Firefly Dashboard

Legal

Privacy Policy

Effective date: November 11, 2026

This policy explains what information Firefly Dashboard ("Firefly", "we") handles when you use the Firefly Dashboard app at app.firefly-dashboard.com and this website, why we use it, and the choices you have. We've tried to keep it plain and specific to how Firefly actually works.

Summary

  • Firefly shows information you choose (calendars, photos, weather and more) on your household's dashboards.
  • Calendar connections to Google and Microsoft are read-only. Firefly never creates, changes or deletes your events.
  • Sign-in credentials for connected accounts are stored encrypted.
  • We don't sell your information, we don't use it for advertising, and this website has no analytics or trackers.
  • You can disconnect a connected account at any time.

Information you provide

Your account

  • Email address, used to sign in, verify your account, and send account emails such as password resets.
  • Password, which we never store in readable form. We keep only a salted one-way hash (scrypt).
  • Optional name and your time zone, used to personalize the app and show times correctly.

Your household and dashboards

Firefly stores the configuration you create: dashboards and their layouts, widget settings, themes, display names, the calendars and photo folders you selected (with the names and colors you gave them), weather locations, countdowns, reminders and text you enter. This is needed to show your dashboards.

Background assets vs photo widgets: Firefly includes a small built-in asset manager for dashboard background images. Background images you upload to that asset manager are stored so they can be used on your dashboards. Ordinary Photo widgets do not use direct uploads; their photo content comes from external sources you connect, such as Google Drive, OneDrive or Immich.

Connected services

You can choose to connect a Google account or a Microsoft account so Firefly can display information from it. Connecting is optional, and you can connect more than one account. Each connection asks only for the permissions the feature needs, and the provider's own consent screen shows you what is being requested.

Google user data

This section describes how Firefly accesses, uses, stores and shares data from your Google account when you connect it.

What Firefly requests

Permission (OAuth scope)Why Firefly needs it
openid, email To confirm which Google account you connected and show its email address next to the connection.
https://www.googleapis.com/auth/calendar.calendarlist.readonly To list your calendars so you can pick which ones appear on your dashboards.
https://www.googleapis.com/auth/calendar.events.readonly To display events from the calendars you selected.
https://www.googleapis.com/auth/drive.readonly Optional, only if you turn on Google Drive photos. Used to browse your folders so you can choose a photo folder, and to show the images in that folder in a Photos widget.

The Google Drive permission is never requested when you only connect Google Calendar. It is requested separately, and only if you choose to use Google Drive as a photo source for that account.

What Firefly reads

  • Account identity: your Google account ID and verified email address.
  • Calendar list: the calendars you can access, with their names and colors.
  • Events from selected calendars only: title, start and end time, all-day status, description, location, organizer email, and recurrence identifiers used to show recurring events and avoid showing the same event twice. Events are read for the date range your dashboards display.
  • Google Drive, only if enabled: folder names while you browse, and in the folder you selected, the list of image files (including names and change information) and the images themselves.

How Firefly uses it

Google user data is used only to show you the calendar information and photos you chose on your own Firefly dashboards and displays, and to let you manage your connection in Firefly. Firefly does not write to your Google account: it never creates, edits or deletes calendar events or Drive files.

Firefly does not use Google user data for advertising, does not sell it, does not use it to build profiles of you, and does not use it to develop or train artificial-intelligence or machine-learning models.

Firefly Dashboard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What Firefly stores, and how it is protected

  • Connection credentials: The OAuth access and refresh tokens Google issues, together with your Google account ID and email, are stored encrypted using AES-256-GCM. The encryption key is stored separately from the database in the service configuration.
  • Your selections: Which calendars you selected (calendar ID, plus the display name and color you chose) and which Drive folder you picked are saved in your dashboard configuration.
  • Calendar events are not saved: Firefly retrieves events from Google when your dashboards need them and sends them to your signed-in app and paired displays. It does not keep a copy of your events in its database.
  • Photos, only if Google Drive is enabled: To show photos efficiently, Firefly keeps an index of the images in your selected folder and a temporary cache of display-sized copies on its servers. Camera and location metadata (EXIF/GPS) is removed from these copies. The cache has a size limit, and older copies are removed automatically.

Who can see it

Calendar events and photos are shown to people who can view your dashboards: signed-in members of your Firefly household and the displays you paired. Firefly does not share Google user data with third parties except with infrastructure providers that host the service on our behalf (see Sharing), when required by law, or with your explicit consent.

Disconnecting and removing access

  • Disconnect a Google account in Firefly from Integrations. Firefly immediately deletes the stored tokens for that account. Your calendar selections are kept as unavailable so reconnecting the same account can restore them.
  • Remove the account in Firefly to also delete its remaining connection record. Remove the related calendars and photo sources from your dashboards to delete those selections as well.
  • Disconnecting in Firefly deletes Firefly's copy of the credentials but does not withdraw the permission on Google's side. You can revoke Firefly's access at any time from your Google Account connections. After revocation, Firefly can no longer read data from your Google account.

Microsoft accounts

If you connect a Microsoft account (Outlook.com or Microsoft 365), Firefly requests Calendars.Read to list your calendars and display events from the calendars you select, plus the standard sign-in permissions Microsoft adds (openid, profile, offline_access). If you choose OneDrive as a photo source, Firefly also requests Files.Read to read photos from the folder you pick. Access is read-only.

Microsoft data is handled similarly to Google data above: sign-in tokens are stored encrypted, events are retrieved when needed rather than saved, photos are cached as display-sized copies without location metadata, and disconnecting deletes the stored tokens. You can also remove Firefly's access in your Microsoft account settings.

Other content sources

  • Immich. If you connect a self-hosted Immich photo server, its address and the API key you provide are stored encrypted and used only to show photos from the albums you choose.
  • Weather. To show weather, Firefly sends the locations you set (as coordinates or a place name) to weather services such as Open-Meteo and, for U.S. weather alerts, the U.S. National Weather Service. No account details are sent.
  • News and sports. Headlines and college football information are fetched from public sources. These requests do not include your personal information.

Displays and devices

When you pair a display, Firefly stores the pairing and a device credential so the display can show your dashboard. Paired displays report technical information such as screen size, software version and connection health, which we use to keep displays working and to help with support.

Dedicated Raspberry Pi displays can also report Wi-Fi diagnostics. You can remove a display at any time; removing it deletes its stored history.

Cookies

The Firefly app uses only cookies needed for it to work:

  • Sign-in session: keeps you signed in (HTTP-only; it ends when you sign out or after a set period, 30 days by default).
  • Display credential: lets a paired display stay connected to your dashboard.
  • Short-lived security cookies: protect sign-in, pairing and account-connection flows; they expire within minutes.
  • Theme preference: remembers whether you chose a light or dark appearance.

Firefly does not use advertising, analytics or cross-site tracking cookies. This public website sets no cookies itself.

How we use information

  • To provide Firefly: show your dashboards, keep displays connected and sync the content you chose.
  • To secure the service: authenticate you, prevent abuse and investigate problems.
  • To communicate with you about your account, such as verification, password resets, invitations and important service notices.
  • To support you when you ask for help.

We don't sell personal information and don't use it for advertising.

Sharing and service providers

We share information only as needed to run Firefly:

  • Infrastructure providers that host the application, database and file storage, and providers that send account emails, process data on our behalf to provide the service.
  • The services you connect (such as Google, Microsoft and Immich) receive the requests needed to read the data you selected.
  • Content services such as weather providers receive only what is needed to answer a request (for example, a location).
  • Legal reasons: if required by law, or to protect the rights, safety and security of users or the service.

Retention and deletion

  • Connected-account credentials are kept until you disconnect or remove the account, and are then deleted.
  • Calendar events are not stored. Cached photo copies are removed automatically as the size-limited cache rotates.
  • Your account and dashboard configuration are kept while your account exists.

To delete your Firefly account and its household data, use the support/contact method published on the Support page. We will confirm the request comes from the account owner and then delete it. Copies in backups may take additional time to expire.

Security

We protect your information with measures such as encrypted connections (HTTPS), encryption of stored account-connection credentials, hashed passwords, and access scoped to your household. No method of transmission or storage is completely secure, so we can't guarantee absolute security, but we work to protect your information and address problems promptly.

Children

Firefly accounts are meant to be created and managed by adults. A household dashboard may show family information, including information about children, that the account holder chooses to display. Firefly is not directed to children, and we don't knowingly collect personal information directly from children. If you believe a child has provided us information, please use the contact method on the Support page so we can address it.

This website

firefly-dashboard.com is a static website. It has no sign-in, no forms, no advertising cookies, no analytics and no trackers. Like any web server, our hosting provider may process standard technical information (such as IP address and browser type) to deliver the pages and protect against abuse.

Changes to this policy

Firefly is in private alpha and will change. When we update this policy we'll change the effective date above and, for material changes, notify account holders, for example by email or in the app, before they take effect where practical.

Contact

For privacy questions or account-deletion requests, contact us at privacy@firefly-dashboard.com. You can also find help on the Support page.