August Home is a San Francisco smart lock brand founded in 2013, known for retrofit smart locks, the Connect Wi-Fi bridge, a doorbell camera, and the August Home app, which provides remote locking, guest access keys, an activity feed of lock and unlock events, and geofenced Auto-Unlock. ASSA ABLOY acquired the company in 2017; in 2023, a US Department of Justice antitrust settlement tied to ASSA ABLOY's purchase of Spectrum Brands' hardware division required divestiture of the August and Yale residential smart lock businesses in the US and Canada to Fortune Brands Innovations, and August is now operated by Master Lock Company LLC. August's policy describes retention of lock activity, including guest activity, for the life of an account and at least 90 days after deletion, sharing with Fortune Brands affiliates and service providers, and advertising cookies and mobile ad IDs on its website, while stating that it does not sell personal information and that Auto-Unlock location data stays on the user's device. In 2020, Bitdefender reported a Wi-Fi credential exposure flaw (CVE-2019-17098) in the Connect bridge; August patched it.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
13 ON FILE
COLLECTION
The August Home iOS app's Apple privacy label discloses collection of data linked to identity including contact info, contacts, user content, identifiers, and diagnostics; precise location and audio data are collected but listed as not linked to identity.
August's privacy policy states that lock activity, including guest activity, is stored for the duration of the account and retained for at least 90 days after account deletion, with aggregate or anonymous information kept indefinitely. The same policy states doorbell camera photos and videos are downloadable for up to 30 days and that Auto-Unlock location data is stored only on the user's device, not on August's servers.
ASSA ABLOY announced on October 19, 2017 that it had signed an agreement to acquire August Home, the San Francisco-based smart lock maker founded in 2013, adding it to the ASSA ABLOY Group.
Under a May 2023 Justice Department antitrust settlement clearing ASSA ABLOY's $4.3 billion acquisition of Spectrum Brands' Hardware and Home Improvement division, ASSA ABLOY was required to divest its August and Yale residential smart lock businesses in the United States and Canada to Fortune Brands Innovations, Inc.
August's current privacy policy identifies the brand as operated by Master Lock Company LLC and elsewhere names Fortune Brands Innovations, Inc. as its parent company, making the operating entity and ultimate parent traceable directly from the policy.
August's 'Do Not Sell My Personal Information' notice states that August does not sell personal information, and describes sharing with service providers and other Master Lock Company LLC entities for purposes the notice characterizes as necessary, with a CCPA opt-out channel provided.
August's privacy policy permits sharing or transferring collected information to organizations affiliated with its parent company Fortune Brands Innovations, Inc., to third-party service providers, and to third parties users select via 'Works With' and 'Connected With' integrations.
In response to the Bitdefender findings, August stated it was aware of the vulnerability and that security updates were in production for the device firmware and Android app as of August 7, 2020; August also said it was not aware of any affected customers and that the flaw did not affect the newer August Wi-Fi Smart Lock.
Bitdefender researchers reported CVE-2019-17098, a flaw in the August Smart Lock Pro + Connect Wi-Fi bridge setup process that could expose home Wi-Fi credentials to a nearby attacker. Bitdefender states it contacted August on December 9, 2019, that August acknowledged the vulnerability, and that Bitdefender published in August 2020 after the vendor stopped responding during coordinated disclosure.
NIST's National Vulnerability Database describes CVE-2019-17098 as use of a hard-coded cryptographic key in the August Connect Wi-Fi Bridge app and firmware, allowing an attacker to decrypt an intercepted payload containing Wi-Fi network authentication credentials.
August's cookie policy states the august.com website uses advertising cookies to serve ads on the site and, through service providers, to serve ads on third-party websites based on the visitor's interactions with august.com, alongside pixel tags and analytics cookies, with a Digital Advertising Alliance opt-out offered.
Per the app's Apple privacy label, August Home indicates that Usage Data may be used to track users across apps and websites owned by other companies — a comparatively narrow cross-app tracking disclosure for the smart home category.
August's California consumer disclosure lists collection of unique browser and device identifiers including cookies, mobile advertising IDs (IDFA and Android Ad ID), device hardware identifiers, IP addresses, and precise geographic location data, and notes that vendor cookie use on its websites may constitute a 'sale' under applicable law.