Privacy Policy

This privacy policy covers the Housely app (iPhone, Android and browser version) and this website. In short: we only process what Housely needs to work. The app has no ads and no advertising ID, and we don't sell data. On the website we count, without cookies, which pages are viewed and how often the App Store and Google Play buttons are tapped (see Web analytics with PostHog). So that we can see whether our own ads work, the iOS app reports installs, app launches and purchases to Meta without an advertising ID (see Ad measurement with Meta).

This is a translation of the German Datenschutzerklärung. If the two differ, the German version prevails.

1. Controller

Represented by the managing directors Michael Wanjek and Nikolas Schaffmann
Email for privacy questions: [email protected]

2. This website

When you open this website, our server processes technically necessary data (IP address, date and time, page requested, browser identifier) in server log files to deliver the website and protect it against attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The website is delivered through Cloudflare's network, which processes the requests to protect against attacks and to deliver pages quickly. The website sets no cookies, loads no content from third parties and uses self-hosted fonts.

If you arrive through one of our ads, the address contains campaign details (such as "utm_source=meta"). We use them to add the campaign's name to the link to the App Store, and the web analytics counts which campaign you came through (see below). In App Store Connect, Apple only shows us summed-up views and downloads per campaign, no individual people.

Web analytics with PostHog

We want to understand which pages and which ads lead people to download Housely. For this, the website uses PostHog, a service of PostHog Inc. (USA), in its PostHog Cloud EU version: the data is processed on servers in Frankfurt am Main, Germany. Your browser only sends it to our own address (gethousely.app), and our server passes it on to PostHog.

What is collected: the pages you view, the page you came from (referrer), campaign details in the address (utm_source, utm_campaign, utm_content and the like), browser, operating system, device type, language setting and screen size, and whether you tap a button to the App Store or Google Play – with the campaign and the place on the page. What you do in the app is not part of it.

We run PostHog without cookies: nothing is stored on your device, not in the browser's storage either. To tell visits apart, PostHog's server creates a checksum from the IP address, the browser identifier and a random value that changes every day. The IP address itself is not stored, and visits on different days can't be linked to the same person. We don't build user profiles and don't combine the data with your Housely account. Session recording, surveys and automatic click tracking are turned off.

The legal basis is our legitimate interest in improving the website and our ads using these figures (Art. 6(1)(f) GDPR). PostHog processes the data on our behalf; we have a data processing agreement with PostHog (Art. 28 GDPR). As PostHog Inc. is a US company, access from the USA can't be ruled out entirely; the European Commission's standard contractual clauses in that agreement apply to it.

You can object to the web analytics at any time: turn on "Do Not Track" or "Global Privacy Control" in your browser and the website won't load PostHog at all. Or write to us at [email protected].

3. The Housely app

Account

For an account we store your name, your email address and your password (only as a secure hash, never in plain text). If you sign in with Apple, we receive an identifier from Apple and – depending on your choice – your email address or a relay address from Apple; you add your name yourself if you want to. On Android, "Sign in with Apple" opens Apple's sign-in page in a browser window; Apple sends the result to our server, which passes it on to the app. We receive the same details as on the iPhone. If you delete your account, we also end the "Sign in with Apple" connection with Apple. If you reset your password, we send you a link by email.

In the Android app you can also sign in with Google. You pick your Google account in Android's sign-in sheet (Credential Manager). Google gives the app a sign-in token with an identifier of your Google account, your email address, whether Google has verified it, and your name. Our server checks the token with Google's public keys and stores the identifier and your email address; we use your name as your display name if your account doesn't have one yet. We don't take your Google profile picture. If you delete your account, we also delete the Google identifier; you can additionally remove Housely's access in your Google account.

When you register and when you sign in on a new device, we send you a 6-digit code by email. We only store a hash of it; the code expires after 10 minutes. If you choose "Trust this iPhone" (on Android "Trust this phone"), we store a random device key (only as a hash, with a label such as "iPhone") so you don't need a code there for 90 days. We also remember your language so emails and notifications arrive in your language, and, if you are in several households, which one you used last.

Household data

Everything you enter in Housely belongs to your household and is visible to all members of the household: chores, messages on chores and expenses, expenses, recurring bills, settle-up payments, the shopping lists with their places (name, address and location of the shops you save for location reminders), pantry, receipt photos, absences, your default expense split, the shared kitty, deposit, meter readings and home info such as Wi-Fi details or your landlord's contact details. We store this data on our server so it is the same on every device in the household. If you are in several households, each household only sees its own data.

You can delete your own messages; the household's admin can also delete other people's.

Reporting, blocking and moderation

Reporting: You can report messages that break our Terms of Use or the law in the app (long-press the message → "Report"), optionally with a reason. We then store your account as the reporting person, the text of the reported message and who wrote it, the title of the chore or expense it belongs to, the household and the time. Only we as the operator see the report, not the other members of the household. We review reports within 24 hours and use them to delete content that isn't allowed, remove people from a household or ban accounts. If you report by email to [email protected] instead, we process the details in your email in the same way.

Blocking: You can block a person in the app ("Block"). We then store who blocked whom and the blocked person's name at that time. Messages from the blocked person are hidden from you, you get no notifications about them, and they can't request to join your households.

Word filter: Messages pass through an automatic word filter. A fixed list of slurs is replaced with asterisks in the app and on our server. Nothing about you is analysed: no profiling, no artificial intelligence.

Account bans: For serious or repeated violations we can ban an account. It is then signed out on all devices and can no longer sign in. We store the date and the reason for the ban.

Device bans and device identifier: So that a banned person can't simply come back with a new email address, the app sends a device identifier with every request: on the iPhone a random identifier the app keeps in the device's keychain, on Android the device's Android ID. We only store a hash of it made with a secret key, never the identifier itself, together with the account, the platform, the app version and when the device was first and last used. On the iPhone the app also sends a token from Apple's DeviceCheck service when you sign in and when it starts; with it we can set and read a single "banned" flag for this device at Apple. Apple tells us nothing about you or your device in the process. If we ban a device, no account can be created or used on it any more; the app then shows "This device has been permanently blocked". We use the device identifier for nothing else, in particular not for advertising or tracking.

Bank details for settling up

You can choose to add an IBAN, account holder and a PayPal.me name. They are only shown to the members of your household so they can transfer money to you (for example via GiroCode). Housely itself doesn't make any payments.

Housely Plus

Purchases are handled entirely by Apple (iPhone) or Google Play (Android). We don't receive any payment data. When you buy, the app gives Apple or Google the identifier of your Housely account (a random number without name or email address) so the purchase stays assigned to your account. Plus applies to individual households. So that a purchase stays assigned to your account and to the right households, we store, for each purchase, Apple's original transaction number or, for Google Play, an identifier we derive from Google's purchase token (the purchase tokens themselves only as a hash), the product (one household or up to three households, monthly or yearly), the environment (App Store or Google Play, or their test environment), the expiry date, which households the purchase covers and when you last moved Plus to another household. The members of a household with Plus see who pays for it, but no purchase details. Apple tells our server through its server notifications when a subscription renews, is refunded or ends; we then adjust Plus accordingly.

If you buy through Google Play, the app sends the purchase token and the product to our server. The server asks Google for the subscription's status (product, start, expiry, state and whether it is a test purchase) through the Google Play Developer API and acknowledges the purchase there. When a subscription renews, is paused, refunded or ends, Google notifies our server; it then asks for the status again and adjusts Plus accordingly.

Notifications

If you allow notifications, we store a push token for your device to send you reminders and updates from your household. On the iPhone they are delivered through the Apple Push Notification service, on Android through Google's Firebase Cloud Messaging (FCM); the content of the notification passes through Apple's or Google's servers. On Android, Firebase creates a Firebase installation ID and the push token on your device and sends both to Google so Google can deliver notifications to your device. We don't use any other Firebase services such as Firebase Analytics. Notifications can show content from your household, including on the lock screen: the text of a message, names, titles of chores, expenses and recurring bills, and amounts of settle-up payments. You choose which notifications you get in the app under Settings → Notifications. Whether previews appear on the lock screen is set in the iPhone settings under Notifications or in the Android settings under Notifications.

Calendar subscription

If you turn on the calendar subscription (Settings → Notifications → Calendar subscription), we create a private, secret link for you. At this link our server provides a calendar with the titles and notes of your chores (if you want, also everyone else's chores, then with the name of the person responsible), the due dates of your recurring bills, the waste collection days and the name of your household. It never contains amounts. Anyone who knows the link can read this calendar – so only share it if you want to. If you subscribe to it in a calendar service such as iCloud or Google Calendar, that service fetches the link from our server regularly and stores the events itself; its own privacy terms apply. You can reset the link in the app at any time, and the old one stops working. We only store a hash of the link.

Operating figures

From timestamps that are stored anyway – when an account and a household were created and when someone joined a household – we calculate weekly totals, for example how many new households have a second person within 48 hours. We don't collect any additional data for this, and nothing is passed on to third parties. Only we see these figures, and they don't show individual people.

Ad measurement with Meta (iOS app only)

We advertise Housely with ads on Facebook and Instagram. To see whether they work, the iOS app contains Meta's software development kit (SDK). It tells Meta that the app was installed and opened, and sends automatically logged app events such as purchases of Housely Plus (product, price, currency). It also sends technical details about your device, such as the device model, iOS and app version, language setting and time zone, your IP address and a random identifier the SDK creates in the app.

The app does not read the advertising identifier (IDFA) and does not ask for permission to track (App Tracking Transparency); advertiser tracking is turned off in the SDK. Meta therefore attributes installs and purchases to our ads through Apple's SKAdNetwork and Meta's Aggregated Event Measurement, and we only see summed-up results per ad. Meta does not receive your name, your email address, your Housely account identifier or any content from your household. The Android app and the browser version do not contain the SDK.

We and Meta are joint controllers for the collection in the app and the transmission to Meta (Art. 26 GDPR); Meta's Controller Addendum (facebook.com/legal/controller_addendum) sets out who is responsible for what. After that, Meta processes the data as an independent controller under its Privacy Policy (facebook.com/privacy/policy), where you can also exercise your rights directly with Meta. Data may be transferred to the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

The legal basis is our legitimate interest in measuring how well our ads work (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR): the easiest way is in the app under Settings → Help & legal → Ad measurement. Once you turn it off, the app stops reporting events to Meta right away, and from the next launch on it no longer starts the SDK at all. The setting applies to that device. You can also object by email to [email protected]. Deleting the app ends the transmission as well.

What stays on your device

• Your profile photo is not uploaded.
• Reading receipts for expenses (amount, date, store) happens on your device – on the iPhone with Apple's text recognition, on Android with Google's ML Kit, which also runs on the device. Only the receipt photo is uploaded, when you attach it to an expense. The one exception is "Match receipt" in the shopping list (see below).
• Location reminders (Housely Plus): when you turn them on, the app asks for your location, only "while using the app" (on Android also "all the time", for reminders while the app is closed). Whether you arrive at a saved shop or at home is checked by your device itself – iOS on the iPhone, Google Play services on Android. Your location and your home are not sent to our server; only the shops you add to a list as places are shared.
• Barcodes and the QR codes of invitations are also recognised on your device (on Android with ML Kit).
• Siri Shortcuts and Spotlight search, and on Android the app shortcuts, are processed on your device.

Features that use third-party services

• Dictation in the shopping list: On the iPhone, Apple handles the speech recognition. Your recording may be sent to Apple; Apple's privacy policy applies. On Android, your device's speech recognition service handles it – Google's on most devices. If your device offers on-device recognition, Housely uses it; otherwise your recording may be sent to the provider of the service, and its privacy policy applies. So that your items are recognised correctly, Housely passes item names from your shopping list to the speech recognition. Our server never receives a recording, only the recognised text as an item.
• ML Kit on Android: ML Kit doesn't pass images or recognised text or barcodes to Google. It does send Google technical usage and performance data (such as the device model, Android and app version, and the duration and errors of the recognition), which Google uses to run and improve ML Kit; Google's privacy policy applies.
• Place search: when you search for a shop or an address for a list, the search text and your approximate area go to Apple Maps (iPhone) or your Android device's geocoder, usually Google's – without account or household data. That provider's privacy policy applies.
• Barcode scan: To find the product name, the barcode number is sent to Open Food Facts (Open Food Facts, France). The service sees your IP address, but no account or household data.
• Waste collection calendar: Our server fetches the calendar link you enter from the respective provider.
• Match receipt (Housely Plus): When you use "Match receipt" in the shopping list, the app sends the photo of the receipt and the names of that list's open items to our server. It passes both on to an AI service, Claude by Anthropic, which reads the receipt (store, date, total, items with quantity and price) and suggests which items of the list are on it. The app asks you before you use the feature for the first time. Our server does not store the photo for this and writes neither the photo nor the items into its logs; it only notes that your household matched a receipt (time, image size, duration, number of recognised lines) to limit the number of matches per month. Anthropic processes the data on our behalf, does not use it to train its models and, according to Anthropic, deletes it after 30 days at the latest. If you save the receipt as an expense, the photo is stored with that expense like any other receipt photo.

Browser version

The browser version stores your sign-in and the last loaded state in your browser's local storage so it opens without a connection too. Signing out deletes it.

Legal basis

We process this data to provide Housely to you as agreed (Art. 6(1)(b) GDPR). We process voluntary details such as bank details because you enter them for your own purpose (also Art. 6(1)(b) GDPR). Security logs and protection against abuse, such as limited sign-in attempts, are based on our legitimate interest (Art. 6(1)(f) GDPR), as are the operating figures: we want to see whether getting started with Housely works, and improve it. We process "Match receipt" because you call up the feature and agree to it in the app (Art. 6(1)(b) and (a) GDPR); you can withdraw your consent at any time by no longer using the feature. That ML Kit on Android sends technical usage data to Google is based on our legitimate interest in recognising receipts and barcodes reliably on the device without sending images to a server (Art. 6(1)(f) GDPR). Reporting, blocking, the word filter, account and device bans including the device identifier serve the safe use of Housely that we promise in the Terms of Use (Art. 6(1)(b) GDPR) and our legitimate interest in protecting everyone who uses it from harassment and unlawful content (Art. 6(1)(f) GDPR). Ad measurement with Meta is based on our legitimate interest in measuring how well our ads work (Art. 6(1)(f) GDPR).

4. Recipients and processors

• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; data centre in Nuremberg (Germany). The provider processes the data on our behalf (Art. 28 GDPR).
• Email delivery for sign-in codes, password links and account notices: Brevo (Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France; in Germany Brevo GmbH, Köpenicker Str. 126, 10179 Berlin), processing in the EU. Brevo routes links in these emails through its own server and counts whether an email was opened and a link clicked. This count is anonymous, not linked to any person, and we do not evaluate it.
• Network and DNS: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers this website and the app's connections to our server. Data may be transferred to the USA; Cloudflare is certified under the EU-US Data Privacy Framework.
• Web analytics on this website (see "Web analytics with PostHog"): PostHog Inc., USA; processing in PostHog Cloud EU, data centre in Frankfurt am Main (Germany). The provider processes the data on our behalf (Art. 28 GDPR).
• Mailbox for messages to [email protected]: Spaceship, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA. Data may be transferred to the USA.
• Apple (Apple Distribution International Ltd., Ireland) for app distribution, purchases, "Sign in with Apple", notifications and speech recognition. Data may be transferred to the USA; Apple is certified under the EU-US Data Privacy Framework.
• Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for app distribution and purchases through Google Play, "Sign in with Google", notifications on Android (Firebase Cloud Messaging), text and barcode recognition on Android (ML Kit) and – depending on the device – speech recognition. For Firebase Cloud Messaging, Google processes the data on our behalf (Art. 28 GDPR). Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework.
• Anthropic (Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA) for "Match receipt": reads photos of receipts on our behalf (Art. 28 GDPR). Data is transferred to the USA, based on the European Commission's standard contractual clauses in the data processing agreement with Anthropic.
• Meta (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland) for ad measurement in the iOS app (see "Ad measurement with Meta"): joint controller with us for the collection and transmission, an independent controller after that. Data may be transferred to the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.
• Calendar services in which you subscribe to the calendar subscription (for example iCloud or Google Calendar) fetch the calendar through your link.
• The members of your household see the household data as described above.

5. Retention

We store your data for as long as you have an account. If you delete your account (in the app under Settings → your profile at the top → Delete account), we remove your sign-in details (including the Apple or Google identifier), push tokens, bank details, calendar links and your Housely Plus purchase records. Entries that concern other members – such as shared expenses, chores and the messages you wrote – stay in the household under your name without an account, so their accounts and history stay correct. You can delete your own messages beforehand. If you are the last person with an account in the household, the household is deleted with all its data. This applies to each of your households. If you leave a household or its admin removes you, your entries and messages there also stay under your name without an account, your bank details in that household are deleted and your calendar link for that household stops working. We delete reports 6 months after we have closed them; if you delete your account before that, the link between you and your reports is removed – both as the reporting and as the reported person. We keep a block until you lift it or one of the two accounts is deleted. We keep the date and reason of an account ban until the account is deleted. We delete an account's device identifiers (as hashes) with the account. We keep a device ban (hash, reason, date and the email address of the account it came from) until we lift it, also after the account is deleted – otherwise it could be avoided by deleting and recreating the account. We delete the records of matched receipts (without photo or content) after 90 days. We delete server log files after 14 days at the latest and the web analytics data at PostHog after one year at the latest. What Meta receives through the SDK, Meta stores under its own Privacy Policy; we don't store anything about it ourselves. Data in backups is deleted when the respective backup is overwritten in the normal rotation.

6. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) – in the app under Settings → your profile at the top → Export my data,
• object to processing based on our legitimate interest (Art. 21 GDPR).

Write to us at [email protected]. You can also complain to a data protection supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information.

7. Security

The connection between the app and the server is encrypted (TLS). We only store passwords as a hash, and the same goes for calendar subscription links. Only a household's members have access to its data.

8. Children

Housely is meant for people aged 16 and over. Younger household members can be added by name, without an account of their own.

9. Changes

When Housely changes, we update this policy. The date at the top shows the current version.