Privacy security and performance

🇫🇷 Version française

Privacy, security and performance

What Maquette stores, what it sends, what it can do in your home, and what it costs.

Where your plan lives

• The plan (rooms, walls, devices, widgets, settings) is stored in the dashboard configuration of Home Assistant, like any card, and saved with the frontend's lovelace/config/save call. Home Assistant requires an administrator for that.
• The JavaScript file contains no data about your home.
• The browser keeps a few things locally (localStorage, per plan id):

Key	Content	When
maquette-brouillon:<id>	The unsaved editor draft (the whole plan)	While editing, removed when it equals the saved plan
maquette-versions:<id>	Fallback copy of the last 5 saved versions and the last 3 plans before clean-up (since 0.3.0 they live in your Home Assistant account, see below)	After a save or a clean-up
maquette-calques:<id>	Layers a viewer hid with the Layers button	When used
maquette-rouvrir:<id> (sessionStorage)	Selection and grid, to reopen the editor after a save	30 seconds

• Since 0.3.0, the saved versions are also stored in your Home Assistant user data (frontend/set_user_data, key maquette-versions:<id>, compressed, 1 MB per card): only your own account reads them, on every device, and nothing leaves your Home Assistant.

These copies stay in the browser in clear text, without expiry. Clear the site data of the browser to remove them (for example on a shared or wall-mounted device). Do not put secrets such as codes in the data of room actions.

Network

• The card makes no request outside Home Assistant: no CDN, no font, no analytics, no external API. The editor file maquette-editeur.js is read from the same folder as the card, on first use.
• It talks to Home Assistant through the frontend connection only:

Call	Used for
history/history_during_period	Tile charts, room climate trends, replay
recorder/statistic_during_period	Periods tables
search/related	Automations, scenes and scripts of a room
lovelace/config, lovelace/config/save	Editor save
frontend/get_user_data, frontend/set_user_data	Saved versions of your account (new in 0.3.0)
/static/mdi/iconList.json (from Home Assistant)	Icon search in the editor

• A person's avatar is loaded from its entity_picture only when Home Assistant serves it (a path starting with /); otherwise the initials are shown. A card's More info button set to a URL opens it in a new tab.

What the card can do in your home

Nothing happens without a tap. The services it can call are listed in Entities › Services Maquette can call: toggles, the buttons of cover, lock and thermostat widgets, Activate buttons for scenes, scripts and buttons, and room actions (any domain.service written by an administrator).

Sensitive services (unlock, open a garage door, disarm, run a script, any service not known as safe) always open a confirmation dialog naming the real service and entities; confirm: true confirms the others too. See Security.

Who can do what

• Every user of the dashboard sees the plan and can use its buttons, toggles and widgets, as with any card.
• Only administrators see the editor; editor: false hides it for everybody.
• The demo (demo: true) never reaches your devices: services and history only touch the simulation, and more-info windows are disabled.

Imported plans and templates

An imported plan or template is configuration: it can contain room buttons, widgets and links. Only import plans from people you trust. Before anything is applied, the import shows what the plan can control, its links and the values removed as invalid; a plan can never run code nor load anything from another site. See Security › Import check.

Performance

• Since 0.3.0, two files: maquette-card.js (about 300 KB minified: the card, both languages, the demo), loaded with the dashboard, and maquette-editeur.js (the editor, the clean-up engine, the YAML reader), loaded only the first time someone opens the editor. People who never edit never download it.
• At rest the plan barely uses the CPU: energy flow dots move at 10 steps per second, dawn and dusk fade in small steps, rain and snow slide with a CSS animation that Chromium-based browsers and the Android app run on the compositor, and every animation pauses while the card is off screen or the page is hidden.
• effects: light (default on touch screens with effects: auto) draws the window light without blur and keeps clouds and fog still; force effects: full on a powerful wall tablet if you prefer the full rendering.
• The plan is drawn once, then each Home Assistant update only changes what depends on the entities of the plan.
• Animations are CSS and SVG, and pause while the card is off screen or the page is hidden; weather and energy flows are redrawn only when their entity changes.
• History is read on demand: charts and trends per entity (cached 5 minutes), statistics (cached 5 minutes), and the replay (every entity of the plan over 1–72 hours, loaded when you open it). On a slow server, keep replay.hours low.
• On a low-power wall tablet: animation_level: reduced, and show_furniture: false if you do not need the furniture.