FrightLink Privacy Policy

1. Who we are and what this covers

FrightLink is a family of wireless devices for Halloween props: the Hub, sensors such as the Ghost, and Executioner prop controllers. FrightLink hardware and the apps that control it are made by Prolific Software Solutions LLC, West Chester, Pennsylvania, USA, the company behind FrightMaps (“we”, “us”).

This policy covers:

• our companion and preview apps that control FrightLink hardware (section 2);
• the FrightLink features in the FrightMaps app (section 3); and
• the FrightLink devices themselves (section 4).

Your FrightMaps account, the rest of the FrightMaps app and website, orders for FrightLink hardware, and anything you send through the forms or chat assistant on frightlink.com are covered by the FrightMaps Privacy Policy.

2. Companion and preview apps

Besides the FrightMaps app, we publish companion and preview apps that control FrightLink hardware. In these apps:

• No accountThere is no account and no sign-in.
• No trackingNo ads, no analytics, no crash reporting and no tracking SDKs.
• Stays on your deviceSettings and setup progress are stored only on your device.
• Nothing collectedWe collect no personal data from these apps and share none.

Bluetooth

The apps use Bluetooth Low Energy only to find and control FrightLink devices you own: the Hub, sensors and Executioners. On Android 12 and newer, the app’s Bluetooth scan permission is declared neverForLocation, so Bluetooth scanning is not used to work out where you are. On Android 11 and older, Android requires location permission before an app can scan for Bluetooth devices; the app asks for it only for that reason, and it never reads, stores or sends your location.

Shopping links

Some screens link to products at a retailer. Those links open the retailer’s website, either in an in-app browser or in your device’s browser. Anything you enter there, such as a sign-in, an address or payment details, goes to that retailer and is handled under the retailer’s own privacy policy, not ours. We do not receive it.

3. FrightLink in the FrightMaps app

The FrightMaps app sets up and runs FrightLink with your FrightMaps account. Unlike the companion apps, its FrightLink features use our cloud services, so some information does leave your phone. This section lists what. Everything else the FrightMaps app does is covered by the FrightMaps Privacy Policy.

Bluetooth

The FrightMaps app uses Bluetooth Low Energy to find, set up and control your FrightLink devices and other supported Bluetooth decorations. On Android 12 and newer its Bluetooth scan permission is declared neverForLocation.

What the app writes to your Hub

• Your FrightMaps account ID, which records you as the Hub’s owner.
• Your phone’s current time and time-zone offset, so schedules and sleep windows follow local time.
• The device names, actions, port settings, schedules and other settings you create.
• If you connect the Hub to Wi-Fi, the network name and password you enter. The password goes from your phone to the Hub over Bluetooth. It is kept on the Hub and in the app on your phone, and it is not saved to your FrightMaps account.

What is saved with your FrightMaps account

When you set up a Hub, the app saves these to your account in our cloud database (Google Firebase):

• A record of the Hub: its Bluetooth name and device identifier, the name you give it, your account ID and email address, when it was paired and last seen, its firmware version, update and storage status, the devices paired to it with their names, battery levels and firmware versions, and whether its cloud features are on.
• Your devices and setup: the sensors and Executioners paired to the Hub, with their device identifiers (hardware addresses) and names, a copy of your schedules, your Fire Groups, cloud triggers and alert settings, and whether the Hub is linked to one of your haunt listings.
• Activity: events the Hub reports, such as motion detected, a prop fired, an input activated, a low battery or a device that stopped responding, with the device and port names involved and the time; and hourly counts of how often each sensor triggered.
• Repair backups: if you run the Hub storage repair, the app saves a backup of your paired devices, port settings and schedules on your phone and in your account. The backup never includes the Hub’s PIN or your Wi-Fi password.
• Beta updates: whether your account is enrolled in beta firmware.

Remote control over the internet

If you turn on the Hub’s cloud features, the Hub connects to your Wi-Fi and to a message broker run for us by HiveMQ. When you fire a prop remotely, the request goes to our servers, which check that the Hub is yours, and then through the broker to the Hub. The app also connects to the broker to show your Hub’s live status and activity. What the Hub reports while it is online is listed in section 4.

Notifications

FrightLink can send push notifications to your phone about your devices, such as motion alerts you turn on, low batteries and a Hub that has gone offline, and a daily email listing devices whose batteries are low. These name the Hub, device and port involved.

Your haunt listing and the visitor remote

If you link a Hub to your FrightMaps haunt listing, activity on that listing, such as likes, reviews, check-ins and shares, can fire your props. When a like, review or check-in fires them, we record the command with that person’s FrightMaps account ID, and for a check-in their display name. If you turn on the visitor remote, people at your haunt can fire the one Fire Group you choose from your listing in the FrightMaps app. To check that a visitor is nearby, the app sends the visitor’s current location with the request; our server uses it only to work out the distance to your listing and does not save it. To enforce cooldowns we keep an identifier for each visitor (their account ID, or a random ID the app creates if they are not signed in) and when they last fired.

Amazon Alexa

If you link FrightLink to Amazon Alexa, Amazon receives the names of your Hubs, Fire Groups and ports so you can control them by voice. Alexa then sends us device commands, such as turning on a Fire Group, not voice recordings. We keep a record that the link exists, including a hashed token. Amazon handles your Alexa use under its own privacy policy.

Firmware updates

The app checks our firmware server for updates, and your devices download updates from the same place. These are plain downloads that carry no account information. If your account is enrolled in beta firmware, that setting is saved with your account.

Analytics and error reports

The app records firmware-update steps in its usage analytics (the device type, the version and whether the update worked). Device faults the Hub reports, such as a sensor restarting unexpectedly or an Executioner that stops responding, are sent to our error-monitoring service, Sentry, with the Hub’s ID and the device’s name. If the app itself hits an error, Sentry receives an error report with your account ID, email address and display name, recent app activity, and a low-resolution screenshot of the screen you were on.

If you tap Send FrightLink Diagnostics, the app attaches a report to an email to our support team: the Hub’s status and recent log, its paired devices, the Wi-Fi network name and the Hub’s local network address, your phone’s recent Bluetooth connection history with the Hub, and your account details. Passwords and PINs are removed. You see the email before you send it, and nothing is sent unless you send it.

4. What the devices store and send

On the devices

The Hub stores your paired devices and their names, your actions, port settings and schedules, the owner’s account ID if it was set up with the FrightMaps app, and, if you set them, the Wi-Fi network name and password. Sensors and Executioners store their own settings and which Hub they belong to.

Between the devices

Sensors and Executioners talk to the Hub over a short-range wireless link, not over the internet. They go online only to download a firmware update you start, using Wi-Fi details the Hub passes to them for that update.

When the Hub is on Wi-Fi

If you give the Hub Wi-Fi details, it joins your network, gets the current time from public time servers (pool.ntp.org, time.nist.gov, time.google.com) and from Google, and downloads firmware updates from our firmware server. Those requests carry no account information. While it is on Wi-Fi, the Hub also broadcasts its diagnostic log lines on your local network (UDP port 5555) so it can be checked without a cable. Other devices on the same network can receive them; they are not sent over the internet.

If the Hub’s cloud features are also on, it sends:

• To our servers: a regular check-in with its ID, firmware version, storage status and paired devices (their names, types, battery levels and firmware versions); and the activity events described in section 3.
• To the message broker: a status report with the Hub’s ID and name, firmware version, the owner’s account ID, the Wi-Fi network name and the Hub’s address on your local network, and its paired devices with their names, battery levels, ports and schedules. The broker keeps the latest report so the app can show your Hub’s status, and replaces it each time the Hub reports. The Wi-Fi password is never included.

With cloud features off, the Hub sends nothing to our servers or the message broker.

5. Sharing

We do not sell information from FrightLink devices or apps. We use these providers to run FrightLink, each acting on our behalf:

• Google Firebase and Google Cloud: database, server functions, push notifications, and hosting for the firmware server.
• HiveMQ: the message broker that carries remote commands and Hub status.
• Sentry: error and fault reports.
• Amazon Web Services: sending email, such as the daily low-battery email.

If you link Alexa, Amazon receives what is described in section 3. We may also disclose information if the law requires it or to protect the safety and security of our users and services.

6. Keeping and deleting data

• Companion and preview apps: everything stays on your device and is never sent to us.
• On your devices: information stays until you change it. Factory Reset in the FrightMaps app erases a Hub’s saved settings.
• In your FrightMaps account: FrightLink records stay while your account exists. Email us at any time to have them deleted, or delete your FrightMaps account as described in the FrightMaps Privacy Policy.

7. Children

FrightLink hardware and the apps that control it are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

8. Changes to this policy

If we change how FrightLink hardware or these apps handle information, we will update this page and its effective date before the change takes effect.

9. Contact

Questions or requests about this policy: contact@frightmaps.com.

Prolific Software Solutions LLC
West Chester, Pennsylvania, USA