Privacy Policy

Last updated: 2026-10-19.

HouseholdOS is a local-first app. There is no account, no cloud sync of your household data, and no advertising. Your bills, tasks, documents, and expirations stay on your device. The only data that leaves your device is anonymous product-usage analytics sent to PostHog so we can improve the app, described below.

What we don't do

• No account creation. No email, phone number, or profile.
• No ad network, no advertising identifiers (we never read IDFA), no ad-tech trackers.
• No transmission of your bills, tasks, documents, or expirations to any server.
• No tracking across apps or websites — we do not request the App Tracking Transparency permission.

We do use one third-party service to receive anonymous product-usage analytics: PostHog. The next section describes exactly what is sent.

Anonymous usage analytics

HouseholdOS sends anonymous product analytics to PostHog (US cloud, project 389134). Per event, that includes:

• The event name (e.g. paywall.viewed, paywall.purchase_success, screen.viewed, settings.toggled) and non-identifying event properties such as the screen name, user segment (anonymous/free/trial/premium/lifetime), days since install, and locale.
• A random per-install identifier generated by the PostHog SDK. It is not your Apple ID, email, device name, phone number, IDFA, or any ad identifier.
• Your app version and build number, your device model and iOS version, and an is_review_env flag that marks events from TestFlight or App Review sandbox builds so we can exclude them.
• For in-app purchases: the StoreKit product ID, the transaction ID, and the price PostHog receives from the device. We never see your payment method, Apple ID, or billing address — Apple handles the transaction.

Every metric property uses a fixed, bounded alphabet; the app's code specifically prevents any user-entered text (member names, bill titles, amounts, document contents, task descriptions, expirations) from being attached to a metric. The PostHog iOS SDK is configured with autocapture off, screen-view autocapture off, session replay off, and personProfiles = .never; only the events described in this policy are emitted. You can turn metrics off at any time in Settings → Analytics; after you opt out, no further events are sent from your device.

Identification after purchase

After your first in-app purchase on this device, we associate that install's analytics events with a pseudonymous identifier derived from a hash of Apple's identifier-for-vendor (IDFV): we take MD5(IDFV), keep only the first 12 hex characters, and prefix it with anon_. The raw IDFV itself is never sent. The IDFV is the same value for all apps from this developer on this device, so this pseudonymous identifier lets us count how many of our apps the same device has paid for; it is also stable across reinstalls as long as another of our apps remains installed. Apple's App Privacy taxonomy classifies IDFV-derived values as a Device ID, so we disclose it as such on the App Store listing. The pseudonymous identifier is never combined with your name, email, phone number, Apple ID, or payment details, is not used for advertising, and is not shared with data brokers. Turning off anonymous analytics (Settings → Share anonymous usage metrics) stops this identification from being sent.

Crash diagnostics and install attribution

• Crash diagnostics. If the app crashes, iOS (MetricKit) gives the app a crash report on the next launch. We send a short, PII-free crash signature (for example the exception type and app version) as an analytics event. We also send basic session timing, such as session length and screens per session, so we can spot performance problems.
• Install attribution. On first launch the app asks Apple's AdServices framework for an attribution token and sends it to Apple (api-adservices.apple.com). Apple replies only whether the install came from an Apple Search Ads campaign, and if so the campaign and ad-group identifiers. We record that on a single first-open analytics event to tell paid installs from organic ones. No personal information is involved. You can turn off Apple's ad attribution in iOS Settings → Privacy & Security → Apple Advertising.

What's stored on your device

• Local database — your household, members, bills, tasks, and expirations live in a SwiftData store inside the app's iOS sandbox.
• Encrypted document vault — files you import are encrypted with AES-GCM before being written to disk. The encryption key is held in the iOS Keychain with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly.
• Local notifications — reminders are scheduled on-device via iOS. No push server is involved.

Permissions the app may request

• Face ID / Touch ID — only if you enable app lock or sensitive-documents mode.
• Camera / Photo Library — only if you attach a photo to a document or receipt.
• Notifications — only when you opt in to reminders.

Retention

Analytics events are kept in our PostHog project for internal product analysis and are not sold or shared with advertisers.

In-App Purchases

HouseholdOS offers an optional upgrade — HouseholdOS Plus — as a monthly subscription, yearly subscription, or one-time lifetime unlock. Purchases are handled entirely by Apple through the App Store. HouseholdOS never sees your name, address, or payment method. The app verifies the purchase with Apple's StoreKit on device; apart from Apple, the only purchase details that leave your device are the product ID, transaction ID and price in the anonymous analytics described above.

If you subscribe, Apple renews the subscription until you cancel it in the App Store. Lifetime is a one-time purchase with no renewal.

Your choices

• Export — Settings → Data → Export JSON writes a single readable file you control.
• Delete — Settings → Delete all data removes the database, the encrypted vault, and the Keychain key. This is final.
• Analytics kill-switch — Settings → Analytics.

Children

HouseholdOS is not directed at children under 13.

Changes

We will update this page with a new "Last updated" date when anything material changes.