HomeTone

← Back to App

Privacy Policy

Last updated: March 23, 2026  |  Effective: March 23, 2026

1. Who We Are

Data Controller: NexusFleet, operated by CarlosFilipe.net
App name: HomeTone - Family Hub
Website: hometone.pro
Privacy contact: privacy@carlosfilipe.net

We are the controller of personal data you provide through HomeTone. If you are located in the European Union, you have rights under the General Data Protection Regulation (GDPR). If you are in the United States and use HomeTone with a child under 13, the Children's Online Privacy Protection Act (COPPA) applies.

2. Information We Collect

HomeTone collects the following categories of information:

• Account credentials: Family account name, family member profiles (display names, avatar selections, PIN codes stored as hashed values)
• To-do lists and tasks: Task titles, descriptions, due dates, completion status, assigned family members
• Shopping lists: Item names, quantities, categories, checked/unchecked status
• Calendar events: Event titles, dates, times, locations, notes, reminders, assigned family members
• Meal planning: Meal names, recipes, scheduled meal dates, nutritional notes you enter
• Household expenses: Expense amounts, categories, dates, notes, payer information within the family
• Family messages: In-app messages and announcements sent between family members
• Habits and goals: Habit names, frequency settings, completion logs, streak data
• Health information: Any health notes, medication reminders, or wellness goals you voluntarily enter for family members
• Journal entries: Personal or shared journal text, dates, moods, or tags you create
• Documents: File names and content of documents you upload to the family vault
• Contacts: Names, phone numbers, and relationship labels you store in the family contacts section
• Stored passwords (encrypted): Website URLs, usernames, and passwords you save in the family password vault — stored using AES-256 encryption
• Location data: If you use location-sharing features, approximate or precise location depending on your device permissions
• AI assistant conversations: Messages you send to the HomeTone AI assistant and the assistant's responses
• Authentication session data: Session tokens used to keep you logged in
• Payment data (premium users): Subscription status — payment card details are processed directly by Stripe and never stored on our servers

3. How We Use Your Information

• To provide all HomeTone features: task management, calendar, shopping, messaging, budgeting, meal planning, habits, health tracking, journals, documents, contacts, and password vault
• To synchronise your family data in real time across devices used by family members
• To power the AI assistant by sending your conversation messages to Anthropic's Claude API for processing and response generation
• To send transactional emails via Brevo (e.g., account verification, password reset, subscription receipts)
• To process premium subscription payments via Stripe
• To maintain session authentication so you stay securely logged in
• To enforce security, detect abuse, and comply with legal obligations
• To improve the app based on aggregated, anonymised usage patterns

4. Legal Basis for Processing (GDPR Article 6)

For users in the European Union, we process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing necessary to deliver the HomeTone service you signed up for — account management, data storage, sync, and all core app features
• Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, service improvement using aggregated analytics, and protecting the integrity of our platform
• Consent (Art. 6(1)(a)): AI assistant processing, location sharing, optional marketing communications — you may withdraw consent at any time
• Legal obligation (Art. 6(1)(c)): Compliance with applicable law, including responding to valid legal requests
• Special category data (Art. 9(2)(a)): Health information entered by you is processed on the basis of your explicit consent

5. Third-Party Services

We share limited data with the following service providers. We do not sell data to any third party.

• Anthropic (Claude AI) — When you use the HomeTone AI assistant, the text of your conversation is sent to Anthropic's API for processing. Anthropic may process this data according to their own privacy policy. We recommend you do not share highly sensitive information (e.g., passwords, financial details) through the AI assistant chat.
  Privacy policy: anthropic.com/privacy
• Brevo (Sendinblue) — We use Brevo to deliver transactional emails such as account verification, password resets, and subscription notifications. Your email address is shared with Brevo solely for this purpose.
  Privacy policy: brevo.com/legal/privacypolicy
• Stripe — If you subscribe to a HomeTone premium plan, payments are processed by Stripe. We share your email address with Stripe for payment identification. We never receive or store your full card number, CVV, or billing address — these go directly to Stripe.
  Privacy policy: stripe.com/privacy
• Let's Encrypt — We use Let's Encrypt to obtain SSL/TLS certificates that encrypt all data transmitted between your device and our servers. No personal data is shared with Let's Encrypt.
  Privacy policy: letsencrypt.org/privacy

We do not use advertising networks, tracking pixels, social media trackers, or analytics services that share data with third parties.

6. AI and Automated Processing

HomeTone includes an AI assistant powered by Anthropic's Claude. When you send a message to the assistant, that message text is transmitted to Anthropic's API servers for processing. The response is returned to you and the conversation may be stored in our database linked to your account.

Important disclosures regarding AI processing:

• Conversation content is sent to Anthropic and subject to Anthropic's data handling practices
• Do not submit sensitive personal information (passwords, financial data, government IDs) through the AI assistant
• AI-generated responses are not professional advice (medical, legal, financial, or otherwise)
• You may disable the AI assistant feature in your account settings at any time
• No automated decision-making with legal or significant effects is performed solely by AI in HomeTone

7. Data Security

We implement the following security measures to protect your family's data:

• Encryption in transit: All communication between your device and our servers uses TLS 1.2 or higher
• Encryption at rest: Your family data is stored in an SQLite database on our dedicated server with filesystem-level encryption
• PIN code hashing: Family member PIN codes are hashed using bcrypt — we never store raw PIN values
• Password vault encryption: Stored passwords are encrypted with AES-256 before being written to the database
• Session security: Authentication sessions use signed, expiring tokens and are invalidated on logout
• Physical security: Our server is hosted in a professional data centre (Hetzner, Helsinki, EU) with physical access controls
• Regular security audits: We conduct periodic security reviews and promptly address identified vulnerabilities

No system is perfectly secure. In the event of a data breach that affects your rights and freedoms, we will notify affected users and relevant supervisory authorities as required by law.

8. Data Retention

• Active account data: Retained for the duration your account is active
• Account deletion: All personal data including family profiles, tasks, messages, documents, and health data is permanently deleted within 30 days of an account deletion request
• AI conversation logs: Retained for up to 90 days to enable conversation history, then permanently deleted
• Payment records: Stripe transaction records are retained for 7 years to comply with financial regulations — card details are never stored by us
• Security logs: Login and security event logs retained for 90 days

9. Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights:

• Right of access (Art. 15): Request a copy of all personal data we hold about your family account
• Right to rectification (Art. 16): Correct inaccurate personal data — most data can be updated directly in the app
• Right to erasure (Art. 17): Request deletion of your account and all associated family data — available via the admin panel or by emailing us
• Right to data portability (Art. 20): Export your family data in a machine-readable format (JSON) via the account settings export feature
• Right to restriction (Art. 18): Request that we restrict processing of your data in certain circumstances
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for AI processing or location sharing at any time without affecting prior processing
• Right to lodge a complaint: You may lodge a complaint with your national data protection authority (e.g., the Information Commissioner's Office in the UK, or your EU member state's supervisory authority)

To exercise any of these rights, contact us at privacy@carlosfilipe.net. We will respond within 30 days.

10. Cookies and Local Storage

HomeTone uses the following browser/device storage:

• Session cookie: A single authentication cookie is set when you log in. It is a session cookie (expires when you close the browser or on logout) and contains only a session identifier — no personal data. This cookie is strictly necessary for the app to function.
• Local storage: We may store app preferences (theme, notification settings) in your browser's local storage. This data is not transmitted to our servers and contains no personally identifiable information.

We do not use advertising cookies, tracking cookies, analytics cookies from third parties, or social media cookies of any kind.

11. Children's Privacy (COPPA Compliance)

HomeTone is a family application. Children's profiles within a HomeTone family account are created and managed exclusively by a parent or guardian (the account holder). We comply with the Children's Online Privacy Protection Act (COPPA) and applicable children's privacy laws:

• Children do not create their own accounts — all accounts are created and controlled by a parent or guardian aged 18 or older
• We do not collect personal information directly from children
• We do not show advertising to any users, including children
• We do not share children's profile data or activity data with any third party except as described in this policy (i.e., AI assistant when a parent uses that feature on behalf of a child)
• Parents may view, modify, or delete a child's profile data at any time through the family admin panel
• Parents may delete the entire family account and all children's data at any time
• We will not knowingly collect data from a child without verifiable parental consent

If you believe a child under 13 has provided information to us without appropriate parental consent, please contact us immediately at privacy@carlosfilipe.net and we will promptly delete such information.

12. International Data Transfers

Your data is stored on a dedicated server located in Helsinki, Finland, within the European Union, operated by Hetzner Online GmbH. This means your data benefits from EU data protection standards by default.

When you use the AI assistant, your conversation text is sent to Anthropic's API, which may process data on servers outside the EU (including in the United States). Anthropic participates in frameworks designed to ensure adequate data protection for international transfers. By using the AI assistant feature, you consent to this transfer.

Email delivery via Brevo and payment processing via Stripe also involve data transfers. Both providers maintain Standard Contractual Clauses (SCCs) or equivalent mechanisms for GDPR-compliant international transfers.

13. Changes to This Policy

We may update this Privacy Policy as our app evolves or as legal requirements change. We will notify you of material changes by:

• Displaying a notice within the HomeTone app at least 14 days before changes take effect
• Sending an email to the family account holder's registered email address for significant changes

The "Last updated" date at the top of this page will reflect all changes. Continued use of HomeTone after the effective date of updated terms constitutes your acceptance of the revised policy.

14. Contact Information

NexusFleet / CarlosFilipe.net
Privacy inquiries: privacy@carlosfilipe.net
App website: hometone.pro

For GDPR-related requests (access, deletion, portability, objection), please email us with the subject line "GDPR Request" and your family account email address. We will respond within 30 days.

For COPPA-related concerns regarding children's data, please email us with the subject line "COPPA — Children's Data" and we will respond within 5 business days.