# Privacy Policy — eWeLink Monitor

**Last updated:** 2026-08-13

This policy describes how the **eWeLink Monitor** Chrome extension (“the Extension”) handles information.

## Summary

The Extension runs locally in your browser. It does **not** operate our own backend for storing your account data. Credentials and settings stay in Chrome local storage on your device. Network traffic goes only to the services needed for the Extension’s features (eWeLink / CoolKit APIs, MEA’s public site for Ft rates, and optionally a LAN agent you run on this machine or another device on your home network, default `127.0.0.1:18721`, for LAN mode — [ewelink-lan-agent](https://github.com/plugpogpag/ewelink-lan-agent)).

## Data we handle

Depending on how you use the Extension, it may process:

- **Authentication information** — eWeLink developer App ID and App Secret that you enter, and OAuth access / refresh tokens
- **Account / device identifiers** — eWeLink user apikey, device IDs, and device names
- **User activity / energy data** — device online status, switch state, meter readings (e.g. power, voltage, current, kWh), billing cycle settings, estimated bill results, and optional energy history you import

We do **not** collect payment card numbers, health data, your general browsing history, or content from unrelated websites.

## How data is used

Data is used only to provide the Extension’s features:

- Sign in to eWeLink and keep your session
- List, monitor, and control devices you choose
- Estimate MEA (non-TOU) electricity bills and show energy history
- Schedule billing cycle close / Ft refresh via Chrome alarms

## Where data is stored

- On your device via `chrome.storage.local`
- Temporarily in memory while the Extension is running (including realtime WebSocket traffic in the Monitor tab — eWeLink cloud frames, or LAN agent snapshots and local switch commands — which is not persisted after the popup closes; duplicate `d_seq` highlighting is display-only)

We do not sell your data. We do not use your data for advertising.

### Optional local LAN agent

The Extension can optionally communicate with a Python agent ([ewelink-lan-agent](https://github.com/plugpogpag/ewelink-lan-agent)) that you run yourself — by default at `http://127.0.0.1:18721` on this machine, or at another private address you enter in Options (for example a Raspberry Pi on your LAN), including `ws://…:18721` for live snapshots. When you enable LAN mode and run that agent:

- Device snapshots (meter readings, switch state) and switch commands may be routed directly between the Extension and the agent on your local network. These messages stay on your LAN / this machine and are not sent to any external servers.
- The Extension only allows loopback, RFC1918 private IPv4, or `*.local` hostnames for the agent. Access to a non-localhost agent requires an extra Chrome host permission that you grant when saving Options.
- A per-device `devicekey` used to decrypt LAN traffic is stored locally (in `chrome.storage.local` and, where needed, the local LAN agent) to enable encrypted communication. This `devicekey` is kept on your device and is not transmitted to our servers (we do not operate any servers).

## Third-party services

When you use the Extension, requests are sent to:

- **CoolKit / eWeLink** (`*.coolkit.cc`, `*.coolkit.cn`, including WebSocket gateways) — authentication, device and energy APIs
- **Metropolitan Electricity Authority (MEA)** (`www.mea.or.th`) — public Ft rate information for estimates

Those services are governed by their own privacy policies. The Extension does not control how they process data once received.

## Permissions (high level)

- **storage** — save settings, tokens, and billing data locally  
- **identity** — eWeLink OAuth via `chrome.identity.launchWebAuthFlow`  
- **alarms** — schedule billing cycle close and Ft refresh  
- **Host access** — CoolKit / eWeLink HTTPS+WSS, MEA HTTPS, and optionally `http://127.0.0.1:18721` / `ws://127.0.0.1:18721` (plus an optional permission for another private `:18721` host you choose) for the LAN agent

## Your choices

- You can clear Extension data, remove App ID/Secret, or uninstall the Extension at any time in Chrome.
- You can log out to remove stored OAuth tokens from local storage (as implemented by the Extension’s logout flow).

## Limited Use

The use of information received by this Extension is limited to providing or improving its disclosed single purpose: monitoring/controlling eWeLink devices and estimating MEA electricity bills. Practices are intended to comply with the [Chrome Web Store User Data Policy](https://developer.chrome.com/docs/webstore/program-policies/user-data-faq), including Limited Use requirements.

## Contact

Publisher contact: use the email verified on the Chrome Web Store listing for this Extension.  
Project / support: https://github.com/plugpogpag/Vite-React-Ewelink-Monitor/issues

## Changes

We may update this policy when the Extension’s data practices change. The “Last updated” date at the top will be revised accordingly.