Privacy Notice

Who is responsible and how to contact us

HomeRoot LLC operates HomeRoot. Contact HomeRoot Support at support@homeroot.app for privacy questions or requests for access, correction, deletion or account closure. This notice covers HomeRoot's information handling. Payment sellers, sign-in providers and other providers also explain their own processing in their notices.

Information we handle and why

We handle account identity and profile information, such as your account identifier, email address and chosen sign-in provider, to provide access, security and account support. For new public signup, we record your US-residency and age-18-or-over statements, Terms agreement, Privacy acknowledgement, identified policy versions and content digests, and acceptance time. This signup step does not collect your exact birth date or precise location or independently verify your age or residence. Setup and recovery records can include earlier unsuccessful or uncertain attempts.

We handle material you and authorized collaborators provide: Entries, discussion, files and previews, context, original words, author and supplier attribution, audiences, assignments, reminders, personal arrangement, versions and recovery history. These records support saving, synchronization, finding information, deliberate collaboration, requested AI and recovery. People/contact labels, names and email addresses can include information about people who do not have HomeRoot accounts.

We handle subscription and purchase references, amounts, tax facts, verified paid periods, credit usage and reservations, refunds, disputes and unresolved operations for billing, reconciliation and support. Support messages can include the explanations, screenshots or diagnostics you choose to send. Send only what is needed; never email passwords, full card numbers or recovery keys.

Account, browser/device, network, request and operational information can be processed by HomeRoot and its infrastructure providers to deliver the service, protect accounts, investigate errors and prevent misuse. Providers can receive IP addresses, device/browser details and security or service logs. HomeRoot uses browser storage for sign-in, preferences, drafts and recovery; identity and payment providers can use their own storage or cookies for their services. This notice does not promise that infrastructure providers keep no logs.

Sharing and service providers

Other people receive material you authorize for the relevant audience. Withdrawing access changes future access through HomeRoot, but cannot retrieve copies someone already downloaded, exported or otherwise retained. Their own contributions and rights can also affect how a shared record is handled.

Google Cloud and Firebase provide HomeRoot's hosted application services, account authentication, database and configured file storage. Google Workspace handles the support mailbox. Google or Apple also receives sign-in information when you choose that provider. See the Google Privacy Policy (https://policies.google.com/privacy), Firebase privacy information (https://firebase.google.com/support/privacy) and Apple Privacy Policy (https://www.apple.com/legal/privacy/).

OpenAI processes information for an explicitly requested AI feature, as described below. Stripe and Link process payment, tax, fraud-prevention and transaction-support information when you use their payment services. Apple Push Notification service and Firebase Cloud Messaging process delivery information when you enable supported notifications. A United States account-residency requirement does not mean all information is stored or processed only in the United States; these providers operate internationally.

Requested AI and public research

When you explicitly request AI, HomeRoot can send OpenAI your authorized question, relevant context and conversation, file excerpts and supported file previews. The material can extend beyond your latest message or a single attachment. HomeRoot checks the audience for a shared answer; private AI Search uses the requester's authorized scope and keeps its answer separate from shared discussion.

When an Ask request includes permitted public web research, relevant search terms can be sent to public search services through the AI provider. Private AI Search does not enable public web browsing. HomeRoot retains the question, context references, answer, sources, adopted results and operation/accounting evidence for its service and recovery purposes.

HomeRoot requests that provider response storage be disabled for these AI calls. This is not a promise of zero provider retention: provider security, abuse-monitoring or legal retention can still apply. We do not represent that every provider copy can be erased immediately. OpenAI describes its API data controls and retention in its API data guide (https://developers.openai.com/api/docs/guides/your-data).

Payments and notifications

Stripe collects payment details through hosted payment services. HomeRoot's billing records do not store full card numbers or card security codes. HomeRoot retains the references and financial facts needed to verify access, credits, refunds and disputes. Processing a payment does not require sending Stripe your household Entry words or original files. See the Stripe Privacy Policy (https://stripe.com/privacy) and Link Privacy Notice (https://link.com/privacy). The actual seller is identified at checkout and on the receipt; it can have independent payment, tax and transaction-support responsibilities.

If you enable supported notifications, delivery providers can receive a device token and notification content. A notification or lock-screen preview can show an authorized title, List, text, sender or reply excerpt. Device settings affect who can see it. Removing access later does not erase an alert already delivered to a device. Camera, photo or file access is used when you choose the relevant capture or attachment action.

Local copies and security limits

HomeRoot keeps web drafts and recovery journals in browser storage, including localStorage and IndexedDB. HomeRoot does not encrypt these web recovery copies. Someone with access to the browser profile may be able to read them, and signing out does not guarantee that every recovery copy is erased. Use a trusted device and preserve unresolved changes before clearing browser data. Device caches, downloads and exports can remain outside the server's control.

HomeRoot is not end-to-end encrypted. Authorized service processing and requested AI can require readable content. These limitations matter when deciding what to store or share; a sign-in boundary is not a promise that every local file or provider copy is encrypted or remotely erasable.

Retention and your requests

We retain content and history for your account, authorized collaboration, synchronization and recovery. Completing, putting away or changing an Entry, withdrawing access, canceling Plus or exceeding a Free limit does not erase every retained version. We also retain the records needed to resolve support requests, uncertain operations and disputes, protect security, document policy acceptance and meet applicable financial or legal duties. Retention depends on the information and its purpose; this is not a policy of keeping all personal content forever.

Email support@homeroot.app to request access, correction, deletion or account closure. We handle requests through a manual review process. We verify account control proportionately, clarify the requested scope and consider other people's rights in shared material. We do not ask you to email passwords, full card details or recovery keys. We explain any necessary retention, material limits or unfinished provider work and respond within applicable deadlines. A preserved history or unresolved operation is not a blanket reason to refuse a right.

An account-closure request is separate from subscription cancellation; tell us if you also want future renewal stopped. We explain the available export and closure steps before carrying out the agreed request. Server-held information, shared contributions, support/billing records, provider copies, backups and device-only copies can require different handling. Copies already received by other people are not all under HomeRoot's control. Where a provider or backup has separate retention limits, we explain those limits rather than claim immediate erasure everywhere.

Changes and questions

We identify material changes to this notice and their effective date. Earlier versions and recorded acknowledgements remain attributable to the version presented at the time. Contact support@homeroot.app for a question, correction or review of how a privacy request was handled.