Homeward Privacy Policy

Version 1.0.2 · Last reviewed 2026-08-29 · Effective date 2026-08-29

1. Who we are

Homeward is a local editorial discovery app for going outside, meeting up with the people you care about, or self-treating with a handpicked outing. The product is operated by Nick Arning, a sole proprietor based in Basel, Switzerland. Pre-validation, Homeward is a personal project — not a registered company. Post-validation, a Swiss GmbH may be formed (per Operating Principle #6); when that happens, this policy is updated and the changelog in _VERSION.md tracks the transition.

Contact: privacy@gethomeward.app (route to operator personal email pre-validation)

2. What we do not collect

This section is load-bearing per Operating Principle #11 (location-lite by design). We make affirmative claims here that are also affirmed in App Store / Play Store privacy nutrition labels and enforced via a CI gate that greps the app source for forbidden location APIs.

• We do not collect an email address. Homeward never asks for your email. Authentication is username and password only; your account cannot be tied to an email address, never emailed a link, never emailed a code. Account recovery uses a one-time code you write down at signup — see § 3.1. This is a design decision, not a limitation.
• We do not collect device location. Homeward never asks for, reads, or stores GPS coordinates. City selection is explicit (you pick from a list at onboarding); navigation hands off to your installed Maps app under their own consent. iOS Info.plist has zero NSLocation* permission declarations; Android manifest has zero ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION / ACCESS_BACKGROUND_LOCATION permissions. No location is collected — affirmative claim, not "limited collection."
• We do not collect device contacts. Homeward never reads your phone contacts.
• We do not collect calendar data. Homeward never reads or writes to your device calendar.
• We do not collect health, fitness, or biometric data.
• We do not collect social graph data from other apps. Homeward does not import friend lists from other social apps.
• We do not sell, rent, or share your data with advertisers, data brokers, or third parties for marketing purposes. Per Operating Principle #14 (honest monetization), advertising revenue and data sale are explicitly forbidden in our doctrine.
• We do not use behavioral targeting, cross-app tracking, or profile-building for ads.
• We do not knowingly collect personally-identifying information (PII) from anyone under 16. Homeward is intended for users 16+; if a younger person's information is identified post-collection, we delete it on discovery.

3. What we do collect

We collect the minimum necessary to operate the app. Per Operating Principle #8 (privacy & consent design-first): if we wouldn't act on it, we don't collect it.

3.0 Anonymous sessions (even without an account)

When you open Homeward without an account, the app creates an anonymous session via Supabase's anonymous-auth API. This gives you a session identifier stored in your device's secure storage and creates a minimal row on our servers (no username, no contact information) so the app can track your in-progress outings, habitat state, and save preferences between launches.

If you later create a named account, your anonymous session transitions to that account and your prior activity transfers with it. If you never create an account, the anonymous session and any activity you generated in it (saved outings, habitat state) remain on our servers tied to no personal identifier. You may contact privacy@gethomeward.app to request deletion of an anonymous session.

3.1 Account data (collected when you create a named account)

When you sign up, we store:

• Username — your chosen display name; visible to other Homeward users on shared outings and ratings.
• Password (hashed) — Supabase Auth manages password hashing (bcrypt). We never see your plaintext password; neither do our operators.
• Age confirmation — a boolean indicating you confirmed you are at least 16 at signup. We store the confirmation flag only, not your date of birth or year of birth.
• Recovery-code hash — a SHA-256 hash of the one-time recovery code shown to you once at signup. The recovery code itself is never stored — only the hash. This is the only password-reset path; without it there is no "forgot password" email because there is no email address on file.
• Home city — your chosen city (Basel for v1; Zürich, Bern, Vienna, Berlin, London at later releases); explicit selection only, never geolocation-derived.
• Visitor flag — opt-in toggle for "I'm visiting this city, not a resident" (used to surface visitor-flagged templates).
• Push notification token — only if you explicitly enable push notifications. Stored in your user row; used only to deliver notifications you have requested. You can revoke it at any time in your device's notification settings or by disabling push in app settings.

3.2 Activity data (collected when you use the app)

• Outings started, completed, swapped, or saved — for your personal journey history and for honest aggregate metrics (no per-user behavioral targeting).
• Follow relationships — who you follow and who follows you, per the minimal social layer (Operating Principle #17: approve-required follows, private by default, going-dark mode available). Stored as pairs in our database; never shared with third parties.
• Ratings and tips you submit — your editorial contributions; tied to your username and visible to other users.
• Photos you upload — EXIF metadata (including any inadvertent GPS data) is stripped client-side before bytes leave your phone. The original file is never transmitted to our servers; only the EXIF-stripped, downsized version reaches Supabase Storage.
• Habitat state — your pixel-art home configuration and unlocked items. Tied to your account; visible only to you (and optionally to followers you approve).
• Reports you file or that others file about your content — to operate the safety and moderation pipeline.
• User-built outings — if you compose a custom outing, the stops and structure are stored and associated with your account.

3.3 Analytics and crash reports (two tiers)

• Tier 1 — Anonymous funnel events (always-on, no PII): screen views, button taps, signup flow events. No user_id, no IP, no device fingerprint. Routed through PostHog (EU-hosted; see § 4 sub-processors).
• Tier 3 — Crash reports (opt-out, default ON): stack traces from app crashes. Routed through Sentry (EU-hosted). PII is scrubbed at the SDK boundary before transmission. You can opt out in app settings. (The tier is numbered 3 for historical consistency with our internal consent model; there is no Tier 2 — an earlier plan for opt-in behavioral analytics was dropped before it ever collected anything.)

We do not collect session-duration, dwell-time, or scroll-depth analytics. We never use any of this data to build behavioral profiles for advertisers. Period.

4. Sub-processors (EU residency)

Per Operating Principle #6: all sub-processors are EU-hosted to minimize cross-border transfer surface and to align with Swiss FADP + GDPR data-residency expectations.

We do NOT use Mixpanel, Amplitude, Segment, Adjust, AppsFlyer, Branch, Firebase Analytics, or Facebook Pixel.

4a. US providers and government access (CLOUD Act)

Several infrastructure providers Homeward uses are US companies. This creates a specific legal exposure that is honest to name.

The CLOUD Act (US Clarifying Lawful Overseas Use of Data Act, 2018) allows US law enforcement and intelligence agencies to compel US companies to produce data those companies control, even when that data is physically stored on servers outside the United States. A US court order or subpoena can reach data held by a US provider on EU-hosted infrastructure.

What this means for your data on Homeward:

• Supabase Inc. (incorporated in the United States) stores your account data, activity data, and EXIF-stripped photos in eu-central-1 (Frankfurt, Germany). As a US company, Supabase Inc. is subject to the CLOUD Act. A valid US legal demand could require Supabase Inc. to produce your data notwithstanding its EU location.
• Expo / EAS (a US company) handles the delivery and update mechanism for the Homeward app binary. Expo does not receive your personal account or activity data; its exposure is limited to app-delivery metadata.
• Sentry (crash reports) and PostHog (analytics) are both EU-hosted and structured to reduce this exposure, but the same principle applies to any US-owned entity regardless of server location.

What we cannot promise: We cannot guarantee that your data will never be subject to a CLOUD Act order or equivalent government demand. No cloud service hosted on US-company infrastructure can honestly make that promise.

What we do to limit exposure:

• We collect the minimum data needed to operate the app (Operating Principle #8: if we would not act on it, we do not collect it).
• We never collect an email address, phone number, real name, or device location, so the most personally identifying fields do not exist in our database.
• All analytics and crash data are PII-scrubbed before transmission.

If you have concerns about government-access exposure, you should weigh those against the data Homeward actually holds: a username, a home-city selection, optional behavioral data, and EXIF-stripped photos. No email, no phone, no location.

Map tile providers and IP-level exposure: When the app renders the in-map cartography, tile requests go directly from your device to OpenFreeMap's infrastructure (a keyless, account-free, cookie-free public tile service). Those requests carry your device's IP address, which is standard behavior for any web request, as is true for all tile services. Homeward itself does not receive or log your IP address in connection with tile requests; the exposure is between your device and OpenFreeMap's servers. Static route-preview images use OpenStreetMap infrastructure on the same basis. No GPS or personal data beyond the IP is involved.

5. AI disclosure

This section covers two distinct AI-related topics: the in-app AI feature (Surprise Me), and the use of AI tools in editorial content development.

5a. In-app AI feature: Surprise Me picker

The Surprise Me feature lets you tap once and receive a suggested outing. It has two modes:

AI-assisted mode (currently OFF): The AI picker is currently disabled at both the app level and the server level (the Anthropic daily budget cap is CHF 0). It will not send any data to any AI provider while it is disabled.

When we re-enable the AI picker, we will notify users in-app before the first AI-assisted pick is generated. Here is exactly what the data flow looks like when enabled:

• A consent screen appears before the first AI-assisted pick. You must explicitly accept before any data leaves the app to an AI provider. Declining means picks are drawn from a local random shortlist instead, with no data sent externally and no difference in what you can access.
• If you accept, a single request is sent to Anthropic (a US-based AI company) containing: the day of the week, the time of day, and the shortlisted outings available in your chosen city. Nothing else leaves the app: no username, no account identifier, no location, no history, no personal data beyond those three inputs.
• Your consent is stored server-side and is revocable at any time in Settings. If you revoke consent, the next Surprise Me tap shows the consent card again; no AI request is made until you re-accept.
• Anthropic processes the request to return a suggested outing with a short reason. Anthropic's use of this data is governed by Anthropic's own privacy policy (anthropic.com/privacy). Because Anthropic is a US company, the CLOUD Act note in § 4a applies to this data too; the three inputs (day, time, shortlist) are the full exposure.

Random mode (always available, no AI): When the AI picker is off or you have declined consent, Surprise Me draws from the local shortlist at random. No data leaves the app to any external service in this mode.

5b. Editorial AI assistance

Some of Homeward's editorial content, including outing descriptions, city background paragraphs, and stop tips, is drafted with AI assistance. Every piece of AI-assisted content goes through an operator edit-pass before being published to the app.

No user data is involved in this process. The AI drafting process uses publicly available information about places, not any data collected from Homeward users.

AI-generated content does not masquerade as user-generated content. Ratings, tips, and photos in the app are real contributions from real users. We do not fabricate or seed user-generated content per Operating Principle #3 (authenticity over scale).

The operator's first-person account of AI use in development and content is on the About page in the app. EU AI Act Article 52 transparency obligations and Swiss FADP disclosure are satisfied by the combination of this section and that About-page copy; the Wave 2-B lawyer-review pass will confirm the allocation.

6. Your rights (GDPR + Swiss FADP)

You have the right to:

• Access your data — use the in-app "Export my data" function in Settings, or email privacy@gethomeward.app.
• Rectify inaccurate data — correct your username, display name, or preferences directly in app settings. (Homeward stores no contact information such as an email address or phone number to rectify.)
• Erase your data — delete your account in app settings (30-day grace + cron-driven hard delete, Apple 5.1.1(v) compliant).
• Portability — download your data in a machine-readable format (in-app export covers ratings, tips, photos, outing history, habitat state, follow relationships).
• Restrict processing — turn off crash reports at any time (the consent controls in app settings).
• Object — to any specific processing (email privacy@gethomeward.app with your concern).
• Withdraw consent — crash reporting (Tier 3) can be switched off at any time in app settings. (There is no behavioral-analytics tier to withdraw from; see § 3.3.)
• Lodge a complaint — see below for the supervisory authority channels.

We respond to data-subject requests within 30 days (the GDPR Article 12 maximum).

Supervisory authorities

Swiss users: You have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), known in German as the Eidgenossischer Datenschutz- und Offentlichkeitsbeauftragter (EDOB). The FDPIC oversees compliance with the Swiss Federal Act on Data Protection (FADP / DSG) and can receive complaints from individuals who believe their data protection rights have been violated.

• Website: edoeb.admin.ch
• Complaint route: use the online contact form at edoeb.admin.ch/en/fdpic/contact.html, or write by post to: Eidg. Datenschutz- und Offentlichkeitsbeauftragter, Feldeggweg 1, 3003 Bern, Switzerland.
• There is no fee to file a complaint with the FDPIC.

EU users: If you are located in an EU member state, you also have the right to lodge a complaint with your local data protection authority (DPA) under GDPR Article 77. You may file with the DPA of the EU member state where you habitually reside, where you work, or where the alleged infringement took place. A directory of EU DPAs is available at edpb.europa.eu/about-edpb/members_en.

7. Data retention

• Account data: retained while your account is active. On deletion: 30-day grace period (account suspended; can be restored by signing in with your recovery code), then hard-delete via cron with anonymization of any rating/tip you authored (text retained, user_id nulled per anti-orphan + community-value preservation).
• Activity data: retained while account is active; anonymized on hard-delete.
• Photos: deleted from Supabase Storage on hard-delete.
• Anonymous session data: retained until transitioned to a named account. If no account is ever created, an anonymous session and everything attached to it (saved outings, habitat state, in-progress outings) is deleted after 12 months without activity. Opening the app is activity, so a session you keep using is never swept. You can also contact privacy@gethomeward.app to request deletion of an anonymous session at any time.
• Tier 1 anonymous analytics: retained 90 days then aggregated to monthly summaries; rolling delete.
• Tier 3 crash reports: retained 90 days; deletable on request.

8. Security

Per Operating Principle #13 (defense in depth):

• Database: PostgreSQL on Supabase eu-central-1 with Row-Level Security (RLS) policies on every user-data table; service-role key scoped to operator scripts only (never client-exposed).
• Passwords: managed by Supabase Auth (bcrypt hashing). We never store or transmit plaintext passwords.
• Recovery codes: only the SHA-256 hash of your recovery code is stored. The plaintext code is shown to you once at signup and never stored anywhere.
• Photos: EXIF-stripped client-side before upload; Supabase Storage with private bucket + signed URLs.
• Auth tokens: stored in secure on-device storage (iOS Keychain / Android Keystore equivalent); never in plaintext.
• In transit: TLS 1.2+ everywhere; HSTS on gethomeward.app.
• At rest: Supabase encrypts at rest with AES-256.
• CI gates: secrets-scan on every commit; no-location-permissions gate on every PR; pgTAP RLS coverage on schema migrations.

9. Cookies and trackers

The Homeward mobile app does not use cookies; it uses native auth-token storage (see § 8).

The Homeward marketing site (gethomeward.app) and share-link receiver use a single first-party functional cookie:

• anonymous_session_id — server-generated UUID, httpOnly, SameSite=Lax, max-age 90 days. Used for share-link attribution analytics under Tier 1 anonymous funnel only. No advertising cookies, no third-party trackers, no Google Analytics, no Facebook Pixel.

10. Children

Homeward is intended for users 16 years of age or older. We do not knowingly collect data from anyone under 16. Per Operating Principle #8:

• Age confirmation is collected at signup as a gate — under-16 signup is blocked. What we store is a single boolean (confirmed_at_least_16), not a birthdate and not an age.
• We hold no data about children at all — no names, no birthdates, no ages, not even age brackets. Some outings suit going out with kids, and you can filter for them; that filter runs in memory on your device and nothing about it is sent to us or stored. Until 2026-08-26 this section described collecting categorical age brackets for that filter. Those columns were removed and the filter was rebuilt without them.
• If we discover a user is under 16, we delete the account.

11. International data transfers

Sub-processors are EU-hosted (see § 4). Limited data may transit to/from Switzerland (where Homeward is operated). Switzerland is recognized as having an adequate level of data protection by the European Commission (adequacy decision); transfers between EU and Switzerland are permitted without additional safeguards.

12. Changes to this policy

We may update this policy. Every change is recorded in the changelog at the bottom of this page, with a version number and a date, so you can see exactly what changed and when.

If a change is substantive — anything affecting what we collect, who we share it with, how long we keep it, or how you delete it — we notify users in the app before it takes effect. We do not make substantive changes quietly, and we do not apply template auto-updates: every revision is written and reviewed deliberately.

The current version and last-reviewed date are printed at the top of this page.

13. Contact

• Privacy queries: privacy@gethomeward.app
• Data-subject requests: privacy@gethomeward.app
• Reports of policy violation: report@gethomeward.app
• General contact: hello@gethomeward.app
• Postal address: Nick Arning, Riehenring 174, 4058 Basel, Switzerland (see also the Impressum)

Related documents

• Terms of Service
• Community Guidelines
• Delete your account

How Homeward uses AI, and where, is described in § 5 above and in plain language on the About page inside the app.

Changelog (this document)

Sources

• docs/06-decision-log.md D138 — username+password+recovery-code auth (no email)
• app/src/data/auth.ts — authoritative auth implementation
• app/src/types/db.ts — public.users schema (confirmed no email field; confirmed_at_least_16: boolean)
• wiki/0-doctrine/privacy-consent-design-first.md — Operating Principle #8: three-tier consent + kid PII boundary
• wiki/0-doctrine/location-lite-by-design.md — Operating Principle #11: affirmative "no location collected" claim
• wiki/0-doctrine/social-lite-by-design.md — Operating Principle #17: follow-graph social-lite doctrine
• wiki/0-doctrine/honest-monetization.md — Operating Principle #14: no advertising, no data sale
• wiki/0-doctrine/validation-gated-spending.md — Operating Principle #6: lawyer review deferred to GATE-04