ObservedSeverity: ModerateConfidence: High
Home/away schedule events sent to an analytics company
With “Usage insights” on, transitions between Home and Away modes were sent to Tallymark Analytics with timestamps.
Hearthly T3 Thermostat
Connected device · Hearthly Home Co. · HT-T3
- Device model
- HT-T3
- Publisher
- Hearthly Home Co.
- Platform
- Hearthly firmware
- Versions
- Firmware 2.7.0
- Scan date and region
- Aug 17, 2026 · EU (Ireland lab)
- Consent state
- Default setup; optional "Usage insights" on
- Scan method
- Lab device — authorized network capture
- Coverage
- Partial · methodology 0.9
Privacy exposure
29 / 100
Moderate measured exposure
Summary of the tested session
During a 72-hour lab session, the thermostat contacted 3 recipient companies. Schedule events that can indicate when a home is occupied were sent to an analytics company. Primary cloud traffic could not be read.
Evidence coverage: Partial
Meets the minimum for rating, but significant parts of behavior could not be observed. Readable request contents: 35%.
Principal findings
UnknownSeverity: UnknownConfidence: High
Primary cloud traffic could not be inspected
65% of requests were unreadable.
What information was involved
A permission alone is not treated as evidence of collection or transmission.
| Category | Status | Detail |
|---|---|---|
| Advertising and device identifiers | No transmission observed in the tested session | No advertising identifier observed. |
| Network information | Observed in a transmission | IP address visible to contacted servers. |
| Approximate or precise location | Declared by the publisher | Publisher declares postal code for weather. |
| Browsing and interaction events | Not assessable with this method | Not applicable. |
| App usage and viewing events | Observed in a transmission | Setpoint changes and schedule events. |
| Account or contact information | Not assessable with this method | Account traffic unreadable. |
| Sensitive contextual information | Observed in a transmission | Away/home schedule transitions. |
Behavior under tested privacy choices
| Scenario | Status | Recipients contacted | Companies |
|---|---|---|---|
| Consent accepted | Tested | 3 | Orbital Cloud, Tallymark Analytics, Nimbus Edge |
| Consent rejected | Not tested | Unknown | Not established |
Why this rating
Illustrative · methodology 0.9
Sensitivity of observed information9/20
Persistence and linkability of identifiers6/20
Recipient roles and dissemination evidence5/20
Behavior under tested privacy choices5/20
Disclosure–observation discrepancies4/20
Five dimensions, 0 to 20 each, sum to the score. Coverage gaps never lower a score.
What remains unknown
- Primary cloud API traffic (65% of requests) unreadable.
- Turning off "Usage insights" was not tested.
What you can do
Turn off “Usage insights”
Publisher states analytics events stop.
Request another scan after changing a setting
A new scan can show whether the setting changed observed behavior.
Not a legal compliance certification or a safety guarantee. Child-audience assessment: Not assessed (separate from this rating). 3 recipient companies observed in this scan.