📋 Quick Overview
Your privacy matters to us. Here's what you need to know in plain English:
- What we collect: Your account info, home data (items, expenses, maintenance), receipts, photos, and documents you upload, and approximate location based on your IP address.
- How we use it: To run the app, send you reminders, sync with your calendar (if you choose), and power AI features like maintenance tips, receipt and label scanning, and expense outlooks.
- Who we share with: Only the service providers listed in Section 6 that we need to run the app. We never sell your data.
- Your control: You can view, edit, delete, or export your data anytime. Turn off notifications whenever you want.
- Security & reliability: We use industry-standard encryption, secure passwords, and isolated household data. Our error monitoring and analytics never receive your email address.
The detailed policy below covers everything in legal terms, but this is the gist of it.
1. Introduction
Welcome to Well Kept. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our home management application.
2. Information We Collect
We collect the following types of information:
- Account Information: Email address, username, securely hashed password, passkey public keys, and the name and account identifier shared by Google, Microsoft, or Apple if you sign in with them.
- Home Data: Information about your home items, maintenance schedules, expenses, contractors, and renovation projects.
- Photos, Documents, and Forwarded Emails: Receipt images, item label photos, contractor estimates, and emails you forward to our receipts address.
- Support Communications: Messages and contact details you send through our support and contact forms.
- Calendar Data: Appointments, maintenance schedules, and reminders you create within the app.
- Financial Information: Expense records, receipts, monthly bills, and Venmo usernames for payment facilitation. We do not store or process bank account numbers or credit card details directly.
- Third-Party Integration Data: Data from Google Calendar and other services you choose to connect.
- Approximate Location: City, state, and country estimated from your IP address. We use this to tailor address suggestions and contractor search.
- Realtor Partner Information: For realtor partners: name, brokerage, license details, and the IP address and approximate location used when generating gift codes.
- Usage Data: Internet Protocol (IP) address, browser type and version, device type, operating system, pages visited, and a random login security reference used for administrator audit history.
3. Information About Other People
Some information we hold is about people who gave it to us indirectly:
- Gift recipients: When a realtor partner gives a client a Well Kept subscription, the realtor gives us the client's name, email address, and property address. We use this to email the client their gift code. The realtor can see whether the code has been sent, redeemed, or has expired, but cannot see anything inside the client's household account.
- Household invitations: When you invite someone to your household, we use their email address to send the invitation.
- Contacts you save: Contractor and service provider details you add are stored in your household and used only to show them to you.
Only provide someone else's information if you have a reason to share it with us. If we hold your information because someone else provided it, you can ask us to delete it by emailing [email protected].
4. How We Use Your Information
We use your information to:
- Provide and maintain the Well Kept application.
- Process and store your home management data securely.
- Send you notifications and reminders based on your preferences.
- Sync data with third-party services you authorize (Google Calendar, etc.).
- Generate AI-powered maintenance tips, scan item labels, receipts, and estimates, and write weekly update summaries using Google Gemini.
- Generate AI expense outlooks using a model accessed through OpenRouter.
- Process receipt uploads, forwarded receipt emails, and expense tracking.
- Tailor address suggestions and contractor search to your approximate location.
- Check that realtor partners issue gift codes in states where they are licensed.
- Respond to support requests.
- Facilitate Venmo payment links for expense settlements.
- Send monthly reconciliation emails and expense summaries.
- Understand how the app is used, and improve our services and develop new features.
- Ensure security and prevent fraud.
5. Data Storage and Security
We take data security seriously:
- Your data is stored securely using Supabase PostgreSQL database with enterprise-grade security.
- Passwords are encrypted using bcrypt hashing and never stored in plain text.
- Receipt images and documents are stored separately in Vercel Blob Storage with CDN delivery.
- All API communications use secure HTTPS protocols.
- Authentication uses industry-standard JWT tokens with automatic refresh.
- Row Level Security (RLS) ensures household data isolation.
- Approximate location is calculated on our own servers using a locally stored MaxMind GeoLite2 database, so your IP address is not sent to a third party for this.
- Regular automated database backups protect your data.
6. Service Providers and Third-Party Services
We use the service providers below to run Well Kept. They handle personal data only to provide their service to us, and we share only what each one needs. We require these providers, through our agreements with them, to protect your data at least as well as this policy describes. They may not use it for their own purposes, such as advertising or training AI models. Some services, like sign-in providers and calendar integrations, are ones you choose to connect. Their own privacy policies also cover data you give them directly.
| Type of provider | Providers | What they receive | Why | Retention |
|---|---|---|---|---|
| Hosting and storage | Providers: Supabase, Vercel | What they receive: Account, household, and home data; uploaded receipts and documents; request logs. | Why: Running the app and storing your data. | Retention: Until you delete it or your account. Request logs are kept for up to 30 days. |
| Email and support | Providers: Resend, Freshdesk | What they receive: Email address, email content, receipts you forward to us, and support messages. | Why: Sending notifications and answering support requests. | Retention: Email content for 30 days. Support conversations while needed to help you and for our records. |
| Payments | Providers: Stripe, RevenueCat | What they receive: Email, customer ID, and purchase and subscription details. We never receive your card number. | Why: Processing and verifying subscriptions. | Retention: Transaction records as financial regulations require (typically 7 years). |
| AI features | Providers: Google Gemini, OpenRouter (sent on to OpenAI), Cloudflare AI Gateway | What they receive: Content you send to AI features, plus expense history and a broad climate region for the expense outlook. | Why: Label and receipt scanning, maintenance tips, weekly summaries, and the expense outlook. | Retention: Kept for a limited period for abuse and usage monitoring, under each provider's API terms. |
| Security and fraud prevention | Providers: Cloudflare Turnstile, Have I Been Pwned, ProxyCheck.io and IPHub | What they receive: Browser and device signals, a partial hash of new passwords, and realtor partners' IP addresses. | Why: Blocking bots, warning about breached passwords, and checking where realtors are licensed. | Retention: Used for the check itself; any logs are kept under each provider's policy. |
| Error monitoring | Providers: Sentry | What they receive: Error reports, device details, masked session recordings, and a scrambled user ID. | Why: Finding and fixing bugs. | Retention: 90 days. |
| Analytics | Providers: Umami | What they receive: Pages visited, referring site, device type, country, and account ID. No cookies. | Why: Understanding how the app is used so we can improve it. | Retention: While needed for product decisions. |
| Features you choose to use | Providers: Sign in with Google, Microsoft, or Apple, Google Calendar and Outlook, Google Places, Venmo, Apple Push Notification service | What they receive: Sign-in details, events you choose to sync, contractor searches, your Venmo username, and your device push token. | Why: Running the features you turn on. | Retention: Until you disconnect the feature, turn off notifications, or delete your account. |
| Content your device loads directly | Providers: Google Fonts, Logo.dev, OpenStreetMap Nominatim | What they receive: Your IP address and the text you search for. | Why: Fonts, brand logos, and address suggestions. | Retention: Under each provider's own policy. We don't receive this data. |
For exactly what each provider receives and how long it's kept, see our Service Providers page. We update it when we add or change a provider. Questions: [email protected].
Google Limited Use Disclosure: Well Kept's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Data Sharing and Disclosure
We do not sell your personal data. We may share your information only in the following circumstances:
- With your explicit consent.
- With household members you invite to join your household.
- With the service providers listed in Section 6, who process data on our behalf to run the app.
- With third-party services you choose to integrate (e.g., Google Calendar) to fulfill specific features.
- To comply with legal obligations or respond to lawful requests.
- To protect our rights, privacy, safety, or property.
- In connection with a business transfer or merger.
California Residents: We do not sell or share your personal information for cross-context behavioral advertising purposes as defined under California law (CCPA/CPRA).
8. Your Rights and Choices
You have the following rights regarding your data:
- Access: View all your stored data at any time through the app.
- Update: Modify your information directly in the application.
- Delete: Remove items, expenses, and other records in the app, or delete your entire account under Settings → Account (on the web and in the iPhone app).
- Get a Copy: Premium members can download their data in JSON format from the app. Anyone, on any plan, can request a free copy of their data by emailing us.
- Disconnect: Revoke third-party integrations at any time through settings.
- Notification Preferences: Control email notifications and reminders for different event types. Every digest and weekly update email includes an unsubscribe link. Account messages, such as password resets and household invitations, are sent regardless of these settings.
Making a Request: To access, correct, delete, or get a copy of your data, or to delete your account, email [email protected] from the address on your account. We may ask you to confirm your identity before acting on a request, and we will respond within 30 days. If we decline a request, we will explain why, and you can appeal by replying to that email. We will not treat you differently, such as by charging more or limiting features, because you used these rights.
9. Cookies and Tracking
Well Kept uses minimal cookies and local storage to:
- Maintain your secure login session with JWT tokens.
- Remember your preferences and settings.
- Cache data for better performance and offline functionality.
- Recognize previously used administrator installations with a random, resettable security reference.
We do not use third-party advertising cookies or tracking pixels. We do not sell your browsing data. We measure app usage with Umami, a cookieless analytics tool, and Sentry may record masked session replays to help us fix errors (see Section 6).
Do Not Track Signals: We do not support Do Not Track ("DNT"). Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked.
10. Data Retention
We retain your data for as long as your account is active or as needed to provide our services. You can delete your data at any time through the app. Activity logs may be retained for up to 90 days for security and operational purposes. Deleted receipt images are permanently removed from our blob storage.
When your account is deleted, we remove your personal data from our active systems within 30 days. If you were the only member of your household, the household and everything in it are deleted. If others share your household, records you shared with them, such as split expenses and payments, stay with the household and show you as "Former member"; your name, email, and other personal details are removed. If you are the household's owner, you choose whether to hand it to another member (any web subscription is cancelled and the household moves to the free plan) or to delete it for everyone, which also deletes the other members' accounts and data and lets them know by email. Copies in routine database backups expire on a rolling basis after that. We keep only what we must for legal or financial reasons, such as payment records, and data held by the service providers in Section 6 is removed according to the retention periods listed there.
11. International Transfer
Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. This means that this information may be transferred to—and maintained on—computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer. Where our service providers offer them, we rely on their data processing terms, including Standard Contractual Clauses, to protect transferred data.
12. Children's Privacy
Well Kept is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately and we will take steps to remove that information. If a parent or guardian becomes aware that their child has provided us with personal information without their consent, they should contact us.
13. Changes to This Privacy Policy
We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Last Updated" date at the top. For material changes, such as collecting a new type of data, using it for a new purpose, or sharing it with a new kind of service provider, we will email you at least 14 days before the change takes effect. We encourage you to review this privacy policy periodically.
14. Contact Us
If you have any questions about this privacy policy or our data practices, please contact us:
- By Email: [email protected]