HomeK8s

Privacy and your data

Your Pi talks to our portal so we can guide you through the tutorials. Here's everything it shares, what we never do, and how to leave.

What your Pi sends while in tutorial mode
  • Node health, every few seconds

    Hostname, Pi model, memory, temperature, uptime, load, disk use, whether kubelet and containerd are running, and how many terminals are open. Nothing about your files or network.

  • Your terminal, passed through

    Your Pi's terminal page reaches you through HomeK8s's gateway (and Cloudflare, which carries our traffic), so it works from anywhere. We pass the bytes along and never record what you type or what's on screen.

  • Step check results

    Named checks like "is swap off?" from a fixed list built into the agent. They send back a short pass/fail message.

  • Support sessions you approve

    An admin can only open a terminal on your Pi after you approve a time-limited session. The Pi announces it, lists their terminals on its page so you can end them, and we log that they opened one.

What we never do
  • Connect into your network. The Pi only makes outbound connections; your router needs no changes.
  • Open a terminal without a link the portal signed for you (or an admin you approved), which the Pi checks itself and accepts once.
  • Store your cluster's secrets: admin.conf, join tokens and certificates stay on the Pi.
  • Keep your data after you offboard. We delete your check results and node health; we keep only order and invoice records the law requires.
You can always see the mode

Every login on the Pi (SSH or a screen) shows a banner saying whether it's in tutorial mode or offboarded. You can also ask the Pi directly:

$ homek8s status
Mode:        tutorial
Portal:      https://homek8s.io
Support:     none
Terminal:    https://pi-3f2a….homek8s.io
Health sent: hostname=pi-1 model=Raspberry Pi 5 … kubelet=active
Leave:       sudo homek8s offboard

The agent is one program at /usr/local/bin/homek8s with no other dependencies. The complete list of checks it can run is readable: checks.sh.

Offboarding

From the portal, or on the Pi with sudo homek8s offboard (which works even if our servers are gone):

  1. 1Every open terminal is closed.
  2. 2The agent tells the portal it's leaving, then deletes its device token and key.
  3. 3The agent and its service are removed from the Pi (not just disabled), so it can't connect out again.
  4. 4The login banner changes to OFFBOARDED so you can always tell.
  5. 5The portal revokes the device and deletes your check results and node health.
  6. 6Your Kubernetes cluster, containerd, kubeadm and your files are untouched. It's yours.
Support sessions

If you ask for help, an admin can request a support session. It does nothing until you approve it in the portal, it ends automatically after the time shown (usually an hour), and you can end it any time. While it's active your Pi broadcasts a message to logged-in users, its login banner says so, the admin's terminals are listed on your Pi's terminal page where you can end them, and we log every time they open one. Outside a support session admins see only your nodes' health, never your commands or their output.

Data terms version 2026-10-10. We handle personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles. Order and invoice records are kept as tax law requires; everything else is deleted when you offboard.