PLACEHOLDER: this policy has not been reviewed by a lawyer. The technical facts below are accurate for this codebase; the legal wording must be completed before launch (LAUNCH_CHECKLIST.md).

Privacy Policy

Last updated: [DATE]. Controller: [LEGAL ENTITY NAME], [ADDRESS], [CONTACT EMAIL].

What we store

  • Account: your name, email, a hash of your password (never the password itself), and session records (IP address and browser) for security.
  • Open household data: supplies, gear, counts, locations by room, scenario settings, labels like "Adult 1". Stored as text so the app can compute your Scorecard.
  • Vault data (Sensitive and Secret): names, health details, addresses, serial and account numbers, combinations and similar. Encrypted on your device before it reaches us, with keys derived from passphrases we never receive. We store ciphertext we cannot read.
  • Billing: your Stripe customer and subscription identifiers and status. Card details are held by Stripe, not us.
  • Usage counts: how many Claude actions your household used this month.

What goes to Claude (Anthropic)

When you parse a Capture, the words you dictated, after the app withholds anything shaped like a code, PIN or account number. When you ask for an explanation or a plan, your open data, and Sensitive details only if you tick the box for that run. Secret details are never sent. Requests pass through our server to Anthropic's API; we don't log or store their content. Anthropic's commercial terms and Data Processing Addendum apply; Anthropic does not use this data to train its models. Its sub-processors are listed at anthropic.com/subprocessors. [RETENTION PERIOD TO CONFIRM FROM THE API ORGANISATION'S SETTINGS.] No other AI company receives your household's data.

What we don't do

  • No advertising, tracking pixels or selling of data.
  • No third-party analytics scripts on the app.

Retention and deletion

Deleting your account deletes your sign-in. When the last operator of a household deletes their account, the household and all its data are deleted, and any paid subscription is cancelled. Backups held by our database provider expire within [N] days.

Your rights

[ACCESS, CORRECTION, DELETION, PORTABILITY, AND STATE-LAW RIGHTS (e.g. CCPA/CPRA) TO BE DRAFTED BY COUNSEL]

Processors

[HOSTING PROVIDER], [DATABASE PROVIDER], Stripe (payments), Anthropic (Claude API), [EMAIL PROVIDER], [ERROR TRACKING PROVIDER, IF ENABLED].