Private by design

What stays on your device

The core of Homie runs on your phone. All of this is stored locally and is not uploaded to us unless you turn on sync or share something:

• Your tasks and notes, including attachments.
• Your chat history with the assistant.
• Your memories — which you can read, edit, and delete in the app.
• Your automations and their run history.
• Your settings, including any search-provider API keys you add.

What reaches our servers, and why

When you ask Homie something, your message — plus the context needed to answer it, like relevant tasks or calendar events — is sent to our API and processed by AI models running on Amazon Bedrock (Anthropic Claude). That's what makes the assistant work. Our servers don't store the content of these requests; per AWS's Bedrock terms, prompts and outputs aren't stored there or used to train models. Server logs record metadata only (account, model, usage volume, timing) — not what you said.

Beyond AI processing, our servers hold only what accounts and optional features need: your email address for sign-in, your subscription status, encrypted sync data if you enable it, and content you explicitly share with other people.

The exception: sharing is server-side

Sharing is the deliberate exception to local-first. When you share a task or note with someone, or add tasks to a household group list, that content is stored on our servers in readable form — that's what lets the people you invited see it. You can stop sharing an item or revoke someone's access at any time, and unshared content goes back to being yours alone.

Homie asks before it acts

Anything the assistant wants to do with outside effects — creating a calendar event, for example — is shown to you first as an approval card: what it will do, with every detail visible. You approve, edit it, or decline. Automations run only with the capabilities you granted them, and their run history shows you what they did.

Integrations are opt-in and scoped

• Everything is off by default. You enable each integration explicitly, and you can disconnect any of them at any time.
• Gmail is read-only, can be limited to specific labels, and your device talks to Google directly — we don't store your Google data on our servers. Our use of Google user data follows Google's Limited Use requirements (see theprivacy policy).
• Calendar access reads your events on your device; creating an event requires your per-action approval.
• Web search uses your own provider account and API key; queries go from your device to the provider you chose.
• Location is opt-in, coarse, refreshed at most every 30 minutes, and not stored on our servers.

Sync is end-to-end encrypted

Optional sync & backup encrypts your data on your device before upload, with keys derived from a passphrase only you hold (plus a one-time recovery code). Our servers store ciphertext we cannot read. The app verifies synced data when it downloads it — if verification fails, Homie warns you and pauses syncing. The honest trade-off: if you lose both your passphrase and recovery code, we can't recover your synced data for you.

Where your data lives

Deletion and export

• Export anytime — download your tasks, notes, memories, and chats as a JSON file from the app.
• Delete anything — individual items, whole chats, or any memory, right in the app.
• Delete your account — permanently, from Account → danger zone, including the server-side data associated with it.^{[TODO confirm — server-side purge is W16; keep in step with the legal policy's deletion wording]}
• Disconnect integrations — in the app, or revoke Homie's access from your Google Account settings.

What we don't do

• We don't sell your data.
• We don't show ads or share data with advertisers.
• We don't use your content to train AI models.