Android app · October 28, 2026
HAM Privacy
HAM is an independent Android agenda app. It is not an official Home Assistant, Google, or Apple app. TinkerCobble does not run a HAM account, calendar database, or authentication proxy. The older experimental .dev package is a separate installation from the canonical com.tinkercobble.ham app.
Information HAM uses
After you authorize HAM in Home Assistant, it reads the calendars, events, and open tasks your account can access. Home Assistant decides the account permissions granted; its authorization is not necessarily limited to calendars. With Android calendar permission, HAM can discover Android Calendar Provider calendars and read or change events on calendars you select when that calendar allows it. Existing Android account synchronization may send those changes to Google or another account provider. HAM does not collect that account's password.
HAM can connect directly to user-configured HTTPS CalDAV services, including iCloud, and read-only HTTPS ICS subscriptions. Calendar items may include names, times, descriptions, locations, recurrence and reminder details. HAM keeps source identity and permission information to show choices and guard writes.
Where information goes
HAM sends sign-in and data requests directly to the Home Assistant, CalDAV or ICS address you choose, or to Android's Calendar Provider. It does not send calendar or task contents to TinkerCobble. Your Home Assistant installation, its integrations, remote-access provider, Android account sync, and underlying calendar services may process those requests under their own practices. HAM includes no advertising, analytics, or telemetry SDK. Find Time and other scheduling calculations run on your device; HAM has no AI scheduling server.
Screenshot import reads only an image you share with HAM or select in Android's photo picker. Text recognition runs on your phone. Address verification is off by default. If you opt in, HAM asks Android's location service to look up a completed street address after you finish entering it; that service may send the address to its provider. HAM does not send the image, event title, or calendar data for this lookup. If you tap Maps, HAM passes the address to the map app you choose; that app may send it online under its own privacy practices. Copying a location places it on Android's clipboard. When you save an event with a screenshot, HAM uploads the image to authenticated private storage on your Home Assistant server and adds a reference to the selected calendar event. The image is not placed on this website. Home Assistant administrators control that server's storage and backups.
When you approve a supported CalDAV or Home Assistant change, HAM can hold it in encrypted storage on your device and retry it when a connection is available, including in the background. The request goes directly to the configured calendar service. A Home Assistant request with an uncertain outcome is checked but never resent automatically; you can review it in Settings. HAM's Offline switch pauses its own remote reads and writes until you turn it off. Android account calendars may still synchronize through Android independently. Optional local reminders use Android alarms and generic notifications, which may resume after a reboot. Android may delay reminders when exact-alarm or notification permission is unavailable.
Home Assistant may request the public HAM identity page while authorizing the app. Cloudflare hosts this website and the public download and processes ordinary request details such as IP address, requested path, and time. The authorization code and calendar contents are not sent to that page by HAM. Downloading the APK does not require an account, email, or PIN.
Information on your device
The canonical app encrypts the selected Home Assistant address and authorization tokens, CalDAV account details and passwords, private ICS subscription URLs and credentials, recent agenda cache, pending Home Assistant and CalDAV changes, local tasks, templates and saved groups in app-private storage backed by Android Keystore. Some choices and status metadata, such as calendar visibility and refresh times, remain in private app settings. An explicitly created HAM local calendar is an Android Calendar Provider record that other calendar apps with permission may see. The older downloadable DEV build has different storage and feature coverage. Android app backup is disabled.
If you choose Copy settings from previous HAM and the old app has its migration update, a signature-protected local connection copies the old Home Assistant address and display choices to the canonical app. It does not copy authorization tokens, calendar events or screenshot images. The old app remains installed and you authorize Home Assistant separately in the new app.
Unfinished Quick Add forms and screenshot review text are encrypted in app-private storage. A chosen screenshot image stays in app-private storage without additional HAM encryption so review can resume. Home Assistant attachments are stored privately on your server without additional HAM encryption. The local-content backup is passphrase-encrypted and contains local tasks and templates; it does not include provider events, account credentials, private subscriptions or pending writes.
The separate Home Assistant sign-in screen uses Android WebView. HAM requests removal of its sign-in history, cache, storage, and cookies when that screen closes. HAM receives authorization tokens, not your Home Assistant password. HTTPS uses Android certificate checks. The app permits HTTP only for private or local addresses after a warning that the connection is unencrypted.
Your controls
Calendar selection is opt-in. Settings can clear loaded information without deleting provider records. Disconnect removes HAM's local Home Assistant session and loaded information; a separate option requests token revocation first and reports when the remote request could not be confirmed. A confirmed event change can modify the selected writable provider calendar. ICS subscriptions are read-only. Uninstalling or clearing app data removes local HAM information but does not delete records held by Home Assistant or other calendar providers.
ICS import reads a document you choose and asks for review before supported writes. ICS export saves a copy to a document location you choose; that storage provider may read or synchronize the exported event details. An encrypted local-content backup is also written to a document location you choose.
Updates and contact
HAM checks its public TinkerCobble update file when opened. On Android 12 and later, HAM can also check in the background and download a verified update on unmetered Wi-Fi when automatic installation is enabled in Settings and Android allows installs from HAM. HAM verifies the APK checksum, package, newer version and signing identity before asking Android to install it. Android may still require your approval; on older devices, or when automatic installation is unavailable, HAM offers the normal approval-based update. You can turn automatic installation off in HAM Settings. These requests expose ordinary connection metadata, such as an IP address, to the website host but do not include your Home Assistant address, credentials, calendar or task contents, or a HAM-generated device identifier. The older DEV app has a separate update file. Google Play and F-Droid versions are not available.
For privacy questions, contact support@tinkercobble.com.