported actions, and activity and source events with their evidence | Same as your reading history |
| Planning data for forecasts and schedules | 36 days |
| Outdoor-forecast snapshots used for window guidance | 7 days, and no more than 2,048 per home |
| Notification history and delivery records | Up to 13 months |
| Household activity log | 400 days |
| Journal entries | Until you delete them or your account |
| Automation and webhook delivery logs | 30 to 90 days |
| Crash reports | 90 days |
| Update-health checks | 1 day |
| Readings from unclaimed sensors | Up to 24 hours |
| Sign-in tokens and email codes | Deleted 7 to 30 days after they expire or are revoked |
| Two-step sign-in attempts, with IP address and browser | 90 days |
| Account security audit log | 24 months; email addresses in it are pseudonymized when you delete your account |
| Consent and acceptance records | While your account exists, and 3 years after you withdraw a consent or delete your account, in minimal pseudonymized form after deletion |
| Web-shop orders, invoices and tax records | 7 years |
| Advertising identifiers attached to orders | Deleted within 48 hours after they are sent |
| Contact, support and privacy requests, including IP address and browser details | 24 months |
| Emails in our support mailbox | Retained as needed to answer and document the support request, resolve follow-up issues and meet applicable legal recordkeeping requirements; subject to applicable deletion rights. |
| Facilities alert contacts | While you're enrolled; after you opt out or are removed, only a one-way fingerprint of the number or address (to honor the opt-out) and the consent record |
| Weekly brief copies (if you turned on the weekly brief) | Three calendar months after creation (UTC, with the last day of a shorter month used when needed). The stored copy and link expire then; the payload and link hash are erased by the next bounded daily cleanup. A minimal home/week/creation marker remains until the home is deleted, to prevent regeneration or duplicate sending. Copies already received by email and underlying readings are not deleted by this expiry. |
| Website visitor log | 13 months |
| Matomo, Google Analytics, cookies | Sections 4.2 and 4.4 |
| Server and network logs | API application logs: 14 daily rotations; API slow-request logs: 7 daily rotations; marketing application logs: 90 daily rotations; monitoring logs: 12 weekly rotations. Network/provider logs follow the applicable service settings and security needs. Rotation counts do not promise deletion at an exact hour. |
| Facilities organization data after contract end | When the Facilities commercial relationship ends, we record its contractual termination or expiration date; a suspension or billing pause alone does not start the closure period. If the customer makes no return/deletion election, we delete the organization’s data from active systems after 90 days from that date. This default applies to every Facilities customer, with or without a DPA. An elected return/deletion follows the applicable agreement and instructions. Required records and legal holds, backup rotation and confirmation of completed deletion remain distinct. Personal accounts and device identities are separate; another owner’s data is not included. Ambiguous custody or an unresolved legal hold requires review and must not be reported as completed deletion. After verified delivery of an elected return, we delete the active copy by the same 90-day deadline measured from contractual termination or expiration. If delivery is not verified, we escalate the case rather than erase the only undelivered return copy. Applicable mandatory shorter deadlines and existing signed agreements control. Required retained records are restricted to that purpose and deleted when that reason ends. |
| Backups | Rotating recovery copies are retained for restoration, not ordinary product use. Marketing database backups use a standard 30-day rotation; API configuration backups use a seven-day local rotation. Managed database and provider backup retention follows the applicable recovery policy. Legacy copies may be preserved during a verified recovery transition; account deletion reaches backups through the applicable rotation rather than immediate rewriting. |
| Aggregate and de-identified statistics | Information that is merely de-identified remains protected where applicable law treats it as personal information. We retain it only for the stated purposes and applicable periods. Only information meeting the applicable legal standard for anonymization is treated as anonymous. |
7.2 Deleting your account
You can delete your account at any time in the apps or on the web dashboard. Before you confirm, we offer you a copy of your data (section 8.2). Account access and sessions end immediately. We delete or anonymize your account, homes that have no other active members, their readings and insights, your Family Circle memberships, notification tokens and history, your personal integrations and their secrets, and your location and time-zone information. Deleting your account does not automatically transfer ownership of a shared home; remaining members keep their existing roles. We stop sending notifications to you. Shared homes and household records needed by their remaining members may be retained. Automations you created remain as shared household rules, with your creator identity removed; we stop fetching outdoor data for homes left without an active owner or co-owner. We request cancellation of any active Pro subscription and retry or escalate external cleanup until confirmed. Your sensors become unclaimed, and we stop storing their readings until someone claims them again.
We keep only what we need: order, payment and tax records (7 years), a minimal record of your consents and acceptances, a pseudonymized security audit trail (up to 24 months) and anything we must keep for legal reasons. Copies in backups are deleted as those backups expire. the backup rotation described above Some dependent cleanup, such as a final phone-activity dismissal or a failed external billing cancellation, may require retries after account access ends. We retry unfinished external billing and delivery cleanup and escalate failures; we do not treat it as complete before confirmation. Stripe keeps its own payment records under its own policies. Deleting an app doesn't delete your account.
7.3 Inactive accounts
The dormant-account deletion process is not currently enabled. If enabled, we apply this notice procedure before deletion: if you don't sign in, and none of your sensors send readings, for 24 months in a row, we email you. If you do not sign in and none of your sensors resume sending readings during the next 60 days, we delete your account as described in section 7.2. Signing in or resumed readings prevents deletion under that notice; a later period of inactivity requires a new notice.
7.4 Deceased users
An executor, estate administrator or surviving spouse can contact us about a deceased person's account. For a deceased Quebec account holder, we handle requests by an estate representative, heir, beneficiary, spouse or close relative under the applicable access rules, including sections 30, 40.1 and 41 of Quebec's private-sector privacy law. We verify identity and authority, protect other people's information and respect applicable restrictions and any recorded refusal. Accounts do not automatically pass to heirs.
8. Your rights and choices
8.1 Your rights
Depending on where you live, the law gives you some or all of these rights. We extend all of them to everyone in the United States, whatever your state, without limiting stronger rights your state gives you. Section 10 covers Canada and Quebec, and section 11 covers Mexico.
- Know and access what personal information we collect, use and disclose, and get a copy.
- Portability: get it in a portable, machine-readable format.
- Correction of inaccurate information, and deletion.
- Opt out of sale, sharing and targeted advertising. Optional ad measurement may constitute sale or sharing and is opt-in (section 4.1).
- Opt out of profiling that produces legal or similarly significant effects. We don't do that kind of profiling.
- Limit the use of sensitive personal information (section 9.3), and withdraw consent you have given.
- Appeal our decision on a request (section 8.4).
- Equal treatment: we won't deny you service, charge you a different price or give you lower-quality service for using these rights. Differences between our Free and Pro plans aren't discrimination.
8.2 How to make a request
- Online: terrestream.com/privacy/data. You don't need an account. We email you a link to confirm the request; it works for 24 hours.
- Contact form: terrestream.com/contact?dept=privacy.
- Mail: Aerodyne Inc., Attn: Privacy Officer, 8 The Green, Ste A, Dover, DE 19901, USA.
- Someone acting for you: an authorized agent, or a legal representative such as a parent, guardian or mandatary, can make a request for you with written authorization. We may ask you to confirm your identity with us directly.
Getting a copy of your data. Choose "access" or "portability" in the privacy portal. After you confirm the request, we send your data to the email address you confirmed, as a machine-readable (JSON) file. The file covers your account, settings and consents; homes, rooms and sensors; Family Circle memberships; notifications (up to 13 months); insights and events; integrations (without their secrets) and API token names; billing status; and hourly readings for your history period. You can also download your JSON account export from the web dashboard’s account settings.
8.3 Verification, timing and fees
We verify your identity before acting on a request. Usually, confirming through the link we email you is enough. For deletions and requests for specific pieces of information, we may ask for more, such as details only the account holder would know.
We confirm receipt within 10 business days. We respond within 45 days in the United States (we may extend once, by up to 45 more days, and will tell you why) and within 30 days in Canada and Quebec. Requests are free, including two access requests in any 12-month period. For more frequent access requests, or requests that are clearly unfounded or excessive, we may charge a reasonable fee or decline, where the law allows.
Family Circle members can make their own requests; the owner's request covers only the owner's information. Your rights have legal limits: we may keep information we need to comply with the law, prevent fraud, protect security, complete a transaction you asked for, or bring or defend legal claims. De-identified information isn't covered, because we can't link it back to you.
8.4 Appeals
If we deny all or part of your request, we will explain why. You can appeal by replying to our decision, or through terrestream.com/contact?dept=privacy with the subject "Privacy appeal". A senior officer of Aerodyne Inc. who wasn't involved in the first decision reviews the appeal and answers in writing within the time the law allows (usually 45 to 60 days). If you are still not satisfied, you can contact your state attorney general or another regulator listed in section 16.
8.5 Choices in the product
- Home location: optional; if you remove it, outdoor information stops.
- Notifications: choose them in the app or turn them off in your phone's settings. The weekly brief email is off unless you turn it on.
- Two-step verification: available for every account.
- Cloud upload: use the sensor on its own, or turn on local-only mode through the Home Assistant link (section 2.3).
- Family Circle: members can leave a home at any time from Settings.
- Website measurement: Your Privacy Choices or GPC (section 4.1).
- Your account: delete it at any time (section 7.2).
9. Notice to California residents
This section and the rest of this policy are our privacy policy and notice at collection under the California Consumer Privacy Act (CCPA). The categories below also describe what we collected in the 12 months before the effective date.The lookback includes information collected by earlier versions, including more precise location coordinates and full crash-memory reports; later data-minimization fixes do not erase that historical collection.
9.1 Categories of personal information
| Category | Examples | Sources | Why we use it | Who receives it | Sold or shared? | How long we keep it |
|---|---|---|---|---|---|---|
| Identifiers | Name, email, account and sign-in identifiers, sensor serial number and ID, IP address, notification tokens; cookie and ad click identifiers if you opt in | You; your sensor, apps and browser; Apple or Google sign-in | Providing the service, security, orders, support, analytics; opt-in ad measurement | Service providers (hosting, network, email, payments, shipping, notifications, sign-in, analytics); Meta, Reddit and Pinterest if you opt in; payment partners you choose | No exchange for money. May constitute sale or sharing (cookie and click identifiers, and the IP address each platform sees) only if you opt in | Until you delete your account; website identifiers as in section 4.4 |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, postal address, email; payment details held by Stripe; mobile number for Facilities alerts | You; Stripe | Orders, shipping, billing, Facilities alerts | Stripe, EasyPost, Mailgun, Proton, Twilio; payment partners you choose | Not sold or shared | Orders 7 years; Facilities contacts while enrolled |
| Characteristics of protected classifications | Confirmation that you are 18 or older; age range of Family Circle members under 18 | You; the Family Circle owner | Eligibility and parental consent | Service providers (hosting) | Not sold or shared | Until the account or membership ends |
| Commercial information | Orders, Pro plan and subscription status, trial and renewal dates | You; Stripe | Orders, billing, support; purchase reporting for opt-in measurement | Stripe; Google Analytics if you allow it; Meta, Reddit and Pinterest if you opt in | No exchange for money. Purchase value, currency and quantity may constitute sale or sharing when disclosed only if you opt in | Orders 7 years; subscription details until you delete your account |
| Internet or other electronic network activity | Pages viewed, campaign labels, device and browser; feedback on insights and notification history; server logs; visitor log (organization, internet provider, ASN) | Your browser, apps and sensor | Analytics, security, product improvement; opt-in ad measurement | Cloudflare; Google Analytics if you allow it; Meta, Reddit and Pinterest if you opt in | No exchange for money. May constitute sale or sharing only if you opt in | Visitor log 13 months; notification history up to 13 months; sections 4.2 and 7.1 |
| Geolocation data | Approximate home location (about 1 km); approximate location from your IP address; time zone | You; your phone; your IP address | Outdoor information, time zone, local website content, pricing currency, visitor log | Service providers (hosting, Cloudflare); Apple or Google geocoding in the apps | Not sold or shared | Home location until you remove it or delete your account; visitor log 13 months |
| Sensory data (environmental sensor readings) | CO₂, particulate matter, VOC and NOx indexes, temperature, humidity, pressure, light | Your sensor | Providing the service and insights; product improvement | Service providers (hosting); Apple and Google when readings appear in notifications | Not sold or shared | Free plan 90 days; Pro as in section 7.1 |
| Professional or employment information | Facilities role, organization and building assignments | Your organization; you | Terrestream Facilities | Service providers (hosting, Mailgun, Twilio) | Not sold or shared | While active; after contract end, the organizational closure rule in §7.1 applies |
| Inferences | Occupancy and routines, away or vacation, asleep now, activities such as cooking, cleaning, a shower or airing; Air Score | Derived from sensor readings | Insights and notifications | Service providers (hosting); Apple and Google when they appear in notifications | Not sold or shared | Same as reading history |
| Sensitive personal information | Account sign-in (email with password); the location reading from your phone, which we round before storing | You; your phone | Sign-in; setting your home's approximate location | Service providers (hosting) | Not sold or shared | Password hash until you delete your account; we don't store the unrounded reading |
We do not collect biometric information, audio, video, education records or medical/wearable-health records. The environmental inferences described above can concern apparent sleep or routines; they are estimates, not medical findings.
9.2 Sale and sharing
We do not exchange personal information for money. Optional advertising disclosures to Meta, Reddit and Pinterest described in section 4.3 may constitute a sale or sharing under California law. You can opt out of both through Your Privacy Choices or GPC.The preceding category table describes the 12-month lookback, including earlier collection. Current consent controls do not establish whether every historical disclosure had the same consent record.
9.3 Sensitive personal information
We use account credentials to provide and secure sign-in, and location information to set your home's approximate location and provide local conditions. Environmental readings also support the occupancy, routine and apparent-sleep estimates described in section 2.5; those estimates are not medical findings. You may request a limit on the use or disclosure of sensitive personal information through the privacy portal (section 8.2). We apply that request and any required restriction under applicable law.
9.4 Other California notices
- Do Not Track: on our website, we treat a Do Not Track signal the same way as GPC; it turns off optional measurement.
- Tracking by other companies: Google, Meta, Reddit and Pinterest can collect information about your online activity over time and across websites through our website only if you allow it (section 4.1).
- Shine the Light: we don't share personal information with third parties for their own direct marketing.
- Financial incentives: we don't offer any in exchange for personal information. The Pro trial and plan differences aren't tied to your personal information.
10. Canada and Quebec
10.1 Person in charge of personal information
The person exercising the highest authority at Aerodyne Inc. is responsible for protecting personal information, unless that responsibility has been delegated in writing. Contact the person in charge of personal information at terrestream.com/contact?dept=privacy or at the mailing address in section 16.
10.2 Consent
We follow the fair information principles of Canadian privacy law and rely on your consent. It can be implied for processing you would reasonably expect, such as sending readings to our cloud while your sensor is connected. We ask for express consent for optional or more sensitive uses, such as website ad measurement, the weekly brief email and text-message alerts. You can withdraw consent at any time, subject to legal or contractual limits, though some features may then stop working; for example, if you turn off cloud upload, your readings stay on the sensor.
The optional occupancy and recurring-routine functions described in section 2.5 analyze household patterns. Occupancy and recurring-routine analysis are enabled by default outside Quebec. In Quebec, or if we cannot determine the home’s applicable region, they remain off until an owner or co-owner explicitly activates them. An owner or co-owner can turn these two functions on or off in the web dashboard. An enabled default is not a record of affirmative consent. This control does not disable the separate air-quality alerts or their detailed evidence.
10.3 Transfers outside Quebec and Canada
We store personal information about people in Canada primarily in the United States, and some service providers process it in other countries (section 6). Before we communicate personal information outside Quebec, we assess whether it will be adequately protected, considering its sensitivity, the purposes, the protective measures (including contracts) and the legal framework where it goes. This describes the required assessment process; it does not certify that every provider or transfer has been assessed. You can ask us about these practices.
10.4 Privacy impact assessments
As Quebec law requires, we assess privacy impacts before we acquire, develop or overhaul an information system or electronic service delivery system involving personal information, before we communicate personal information outside Quebec, and before we communicate it for research without consent.
10.5 Your rights in Canada and Quebec
You can ask to access and correct your personal information, ask how we use and disclose it, and withdraw consent. In Quebec, you can also ask for your computerized personal information in a structured, commonly used technological format, and ask us to stop disseminating your information or to de-index a link to it, where Quebec law allows. We don't make decisions based exclusively on automated processing of your personal information; if we ever do, we will tell you and let you submit observations to a member of our staff. To make a request, see section 8.2. This policy is also available in French.
10.6 Confidentiality incidents
If a confidentiality incident presents a risk of serious injury (Quebec), or a breach of security safeguards creates a real risk of significant harm (elsewhere in Canada), we notify the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada, as applicable, and the people affected. We also notify the Alberta and British Columbia commissioners where their laws require it, and we keep a register of incidents.
11. Mexico
If you live in Mexico, our Spanish-language privacy notice (aviso de privacidad) explains how we handle your personal information under Mexican law, including your rights of access, rectification, cancellation and opposition (ARCO rights), and how to exercise them. For people in Mexico, the aviso controls if it differs from this policy.
12. Children and Family Circle
Terrestream is not directed to children. You must be 18 or older, or the age of majority where you live if that is higher, to create an account independently, and you confirm this when you sign up. An eligible minor may instead create a restricted account through a Family Circle invitation with the guardian confirmation described below.
In Family Circle, the owner can add a member aged 13 to 17 only after confirming that the owner is the member's parent or legal guardian, or has the parent's or guardian's consent. We record that confirmation. Children under 13 can't be added, and in Quebec, children under 14 can't be added.
We don't collect information directly from Family Circle members beyond their own account and the choices they make. If we learn that we have collected personal information from a child under 13 (under 14 in Quebec) without a parent's or guardian's consent, we delete it and remove the child's access. A parent or guardian can contact us at terrestream.com/contact?dept=privacy to review or delete a child's information.
The sensor measures a room's air, not individual people. Schools, daycares and other organizations that install sensors where children are present must comply with the child-privacy and education laws that apply to them. Occupancy insights combined with class schedules or rosters could identify individuals.
13. Security
We protect personal information with measures suited to its sensitivity, including:
- encrypted connections in transit using TLS;
- passwords stored only as Argon2id hashes, and sign-in, verification, invitation and API tokens stored only as hashes;
- AES-256-GCM encryption in our applications for sensitive values, such as two-step verification secrets, sensor keys, notification tokens and Facilities alert contact details;
- encrypted (TLS) connections between our application servers and our separate database server;
- sensor messages signed with a key unique to each sensor;
- two-step verification, available for every account; and
- access to production systems limited to authorized staff.
We do not claim a completed SOC 2 certification.
No system is completely secure, and we can't guarantee that these measures will always prevent unauthorized access. If a security breach affects your personal information, we notify you and regulators as the law requires (see also section 10.6). If you think your account has been compromised, contact us. To report a vulnerability, see terrestream.com/security.
14. Terrestream Facilities
Terrestream Facilities is our service for organizations that monitor buildings. The organization's contract and our Data Processing Agreement govern the building information we process for it, and the organization decides how it is used. This policy covers the account and alert information of Facilities staff.
Email and text alerts. Staff can sign up for incident alerts by email, sent through Mailgun, and, with separate consent, by text message, sent through Twilio. We use your mobile number to verify it and to send the alerts you choose. We record your consent, the disclosure you accepted and its version, the verification and any withdrawal. Alerts include the building and room names and a short description of the condition. Your organization's administrators can see a masked version of your number and its verification and delivery status.
Mobile information and text-message consent are never sold, rented or shared with third parties or affiliates for marketing or promotional purposes. This applies despite anything else in this policy. Twilio processes messages only to deliver them. You can withdraw consent in My notifications or by replying STOP. After you withdraw, we keep only what we need to honor your choice. The SMS terms are at facilities.terrestream.com/sms and in our Commercial Addendum.
15. Changes to this policy
We post the current version at terrestream.com/legal/privacy and keep earlier versions at terrestream.com/legal/archive.
For a material change, such as new categories of personal information, new purposes, new kinds of recipients or a change to your rights, we give you at least 30 days' notice by email, in the apps and on the web dashboard, and we ask you to review and accept the updated terms before you continue using the service. Other changes take effect when we post them. If a change needs your consent, we ask for it before the new processing starts.
16. Contact us
- Person in charge of personal information: the person identified by role in section 10.1
- Contact form: terrestream.com/contact?dept=privacy
- Privacy requests: terrestream.com/privacy/data
- Mail: Aerodyne Inc., Attn: Privacy Officer, 8 The Green, Ste A, Dover, DE 19901, USA
You can complain to a regulator without contacting us first, though we would welcome the chance to help:
- United States: the California Privacy Protection Agency, your state attorney general, or the Federal Trade Commission.
- Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376).
- Quebec: the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
- British Columbia: the Office of the Information and Privacy Commissioner for British Columbia.
- Alberta: the Office of the Information and Privacy Commissioner of Alberta.
Terrestream℠ is a service mark of Aerodyne Inc.; the leaf logo and “Breathe Better. Live Smarter.®” are registered trademarks of Aerodyne Inc. Patents pending.