Privacy Notice

1. Controller and contact

The controller for House Hero is Dariusz Skrzeczkowski, Poland. For privacy questions, access or deletion requests, email skrzeczkowskidariusz@gmail.com. The notifications@gethousehero.app address sends application messages and is not an incoming support mailbox.

2. Information processed

• Account: email, authentication information handled by Supabase Auth, chosen hero/display name and account, membership and household identifiers. Google sign-in may supply basic profile information and a profile-image URL.
• Household content: household name, roles, invitations, tasks and notes, dates, assignments, recurrence, projects, checklists, comments, reactions, completion history, XP, levels, badges and streaks.
• Images: selected attachments and thumbnails, task/uploader associations, format, dimensions, file size, version and upload status.
• Technical information: installation identifier, push token, settings, drafts, synchronization versions and retry records. Infrastructure providers may process IP addresses and logs needed for delivery and security.
• Age declaration: age band, protection level and declaration-change information. This flow does not persist the exact age entered or a date of birth.

You choose what content to enter. It can concern other people or reveal sensitive information. Avoid medical records, identity documents and unnecessary special-category personal information.

3. Purposes and legal bases

• Providing requested accounts, household planning and synchronization: performance of the service, GDPR Article 6(1)(b), where applicable.
• Security, abuse prevention, record integrity, handling support and legal claims: the controller's legitimate interests, Article 6(1)(f), taking users' rights, particularly children's rights, into account.
• Specific legal obligations, when applicable: Article 6(1)(c).
• Optional advertising processing and device storage/access where required: prior consent and applicable local rules. Refusal does not remove access to core features.

Without required account or synchronization information, the corresponding feature may be unavailable. An Android microphone or notification permission is a device permission, not automatically consent to every form of personal-data processing.

4. Household visibility

Authorized members can see household tasks, assignments, comments and progress according to their roles. Assigning a task to one person does not make it private. The current model has no separate private-task type. Administrators manage membership; unrelated households are not entitled to this content.

Removing a member restricts current access but does not automatically erase their past completions and historical references. Invitation messages contain information needed to recognize the inviter and household and accept the invitation.

5. Providers and recipients

• Supabase: authentication, database, Realtime synchronization and private image storage.
• Resend: authentication and invitation email, including recipient address, inviter/household information and links. House Hero does not use these transactional messages for marketing advertisements.
• Google: optional sign-in, Firebase Cloud Messaging, invitation-code scanning, Google Mobile Ads and the UMP consent platform in the permitted test mode described below.
• OpenAI: the entered goal and deadline, only when you request external AI project suggestions through the backend.
• Netlify: public information/privacy-page hosting and the associated web requests.

The speech-recognition provider depends on the phone's configuration. Providers may also act as independent controllers for their own services and legally required purposes. Provider information: Supabase, Resend, Google, Firebase, OpenAI API, Netlify.

6. Photos, dictation, AI and notifications

The phone prepares task images and thumbnails before uploading them to private Storage. The new preparation flow removes unnecessary metadata, including GPS; this is not a guarantee that all historical files have no metadata. A locally selected hero photo and a Google profile image may follow different flows. Private Storage is not end-to-end encryption.

Dictation uses the recognition service available on the phone. That service may send audio to its provider. House Hero does not guarantee offline-only recognition and does not create its own audio archive.

External AI suggestions are user-triggered. The entered goal and deadline may be sent to OpenAI; the feature does not automatically send the entire household or photographs. Do not include secrets or sensitive data. Local suggestions do not require that request. AI output is a suggestion for review, not a decision about a person.

You can disable notifications. Firebase may obtain a technical registration token before permission to display notifications is granted. Denial prevents display and active delivery registration; it does not guarantee that no connection to Google takes place.

7. Age, privacy choices and beta advertising

Commercial ads are disabled. An optional test banner in Statistics is restricted to adult testers who pass the age and consent gates. Minors and unknown-age accounts are blocked from advertising in the current implementation. Advertising for children has not been implemented.

Even test ads and UMP may contact Google and process IP addresses, device information, identifiers and information needed for operation, fraud prevention and privacy choices. Nonpersonalized does not mean no personal-data processing. Personalization is disabled in current test requests.

If the Google consent form appears, you may reject optional purposes, manage your choice and return to privacy settings. You may change your age declaration in settings. An earlier minor declaration can retain protective restrictions; entering an older age does not bypass them. Any change to serving rules must be accompanied by updated information and required user choices.

8. Processing location and security

External services may process information inside and outside the EEA, including in the United States. We do not claim all information stays in Poland or the EU. The standard terms of Supabase, Resend and Netlify include data-processing agreements and standard contractual clauses for applicable transfers. Firebase and OpenAI also provide relevant processing terms. This does not grant unlimited permission to transfer information. Ask the controller for information about your account and a copy of the applicable transfer safeguards.

Controls include authentication, household permissions, encrypted connections and private resources. No system guarantees zero risk. Devices keep local copies and pending offline operations. Android system backups depend on device settings and the application version.

9. Retention and deletion

Account and household information is retained as needed to provide the service, maintain accurate shared history, handle requests and meet legal/security requirements. There is no single fixed retention period for every category. Provider logs and backups follow applicable agreements and policies.

Deleting a task/project may archive it. Resetting progress or removing membership is not complete account, ledger or photograph erasure. Logout removes the session and some caches but may preserve unsent operations to avoid losing work.

Request account-data deletion using the contact in section 1. The beta does not yet provide complete self-service account deletion or export. Requests are reviewed individually; proportionate identity verification may be needed. We will explain what can be erased and the reason for any necessary retention. Do not send identity-document scans unless a necessary, safe method has been agreed.

10. Your rights

Where provided by law, you can request access, rectification, erasure, restriction and portability, object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing. Contact section 1; the absence of a button does not remove these rights. GDPR generally requires a response within one month, with extensions in circumstances provided by law.

You may complain to the Polish Personal Data Protection Office or the competent authority in your country. XP, badges and project suggestions are not used for automated decisions producing legal or similarly significant effects.

11. Children and guardians

House Hero can contain child profiles created within a household by a guardian. Guardians should minimize information and manage access. Do not create a child's independent account without the legal basis required in the child's country and effective guardian consent where necessary. Advertising age declarations do not verify guardianship or parental consent.

Advertising to minors is not enabled in this beta. Wider distribution for children requires separate assessment of age rules, parental consent, store requirements and local laws. Guardians may contact section 1 about children's information.

12. Information website and updates

The privacy page does not require a House Hero account. We add no analytics or advertising cookies to that page. Hosting receives normal request information, such as IP addresses, to deliver and protect it. External links lead to services with their own policies.

This notice will be updated when processing changes. Publishing a changed document does not replace any newly required consent. This notice describes the beta; publication does not enable advertising or certify that worldwide advertising is ready or legally compliant.