← IoT Privacy Database

August / Yale Smart Lock

August Home (ASSA ABLOY) · Smart Lock

Staff Reviewed — a person at DeSpy reviewed this rating.

2.6Surveillance
Index
Policy — what its policy permitsC
Evidence — what research provesB

The lock logs every entry and exit and the identity of everyone granted access - household members, guests, cleaners, delivery workers - creating a precise occupancy and who's-home record tied to your door. August collects name, email, phone and details about other people with access, and may share information with ASSA ABLOY-affiliated organizations. Core lock/unlock works over local Bluetooth without the cloud, but WiFi features and remote access route through August's servers and require an account.

Why this rating

The written explanation of this rating is withheld while a person re-reviews it.

What it is

Manufacturer
August Home (ASSA ABLOY)
Category
Smart Lock
Model years
2020-present
Market status
Current
Companion app
August Home / Yale Access

The evidence 1

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S2August Smart Locks - Privacy & security guide
    Ngo review · Mozilla Foundation (*Privacy Not Included) · 2021-11

    Mozilla notes August collects data on everyone with lock access, shares with ASSA ABLOY affiliates, and flags an unresolved August Connect WiFi vulnerability, rating data protection 'Needs Improvement.'

    Why it matters here: Independent privacy assessment specific to these locks, covering both the who-has-access data collection and a real security disclosure.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database