Privacy Policy

This policy covers the version of Domestic hosted at this domain. The source code is published under the MIT license, so anyone is free to run their own copy. If you are using someone else’s deployment, they control that database and this policy does not describe it — ask them.

Only what the app needs to work:

• Your account — name, email address, and the profile picture and initials shown next to your chores. These come from whichever sign-in method you chose.
• Your household — its name, its time zone, and an optional street address used to place the kiosk’s weather.
• Chores — the rotation, whose turn it is, and the history of completed, skipped, and swapped turns.
• Shared costs — amounts, descriptions, categories, line items, how each is split, and any note or receipt link you add yourself.
• Notification settings — your quiet hours, and, if you turn on push notifications, the subscription your browser issues along with the browser and device name it reports.
• Wall displays — a name for each paired tablet and when it last checked in. Pairing tokens are stored only as a hash, never in a form that can be read back.

There is no tracking pixel, no advertising identifier, and no third-party profile built about you.

Everyone in your household can see everything in it. That is the point of the app — the rotation, the ledger, and who owes what are shared by design. Do not put anything in a note or an expense description that you would not want your roommates to read.

Households are isolated from one another at the database level. Every table enforces membership on every read and write, so another household cannot query yours even by accident.

Domestic hands data to a small number of providers in order to run. Each one gets only what its job requires:

• Supabase — hosts the database and handles sign-in. Everything listed above lives here.
• Vercel — hosts the app and keeps ordinary server request logs, including IP addresses, for a short period.
• Google — verifies your identity if you sign in with Google, and returns address suggestions as you type your household’s address. If this deployment has analytics turned on, Google Analytics also receives standard page-view data.
• Cloudflare — runs the bot check on the sign-in page.
• Anthropic or Google — reads receipt photographs, but only if an admin of your household has supplied an API key for one of them. See below.
• Open-Meteo — returns the kiosk forecast. It receives approximate coordinates for the household, never anything about a person.
• Apple, Google, and Mozilla — deliver push notifications to whichever browser you subscribed with.

When you scan a receipt, the image is sent to the AI provider your household configured, read once, and turned into line items. Domestic does not store the photograph. It is held in memory for the length of that single request and then discarded — only the text pulled out of it is saved to your expense.

What the provider does with the image afterward is governed by their terms, not this policy, and depends on the API key your admin used. Receipt scanning is off entirely until an admin adds a key.

Domestic sets a cookie to keep you signed in and one to remember whether you chose light or dark mode. Neither is used to track you across other sites. If analytics is enabled on this deployment, Google Analytics sets its own cookies; blocking them does not affect the app.

Your data stays as long as your household does. Completed chore turns and settled expenses are deliberately kept as history — the ledger would not add up otherwise.

A household admin can remove a member at any time from Settings. To have your account and personal data deleted outright, open an issue at github.com/tejasthy/domestic/issues. There is no self-service delete button yet.

• Edit your name, initials, color, and notification settings in Settings at any time.
• Turn push notifications off, from Settings or from your browser.
• Ask for a copy of your data, or ask for it to be deleted, via the link above.
• Run your own copy of Domestic instead, if you would rather nobody else host it.

Traffic is encrypted in transit. Access is enforced in the database itself rather than only in application code, so a bug in a page cannot hand you another household’s rows. Wall-display pairing tokens are stored as hashes, and any AI provider key an admin adds is encrypted at rest and unreadable to the app’s normal query paths.

No system is perfectly secure, and this one is maintained by one person. Please do not store anything in Domestic that would be genuinely damaging to lose or expose.

Domestic is not directed at children under 13 and accounts should not be created for them.

If this policy changes in a way that matters, the date at the top will change and the change will be visible in the project’s public commit history.

Questions, data requests, and anything that looks like a security problem: open an issue on GitHub. For a security report, please avoid including details that would help someone else exploit it.

See also the Terms of Service.