HomeBase
Privacy Policy
Last updated: 7 November 2026
In short
- We collect only what HomeBase needs to work: your account, your profile and what you add to your households.
- The people in your household see what you share with that household. Nobody else does.
- No ads, no tracking, no analytics, and we never sell your data.
- You can delete your account and its data in the app at any time.
1. Who is responsible for your data
HomeBase is developed and operated by Aron Papp, Hungary (“we”, “us”). We are the data controller for the personal data processed through the HomeBase app and this website.
Contact for any privacy question or request: support@paron.hu.
2. What we collect
Your account
- You sign in with Apple or with Google. HomeBase has no passwords of its own.
- Sign in with Apple: a user identifier issued by Apple and the email address Apple shares with us. If you choose “Hide My Email”, we receive a private relay address and never see your real one. Apple shares your name only on your first sign-in, and only if you allow it.
- Sign in with Google: your Google account identifier, email address and name, and the link to your Google profile picture, as Google provides them when you sign in. HomeBase does not show your Google picture or ask Google for any other data.
Your profile
- Your first and last name, filled in from Apple or Google if they share it, and a nickname if you set one. Members of your households see your nickname, or your full name if you haven’t set one.
- A profile photo, if you add one.
What you add to a household
- Households: name, icon or photo, members and their roles, and invitation codes. Anyone who enters a valid invitation code sees the household’s name and icon, how many members it has and the owner’s name before they join.
- Tasks: titles, colours, assignees, deadlines, repeats, completion history, and task suggestions learned from titles you add often.
- Shopping: list items, quantities, units, notes, the product catalogue and past shopping trips.
- Warranty: products (such as name, brand, type, model, serial number, retailer, price, purchase date, notes and a photo), warranties, and the documents you attach, such as receipts, warranty cards and manuals, as photos or PDFs.
- Activity: a record of who did what in the household (for example, “Anna completed Take out the bins”), shown on the Home screen.
Technical data
- Our server records technical logs of requests, which can include your IP address, the time and the type of request. We use them only to keep the service running and secure.
- A public encryption key for your account, used to share a household’s AI API key with your devices (see section 6), and your AI data sharing choices for each provider.
- Some settings stay only on your device and are never sent to us, for example whether you have seen the introduction, which household you last opened and the counter used to ask for an App Store rating.
Camera, microphone and photos
HomeBase uses the camera only when you choose to: to scan an invitation QR code, to scan a document or, with AI features, to photograph a product. A QR code is read on your device and the image is not stored. Photos and scans you attach are uploaded to your household. A product photo taken to add an item to the shopping list is sent only to the AI provider and is not stored by us.
The microphone is used only while you speak a task with the AI features. Speech is turned into text on your device; the recording is never stored or sent.
Optional AI features
A household’s owner can turn on AI features by adding the household’s own API key from OpenAI or Google (Gemini). They let you add or complete tasks by voice, add a product to the shopping list from a photo, and fill in a warranty from a receipt or invoice.
- Nothing is sent until you personally allow it in the app. Each member decides for themselves, per provider, and can withdraw at any time in Profile → AI data sharing.
- Your voice is turned into text on your device; the recording is never sent or stored. Only the text, today’s date, the names of your household’s members and, when you mark a task as done, the open tasks with their assignees and deadlines are sent, so the provider knows who and what you mean.
- Product photos and scanned documents are sent only when you choose to have them read.
- This data goes straight from your device to the provider. It does not pass through our server, and we do not keep it. The provider processes it under its own terms and privacy policy (OpenAI, Google), may keep it for a limited time, and, depending on the household’s plan with that provider, may use it to improve its services.
- Requests are billed to the household’s own account with the provider.
What we do not collect
We do not use advertising, tracking or analytics tools, and we do not collect your location, contacts or browsing activity. HomeBase does not track you across other companies’ apps or websites.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating your account and signing you in | Account data | Performance of a contract, Art. 6(1)(b) |
| Running the app: sharing tasks, lists, warranties and activity with your household | Profile and household content | Performance of a contract, Art. 6(1)(b) |
| Keeping the service secure and preventing abuse, such as limiting invitation-code guessing | Technical logs, account data | Legitimate interest, Art. 6(1)(f) |
| Optional AI features: voice tasks, product photos and document reading | What you say (as text), member names, task titles, photos and scans you choose | Consent, Art. 6(1)(a), which you can withdraw at any time |
| Answering your messages | Your email and what you write | Legitimate interest, Art. 6(1)(f) |
4. Who can see your data
- Your household. Everything you add to a household is visible to its members, and your name and profile photo are visible to the people you share a household with. When someone joins, they see the household’s existing content.
- Our server. We run HomeBase’s backend (database, file storage and sign-in) on a server we operate ourselves in the European Union. We don’t send you emails.
- Apple. If you use Sign in with Apple, Apple processes your sign-in under its own privacy policy. When you delete your account, we ask Apple to revoke HomeBase’s access.
- Google. If you use Sign in with Google, Google processes your sign-in under its own privacy policy. When you delete your account, HomeBase asks Google to remove its access to your Google Account; you can also remove it at myaccount.google.com.
- OpenAI or Google, only if your household uses AI features and you have allowed it, as described in section 2. They act under their own terms with the household’s own account.
- Authorities, only if the law requires us to.
We do not sell, rent or share your personal data for advertising.
5. How long we keep it
- Your account and profile are kept until you delete your account.
- Household content is kept as long as the household exists. Deleting a household deletes its content and files.
- When you delete your account, your account, profile and photo are deleted. Households you were the only member of are deleted with everything in them. A household you shared with others is handed to another member, and what you added stays part of that household, without your name.
- Technical logs are kept only as long as needed for operation and security. Deleted data may remain in backups for a limited period until those backups are overwritten.
6. How we protect it
- All traffic between the app and our server is encrypted in transit.
- Access rules on the server check for every request that you are a member of the household whose data you ask for.
- Files are kept in private storage and are only available to members of the household they belong to.
- Your sign-in session is stored in the iOS Keychain on your device.
- A household’s AI API key is encrypted on the owner’s device before it is saved. Our server only ever stores it encrypted, and only household members’ devices can unlock it. The private key that unlocks it stays in your iCloud Keychain and never reaches our server. When someone leaves, the owner’s device re-encrypts it.
7. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy of it;
- correct inaccurate data. You can edit your name, nickname and photo in the app at any time;
- have your data deleted. Use Profile → Delete account in the app, or write to us;
- restrict or object to processing based on legitimate interest;
- receive your data in a portable format.
To exercise these rights, write to support@paron.hu. We answer within one month.
You can also lodge a complaint with the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11., naih.hu, or with the authority in the EU country where you live.
8. Children
HomeBase is not directed at children under 16, and they should not create an account without a parent’s or guardian’s consent.
9. This website
This website does not use cookies or analytics. Your language choice is saved in your browser’s local storage and never leaves your device. Our web server keeps standard access logs, including IP addresses, for security.
10. Changes to this policy
If HomeBase starts processing data in a new way, for example to add a feature that sends data to another service, we will update this policy first and tell you in the app before it applies to you. The date at the top shows when it last changed.