Smart thermostats do so much for such a little device, from learning your heating and cooling habits to managing your humidity, air quality and more. But if you're going to drop a few hundred dollars on a smart thermostat and maybe a satellite sensor or two, you should know if it's going to track you -- and what it's doing with the data. 

When I discussed privacy issues with Resideo and their Honeywell Home brand, a spokesperson said, "For someone looking to upgrade to a smart thermostat who prioritizes privacy, I'd recommend using one from a trusted manufacturer, ensure the thermostat is connected to a private, password-protected Wi-Fi network and use Multi-Factor Authentication, which can add an extra layer of protection."

That's a great start, but it's also important to understand the details of what smart thermostats collect and process, especially since they're always keeping an eye (well, not a literal eye) on your home. I found out what data they keep and why.

What are smart thermostats tracking about you?

Google/CNET

The good news is that smart thermostats don't track much more than your average app, and they aren't particularly invasive compared with other home devices. However, they do harvest some types of data. Resideo broke down how thermostats, like its Honeywell Home line, collect info in several key categories:

• Account data: Account data refers to all the data you provide when you sign up for the smart thermostat app. That also includes a lot of the actions that the app logs, like the status of the thermostat, login attempts and how customers are setting things like routines and third-party connections, such as connections with Apple HomeKit.
• Energy management data: Resideo also refers to this as "demand response" information. Basically, any program you sign up for that lets the thermostat automatically adjust itself due to present conditions (like peak usage hours, automation, etc.) will send that data to Resideo, including the changes made and how long the thermostat made the change. The thermostat also collects data about manual changes, such as if the customer overrides the automatic response with their own temperature.
• Usage data: Usage data refers to a variety of information needed to enable more complex smart thermostat features. In this case, Resideo specifically called out location-based data used to automatically change thermostat settings based on whether the customer is home or away. Other applicable features may include changes based on local weather or indoor air quality.
• "Pro" data: This refers to data about professionals who install and work on the thermostat and related support and technical information for the model.

Other companies are quite similar in what data they collect. Nest, for example, breaks its collection down into setup info, environmental data from the thermostat itself, all direct adjustments you make, heating and cooling usage information, and technical data from the thermostat -- to much the same result as Resideo, albeit more comprehensive.

What do smart thermostat companies do with this information?

They primarily collect it for internal analysis. They want to know how people heat and cool their homes, when and why they make thermostat changes, and how they use the app. Some of this data can help them target their internal marketing efforts, while other types of data can inform design choices or app UI. Companies generally want a good idea of how their customers behave and if those behaviors indicate more sales opportunities, likely buyers, or new features to increase device value.

In some cases, companies may also share or sell data to third parties for additional analysis, services, marketing opportunities and so on. As Ecobee says, it uses information to, among other things, "Market to you, including providing you information about our affiliates' products and services," as well as, "Customize your experience and provide you with targeted advertising based on your online activity and inferred interests," and "For testing, research, analysis, and product development, including to understand our audience, develop and improve the ecobee Services, as well as our customer service, products, and services."

We'll discuss this more below, but thermostat companies generally limit third-party sharing to only when necessary and require your consent before sharing (that consent may be part of those long user license agreements the app gives you). This part deserves a closer look.

Do smart thermostats share your data with third parties?

Thermostat sensors can go anywhere to monitor specific temperatures. Google Nest

They may share data depending on their partnerships or deals. However, some brands have a policy of never sharing data with third parties. Others, like Resideo, require explicit customer permission to share data with their third-party connections, which also helps meet privacy regulations in places like California or the EU. Ecobee also seems to require consent, although their language is vaguer. Brands like Sensi outright say they won't sell personal information to third parties.

Google Nest meanwhile, has a similar rule for its data sharing program but has a notable exception for connected services, saying, "We will ask your permission before sharing your personal information with third parties for purposes other than at your request or to provide Nest's Products, and to do so only when we think they will provide you with a welcome additional service."

Ultimately, if you're worried, it's a good idea to look at the fine print when creating a thermostat app account.

Can smart thermostat companies access video or audio of your home?

Google's Home app showing Nest doorbell views.

That's not a concern with smart thermostats. Their motion sensors are made to sense activity and presence. They don't "watch" you in any real sense. Smart thermostats themselves don't listen to you, although if you use a voice assistant to control them, the company in charge of that voice assistant may be analyzing your commands. But you don't have to worry about cloud video hacks as you might with video doorbells or security cameras.

One exception is the more advanced thermostats from the Canadian company Ecobee, which have built-in speakers for assistants like Alexa or Siri, and can connect to other Ecobee devices like video doorbells. In that case, your voice or video data may pass through the Ecobee servers. Ecobee reports that, "We have strict policies and technical measures to prevent unauthorized employee access to your data (including sound and video recordings). And when your data is no longer needed for a particular purpose, we will delete it."

Ecobee does have a fairly strong privacy background, notably for refusing Amazon requests to collect and send constant customer data via its built-in Alexa, even when Alexa wasn't being used (which makes us a bit more worried about Amazon's own smart thermostat).

Can you stop a smart thermostat from sensing your activity?

Some thermostats, such as Nest, allow you to turn off learning or presence sensing functions, but that gives up the biggest features of a smart thermostat for relatively few privacy gains. If you're really concerned about privacy, we suggest not connecting or using voice assistants or other devices with the smart thermostat. It does plenty well on its own and you lower the ways companies can use your in-home habits.

How do I learn about my specific thermostat's privacy policies?

Nest Thermostat app view. Tyler Lacoma/CNET

Brands should have their privacy policies posted online so you can learn more, and we'll keep you updated if we notice any significant data breaches or security faux pas. For example, you can find Ecobee's privacy policy here, along with a form for specific privacy requests, like erasing all your data. Here's the policy for Nest thermostats and the privacy options for Honeywell Home.

Amazon's own thermostat, despite Honeywell Home being involved in the design, doesn't come with the same privacy guarantees and it's difficult to find out how Amazon uses it, but Mozilla's analysis of the smart thermostat considering Amazon's other policies is interesting.

So which brands are best when it comes to thermostat privacy?

Every brand will use your thermostat activity for its own internal analysis. Resideo's Honeywell Home and Ecobee appear to do well when it comes to third-party data sharing, and we like Ecobee's easy method of requesting that they erase all your data whenever you want. 

Nest gives itself some leeway in sharing data to enable various Nest products and connections, but doesn't share data for commercial or marketing purposes without asking. Nest also has a very good track record of protecting its own data. 

Amazon's approach to data collection on thermostats is more nebulous, but their track record on data management puts them in last place here.

Read more about what to expect from smart thermostats with my guide on thermostat installation, the big differences between smart and regular thermostats and our review of the highly affordable Amazon Smart Thermostat.