About this pre-release policy
Published 29 October 2026. Pre-release version. Nuclyo is preparing its Android and iOS app for public release. This page records confirmed product choices and the privacy commitments we require the release to meet. In-app account deletion, detailed retention schedules and some service-provider arrangements are still being implemented or verified.
We will update this page to describe the verified release before public launch and app-store submission. Publication of this pre-release version does not mean those controls are already available. Current privacy and account-deletion requests can be sent to support@nuclyo.com.
Who we are and what this covers
NUCLYO LLP, Hyderabad, India (Nuclyo, we or us), is responsible for the Nuclyo app and its connected smart-home services. This notice covers accounts, home and device management, compatible cameras and locks, household sharing, notifications, home-location features and supported integrations.
Features depend on your device, permissions and the released app. AI chat and cloud recording storage are excluded from the initial release. Camera recordings are stored locally on the camera’s SD card. Our website privacy notice separately describes browsing nuclyo.com, including these pages.
Information and its purposes
The release must limit personal information to what is needed for the function you choose. Relevant categories are:
- Account and support information: account identifiers, contact details, sign-in and verification information, preferences and correspondence, for account access and assistance.
- Homes and household access: home and room names, selected home location, invitations, members and permissions, for organising devices and sharing access.
- Device and connection information: device identifiers, model and firmware, pairing and network information, IP address, status, commands, schedules and event times, for connecting and controlling devices. Pairing can require a Wi-Fi network name and credentials; their use must be restricted to connection setup and operation.
- Feature content: information needed for compatible camera viewing, talk, alerts, local playback and lock or guest-access functions, as explained below.
- Service operation: notification identifiers, app and operating-system version, connection errors and relevant logs, for notifications, troubleshooting and service security.
The release must not use personal information for sale, targeted advertising or tracking across other companies’ apps or websites. Optional analytics and diagnostic collection must be reviewed and disclosed before it is enabled. No claim is made here that every SDK in the current test build has already been audited.
Home location and weather
Location use is limited to tagging a home and providing weather information for that location. The release must not introduce continuous background location tracking or geofencing. A selected home location can remain associated with the home until it is changed or deleted.
Phone location permission must be requested when the relevant feature needs it. The operating system may provide precise or approximate location. Where an older operating system requires location permission for Wi-Fi or Bluetooth discovery, the pairing explanation must distinguish this from home-location use. The final release notice will identify the weather provider and the location information it receives.
Cameras, recordings and locks
Camera recordings are stored on the camera’s local SD card. This is separate from live video or audio transmission, remote playback, alert snapshots, thumbnails, technical metadata and copies saved to your phone. Local recording storage does not mean that video or related information never passes through network services.
Before launch, we will identify the actual media-transmission providers, any server-held event images or temporary caches, who can access them and their retention. Microphone permission must be limited to features such as two-way talk that you activate. Phone-camera permission must be tied to an explained feature such as scanning a pairing code.
Compatible lock functions can involve permission and credential identifiers, temporary-access arrangements, lock status and entry events. Before launch, the release must specify whether access codes or biometric information remain on the physical device or are processed by a service provider. Phone face or fingerprint authentication must not be confused with a smart lock or camera processing biometric data.
Account deletion must not be presented as proof that an SD card or downloaded recording has been erased. Supported local-erasure instructions must be shown before app access is lost, without making erasure a condition for deleting an account. Deletion must not silently unlock a door, format a card or reset household devices.
Service providers and processing locations
Tuya provides the smart-home platform and SDK underlying relevant Nuclyo functions. This can involve account, home, device, connection and feature-specific information. Its SmartLife SDK privacy notice describes the platform; the modules included in our release determine the actual data flows.
The planned release will use Google Firebase Cloud Messaging and Apple Push Notification service for notification delivery using installation or device identifiers and notification content. Firebase setup does not mean that Firebase Analytics or Crashlytics is included. The planned release will use Google Maps for the selected home’s map functionality. See Firebase privacy information, Google’s privacy policy and Apple’s privacy policy.
Before launch, this notice will identify additional weather, hosting, media-relay and diagnostic providers actually used. We require providers acting on our behalf to process information for the disclosed service purposes and protect it. Manufacturer or installer access must be reviewed and disclosed before it is enabled.
App or device information may be processed outside India. We will verify the service regions and applicable transfer safeguards before launch. This notice does not promise India-only hosting. Where disclosure is legally required, it must be limited to the relevant information and purpose.
Permissions and your choices
The release must request permissions in context: Bluetooth, nearby-device and local-network access for pairing or communication; location for the explained home/weather or operating-system pairing purpose; camera and microphone for the chosen camera or talk feature; selected photos or files for content you choose to upload or save; and notifications for alerts.
You can manage app permissions through your phone settings. Refusing an optional permission may limit the related feature. Household access, linked services and device recording settings are separate controls. Notification previews can reveal home information on a locked phone, so choose the preview setting appropriate for you.
The app must explain unexpected sensitive-data collection before it occurs and obtain any required consent. Requests for access, correction, deletion or withdrawal of consent can be sent to our privacy contact. We may need proportionate information to verify an account holder. Never send a password, one-time sign-in code or device access code to support.
Retention and security commitments
Our release requirements are to keep personal information only for its disclosed purpose and to apply a documented deletion or expiry rule to each category:
- Account, home and device configuration must be retained only while needed to provide the requested service, then included in account or relevant data deletion.
- Device and lock events, technical logs, alert images and temporary media caches must have separate, limited retention rules. They must not be retained indefinitely by default.
- Support correspondence must be kept only while needed to resolve the request, fulfil relevant support or warranty obligations, or meet a specific legal requirement.
- Backups must have a defined expiry cycle and must not restore deleted information into active use.
- Any information retained after account deletion must have a specific disclosed justification and retention period or expiry criterion.
The final release notice must publish the actual periods or specific criteria for these categories and provider-held copies. SD-card retention depends on device recording settings, capacity and overwrite or erase controls.
Firebase states that installation identifiers are removed from live and backup systems within 180 days after the customer requests deletion through its API. This applies to those identifiers; it is not a general retention period for all Nuclyo information or a promise that removing an account alone triggers that API request.
Required security measures include encrypted transmission, restricted administrative access, secure credential handling and tested deletion controls. These are launch requirements, not a statement that the current test build has passed verification. No method is absolutely secure, and we do not claim end-to-end encryption for unverified data flows.
Deleting an account
Current route: request deletion by emailing support@nuclyo.com. Our account-deletion page explains what to include and the current process. Do not send passwords or access codes.
Required at launch: an easy-to-find in-app Delete Account flow and a public web request route. Users must be able to submit the in-app request without a required separate email, call or support conversation. Before confirmation, the app must explain identity checks, shared-home and device effects, processing time and any justified retention. Accepted requests must be acknowledged, delays explained and completion confirmed accurately.
Deletion must cover the account and associated personal information in Nuclyo and relevant provider systems, with disclosed justified exceptions. Disabling the account or signing out is insufficient. Linked access must be revoked appropriately; if Sign in with Apple is used, its tokens must be revoked. Copies held independently by other users or services may need separate requests.
Tuya’s current SDK documentation describes a one-week account-cancellation period, during which signing in again cancels the request. We must verify the behavior in the release, disclose it and prevent automatic sign-in from silently reversing a deletion request. This is not a seven-day guarantee for every provider record or backup. Local SD-card recordings and phone downloads need separate erasure controls.
Uninstalling the app, signing out or removing a device does not by itself delete the account. The completed release notice will state the implemented menu path and actual deletion timeframe.
Children and people recorded by devices
Account eligibility and household-member age restrictions will be set and explained before launch. Accounts intended for children must not be enabled without the necessary safeguards, disclosures and authorisation.
Cameras, microphones and access systems can capture visitors, household members and children who do not have an account. Use them lawfully, provide necessary notices or permissions and limit access. Contact us about information you believe has been processed improperly, including a child’s information.
Privacy contact and updates
Privacy questions, complaints and requests: NUCLYO LLP, support@nuclyo.com.
Customer support: +91 98661 23707.
Plot No. 47-III, Road No. 76, Jubilee Hills
Hyderabad, Telangana 500033, India
Rights and response periods depend on applicable law. You may contact us about access, correction, deletion, consent or a privacy complaint. The designated grievance contact and any market-specific information required for launch will be added before release; this support number does not by itself appoint a statutory officer.
We will update this notice when the release is verified or our practices change. Material changes require appropriate notice and, where applicable, new consent before the new use begins. AI chat or any future cloud-recording service requires its own review and updated disclosures before being enabled.