Privacy Policy

Homeflow is a household coordination tool for adults and authorized caregivers. It helps households manage schedules, tasks, meals, notes, photos, receipts, payroll-related records, caregiver instructions, school and activity information, and optional AI-assisted summaries. Homeflow is not a medical, legal, financial, payroll, tax, emergency response, child safety monitoring, or childcare replacement service.

We may collect the following categories of information:

• Account and profile data: name, email, phone number, profile photo, role, login credentials, household membership, and account settings.
• Household data: children, parents, pets, routines, house rules, household manual content, schedules, tasks, meals, school lunch settings, shopping lists, notes, contacts, and preferences.
• Caregiver and employment data: nanny or babysitter profile details, availability, time entries, time-off requests, on-call blocks, employment settings, payroll periods, reimbursement settings, expenses, receipts, and uploaded employment documents.
• Photos and documents: photos, receipts, profile images, CVs, agreements, handoff attachments, and metadata such as upload status and timestamps.
• Connected account data: Google account email, OAuth tokens, calendars, task lists, document links, Google Photos album links, and related sync metadata when you choose to connect Google services.
• AI interaction data: prompts, messages, uploaded text, retrieved household context, generated responses, action confirmations, model metadata, token usage, and logs used for safety, debugging, cost controls, and auditability.
• Technical and usage data: device, browser, IP address, approximate location from settings or device data, access logs, feature interactions, diagnostics, errors, and security events.

The Service may contain sensitive information about children, caregivers, household routines, family schedules, locations, allergies, health-related reminders, emergency contacts, photos, and private family notes. Adult household administrators are responsible for deciding what information to enter, obtaining any required permissions, and limiting caregiver access to appropriate information.

Homeflow is not directed to children, and children may not create accounts. We do not knowingly collect information directly from children under 13. Any child-related information is provided by an adult household administrator or authorized adult user for household coordination purposes.

• Provide, operate, secure, personalize, and improve the Service.
• Authenticate users, enforce role-based access, and protect household data.
• Sync calendars, tasks, Google Photos albums, documents, and other connected services you authorize.
• Generate AI-assisted summaries, searches, plans, suggestions, and action confirmations.
• Process household workflows, including tasks, handoffs, receipts, time tracking, time off, reimbursements, and payroll-period records.
• Send operational messages such as invitations, password resets, alerts, SOS messages, confirmations, and support responses.
• Monitor abuse, troubleshoot errors, enforce our Terms, audit access, and comply with legal obligations.
• Create aggregated or de-identified insights that do not reasonably identify a household or person.

Homeflow uses AI providers, including OpenAI, to process prompts and relevant household context when users ask for AI assistance. AI features may use house rules, household manual content, calendar data, tasks, notes, school and event data, connected-account data, and other information needed to answer the request.

AI outputs may be inaccurate, incomplete, outdated, biased, or inappropriate. AI responses are for convenience only and are not professional advice, safety determinations, emergency instructions, medical guidance, legal advice, tax advice, payroll advice, employment advice, or a substitute for adult judgment. Users are responsible for reviewing AI outputs before relying on or sharing them.

Data sent to OpenAI through the API is not used to train OpenAI models by default unless we separately opt in. OpenAI and other providers may process and retain data as described in their own policies, including for security, abuse monitoring, legal compliance, and service operation.

If you connect a Google account, we access only the Google data and scopes you authorize, such as Calendar, Tasks, Docs, Drive read-only access, and Google Photos upload or app-created preview access. We use Google data only to provide user-facing Homeflow features, such as showing calendars, adding events, reading task lists, linking household documents, and uploading photos or receipts to the albums you configure.

Homeflow's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train generalized AI models.

We may share information only as described below:

• Within your household: with authorized users according to their role and household permissions.
• With service providers: vendors that provide hosting, database, authentication, storage, email, AI, analytics, logging, payment, support, or security services.
• With connected services: Google and other services you choose to connect, only as needed for the integration.
• For legal and safety reasons: when we believe disclosure is required by law, legal process, security needs, fraud prevention, rights protection, or urgent safety concerns.
• Business transfers: in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets.
• With consent: when you direct us to share information or otherwise give permission.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Profile pictures may be stored by Homeflow. Other photos and receipt images may be routed to your connected Google Photos albums when configured. The Service may store related metadata, thumbnails, upload status, file identifiers, links, or error logs so features can work. Users should not upload illegal, exploitative, highly sensitive, or unnecessary images.

If you choose to use SMS features, we may process your phone number, verification challenge metadata, consent state, opt-in or opt-out events, delivery metadata, and related troubleshooting information. SMS notifications default to off. Users provide a phone number in Homeflow Settings, verify phone ownership with a Twilio Verify code, and explicitly enable SMS before opted-in operational notifications can be sent.

Homeflow SMS is used for phone verification, opted-in household operational notifications, and emergency/SOS household alerts where enabled. We do not use SMS for marketing. SMS delivery can be delayed, blocked, filtered, or unavailable and is not a 911 or emergency dispatch service. See our SMS Consent and Messaging Terms.

We use reasonable administrative, technical, and organizational measures designed to protect information, including authentication, access controls, encryption in transit, role-based authorization, private storage settings where appropriate, and audit or troubleshooting checks. No system is perfectly secure. You are responsible for strong passwords, safe device practices, and promptly reporting suspected unauthorized access.

We retain information for as long as needed to provide the Service, maintain records, comply with legal obligations, resolve disputes, enforce agreements, preserve security, and support legitimate business purposes. Different categories may have different retention periods. Backups, audit logs, and legal records may persist for a limited time after deletion from active systems.

Depending on your location, you may have rights to request access, correction, deletion, portability, restriction, or objection regarding certain personal information. You may disconnect Google integrations, update profile information, delete or archive certain household records, or contact us to request assistance. We may verify your identity and may deny or limit requests where permitted by law.

Some U.S. state privacy laws, including California privacy laws, provide additional rights for eligible residents and require disclosures about categories of personal information, purposes, sources, retention, and sharing. We collect the categories described in this Policy from users, households, connected services, devices, and service providers. We use them for the purposes described above. We do not sell personal information or share it for cross-context behavioral advertising.

The Service is operated from the United States. If you access it from another country, you understand that information may be processed in the United States or other jurisdictions where our service providers operate.

We may update this Privacy Policy from time to time. Material changes will be posted with an updated date and, where appropriate, additional notice. Continued use of the Service after an update means you accept the revised Policy.

For privacy questions or requests, contact us at privacy@homeflow.ai.