Privacy notice

What Housekeeping stores about you and your household, who can see it, and how long it is kept. The list of how long we keep things comes from the same rules the app's cleanup jobs follow.

What we store

Your account: name, e-mail address, language, and a password hash or your Google sign-in.
Your household: its name, time zone and currency, and each member's name, role and colour or avatar. For children and teens only the birth month, never the full date of birth.
Tasks and jobs: what needs doing, who did it and when, notes, review outcomes and photo proof.
Money and points, if the household turns them on: earnings, payouts, savings goals and bank balances you enter. No real payments go through the app.
Planning: events, dinner plans, dishes, shopping lists and calendars you import.
Sign-ins: the device, browser and IP address of each sign-in. The app also keeps some jobs and lists on your device so it works offline; they are removed from the device when you sign out.

Children

A parent or guardian creates a child's profile and confirms that they are the child's parent or guardian. A child profile has no e-mail address or password; a child's device is signed in with a one-time code from a parent.
Children only see what their permissions allow. They never see other members' money or the household's settings.
Push notifications on a child's device use a general text, without names or job titles.

Photo proof

Before a photo is stored, the app removes location and camera data and makes it smaller. Photos are stored privately and never have a public address.
A photo can only be seen by the member who did the job, the person who took it, and members who approve jobs. When anyone but the person who took it looks at it, that is written to the household's audit log.
A photo is deleted when the job is approved, or up to 72 hours later if the household chooses. Every photo is deleted 30 days after it was taken at the latest, approved or not.

Who else handles your data

Some features pass data through other services:

Photos and exports are kept in private file storage run for this service.
E-mails (confirming your address, password resets, invites) are sent through an e-mail provider.
If you sign in with Google, Google tells us your e-mail address and name.
If you turn on push notifications, they are delivered through your browser maker's push service (for example Google, Mozilla, Apple or Microsoft).
If you import a calendar, the app fetches it from the link you give. If you subscribe to a calendar feed, your calendar app fetches it from us.

The app has no adverts, no analytics and no tracking, and this page loads nothing from other sites.

Cookies

The app only uses the cookies it needs: one that keeps you signed in, one that protects forms against forged requests, one that remembers your language, and a short-lived one during Google sign-in. There are no other cookies, so there is nothing to accept.

How long we keep it

Cleanup jobs delete data by these rules every day. Data kept for the life of the household goes when the household is deleted.

Proof photosPhotos of finished jobs. Deleted when the job is approved, or after the household's delay.: Deleted 30 days after the photo was taken, at the latest.
Unused photosA photo that was taken but never sent with a finished job.: Deleted 1 day after the photo was taken, at the latest.
Done jobs and review outcomesWho did what and when, and whether it was approved: the household's history and the basis for earnings.: Kept while the household exists. Removed with the member or the household.
Money and pointsEarnings, payouts and corrections. A child's earnings history is the point, so entries are never changed or deleted one by one.: Kept while the household exists. Removed with the member or the household.
Missed and skipped jobsJobs nobody did. Kept long enough that last year's season still shows; done jobs are kept.: Deleted 13 months after its day.
Sign-insWhich device and browser is signed in, and its IP address.: Deleted 30 days after it ended: expired, used, signed out or withdrawn.
E-mail linksLinks to confirm an e-mail address or reset a password. Only a fingerprint (hash) of the link is stored.: Deleted 30 days after it ended: expired, used, signed out or withdrawn.
InvitesLinks to join the household, and the e-mail address they were sent to.: Deleted 30 days after it ended: expired, used, signed out or withdrawn.
Device codesCodes that sign a child's device in, and devices a parent signed out.: Deleted 30 days after it ended: expired, used, signed out or withdrawn.
Own-account upgradesInvitations for a teen to get their own e-mail account.: Deleted 30 days after it ended: expired, used, signed out or withdrawn.
NotificationsThe messages under the bell, read or not.: Deleted 90 days after it was made.
Reminder recordsWhich reminders went out, so none is sent twice.: Deleted 90 days after it was made.
Audit logWho changed settings and permissions, and who looked at or approved children's jobs.: Deleted 12 months after it was made.
Recently boughtItems cleared off a shopping list, so they are quick to add again.: Deleted 90 days after it was cleared off a list.
Offline receiptsIds of changes made offline, so a change sent twice only counts once.: Deleted 30 days after it was made.
Freshness readingsThe daily score behind the home freshness trend.: Deleted 90 days after it was made.
Dinner suggestions and votesIdeas and thumbs-up for a week's dinners.: Deleted 4 weeks after its week began.
Data exportsThe ZIP archives you download.: Deleted 7 days after it was made.
Deleted householdsUntil then, an owner can restore a deleted household.: Erased for good 14 days after the household was deleted.
Former membersSomeone who leaves keeps their name on past jobs; everything else about them goes at once. Erasing a member removes them completely.: Kept while the household exists. Removed with the member or the household.
Imported calendarsCalendar links, iCloud app-specific passwords and Google Calendar access you add, and the events read from them. They are stored encrypted, and Google access is withdrawn when you disconnect.: Kept until it is removed.
Push subscriptionsThe address a browser gave for push notifications. Removed when push is switched off or the browser stops accepting it.: Kept until it is removed.
Family questsThe weekly shared goal and whether it was reached.: Kept while the household exists. Removed with the member or the household.
RoutinesThe steps of each routine and which were ticked on which day.: Kept while the household exists. Removed with the member or the household.
Levels and badgesEach member's best effort points and the badges members and the household earned. Erasing a member removes theirs.: Kept while the household exists. Removed with the member or the household.
Weekly recapsWhich weeks' recaps were announced. The recap itself is worked out when it is opened.: Deleted 12 weeks after its week began.
Family meeting summaryWhat the last family meeting decided, as shown on the wall display.: Deleted 2 weeks after its week began.
KudosWho said thanks for which job, and with which reaction. Gone when taken back or when either member leaves.: Kept while the household exists. Removed with the member or the household.
Administrator actionsWhat the service's administrators did to an account: ids and the action only.: Kept while the account it is about exists.
Server logsTechnical lines about requests, without names, e-mail addresses, passwords or tokens.: Kept outside the app by whoever runs the service. The app does not decide how long.
BackupsCopies of the database. Deleted data stays in a backup until the backup is replaced.: Kept outside the app by whoever runs the service. The app does not decide how long.

What you can do

Download your own data, or all of the household's data if you manage it, as a ZIP file.
Delete your account in your account settings.
Members who manage the household can remove a member, keeping their name on past jobs, or erase everything about them.
An owner can delete the household. It can be restored for 14 days, and is then erased for good.
Deleted data can stay in the service's backups until they are replaced.