Kraftspa — Privacy Policy

Last updated: 7 November 2026

Kraftspa is a controller for Balboa hot tubs, with an app for iPhone. The controller sits at the tub on your home network; the app talks to it. This policy describes what each does with your information. There is no Atemkraft account, no analytics and no advertising, in the app or on the controller.

What the controller keeps, and where

Everything Kraftspa knows about your tub lives on the controller, at the tub:

• Your tub's settings and history: its name, temperatures, plan, the water and outdoor temperature graphs, heating energy and cost, and a log.
• Your WiFi network and the controller's password (stored only as a hash).
• Each paired phone: the name you gave it, its own key and sign-in, which alerts it wants, and its Apple push address if you turned alerts on.
• Your postal or ZIP code, if you entered one for the outdoor temperature.

What the app keeps

The app keeps each tub's address, its own sign-in and its key in the iPhone's keychain, on that iPhone only. The tub's password, if the app made or was given it, is kept in your iCloud Keychain so your other devices can show it. A copy of each tub's latest reading is kept on the iPhone for the widgets and Siri.

What goes to other services, and when

• Time: the controller asks public time servers for the time.
• Updates: the controller asks GitHub for new versions when it checks, and downloads them from GitHub.
• Weather: if you enter a postal or ZIP code, the controller asks Environment Canada or the US National Weather Service for the nearest station's readings. Your code stays on the controller; the station's location is what's asked about.
• Alerts go from the controller through Atemkraft's relay (remote.atemkraft.dev) to Apple's push notification service and on to your iPhone. The words of each alert are encrypted with your phone's own key, which neither the relay nor Apple has. The relay and Apple see your phone's push address, the kind of alert (for example "ready" or "fault") and when it was sent. To tell you when the tub goes offline, the relay keeps the push addresses of the phones that asked for that alert while the tub is connected.
• The heating Live Activity, only if you turn it on, sends the water temperature, the target and the expected ready time through the relay to Apple, not encrypted with your key, because iOS needs to read it to show it on your Lock Screen.
• Remote access, only if you turn it on, goes through the same relay, encrypted end to end with each phone's own key. The relay sees when a phone talks to your tub and how much, never what is said.
• Smart home: Apple Home and Matter work on your home network. MQTT, if you turn it on, goes to the server you name.
• Support access, only when you give Atemkraft a code, lets us look at your controller through the relay until you stop it or it times out.

What Atemkraft receives

The relay keeps a random id for each tub, a hash of its secret, when it last connected and counts used to limit how many alerts it sends: no name, email, address or tub readings. It keeps no logs of what passes through. Otherwise we receive nothing, unless you write to us or give us support access. TestFlight and the App Store may share crash reports with us if you choose to send them through Apple.

Your control

• Turn alerts, each kind of alert, the Live Activity and remote access off at any time in the app's Settings.
• Remove a phone in Settings › Household, and its key and sign-in stop working at once.
• "Forget remote access" asks the relay to delete your tub's record.
• A factory reset erases everything on the controller.

Children

Kraftspa is for the adults of a household. It does not collect information about children.

Changes

If this policy changes, the date at the top changes with it.

Contact

Questions about this policy: info@atemkraft.dev