Homaic

Privacy Policy

Effective date: 2026-05-07 Version: 0.1 (pre-lawyer-review draft)

Pending legal review. This document was drafted in good faith from Homaic's constitutional privacy commitments. It will be reviewed by counsel before Homaic's public launch. Until that review lands, treat this Policy as Homaic's stated intent, not a finished legal instrument.

0. The short version

  • Homaic's data never works against the person it came from.
  • Your home data is yours. You own it; you can export it; you can delete it.
  • Homaic never sells, rents, licenses or gives away any home's record or any person's data, identified or "deidentified". No ads, no ad pixels, no audiences.
  • Nothing Homaic holds, and nothing built from it, sets or informs anyone's price, premium, credit, insurance, tenancy, employment or eligibility. Homaic is not a consumer reporting agency (§2.4).
  • No AI provider may train on your data, with or without consent, and Homaic never sells or licenses a model trained on Homaic records. Homaic learns from your corrections to improve its own product only if you turn on Improve Homaic with my data, which is off until you turn it on (§2.2).
  • Homaic uses third-party processors to run the Service: Anthropic and OpenAI (AI), RentCast and Google Maps (property data and imagery), Resend (email), Sentry (error reporting), Vercel Analytics and PostHog (usage analytics, consent-gated), Supabase and Vercel (hosting), and Stripe as a future optional payment processor (unused during beta). §4 lists each one with exactly what it receives.
  • Privacy is built into the system: row-level security on every table. Nothing about a single home leaves Homaic. Any figure computed across homes follows the published minimum group sizes in §2.3: at least 11 homes behind every figure.
  • These promises follow your data if Homaic is ever sold, merges or closes (§4.15).

The detail is below.

1. What we collect

Homaic classifies data into three tiers. The classification determines what can be done with each piece of data.

1.1 Tier 1: your personal data (never aggregated without explicit opt-in)

This is your account and your home data. It is visible only to you, accessible only by your authenticated session, and never aggregated without explicit, opt-in consent.

  • Account data: email address; account creation date; account status; magic-link authentication events.
  • Beta seat ask: your email, the house address you asked from, how you heard about Homaic (if you picked an answer), who invited you (if an invite link brought you), and the IP address and browser your ask came from. Kept to answer your ask.
  • Property data: addresses, property details, assets, projects, service events, contractors, quotes, decisions, documents, warranties, briefs, configurator outputs, decision records, and any free-text notes you write.
  • Usage data tied to your account: configurator session content, Homaic's AI extraction events you initiate (extractions run by Homaic's built-in AI, Terms §7.1), and activity logs from your own AI (any MCP client you connect, Terms §7.2), scoped to your tenant.
  • AI cost log: a per-request log of token usage for quota enforcement. This log records the count of tokens, the model name, and the time of the request, not the content of the request or response. Retained 90 days, then purged.
  • Payment metadata: Beta is invite-only and free. Homaic does not collect payment during beta and does not store payment metadata for beta access. There is no Pricing page. If a paid plan is offered later, this Policy will be updated before that plan is offered; payment card numbers would be stored by the processor, not by Homaic.

1.2 Tier 2: pseudonymized analytics (no personally identifying information)

Tier 2 covers operational signals that help us run a reliable service. Inside the product, an event carries your account's ID number and your house's. It never carries your name, email, address, documents or questions.

  • Aggregate page-view and feature-usage counts, where analytics are enabled. Vercel Analytics counts page views on homaic.io for every visitor, and inside the product only while your Product analytics switch is on (Settings › Privacy, §4.8).
  • Error logs (stack traces) scrubbed of personally identifying values before they reach the logging surface. We treat error logs as Tier 2 because they are a reliability requirement; we will never enrich them with your account data.

1.3 Tier 3: public reference data (no user_id, system-wide)

Tier 3 is reference data Homaic publishes for everyone. This is not your data; it is system content.

  • The products catalog (e.g., asset categories, brand listings).
  • Expert content (articles, guides).
  • Brief templates.

If you contribute to Tier 3 (for example by submitting feedback that is incorporated into an expert-content article), Homaic does not include your name unless you have separately agreed to be credited.

2. How we use it

Homaic uses your Tier 1 data to provide the Service to you. Specifically:

  • To deliver the core Service: store and retrieve your home data, generate briefs you create, run share-token flows you initiate, render the dashboard you log into.
  • To run Homaic's AI extractions you initiate: when you upload a photo or document for extraction, we send the input to Anthropic's API, return the structured suggestion to you, and let you review before saving. See §4.
  • To enforce quotas: the AI cost log (§1.1) tracks per-request token usage for product usage limits. There is no Pricing page during beta.
  • To secure your account: detect and prevent fraud, abuse, and unauthorized access; investigate security incidents; respond to lawful legal process.
  • To communicate with you about your account: account notices, security alerts, and material changes to these Terms or this Privacy Policy. You cannot opt out of these because they relate to your active account; you can leave the Service if you do not want them (§5).
  • To improve Homaic, and for anonymous research, only if you say yes: two separate choices, each off until you turn it on (§2.2).

Homaic does not use your data to:

  • show you ads, use ad pixels, or build or sell audiences;
  • sell, rent, license, give away or otherwise transfer any home's record or any person's data, identified or deidentified;
  • set or inform anyone's price, premium, credit, insurance, tenancy, employment or eligibility;
  • let any AI provider train on it, or sell or license a model trained on Homaic records;
  • take money for placement, ranking or referral, from pros, brands, insurers, lenders or AI platforms;
  • hold a feature back unless you say yes to research. Saying no never makes Homaic worse for you.

2.1 These promises

Homaic's Data Charter governs every use of the data Homaic holds. This section is its plain-words form. These promises can be strengthened at any time. They are never loosened for data Homaic already holds: a new use needs a new yes from each person (§9).

2.2 Two choices: Improve Homaic, and Anonymous research

Each is asked once, in plain words, and each is off until you turn it on.

  • Improve Homaic with my data. When Homaic reads a photo, a paper or a chat and you correct it, the pair can be used to make those reads better. It stays inside Homaic.
  • Anonymous research. Your home can count in figures across many homes, such as how long water heaters last, under the rules in §2.3. It covers what you add from the day you turn it on.

Homaic keeps every yes and no with the exact words you were shown, the date, and where it was asked. Turning a choice off stops new use at once. Figures already published cannot be recalled.

Never in research figures: anything that hints at health or disability, bank or card data, children's details, an exact address or location, and other people named in a record (prior owners, pros, tenants, family).

An earlier choice, Use my data to inform expert content, does not carry over: research needs the new yes.

2.3 Figures across homes: the published minimums

Homaic shares no figures across homes today. When it does, these are the published minimums:

  • Your home beside similar homes: computed inside Homaic, shown only to you, from a group of 11 or more homes.
  • Tables that leave Homaic: no figure from fewer than 11 homes, including a figure that could be worked out from others; no figure dominated by a single home; and no place finer than a county or the first three digits of a ZIP code unless the figure covers 50 or more homes.
  • Public releases: the same rules, plus statistical noise (differential privacy), with the amount published for each release.
  • Never a record-level release. Before any table leaves Homaic, Homaic tries to match it back to public records (assessor, permits, listings). If any figure ties to fewer than 11 homes, the table does not ship.
  • No re-identification. Homaic never tries to tie a figure back to a home or a person, and every recipient of research tables agrees by contract not to try.

Who may receive figures, and only figures:

  • the public, cities, utilities, state energy and emergency offices, product-safety regulators and resilience researchers, free or at cost, for planning, safety, recalls, retrofits and storm preparation;
  • researchers, through an archive partner that vets them, free, with results made public;
  • manufacturers, retailers and builders, for product reliability and design, from one public price list: the same tables for everyone, no private feeds, no exclusives.

Never: insurers, lenders or appraisers (they may read the free public figures like anyone, but their terms of use bar pricing and underwriting), data brokers, ad networks, traders and hedge funds, or political campaigns.

2.4 Homaic is not a consumer reporting agency

No insurer, lender, landlord, employer or broker receives household-level data from Homaic, and none may buy figures for pricing, underwriting or eligibility, even where the law would allow it.

You may share your own record, or one fact from it (for example, "water heater replaced 2025, receipt attached"), with someone you name, by your own tap. You can take it back, Homaic logs it, and Homaic takes no fee and no cut from anyone. Any discount is between you and your insurer.

3. Where your data lives

  • Primary storage: PostgreSQL on Supabase, hosted in AWS. Region defaults to a U.S. region. EU data-residency support is on the v1.x roadmap; if you need EU residency for compliance reasons before then, contact privacy@homaic.io and we will tell you whether self-hosting on your own infrastructure is the right path for now.
  • Encryption at rest: Database storage is encrypted at rest by Supabase/AWS using AES-256.
  • Encryption in transit: All Service traffic uses TLS 1.2 or higher.
  • Row-level security: Every table that holds Tier 1 data carries a user_id column and a row-level security policy that gates access to your authenticated session. This is constitutional; it is not a feature that can be turned off.
  • Backups: Daily automated backups by Supabase. Backups are encrypted and access-controlled. Backup retention does not exceed 90 days.

4. Who we share with

Homaic uses third-party processors to operate the Service. Each is listed below with the data it receives and why. The full Data Processing Agreement, including sub-processor terms, is at /dpa.

4.1 Anthropic, PBC: Homaic's AI (chat, extraction, synthesis)

When you use Homaic's AI (the chat, a photo or document read, a brief), the input for that request (your question, the photo or document, and the home context the feature needs to answer) is sent to Anthropic's API. The output is returned to you for review. For signed-in use this is gated by the ai_processing consent purpose.

  • Data sent: the input for that specific request, plus the home records the feature includes as context.
  • Data not sent: your account email or payment details.
  • Anthropic's commitment, per Anthropic's API terms: API inputs and outputs are not used to train Anthropic's foundation models.
  • Anthropic's Privacy Policy: anthropic.com/privacy.

4.2 OpenAI, L.L.C.: search embeddings

Homaic's search works by computing a numeric embedding of your records. The text of those records (assets, properties, documents, projects, service events, people, thoughts, and briefs) is sent to OpenAI's embeddings API (model text-embedding-3-small) on an hourly schedule when a record changes. Only the vector comes back. Gated by the ai_processing consent purpose; a revoked consent stops the backfill for your rows.

  • Data sent: the searchable text of the changed record.
  • OpenAI's API data-usage terms: openai.com/policies/api-data-usage-policies.

4.3 RentCast: property data

When you claim a home or ask for its facts, the address is sent to RentCast to return public-record details (year built, square footage, lot, sale history, estimated value).

  • Data sent: the property address.
  • RentCast's Privacy Policy: rentcast.io/privacy.

4.4 No longer used

4.5 Google LLC: Maps, Street View, Places

To show your house on a map, to fetch a Street View image of it, and to autocomplete an address as you type, Homaic sends the address (or the partial address you are typing) and coordinates to Google's Maps Static, Street View, and Places APIs from Homaic's servers. Your browser never receives Homaic's Google key.

  • Data sent: the address or partial address, and coordinates.
  • Google's Privacy Policy: policies.google.com/privacy.

4.6 Resend, Inc.: transactional email

Homaic sends these emails through Resend: sign-in codes and other account emails, such as confirming a change of email address, your invite to the beta, household invitations, assignment notices, the weekly digest, the monthly email that your copy is in Documents, a welcome email when you first add your house, an email when someone mentions you in a comment, an email when someone you shared with answers, opens your link or asks to be let in, a receipt when an email you forwarded arrives, a quote request you send to a pro, and a receipt when you ask for a seat. Email you forward to your house's Homaic address is received through Resend.

  • Data sent: the recipient's email address and the content of that email (which can include the names of people and tasks, your address and a drawing of your house).
  • Data received: the email you forward to your house's Homaic address, with its attachments.
  • Resend's Privacy Policy: resend.com/legal/privacy-policy.

4.7 Functional Software, Inc. (Sentry): error reporting

When something breaks, an error report is sent to Sentry so it can be fixed. Homaic's Sentry configuration does not send personal identifiers by default (sendDefaultPii: false), records no session replays, and scrubs events before they leave.

  • Data sent: the error, stack trace, and request metadata after scrubbing.
  • Sentry's Privacy Policy: sentry.io/privacy.

4.8 Vercel, Inc.: application hosting and usage analytics

Vercel hosts the Homaic application surfaces (homaic.io and product subdomains) and sees request metadata necessary to route traffic. Vercel Analytics (page views) runs inside the product only when your Product analytics switch is on (Settings › Privacy). On the marketing site (homaic.io) it runs for every visitor.

  • Data sent: request metadata; page views where analytics is on.
  • Vercel's Privacy Policy: vercel.com/legal/privacy-policy.

4.9 PostHog, Inc.: product analytics (when enabled)

On homaic.io, Homaic records the pages opened, the site that sent you, the source and campaign tags in the link, and when you ask for a seat or start with an address. In the product, it records named steps: asking for a seat, getting your invite, signing up, keeping your first house, your first add, your first document, coming back, and the other events listed in the analytics disclosure. Asking for a seat records the source and campaign tags in the link and, if you pick one, how you heard about Homaic, under the ask's own ID number; when your invite comes, that ID is joined to your account's. On homaic.io, events go from Homaic's own servers to PostHog's US endpoint; in the product, they go from your browser and from Homaic's servers to the same endpoint. They never carry your name, email, address, documents or questions, and they are not used for ads or retargeting. Session recording is off. On homaic.io nothing is stored in your browser, and a Global Privacy Control or Do Not Track signal turns it off. In the product, turn it off with your Product analytics switch (Settings › Privacy). Before you have an account, a Global Privacy Control or Do Not Track signal on your ask turns its count off.

  • Data sent: product events and the scope described in the analytics disclosure shown at sign-up.
  • PostHog's Privacy Policy: posthog.com/privacy.

4.10 Supabase, Inc.: database, authentication, storage

Supabase hosts the PostgreSQL database that stores Tier 1 data, the authentication system, and the file storage for your paper. Supabase processes your data only to provide hosting; Supabase does not access the contents of your data except as necessary for support requests you initiate.

  • Supabase's Privacy Policy: supabase.com/privacy.

4.11 Stripe, Inc.: future payment processor

Stripe is named here as a future, optional processor for a paid plan that is not offered during beta. Homaic does not collect payment during beta. There is no Pricing page. If a paid plan is offered later, this Policy will be updated before that plan is offered. At that time Stripe would receive the payment information submitted at checkout, and Homaic would receive a Stripe customer ID and subscription status, not a card number.

  • Stripe's Privacy Policy: stripe.com/privacy.

4.12 Public data services that receive an address or coordinates

To describe a home's environment and to watch for hazards, Homaic queries United States government open-data services with the property's address or coordinates: FEMA (flood zones), USDA NRCS (soil), USGS (elevation), NOAA / ACIS (climate normals), the National Weather Service (active alerts), the U.S. Census Bureau geocoder (address to coordinates), and the CPSC (product recalls, queried by brand, not address). These are public services, not contracted processors.

4.13 No other sharing

Homaic does not share your data with any third party other than the processors above and any successor processor whose addition is disclosed in an updated version of this Policy under §9. Every AI processor's terms bar training on Homaic users' data; there is no consent that changes this.

4.14 Requests from government

Homaic gives your data to a government only under legal process, such as a subpoena, court order or warrant. Homaic tells you first unless the law forbids it, and counts every request, and how Homaic answered it, on a public page.

4.15 If Homaic is sold, merges or closes

Homaic will not transfer personal information to an unaffiliated party except under these promises. A buyer, or anyone who gains control of Homaic, takes the data only by adopting them unchanged. Before any transfer, every owner is told and can export everything and delete it first. If Homaic closes, every owner gets 90 days' notice and an export in an open format, and then the data is deleted. The records are never sold. No insurer, lender or data broker may own or control Homaic, or sit on its board, unless bound by these promises.

5. How long we keep your data

  • Active accounts: retained for the lifetime of the account.
  • Deleted accounts: purged from primary storage within 30 days. Backups age out within 90 days.
  • AI cost logs: 90 days, then purged. Used solely for quota enforcement.
  • Audit logs (security and legal-compliance): 90 days, then purged. Used solely for security investigations and lawful disclosures.
  • Backups generally: 90 days maximum.

6. Your rights

The following user rights are first-class features of the Service, not just policy commitments.

  • Access. You can download a full export of your data at any time from the Settings page. The export is in standard, machine-readable formats. No exit fee, no rate gate.
  • Correction. You can edit any data in the Service from the dashboard. If a piece of data is not editable from the UI in a given release, contact privacy@homaic.io and we will fix it.
  • Deletion. You can delete your account from the Settings page. Deletion triggers the purge described in §5.
  • Portability. Your export is portable. The AGPL license on the software guarantees you can run a self-hosted Homaic instance and import your export. Homaic-hosted is convenience; self-hosted is sovereignty. You choose.
  • Object. You can turn off any non-essential processing (Improve Homaic, Anonymous research, recommendations) at any time from the Settings page. Turning a choice off stops new use at once; figures already published cannot be recalled (§2.2).
  • Withdraw consent. You can withdraw any consent you previously gave. Withdrawal does not affect lawful processing that occurred before withdrawal.

7. GDPR and CCPA

7.1 GDPR (EU/UK users)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the rights described in §6, plus the following:

  • Lawful basis. Homaic processes your Tier 1 data on the basis of contract performance (delivering the Service you signed up for) and legitimate interests (security, fraud prevention). Where Homaic processes data on the basis of consent (opt-in aggregation, opt-in AI uses), you can withdraw consent at any time. If a paid plan is offered later, this Policy will be updated before billing becomes a processing purpose.
  • International transfers. Tier 1 data is hosted in the United States. Where Homaic transfers data from the EEA, UK, or Switzerland to the U.S., the transfer is governed by the European Commission's Standard Contractual Clauses (SCCs) and supplementary technical measures (encryption in transit and at rest).
  • Data Protection Officer. Contact dpo@homaic.io for any GDPR question.
  • Data Processing Agreement. A standalone DPA is published at /dpa. It is also available by request to legal@homaic.io.
  • Supervisory authority. You have the right to lodge a complaint with your local data protection authority.

7.2 CCPA (California users)

If you are a California resident, you have the rights described in §6 (the CCPA labels them: Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of Sale/Sharing, Right to Limit Use of Sensitive Information, Right to Non-Discrimination). Specifically:

  • No sale or sharing. Homaic does not sell or share (in the CCPA sense) your personal information. There is no opt-out flow because there is nothing to opt out of.
  • Sensitive personal information. Homaic limits its use of sensitive personal information (which under the CCPA can include precise geolocation and account credentials) to providing the Service you requested.
  • Authorized agent. You may submit requests through an authorized agent; Homaic will verify the authorization.
  • No discrimination. Homaic does not discriminate against you for exercising any CCPA right.

8. Cookies and similar technologies

Homaic sets cookies to keep you signed in and to remember a choice you made. None of them follow you to another site, and none carry advertising. Here is every one.

  • Sign-in session (sb-…-auth-token): your signed-in session. Without it you cannot log in. Signing out removes it.
  • Sign-in check (sb-…-auth-token-code-verifier): a one-time value, used once to finish a Google or emailed-link sign-in.
  • homaic_theme: light or night, if you picked one. One year.
  • homaic_tz: your time zone, so a day starts when yours does. One year.
  • homaic_active_property: which of your houses is open. One year.
  • homaic_actions_scope: whether Up next shows yours or everyone's. One year.
  • homaic_arrival: that you just accepted an invite, so the next page can say so. Ten minutes.
  • homaic_gmail_oauth: a one-time check while you connect Gmail. Ten minutes.

Your browser's own storage also holds a few things: where you left a panel open or closed and the day of your last visit, which stay on your device, and a copy of your open conversation with Ask, whose questions are also saved to your account.

Product analytics are on by default and you can turn them off in Settings › Privacy. Analytics keeps no ID in your browser: Vercel Analytics sets no cookie, and PostHog, where Homaic has it configured, holds its identifier in memory for the open page only, so closing the page forgets it.

Homaic does not use third-party advertising cookies, tracking pixels, or fingerprinting. It sets no cookie that tracks you across sites, so it shows no cookie banner.

9. Changes to this Policy

Homaic may update this Privacy Policy from time to time. For material changes, Homaic will give you at least 30 days' notice by email and in-product notice before the change takes effect. The version history is maintained at /privacy and in the source repository.

If a material change affects how Homaic processes your existing data, the change does not take retroactive effect on data already collected without your consent. The promises in §2 can be strengthened at any time; they are loosened only for data collected after the change, and only with a fresh yes from each person. If you do not accept a material change, your remedy is to terminate your account before the change takes effect (Terms §3.5).

10. Contact

  • Privacy questions: privacy@homaic.io
  • GDPR / DPO: dpo@homaic.io
  • Legal notices: legal@homaic.io
  • Security disclosures: security@homaic.io

Mailing address: Homaic, Inc., registered address in Colorado, USA, to be inserted at incorporation.

11. Connecting Gmail

You can connect your Gmail account so Homaic can suggest email that is about your house. This is optional. If you would rather not give Homaic access to your mailbox, you can forward individual emails to your house's own Homaic address instead, which uses no Google access at all. If you connect, here is exactly what happens.

What we ask Google for. One permission: read-only access to your Gmail (gmail.readonly). Homaic cannot send email as you, cannot change, label or delete your mail, and asks for nothing else.

How we look for house mail. When you press Look in Gmail, and once a day on its own unless you turn that off in Settings › Your inbox, Homaic asks Gmail to search your recent mail (within the window you chose: 30, 90 or 365 days) for messages that look like they are about your house. The searches are built from your own home record: mail from people and companies saved in your record, mail that mentions your street address, mail that uses words such as "warranty", "estimate" or "inspection", and purchase receipts and PDFs. Gmail's search matches these anywhere in a message, including its text. After those, with whatever is left of a fixed limit on how many messages one look may read, Homaic also goes through the rest of your recent mail in the same window, newest first, leaving out mail you sent, chats, and Gmail's Promotions and Social tabs. Every message a look reads is checked the same way, and only those that look like house mail are kept as suggestions.

What we read, and what we keep. For each message the search returns, Homaic fetches the whole message from Gmail to read its headers and its list of attachments. The text of the message is read only in memory while that check runs and is then discarded. It is never stored. From each message that looks like house mail, we keep only what we need to suggest it to you: the sender's name and address, the subject, the date, the names, sizes and file types of any attachments, Gmail's labels and identifiers for the message, and the reason it looked like it belonged to your house (for example, that the sender is already saved in your record as your plumber, or that the message mentions your street address).

Suggestions are not your record. A suggestion is a pointer, not a copy. Nothing enters your home record until you open a suggestion and press Import. When you open a suggestion to look at it, the message or its attachment is fetched from Gmail at that moment and shown to you. It is not stored. Suggestions you have not acted on are deleted 30 days after we first saw them. After you decide on a suggestion (importing it, or marking it Not this), its details stay for up to a week so you can undo the choice. Our weekly cleanup then removes the sender's name, the subject, the date, the attachment details, the labels and the reason. What remains is the sender's address, Gmail's identifier for the message, and our own record of the decision (what you chose, how strong the match was, and a link to the item you imported, if any), so we do not suggest the same message again. That remainder is deleted when you disconnect.

What you import is yours. When you press Import, that message and its attachments are copied into your home record exactly as they were sent. They are then treated like any other document you add: you can read, file, download or delete them, and they stay until you delete them, even if you later disconnect Gmail.

How imported mail is read. AI processing is on by default for every account, and you can turn it off at any time in Settings › Privacy. While it is on, Homaic sends the text of each imported message, and its attachments, to Anthropic, our AI provider (§4.1), so it can suggest what the item is, such as a quote, a receipt or a warranty, for you to confirm. Once you file an imported item as a document in your record, its title and the text read from it are also included in your record's search index, which is computed through OpenAI's embeddings service (§4.2), under the same AI processing setting. While AI processing is off, nothing you import is sent to either provider. Only items you chose to import are sent to either provider. Suggestions and messages you did not import are never sent to them. Both providers' API terms do not allow them to use this data to train their models.

Senders you mute. If you tell us never to suggest mail from a sender, we keep that sender's address on your mute list until you change it or disconnect.

How your access is stored. The token Google gives us to read your mailbox is stored encrypted. It is decrypted only inside our servers when they talk to Gmail, and it is never available to your browser or to anyone else.

Disconnecting. You can disconnect Gmail at any time from Settings › Your inbox. Disconnecting asks Google to revoke Homaic's access, deletes the token, deletes every suggestion and your mute list, and leaves in place only the documents you chose to import. You can also remove Homaic's access from your Google Account permissions page at any time.

Who can see your Gmail data. No person at Homaic reads your Gmail data unless you ask us to (for example, in a support request), unless it is needed for security purposes such as investigating abuse, or unless the law requires it.

What we never do with Gmail data. We never sell it, never use it for advertising, and never use it to train machine-learning or AI models. We do not share it with third parties except as needed to provide the features described above: our hosting and database providers (Vercel and Supabase, §4.8 and §4.10, and Railway, which hosts the server that reads imported documents); for items you import, Anthropic and OpenAI as described above; and Sentry, our error-reporting service (§4.7). Homaic's Gmail code sends nothing to Sentry itself, but if something breaks while Homaic is handling your Gmail data, the error report goes to Sentry with personal identifiers turned off and the event scrubbed before it leaves. We may also share it when the law requires it.

Google's Limited Use policy. Homaic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Version history

  • 2026-05-07 · First draft, written before a lawyer's review. It describes how Homaic treats your home data and the rights you have over it.
  • 2026-08-22 · The list of outside services (§4) now names every company Homaic sends data to, and what each one receives. The earlier line saying no other third party receives data is marked out of date. The policy itself did not change.
  • 2026-09-21 · Added §11, on connecting Gmail, with Google's required limited-use sentence word for word. It says only what the Gmail connection does today.
  • 2026-09-21 · Beta is invite-only and free, so §0, §1.1, §2, §4.11 and §7.1 no longer describe a paid plan, a Pricing page or Stripe billing as live. Stripe is named only as a possible future payment processor.
  • 2026-10-01 · §11 now matches what Homaic does with Gmail. Imported items go to Anthropic to be read and, once filed, to OpenAI for search, both under your AI processing setting. It says what the look at each message does: reads it in full, keeps only the listed fields, discards the text. The address match is on the message, not only the subject. The list of kept fields is complete, the broad sweep and what remains after a decision are described, and it adds who can see your Gmail data, forwarding as an alternative, and Railway as the host of the document reader.
  • 2026-10-03 · §11 names Sentry among those who receive data. It also says AI processing is on by default, where to turn it off, and that nothing imported goes to Anthropic or OpenAI while it is off.
  • 2026-10-07 · §8 now lists every cookie Homaic sets, what it holds and how long it lasts, and the storage that stays on your device. It had said only sign-in cookies exist.
  • 2026-10-07 · §4.8 names the Product analytics switch (Settings › Privacy) where it named the code key. The policy itself did not change.
  • 2026-10-08 · Rewritten to the Data Charter the founder adopted on 2026-10-08: the two choices (§2.2), figures across homes only in groups of at least 11 homes (§2.3), the consumer-reporting line (§2.4), government requests (§4.14), and change of control and wind-down (§4.15). The k-anonymity sentences are gone because no such gate was built, and the opt-in exception for AI training is gone because no AI provider trains on users' data, with or without consent.
  • 2026-10-11 · §1.2 and §4.9 say what homaic.io now records, that nothing is stored in your browser there, and that a Global Privacy Control or Do Not Track signal turns it off. §1.2 says an event carries your account's and your house's ID numbers.
  • 2026-10-11 · Analytics no longer keeps an ID in your browser. PostHog now holds its identifier in memory for the open page only, and §8 says so.
  • 2026-10-11 · §3 says what runs for backups: daily automated backups by Supabase, encrypted and access-controlled. It no longer names point-in-time recovery or a weekly export to S3. §5 says backups age out within 90 days. Elsewhere, punctuation only.
  • 2026-10-12 · §4.9 names asking for a seat, getting your invite and your first document; says an ask carries its link's tags and the answer you picked under its own ID, joined to your account's when your invite comes; and says a privacy signal turns an ask's count off before you have an account. §1.1 names what a beta seat ask stores.
  • 2026-10-12 · Homaic no longer sends addresses to ATTOM Data Solutions. RentCast is the one property-data source. §0 and §4.1 no longer name ATTOM, and §4.4 is marked no longer used; the other sections keep their numbers. §4.1 and §4.6 no longer describe the Home Plan, which was removed from Homaic on 2026-10-06. §4.6 now lists every email Homaic sends through Resend, and says Resend receives the email you forward to your house.