The Empty-Room Glitch: Auditing Your Smart Heating Before the Cold Snap

Smart heating is one of those bits of home tech that quietly earns its place. You stop arguing with a dial, the radiators come on before you get up, and the house is not freezing when you come back from the shops. But the same sensors and app data that make that work can also build a fairly detailed picture of your household’s comings and goings. That is the bit worth looking at before the cold snap.

Here at Spy UK, we are not against a warm bathroom. We are against handing over a minute-by-minute occupancy diary without knowing it. So this is a practical pre-winter sweep, not a scare story.

What the thermostat actually learns

A smart thermostat starts with temperature, schedules and maybe a room sensor or two. Then the app adds context: your phone’s location if you use geofencing, when you adjust the set point, which rooms you heat, whether the hot water is on, and when the system switches to away mode. Over a few weeks, that can become a routine.

Most of the sensitivity is not the temperature itself. It is the absence data. A house that is usually warm at 7am and cold by 9am looks like a commute. A midday gap that repeats every Tuesday might be a school run, a gym session or a shift pattern. A sudden week of low activity in January could look like a holiday — or a hospital stay. None of that is necessarily shared with anyone, but it is the kind of inference that makes thermostat data more personal than it first appears.

Where the data can travel

Be sceptical of the idea that there is one simple “sharing” switch. In practice, data can leave the thermostat through several routes: the manufacturer’s cloud account, energy-supplier integrations, voice assistants, automation services such as IFTTT, and any “insights” or “personalised tips” features you have opted into. Your energy supplier may also hold smart meter data separately — that is a different data stream, with its own privacy notice and consent rules. It is worth keeping the two in your head as separate things.

The risk is rarely a secret live feed of your sofa habits. It is the quiet accumulation of opt-ins. A product-improvement setting here, a linked app there, an old flatmate still listed as a home member, and suddenly the account is broader than you thought. UK GDPR gives you rights over that personal data, including access and deletion in some circumstances, but the first step is knowing what is connected.

A pre-winter settings sweep

Start in the thermostat app, not the boiler. Menu names change between brands — Hive, Nest, tado°, Drayton Wiser, Honeywell Home and others all phrase things differently — so look for the privacy, account, connected services or data section rather than a specific label.

First, download or export your data if the app offers it. Even a basic usage history can be revealing. Second, review the privacy settings for usage analytics, personalisation, marketing and third-party sharing. Turn off what you do not need. Third, check connected services: voice assistants, energy-supplier links, weather services and automation platforms. Revoke anything you no longer use. Fourth, look at home members and guests. Remove former housemates, old tenants and anyone who should not still have access. Fifth, check geofencing. If you are comfortable with it, fine; if not, a simple schedule may be less revealing and almost as useful.

One more thing: if you rent, do not assume the thermostat account belongs to you. Ask the landlord or letting agent who controls it, and make sure you are not stuck with someone else’s login.

Keep the automation, lose the overshare

You do not have to choose between a warm house and a private one. Use schedules instead of always-on location tracking. Heat the rooms you actually use rather than the whole house. Set a sensible frost-protection temperature. Use the holiday mode if you are away, but check whether it also triggers a “we are out” signal to any linked service. If your system supports separate user accounts, use them, so one person’s phone is not the only key to the household’s occupancy pattern.

It also helps to read the energy supplier’s privacy notice if you have linked your thermostat to a tariff or flexibility scheme. Those schemes can be genuinely useful, but they may involve sharing half-hourly or near-real-time data. Ask what is shared, why, and how long it is kept.

If you want to see what is held

You can make a subject access request to the manufacturer or supplier holding your data. It is usually free, should be answered within a month, and does not require a special form — a clear email to the privacy team is enough. If something looks wrong, ask for correction. If you are unhappy with the response, you can complain to the Information Commissioner’s Office.

Winter is coming, and the heating will do its thing. Just make sure it is doing it for you, not building a profile of an empty house for everyone else.