MyHomeBase

Privacy Policy

Last updated: September 12, 2026 · Effective: May 3, 2026

This Privacy Policy explains how HomeSoft, LLC ("HomeSoft," "we," "us," or "our") collects, uses, shares, and protects information when you use MyHomeBase Manager (the "App") on iOS or Android, or when you visit myhomebasemanager.com.

We built MyHomeBase Manager as a personal home-management tool. Our default posture is to collect as little as possible, store what we collect securely, and never sell or share it for advertising. The rest of this document is the long-form version of those commitments.

1. Information we collect

We collect the information you give us directly when you create an account and use the App, plus a small amount of technical information about your device that's automatically read at sign-in (see "Device and technical information" below).

Account information

  • Name (optional, derived from your sign-in provider when available)
  • Email address — collected when you sign in via Amazon Cognito (the App's authentication provider). Cognito issues us a stable user identifier (a "sub" UUID) that we use to scope every subsequent request.

Content you create in the App

You enter or upload the following items, all of which are tied to your account:

  • Properties — name, address (street, city, state, zip, country), property type, year built, square footage, currency, and free-text notes
  • Rooms — name, floor, area, notes
  • Assets — name, category, room association, make, model, serial number, purchase/installation/warranty dates, purchase source, purchase URL, price, linked smart-home app, free-text notes
  • Asset parts — name, part number, purchase information
  • Maintenance logs — title, description, date performed, performer, cost, recurring/frequency settings, vendor link, asset link
  • Vendors — name, company, classification, phone numbers, email, address, service notes, payment methods (handle/identifier only — we never collect card numbers, bank account numbers, or full account credentials)
  • To-Dos — title, description, due date, priority, status, subtasks, estimated cost, asset link
  • Photos and documents — images and PDF/Word/Excel/text files you upload to attach to any of the above

Device and technical information

  • Device platform, OS version, device model and brand, device type (phone/tablet), screen dimensions, and app version — read from your device and recorded once when you sign in, tied to your account. We use this to understand what devices and OS versions the App needs to support and to help debug issues you report. This is a one-time snapshot at sign-in — separate from the ongoing feature-usage analytics described just below.

Feature-usage analytics

  • Which screens you view and which features you use (e.g. "created an asset," "generated a maintenance calendar," "opened the AI Advisor"), each tagged with a timestamp and app version, tied to your account. This is first-party only: it goes to our own backend, never to a third-party analytics company. We use it to understand which parts of the App are actually useful, find where people get stuck, and prioritize what to build next. We do not use it for advertising, we do not sell it, and we do not build individual behavioral profiles for marketing purposes.

Subscription information

  • Subscription status, plan tier, and purchase history — when you subscribe, our payment infrastructure provider (RevenueCat) shares your subscription status (trialing, active, cancelled), which plan you're on, and renewal/expiration dates with us, tied to an account identifier. Purchases themselves are handled entirely by the Apple App Store or Google Play Store — we never see or store your payment card details. See "Third-party services" below for what RevenueCat receives.

Diagnostic information

  • Crash diagnostics — when the App crashes, the platform (Apple or Google) may share standard crash logs with us through TestFlight/Play Console. These are device-level, not user-identifiable.

2. Information we do not collect

We want to be explicit about what we don't do, because most apps do at least one of these:

  • No location tracking. The App does not request or use your device location. Property addresses are typed by you, not derived from GPS.
  • No third-party analytics. We do not run Google Analytics, Mixpanel, Amplitude, Firebase Analytics, Segment, or any equivalent product. We do collect first-party feature-usage analytics on our own infrastructure — see "Feature-usage analytics" in Section 1 — but it never leaves our systems, is never sold, and is never used for advertising.
  • No advertising or ad tracking. The App contains no advertisements, no SDKs from ad networks (no Facebook SDK, no Google Ads, no AdMob, no IDFA collection), and no behavioral advertising.
  • No selling of data. We do not sell, rent, or lease your personal information to anyone, ever, under any circumstances.
  • No third-party tracking. We do not embed pixels, beacons, or any third-party tracking scripts.
  • No microphone or camera access except when you explicitly use them. The App requests camera permission only when you tap Identify by Photo (asset nameplate OCR) or upload a photo. It does not record audio.
  • No contacts upload. When you tap "Import from Contacts" while creating a vendor, the contact you choose is read locally on your device and only the fields you save end up in our backend. We don't upload your contact list.
  • No social-network integrations.
  • No browser fingerprinting.

If we ever change one of these, we'll update this Privacy Policy and announce the change in the App before the change takes effect.

3. How we use your information

We use the data you give us only to operate the App:

  • To authenticate you (verify it's really you signing in)
  • To store and display the properties, rooms, assets, maintenance logs, vendors, to-dos, photos, and documents you create
  • To deliver AI features that you explicitly invoke (Home Health Score, repair cost estimator, PM calendar generation, asset label OCR, AI Advisor chat) — see Section 5 for how third-party AI is handled
  • To respond to support requests you send us
  • To debug crashes from anonymized platform-level reports
  • To understand which features are used and how often, so we can prioritize what to build and fix next (see "Feature-usage analytics" in Section 1)
  • To manage your subscription and unlock the features included in your plan (see "Subscription information" in Section 1)

We do not use your data for marketing, profiling, behavioral advertising, training machine-learning models, building data products, or any purpose other than running the App for you.

4. How and where we store your data

Your account and content are stored in Amazon Web Services (AWS) infrastructure under HomeSoft, LLC's account, in the us-east-1 region (N. Virginia, USA).

  • Encryption at rest. All data in our managed Postgres database (Amazon RDS) and our object storage (Amazon S3) is encrypted at rest using AWS-managed keys (AES-256).
  • Encryption in transit. All connections between the App and our backend use HTTPS / TLS 1.2+. The App pins to the AWS API Gateway certificate.
  • Multi-tenant isolation. Every database query, every photo upload URL, and every API call is scoped to your Cognito user identifier (sub) by Lambda authorizers and presigned-URL paths. One user cannot access another user's data, even if they construct an unauthorized request.
  • Photos and documents are uploaded directly to a private S3 bucket using short-lived presigned URLs. The bucket is not public; the App generates a fresh presigned URL each time it needs to display a thumbnail.
  • Authentication tokens are stored locally on your device in AsyncStorage. On iOS this is the app's sandboxed Documents directory; on Android, the app's private internal storage. Tokens are short-lived (Cognito ID and access tokens expire after one hour) and are refreshed transparently.

We retain your data for as long as your account is active. See Section 6 for deletion.

5. Third-party services

We use a small number of third-party services to operate the App. We do not share your information with anyone outside this list.

Provider Purpose What they receive
Amazon Web Services — Cognito, Lambda, API Gateway, RDS Postgres, S3, Secrets Manager Authentication, application backend, file storage All app data (your account, your content, your photos). AWS acts as our infrastructure provider; data does not leave our AWS account except as described below.
Anthropic (Claude API) Powers the AI features: Home Health Score, repair cost estimator, PM calendar, move-in checklist, seasonal tips, asset label OCR (Claude Vision), and the AI Advisor chat The text and (for asset OCR) the photo of the manufacturer label that you submit when you invoke an AI feature. Per Anthropic's API terms, Anthropic does not use API inputs or outputs to train its models, and inputs are not retained beyond what's needed for transient processing. We do not send your authentication tokens or any data you did not explicitly invoke an AI action against.
Apple App Store / Google Play Store App distribution Your store-account email and platform crash diagnostics. We do not see your store-account information; the platforms do.
Sign-in providers (Google, Apple) — when you choose to use them OAuth-style federated sign-in via Cognito Hosted UI Your name and email address as released by the provider. We never see your provider password.
RevenueCat Subscription and entitlement management — tracks what plan you're on and whether your subscription is active, so the App unlocks the right features An opaque account identifier (not your name or email) plus your subscription/purchase status and history. RevenueCat never receives your payment card details — those stay with Apple/Google. See RevenueCat's privacy policy for how they handle this data.

We do not use any analytics provider, any advertising network, or any data broker.

If we ever add a new third-party service, we will update this list and notify you in the App.

6. Account deletion and data export

You can delete your account and all associated data at any time:

  • In-app: Profile → Sign Out → contact support@myhomebasemanager.com from the email address on file with the subject "Delete my account." We will delete your Cognito user, every database row scoped to your sub, and every S3 object in your folder within 30 days of receiving the request, and confirm by email when complete.
  • Self-service deletion is on the roadmap; until it ships, the email path above is the canonical method.
  • Data export is also available on request to the same address. We will provide a JSON archive of your records and a ZIP of your photos within 30 days.

If you delete the App from your device without deleting your account, your server-side data is preserved so you can sign in again from a new device. To purge it, follow the email path above.

7. Children's privacy (COPPA)

MyHomeBase Manager is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us at support@myhomebasemanager.com and we will delete the account and any associated data promptly.

The App is rated 4+ on the App Store and Everyone on Google Play; the rating reflects content only and is not a statement that the App is targeted at young children.

8. Your rights

Depending on where you live, you may have the following rights regarding your information:

  • Access — see what we have about you
  • Rectification — correct inaccuracies
  • Deletion — have us erase your data
  • Portability — receive your data in a machine-readable format
  • Withdrawal of consent — stop using the App at any time

To exercise any of these rights, email support@myhomebasemanager.com. We respond within 30 days.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, the right to delete, the right to opt out of sale (we do not sell data), and the right to non-discrimination for exercising these rights.

EU/UK residents have additional rights under the GDPR. Our lawful basis for processing your data is contract (operating the App is the contract you agreed to when creating an account) and legitimate interest for diagnostic crash reports.

9. Security

We take the following measures to protect your information:

  • TLS 1.2+ in transit, AES-256 at rest
  • Cognito-issued JWTs as bearer credentials; no static API keys in the App
  • Row-level scoping on every database query
  • Presigned, short-lived URLs for photo and document access
  • Infrastructure managed via Terraform with version-controlled audit history (no manual AWS Console changes)
  • Application Lambdas run with least-privilege IAM roles

No system is ever 100% secure. If we learn of a security incident that affects your data, we will notify you by email within 72 hours and post a notice in the App.

10. International users

MyHomeBase Manager is operated from the United States. If you are accessing the App from outside the United States, your data will be transferred to and processed in the United States. By using the App, you consent to this transfer.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will:

  1. Update the "Last updated" date at the top of this page.
  2. Push an in-app notice on next launch summarizing what changed.
  3. For material changes (new categories of data collected, new third-party services, change to data sharing practices), require you to acknowledge the new policy before continuing to use the App.

12. Contact

If you have questions about this Privacy Policy, want to exercise a right under it, or want to report a privacy concern:

HomeSoft, LLC
Michigan, USA
Email: support@myhomebasemanager.com
Web: myhomebasemanager.com

For privacy-specific inquiries, please put "Privacy" in the subject line so we can route the request promptly.