Privacy

Who is responsible

The data controller for Heim is:

What Heim stores

Only what a household types in, or asks Heim to fetch on its behalf:

• —The household: its name, its house code, and a hashed house password. Passwords and PINs are stored as one-way hashes and cannot be read back, by us or by anyone else.
• —The people in it: name, role, colour, birthday, and whatever a family chooses to add — allergies, clothing sizes, school, doctor, dentist, phone number, emergency contact, free notes.
• —What the household writes down: calendar events, chores and who did them, shopping lists, recipes, meal plans, notes, contacts, maintenance records, renewals, wish lists, pocket-money points, and utility readings and bills.
• —Photographs uploaded to the photo wall, together with their caption and the day they belong to.
• —One recovery email address per household, used only to confirm the address and to send a password reset.
• —A record of the emails Heim has tried to send to that address, and what became of them.

There is no analytics, no advertising, no tracking pixel and no third-party script anywhere in Heim. Nothing about a household is sold, shared for marketing, or used to train anything.

Connected calendars — Google and Microsoft

A household may connect a Google Calendar or a Microsoft Outlook calendar. This is optional, off by default, and can be disconnected at any time.

What Heim reads, and why

• —The events in the calendars a household chooses to connect — title, time, place and description — so that they can be shown on the household's own calendar screens alongside what the family has written down. Nothing else about a Google or Microsoft account is read.
• —The list of calendars on the account, so the household can choose which of them to connect.
• —The email address of the signed-in account, shown on the household's settings screen so that two connected accounts can be told apart.
• —If, and only if, a household switches a connection to “both ways”, Heim also creates and updates events in that calendar — the ones the family made in Heim. Heim never edits or deletes an event it did not create.

How much, and for how long

Heim keeps a copy of the events in a window running from one month back to thirteen months ahead. Older and further-out events are not copied. Disconnecting a calendar deletes every event Heim imported from it, immediately.

Limited Use

Heim's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms: calendar data is used only to show a household its own calendar. It is not transferred to anyone, not used for advertising, not read by a human, and not used to train any model.

Taking it back

A household can disconnect a calendar from the settings screen in Heim, which deletes the stored sign-in and the imported events. Access can also be withdrawn directly from the Google account permissions page or the Microsoft account privacy page, which stops Heim reaching the calendar at all.

Published calendars

A household can create a private web address that publishes its own events as a calendar subscription, so they appear on family phones. Anyone who has that address can read those events, which is why it is long and random and can be revoked at any time from the same screen. Only events made inside Heim are published this way — never events imported from a connected calendar.

Why we are allowed to keep it

Under the GDPR the legal basis is contract (Article 6(1)(b)): a household asks Heim to keep these things for them, and Heim cannot do the job without them. There is no other purpose. Nothing is processed on the basis of legitimate interest, and nothing is done with the data that a family has not asked for.

Children

Heim is built for whole households and children use it directly — that is the point of it. Children's information is entered by the adults who manage the house, on their own children's behalf, and it is visible only inside that household. An adult who manages the house can see, correct or remove any of it at any time from the people screen.

Where it is kept, and who else touches it

Heim runs on one server and uses as few outside services as it can. These are all of them:

• —Hetzner Online GmbH — the server and its database, physically in Helsinki, Finland, inside the European Economic Area. Everything except photographs lives here.
• —Cloudflare — storage for photographs, in Cloudflare's European jurisdiction, which keeps the files themselves in the EEA. Cloudflare is a United States company, so the European Commission's standard contractual clauses cover the arrangement.
• —Resend — sending the confirmation and password-reset emails, and reporting whether they arrived. Only the recovery address and the message itself are involved.
• —Google and Microsoft — only for a household that has connected a calendar, and only that household's calendar.

The database is backed up every night. Copies kept on the server are deleted after 14 days; one copy is also stored off-site, so that a failed server does not lose a family's year. If a household asks to be deleted, it goes from the live database at once and from the off-site copies within 30 days.

How long

• —Household data is kept for as long as the household exists.
• —Password-reset and address-confirmation links expire within hours of being sent.
• —The record of emails sent to a household's recovery address is kept for as long as the household exists, and is deleted with it. It holds no message content beyond the subject and what became of it.
• —Imported calendar events are deleted the moment a calendar is disconnected.
• —Backups on the server are deleted after 14 days.

Cookies

Three, all of them necessary, none of them tracking anything:

• —A signed sign-in cookie, so a household stays signed in. It lasts 90 days and can be ended everywhere at once from the settings screen.
• —A language cookie, remembering which of the two languages this browser reads Heim in.
• —A cookie remembering the house code on a device, so the sign-in page does not have to ask twice.

Your rights

Under the GDPR you may ask for a copy of what is held about you, have it corrected, have it deleted, object to it being processed, or ask for it in a portable form. Most of this is faster to do inside Heim itself, where an adult who manages the house can edit or remove anything; for the rest, write to the address above and we will answer within 30 days.

If you are not satisfied, you may complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or the supervisory authority in your own country.

If something goes wrong

If household data is exposed in a way that is likely to be a risk to anyone, we will tell the affected households and the Data Protection Authority within 72 hours of finding out.

Changes to this page

If this policy changes in a way that affects what happens to a household's data, we will say so on the sign-in screen before the change takes effect. The date at the top always says when it was last edited.