Privacy Policy
v0.4 · Effective 27 July 2026 · pending one professional review pass
The short version
We are House Brownie, a household-inventory app. Here is the whole privacy story in a box; the detail is below.
- We do not sell your data, and we do not show ads. No ad pixels, no trackers, no data brokers.
- Analytics are strictly opt-in. Nothing is measured until you say yes. If you never opt in, no analytics ever run — the switch to turn them on lives on your device, and until you flip it, no analytics network call is made at all.
- Your household inventory is yours. It is isolated from every other household at the database level (row-level security keyed to your household). We do not read it to train anything.
- Voice is powered by AI (OpenAI). If you use voice or the AI assists, your audio is sent to OpenAI to turn into text and is then discarded. Voice transcripts auto-delete after 90 days. If you never turn on AI, no audio and no AI processing happens.
- You can export everything and delete everything, yourself, at any time, from Settings.
- We are a US-registered company operated from Portugal — EU data-protection law applies to us directly, and we use trusted US and EU vendors to run the service. We list every one of them below.
If you only read one thing: we collect what we need to run a household-inventory app you asked us to run, we keep it only as long as we need it, we never sell it, and you can take it or delete it whenever you want.
1. Who we are (the controller)
House Brownie is operated by Fresh Eyes Studio LLC, a Wyoming limited liability company ("House Brownie", "we", "us").
- Postal / registered address: 30 North Gould St, Ste N, Sheridan, WY 82801, United States
- Privacy contact / how to reach us: hello@housebrownie.com
For personal data we handle about you as a House Brownie user, we are the data controller — we decide why and how it is processed. (Your payment is handled by Paddle as the seller of record; for the payment transaction itself, Paddle is the controller — see §4/§6 and the Terms of Service.)
Where we are established: House Brownie is operated from Portugal, where its sole operator permanently resides — for GDPR purposes we are an EU-established controller, and our lead supervisory authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD, cnpd.pt). Our Portuguese legal notice (imprint), including registration details, is published at /imprint. (Because we are EU-established, no EU Article 27 representative is required.)
United Kingdom — not offered at launch
House Brownie is currently offered to residents of the United States and the European Union only. We do not offer or market the Service in the United Kingdom, and no UK representative is appointed.
2. What we collect, why, and our legal basis
We collect only what the app needs. We do not ask for your date of birth, and House Brownie is a general-audience product not directed to children (see §11).
| What | Examples | Why (purpose) | Legal basis (GDPR Art 6) |
|---|---|---|---|
| Account identity | Your email, name, and login, managed through our auth provider Clerk | Create and secure your account; sign you in; send account email | Contract (Art 6(1)(b)) — we can't give you an account without it |
| Household data you enter | Your inventory items, locations/rooms, shopping lists, tasks, store names, notes | This is the product — it answers "what do we have / where / what to buy / what to do" | Contract (Art 6(1)(b)) |
| Membership & roles | Who is in your household, owner vs. member | Run a shared household; enforce isolation between households | Contract (Art 6(1)(b)) |
| Voice & AI content (only if you use AI) | Audio you record, the text it becomes, the structured actions parsed from it, translations | Turn speech into inventory actions; translate notes; estimate item freshness | Contract (Art 6(1)(b)) for the feature you invoked |
| Billing metadata | Plan, credit balance, renewal/refund status — not your card number | Give you the plan/credits you paid for; honor refunds | Contract (Art 6(1)(b)) + legal obligation (tax/records) |
| Your own AI key (BYOK) (optional) | An OpenAI API key you choose to store | Let you run AI on your own key at no platform cost | Contract / consent — you opt in by entering it |
| Product analytics (opt-in only) | Feature-usage events via PostHog | Understand which features are used, to improve the app | Consent (Art 6(1)(a)) — off until you say yes; withdraw anytime |
| Security & operational logs | Error reports (secret-scrubbed), rate-limit counters, audit of admin actions, cost/usage metering | Keep the service secure, working, and abuse-free; bill AI usage accurately | Legitimate interests (Art 6(1)(f)) — running a secure, reliable service |
Card data: we never see or store your full payment-card details. Checkout is handled by Paddle (our merchant of record); your card data goes to Paddle and its payment processors, not to us.
No special-category data, no profiling. We do not intentionally collect sensitive data (health, religion, etc.), and we do not do automated decision-making that produces legal or similarly significant effects about you (Art 22). Voice-to-action is a convenience feature that structures what you dictated; it is not emotion recognition or biometric categorization.
Do you have to provide it? The account and household data are required to use the app — without them there is no service. Voice/AI, BYOK, and analytics are all optional; declining them just means those features are off.
3. AI features and OpenAI (plain disclosure)
House Brownie's voice capture, translation, and the "freshness" estimate are AI-powered, using OpenAI. Here is exactly what happens:
- Voice: when you record, your audio is sent to OpenAI to transcribe (speech→text), then the text is parsed into structured inventory actions. We do not keep your audio — OpenAI's transcription endpoint retains it for zero time by default, and we do not store it either.
- Transcripts: the text transcript is stored to give your undo and activity history its context, and is automatically deleted after 90 days. The structured actions it produced (e.g. "milk → Low") stay, because they are your inventory history. You can also delete your own voice history immediately from Settings.
- Translation & freshness: short pieces of text (a note, an item name) are sent to OpenAI to translate or to estimate a typical "use-within" window.
- We send OpenAI as little as the feature needs, tell OpenAI not to store chat/response content for training, and OpenAI does not train on API data by default.
- If you do not use AI, none of this happens. AI runs only if you have paid for an AI/credit plan or supplied your own OpenAI key (BYOK). Otherwise the platform makes no OpenAI call on your behalf and those features fall back to manual entry.
If you use BYOK (your own OpenAI key), we encrypt it at rest with AWS KMS envelope encryption, bind it cryptographically to your household, and never log it. See §7.
4. Who we share it with (processors / sub-processors)
We do not sell your personal data and we do not share it for cross-context behavioral advertising. We use the following vendors to run the service. Each processes data only on our instructions under a data-processing agreement, and only for the purpose listed.
| Sub-processor | Role | What it processes | Location |
|---|---|---|---|
| Clerk | Authentication & household/organization management | Account identity, membership | US |
| Neon | Managed Postgres database | All household data, at rest (row-level isolated per household) | US (AWS us-east-1) |
| Vercel | Application hosting / serverless compute | Data in transit while serving requests | US / global edge |
| OpenAI | Voice transcription, parsing, translation, freshness (AI features only) | Audio (transient), text you submit to AI | US |
| Paddle | Merchant of record / billing | Purchase, billing, and refund data; card data (we don't see it) | UK/EU + US |
| AWS (KMS) | Encryption-key management for BYOK secrets | Encrypted key material / key operations | US (us-east-1) |
| PostHog | Product analytics and error tracking | Opt-in usage events; secret-scrubbed error reports | US (us.i.posthog.com) |
| Upstash | Rate limiting (Redis) | Ephemeral rate-limit counters keyed to request identity | US / [region] |
| Resend | Transactional email | Your email address + the message (receipts, resets, notices) | US |
| Cloudflare | DNS, edge/CDN, bot protection (Turnstile) | Network-level request data | US / global edge |
This is our current sub-processor list as of 2026-07-20. We keep it accurate; when it changes we update this notice. (We do not use Sentry, and we do not store your photos or files in object storage — there is no such feature.)
We may also disclose data if legally required (valid legal process), or to protect the rights, safety, or security of House Brownie, our users, or the public. If we are ever party to a merger or acquisition, we will require the successor to honor this policy and will notify you.
4.1 Our data promise — and its canary
Beyond the legal minimum, this is the promise the product is built on. Your data is yours. Your usage is yours. Concretely, as of the affirmation date below:
- We have never sold, rented, or traded user data. Not to advertisers, not to data brokers, not as an "aggregated and anonymized" dataset. There is no revenue line that involves your data — you pay for the product, and that's the whole business model.
- We have never used your household's data to train AI models — ours or anyone else's — and our AI sub-processing is configured so vendors don't either (§3).
- We run no advertising and no cross-context tracking. No ad pixels, no profiling, and nothing non-essential loads before you opt in (§9). Opt-in analytics exists to fix the product, never to monetize you.
- We have never received a government or law-enforcement demand for user data, including any demand we would be prohibited from telling you about.
The canary: we re-affirm all four statements, with a fresh date, in every revision of this policy. Last affirmed: 26 July 2026. If this section is ever removed, or its date is left to go stale while the rest of the policy keeps updating, treat that as the warning it is.
5. International data transfers
We are an EU-established controller (Portugal). Several of our sub-processors (§4) are based in the United States, so personal data we control is transferred to the US — these are restricted transfers under GDPR Chapter V, and for each one we rely on:
- the EU–US Data Privacy Framework (DPF) where the processor is certified under it (current "Active" status verifiable at dataprivacyframework.gov), and/or
- Standard Contractual Clauses (2021) in the processor's data-processing agreement, where a processor is not DPF-certified.
We keep the signed DPAs / SCCs and a short transfer-impact assessment on file. You can ask us which mechanism applies to a given sub-processor (§8).
6. How long we keep it (retention)
| Data | Retention |
|---|---|
| Account & household data | For as long as your household exists. Deleted when you delete the household (§8). |
| Voice transcripts (text) | Auto-deleted after 90 days by a nightly job. Structured actions derived from them are kept as inventory history. |
| Voice audio | Not retained — sent to OpenAI to transcribe, then discarded. |
| Operational/audit logs | Admin-action and security audit logs are kept ~90 days; activity logs are slimmed/aged over 12–24 months. |
| Analytics events (if opted in) | Retained by PostHog per our configured retention; deleted/stopped when you opt out. |
| Billing records | Held by Paddle and by us for the period required by tax/accounting law. |
When your household is deleted, we purge the data we control across our tables. Some records that we are legally required to retain (e.g. transaction/tax records held by Paddle) persist for their statutory period.
7. How we protect it
- Tenant isolation: every household's data is separated at the database layer by row-level security keyed to your household — the boundary is enforced by the database, not just app code.
- Encryption in transit: all traffic uses TLS.
- BYOK secrets: if you store your own OpenAI key, it is envelope-encrypted with AWS KMS (AES-256-GCM under a KMS-managed master key), cryptographically bound to your household so a stored key can't be replayed against another household, and never written to logs.
- Least privilege & audit: operator/admin access is restricted, requires multi-factor authentication, and every administrative action is logged to an immutable audit trail.
- Breach response: if a personal-data breach occurs that is likely to be a risk to you, we will notify the relevant supervisory authority without undue delay (and within 72 hours where required), and notify you where the risk is high.
No system is perfectly secure, but we design for isolation-by-default and keep the attack surface small (for example, we don't retain audio and don't run third-party trackers).
8. Your rights and how to use them
Wherever you live, you can:
- Export your data — download everything your household owns as a single JSON file, yourself, from Settings → Danger zone → Download export (or /api/export).
- Delete your data — the household owner can delete the entire household from Settings → Danger zone → Delete this household. This cancels any active billing subscription, then purges the household's data from our database and removes the organization. It cannot be undone — export first.
- Delete voice history now — remove your stored transcripts immediately, without waiting for the 90-day auto-delete.
- Turn analytics off (or on) — anytime, from Settings; opting out stops further analytics.
If you are in the EU (or another region granting these rights), you also have the rights to: access your data, rectify inaccurate data, erase it, restrict or object to processing, data portability, and to withdraw consent at any time (for anything based on consent, e.g. analytics or BYOK) without affecting prior processing.
How to exercise them: most are self-service (above). For anything else, contact us at hello@housebrownie.com. We respond to requests within one month (extendable by two further months for complex or numerous requests — we'll tell you within the first month if we need the extension and why). We don't charge for this unless a request is manifestly unfounded or excessive.
Right to complain: if you think we've mishandled your data, you can lodge a complaint with a data protection supervisory authority. Our lead supervisory authority is Portugal's CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt); in the EU you may equally complain to the authority in your own country of residence or work. We'd appreciate the chance to fix it first, but it's your right either way.
9. Cookies and similar technologies
House Brownie is deliberately light here:
- Strictly necessary only, by default: we use what's needed to sign you in and keep your session secure (authentication/session tokens, security tokens). These don't require consent.
- Your consent choice for analytics is stored as a single flag on your device (localStorage) — that flag itself is exempt (it only records your choice).
- Analytics (PostHog) load only after you opt in. Until then, no analytics code initializes and no analytics request is sent. This is a real block, not a cosmetic banner.
- No advertising cookies, no third-party trackers, no session-replay.
10. Changes to this policy
We'll update this notice when our practices or sub-processors change. When we make a material change, we'll update the version and effective date at the top and, where appropriate, notify you (e.g. by email or in-app). Continued use after an update means the current version applies.
11. Children
House Brownie is a general-audience product not directed to children under 13 (or the equivalent age in your country). We don't knowingly collect data from children, and we don't ask for age or birthdate. If you believe a child has given us personal data, contact us and we will delete it.
Attribution & sources
This policy was hand-drafted to House Brownie's actual practices. External policies were used for structure and coverage checklists only — no third-party wording was copied — so no share-alike or other license obligation attaches to this document. Sources consulted:
- 37signals / Basecamp open-source policies — CC BY 4.0 — https://github.com/basecamp/policies (now at 37signals.com/policies). Informed: the plain-language "short version" box, the layered summary-then-detail structure, and the sub-processor-table pattern. Attribution per CC BY 4.0.
- Automattic "Legalmattic" — CC BY-SA 4.0 — https://github.com/Automattic/legalmattic. Consulted for structure/coverage of the rights and cookies sections. Share-alike note: CC BY-SA attaches only if you adapt their text; we did not copy their expression (every clause is written from our own facts), so this document is not a derivative work and is not encumbered by share-alike. If any Legalmattic wording is later pasted in, this document (or that portion) must then be released under CC BY-SA 4.0 — avoid that.
- GDPR Articles 13/14 (gdpr-info.eu) and the ICO "right to be informed" guidance — used as the completeness checklist for a direct-collection privacy notice.
- docs/COMPLIANCE-CHECKLIST.md (internal, 2026-07-20; PT-establishment banner 2026-07-22) — the US + EU/PT/UK research foundation (PT-established controller, CNPD lead SA, DPF+SCC transfers, opt-in analytics, 90-day TTL story).
Every factual claim here was checked against the House Brownie codebase on 2026-07-20 (export route, app.purge_org/Danger Zone, 90-day transcript TTL cron, opt-in PostHog consent gate, AWS-KMS BYOK envelope, the AI-cost firewall). If the code changes, this notice must change with it.