Privacy policy
DRAFT, not yet in effect. Written 2026-10-19 to match what Hemhold does today. A lawyer reviews it before launch. Anything marked [not yet] is a commitment that isn't built. It ships before launch, or the line comes out of this policy.
Hemhold keeps your family's week in one place. To do that it has to read what you send it: the coach's email, the school calendar, the flyer. This page says plainly what we keep, who can see it, and what we will never do with it.
The short version
- We read what you send us so we can organize your week. That is the only thing we use it for.
- We never sell your data, show you ads, or use your family's information to train AI.
- We, the people running Hemhold, don't look at what's inside your family's account. We see that your account works. We don't see what's in it, unless you choose to share something with support, and when we do look, you can see that we did.
- Your data is stored on servers we can technically access. We don't pretend otherwise; see "What we can and can't see."
What we keep
| What | Why | Where it comes from |
|---|---|---|
| The email addresses you sign in with | To send your sign-in links and codes | You |
| The devices you're signed in on: the browser and device in plain words (like "Safari on iPhone") and the day each was last used | So you can see your devices on the Family tab and sign any of them out | Your browser |
| If you set up a passkey: its public key, and when it was added and last used | To check it's you when you sign in with it | Your device |
| Your household's name and the people in it (names, parent or kid, an optional age, a color) | To show whose day is whose | You |
| What you forward or send in: emails, calendar links, photos of flyers | To turn them into your family's schedule, to-dos and reminders | You |
| What Hemhold makes from it: events, to-dos, "waiting on" items, dinner plans, notes | That's the product | Hemhold, from what you sent |
| A record of each AI request: when, which model, how much it cost, whether it worked | To keep costs in check. It contains no content from your account. | Hemhold |
| Basic service logs: sign-ins, errors, deliveries | To keep the service running. [not yet] These logs will contain no message content. | Hemhold |
If you ask for an invite. The invite list holds only the email address you give us and when you asked, and we use it only to write back to you about an invite.
About children. Hemhold stores information about children that a parent enters or forwards: a name, an optional age, and their schedule. Children don't get their own accounts and don't give us information directly.
Who can see it
Your household. Everyone who signs in to your household sees your household's information, and no one else's.
The people running Hemhold. We can see what we need to run the service:
- your account details
- how many people are in your household
- whether forwarded emails arrived or were turned away
- errors
- what your account costs us to run
We do not browse your family's schedule, to-dos, messages or notes.
Support, only when you ask. [not yet] If you need help, you'll be able to share one specific email or item with us, or open a short access window that closes by itself within 24 hours. Every time support looks, it's recorded, and you can see that record in your account.
Companies that help us run Hemhold. They process data only to provide their part of the service:
| Company | What they do | What they handle |
|---|---|---|
| Amazon Web Services | Runs the server Hemhold lives on (Virginia, USA) | Everything we store |
| Cloudflare | Connects you to Hemhold securely, and receives the email you forward to your Hemhold address | Traffic to and from Hemhold, and forwarded email in transit |
| Resend | Sends the email Hemhold sends you: sign-in links, the "Got it" reply when you forward something, and reminders if you turn them on | Your email address and that one message (for a reply or a reminder, the titles, days and times it mentions) |
| Anthropic | The AI that reads what you send and organizes it | The content needed for each request. We use their commercial API, under terms that don't let them train their models on it. [verify the current terms before launch] |
Nobody else. We don't sell, rent or share your information with advertisers or data brokers. If the law requires us to hand something over, we'll tell you unless the law forbids it.
What we can and can't see
Our servers hold your data in a form the AI can read, because reading it is the whole point. That means the people who run the servers could open it. We don't rely on "we can't" claims. Instead:
- Hemhold is built so that day-to-day running doesn't involve looking at your content. The owner's dashboard shows accounts and costs, never a family's schedule.
- [not yet] Every support access is logged where you can see it.
- If this ever changes, we'll update this policy and tell you before it takes effect.
How long we keep it
- While your account is open, we keep your household's information.
- Backups are taken nightly and before every update, and each is kept for 14 days.
- [not yet] Deleting your household will remove it from our servers right away, and from backups within 14 days as they age out.
Security
- You sign in with a one-time link or the one-time code in the same email, or with a passkey (Face ID, Touch ID or a fingerprint) if you set one up. There are no passwords to leak.
- A passkey's private key stays on your device (or in your phone's password manager, if it syncs your passkeys). Hemhold stores only the public key, which can check a sign-in but can't be used to make one.
- Once you're signed in, your device keeps a sign-in cookie, so you stay signed in. It expires after 90 days without using Hemhold on that device, and a year after you signed in there at most. The Family tab lists your devices and passkeys, and you can remove any of them.
- Every page with your family's information requires you to be signed in to that household.
- Hemhold's server accepts no connections from the internet except through Cloudflare's secure tunnel, plus key-only access for maintenance.
- If we ever learn your information was exposed, we'll tell you promptly.
Your choices
- See and change your household's people, name and forwarding address on the Family tab.
- [not yet] Delete your whole household from the app.
- Ask us anything about your data: [contact address before launch].
Changes
When this policy changes, we'll update the date below. If a change affects what we do with your information, we'll tell you in the app before it takes effect.
Last updated: 2026-10-20 (draft).