Draft — needs review before launch
Privacy notice
Heimfolk is designed so that we can’t read your family’s data. This notice explains what our server does hold, why, and for how long.
Who we are
Heimfolk is made by [Owner’s full name — to fill in], a sole trader in the United Kingdom, who is the data controller for the information described here. Contact: support@heimfolk.gisvold.org.
Your family’s data is end-to-end encrypted
Everything your family puts into Heimfolk — calendars, chores, lists, notes, photos, names — is encrypted on your devices with AES-256-GCM before it is synced. The key stays on your family’s devices. We never have it, so we cannot read, search or hand over that content.
To sync, our server stores for each item only:
- the encrypted data (ciphertext);
- a random id, the kind of item (for example “chore” or “event”), timestamps and a deleted flag;
- counts and storage size per household, to run the service and apply limits.
No accounts
You don’t need an email address or password. A household is identified by random ids, and each device by a cryptographic key created on the device.
What else we process, and why
| Data | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Device model, OS version and app version for each registered device | Running sync, showing your devices in Settings, compatibility | Contract (providing the service) |
| Push notification tokens | Telling you when support has replied | Contract |
| Subscription status (plan and expiry date), received from Apple | Knowing whether your household is subscribed. We never see payment details; Apple handles payment. | Contract |
| Support tickets: what you write, attached screenshots, and an optional contact email | Answering you. The email is optional and stored encrypted; you can use support without it. When a ticket arrives, our staff are alerted by email and Telegram, and the Telegram alert includes the start of what you wrote (up to 1,000 characters). | Contract, and legitimate interests (improving the app) |
| Diagnostics, only if you choose to send them with a ticket | Fixing problems. They describe the app and device (versions, sync status, error codes, counts of items by kind, settings switches) and contain no family content. | Consent (opt-in each time) |
| Your household’s approximate location, when you use weather | Fetching the forecast and air quality. Our server asks MET Norway, OpenAQ and Sensor.Community on your behalf, using a rounded location (about 1 km for the forecast, about 10 km for air quality). We don’t store your location against your household or device, and those services don’t learn who you are. Results are shared by everyone in the same area and kept for about an hour. | Legitimate interests (providing a feature you turned on) |
| Technical logs (for example IP addresses in request logs), and the device and IP recorded when a ticket is created, replied to or closed | Security, abuse prevention and keeping the service running | Legitimate interests |
We don’t sell data, show ads, or use tracking or analytics SDKs.
Children
Children use Heimfolk on family devices that a parent sets up. Children have no accounts, and support and subscriptions are behind the parent PIN, so children can’t contact support or buy anything.
Who processes data for us
- Cloudflare — hosting, database and file storage for our server.
- Resend — sending support emails, if you gave a contact email.
- Telegram — alerts to our support staff when a ticket or reply arrives, including the start of its text. Telegram chats are not end-to-end encrypted.
- Vercel — a small relay that passes push notifications to Apple. It sees the device’s push token and the ticket title in the notification, and keeps neither.
- Anthropic — an AI assistant helps our staff draft replies and spot known problems, and so reads the text of support tickets. It can’t contact you; a person checks anything before it is sent.
- GitHub — we store write-ups of solved problems there. They are written without family details.
- Apple — the App Store, subscriptions, push notifications and device attestation.
The weather services (MET Norway, OpenAQ, Sensor.Community) receive only the rounded location, from our server, not from your device.
Some of these process data outside the UK. Where they do, we rely on the safeguards UK law requires (such as UK adequacy regulations or the International Data Transfer Addendum).
How long we keep it
- Synced household data: until you delete it or your household.
- Encrypted backups: 30 days.
- Support tickets: 24 months after they are closed, then everything you wrote is erased and only the ticket number, type and dates remain.
- Screenshots attached to tickets: 12 months.
- The device and IP recorded against ticket actions: 12 months.
- Subscription events from Apple: kept for our accounting records.
- Devices and push tokens: until removed, or until the household is deleted.
If you delete your household, synced data, devices and push tokens go straight away, backups within 30 days, and your tickets are erased: what you wrote, your screenshots and your contact email.
Your rights
Under UK GDPR you can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent at any time. In Settings, Export everything saves a copy of your family’s data, and you can delete your household. For a copy of what our server holds about your tickets and devices, or for anything else, email support@heimfolk.gisvold.org. Because we hold no names or emails for households, we may need a ticket number or similar to find your data.
If you’re unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113.
Changes
We’ll update this page if anything changes, and tell you in the app about significant changes.