Security and privacy

Your data stays at home

• 

  No central server

  SweetFrame has no server that collects families' data. Resized copies of your photos, your settings and your birthdays are kept on the frame in your home, and the frame connects directly to the services it needs. We do not receive photos, glucose readings, calendars or settings from it.

• 

  No ads, no tracking, no analytics

  The frame has no ads, telemetry or analytics. The nightly update check carries no family data. It does identify the frame to our update channel, with the frame's own Google identity, so that only frames we registered receive updates (Signed updates). The browser that draws the screen is set up not to connect anywhere outside the frame itself.

• 

  Access details in protected files

  The Nightscout token and secret calendar links are kept on the frame in a protected file and are never written to the system logs. The settings PIN is stored only as a hash, and for paired phones only a hash of their access code is stored, so nobody can impersonate a phone with what is stored on the frame.

Minimal access to your accounts

The frame does not need the password of any account. It sees only what you chose to share with it, and only to read it, apart from the optional settings backup, which writes only its own file.

• 

  Google Drive and Google Calendar: read-only

  Each frame has its own Google address, and you share a folder or a calendar with it as with any person. With that address the frame uses read-only permissions (drive.readonly and calendar.events.readonly): through it, the frame never uploads, changes or deletes anything, and it does not see your e-mail, contacts or other files.

• 

  No folder is shown without your approval

  A folder shared with the frame is not shown until someone approves it on the frame or on a paired phone, so a stranger who shares a folder with the frame's address cannot put photos on it. A calendar shared with the frame is read only if you add it in the settings, and the frame keeps only the title, date and time of each event: no description, location or attendees.

• 

  Nightscout: a read-only token over an encrypted connection

  The frame contacts your Nightscout site only over an encrypted connection (https), with a read-only token that you create on the site, and it does not need the API_SECRET. Glucose readings are kept only in the frame's memory, never in files, and are not sent from it to any service: not to us, not to Google and not to the backup.

  The frame also checks what the token can do. A token that the frame finds can write to the site, or what it recognises as the API_SECRET, is not saved, and such a token that is already saved shows no glucose until it is replaced with a read-only one. When the site does not let the frame tell whether a token can write, the frame shows the glucose and warns you to check on the site that the token has only the readable role.

• 

  Settings backup: SweetFrame's own files only

  The Google Drive backup is optional. If you choose it, the frame asks for a single permission, drive.file, which reaches only the files SweetFrame itself created. With it the frame creates a SweetFrame folder with its own backup file in your Drive, updates that file, and deletes only older versions of that same file (when you turn off including access details, below). The backup goes straight from the frame to your Drive, not to us. The account can be connected only on the frame's own screen, and nothing is saved until you confirm on the screen that the account is yours.

  Wi‑Fi passwords, the settings PIN, paired phones, the frame's own key, family notes and photos never go into a backup. The Nightscout token and calendar links are included in the Drive backup by default, so that a restore is complete, and you can turn that off. A backup file downloaded to a phone never contains them. What exactly the backup holds

The frame itself

• 

  A firewall: home network only

  A firewall on the frame blocks every incoming connection except those from your home network. Nothing on the frame is reachable from the internet, and settings from a phone work only from inside your home.

• 

  Pairing a phone: a one-time code from the screen

  To pair a phone you scan a code that the screen shows only when someone asked to pair a phone. The 6-digit code is valid for 10 minutes and for one use, and after 5 wrong tries it is replaced with a new one. Without pairing, a phone or computer on the network cannot see the family's information or change settings. A phone not used for 90 days is unpaired by itself, and a lost or sold phone is unpaired in Settings → Phone.

• 

  A settings PIN

  You can set a 4 to 8 digit PIN without which the settings cannot be opened on the frame's screen, for example when small children or guests are around. After 5 wrong tries the settings are locked for 5 minutes. A phone that is already paired does not need the PIN.

• 

  A screen that does one thing

  The browser that draws the screen opens only the frame itself: no browsing, downloads, extensions or account sign-in, and its data is erased at every start. The frame's app, which connects to the internet and opens your photos, and this browser run as an ordinary user, without administrator rights, and cannot change the system files. The installer of signed updates and the full reset run with full rights. The app can only ask for them, and for a short, fixed list of other system actions, such as connecting to Wi‑Fi or restarting the frame.

• 

  Encrypted connections

  The frame connects to Google, your Nightscout site, the weather service, the Shabbat times service, your calendar links and the update channel only over encrypted connections (https). A calendar link or Nightscout address that starts with http:// (unencrypted) is refused. A Nightscout address typed without a prefix gets https://, and a webcal:// calendar link is read over https.

Signed updates

• 

  Only updates we signed

  Every SweetFrame update is digitally signed (Ed25519). Before installing, the frame checks the signature and the file's size and fingerprint (sha256), and an update that fails the check is not installed. The key that signs updates is not on the frames and not in the update channel, so taking over the update channel alone is not enough to install other software on frames.

• 

  A private update channel

  Frames download updates from a private storage area of ours on Google Cloud, which only frames we registered can read. Each frame signs in to it with its own Google identity and gets read-only access, so we can cut off the access of a single frame, for example a stolen one, without affecting the others. The channel keeps our software private; what protects your frame is the signature above, which the frame checks whatever the channel delivers. What Google and we can see of these requests: privacy policy, section 6.

• 

  Only forward, with a way back

  The frame installs only a version newer than the one it has. After installing, it checks that the new version works, and if it does not, or keeps crashing, the frame goes back to the previous version by itself. Photos and settings are kept.

• 

  Operating system security updates

  Security updates for the operating system and the browser, from Debian and Raspberry Pi, are installed automatically and checked against the distributor's digital signature before they are installed.

This website

• 

  A static site, without tracking

  sweetframe.org is a static site: it has no scripts, the site itself sets no cookies, and it has no analytics, ads, fonts or components from other services. Its Content Security Policy (CSP) forbids the browser to run scripts on it or to load components from other sites, and it tells the browser to connect to it only over an encrypted connection. The site is hosted on Cloudflare Pages: what Cloudflare processes is set out in the privacy policy, section 8.

Good to know

Good security includes being honest about the limits. These are the things you should be aware of:

• 

  The memory card is not encrypted

  Someone who physically holds the frame or its memory card can read what is stored on it. If the frame is lost or stolen, follow the steps in the guide (Hebrew) and write to us. Before a frame goes to another family, we recommend a new card.

• 

  Inside your home, the phone talks to the frame without encryption

  The connection between a phone and the frame travels over your home network without encryption. So connect the frame to the family's network rather than the guest network, and if the network is not entirely yours, type tokens, passwords and calendar links on the frame's own screen.

• 

  We have technical access to the frames

  As the people who prepare and update the frames, we have technical access to them. What exactly, and when we use it: privacy policy, section 10.

What you can do

• Settings PIN: Settings → System → “Settings PIN” (״קוד נעילה להגדרות״). Pair a phone first, since a paired phone needs no PIN.
• The pairing code on the screen is only for whoever stands in front of the frame: do not photograph or forward it.
• Nightscout: create a token with the readable role only (chapter 8 of the guide, Hebrew), and do not post the address or the token in group chats.
• A lost or sold phone: unpair it in Settings → Phone.
• Guests: guest mode hides glucose, the calendar and notes from the screen.
• Passing the frame on to someone else? Write to us, and stop sharing your folder and calendar with it. There is also a full reset on the frame's own screen, which deletes the family's information from the frame's storage (chapter 12 of the guide, Hebrew). Deleted data can sometimes be recovered from a memory card, so for a frame that goes to another family we also recommend a new card (Good to know).

Found a security issue?

• 

  Write to us

  Found something on the frame or on this site that looks like a security issue? Write to us at support@sweetframe.org with the word “Security” in the subject. Tell us what you saw, which version (Settings → About), and how to reproduce it. We look into every report and will get back to you.

  Please do not publish the details before we have had a chance to fix it, and do not attach tokens, passwords or screenshots with glucose readings.

More about what the frame stores and who receives what: privacy policy.

אבטחה ופרטיות בעברית