Privacy policy
This policy describes what personal data the HomeQuest mobile app (iOS, Android) and its server process, for what purpose and how long, and what rights you have. Processing is carried out under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungarian Act CXII of 2011. In case of a discrepancy, the Hungarian version prevails.
1. Data controller
Áron Papp (private individual)
E-mail: aron.papp2003@gmail.com
You can reach us at this address with any privacy question or request.
2. What data we process
2.1. Account data
We do not ask for a password: you sign in with your Google or Apple account. Authentication is handled by WorkOS, except Sign in with Apple on iPhone, which Apple handles directly with our server. On sign-in we receive and store:
- first and last name,
- e-mail address (with Apple this may be a private relay address generated by Apple),
- the web address of your profile picture (we do not copy the image, it loads from Google's/Apple's servers),
- your internal WorkOS user ID, or with Sign in with Apple on iPhone your Apple user ID and an Apple sign-in token (stored encrypted, only so we can revoke your Apple sign-in when you delete the account),
- your language setting (Hungarian/English).
We also store the nickname you set.
2.2. Household data
The app exists to organise a shared household, so we store:
- households (name, join code, settings such as the weekly or monthly scoring period), your membership and role (admin, member, child);
- chores (name, category, difficulty, duration, recurrence, assignment mode) and their occurrences: who claimed them, who completed them and when;
- your points, point transactions, weekly/monthly goals and any penalty points;
- the personal weight you gave to chores (how much you like them) and the rotation order;
- chore swaps (offers, acceptances) and grace days you requested;
- rewards (name, description, point value) and their redemptions;
- the stickers in your sticker album;
- records of members leaving (so admins can decide about the chores of a former member);
- a change log of household data (what changed, when and by whom).
2.3. Notifications and calendar
- Push notification token and device platform (iOS/Android) – only if you allow notifications. It is deleted when you sign out.
- Calendar subscription: if you turn it on, we create a link containing a secret random identifier that lets your calendar app fetch the household's chores (chore names, due dates, assignees' names). Anyone with the link can see this data, so do not share it; you can request a new link in the app at any time, which invalidates the old one.
2.4. Technical data
- The access token of your signed-in session (stored on the server only as a hash) and its last use.
- Server logs: IP address, time and path of requests, error messages – for security and to fix bugs.
2.5. Data stored on your phone
- Your sign-in token is kept in the device's secure storage (iOS Keychain / Android Keystore).
- The selected household and your appearance settings (theme, palette, font, icon set) are stored on the device only.
- The camera is used only to scan a household's QR code. The image is processed on the device and is neither stored nor transmitted.
2.6. What we do not collect
We do not collect location, contacts, photos, health or financial data. We use no advertising, advertising identifiers, third-party analytics or tracking, and we never sell your data.
3. Who can see your data
The other members of your household(s) can see your name (or nickname), profile picture, e-mail address, points, the chores you claimed and completed, your rewards and redemptions. Members of other households cannot see your data.
4. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Creating the account, signing in | account data, access token | performance of a contract – Art. 6(1)(b) GDPR |
| Organising the household (chores, points, rewards, statistics) | data in section 2.2 | performance of a contract – Art. 6(1)(b) GDPR |
| Sending push notifications | push token, platform, language | consent – Art. 6(1)(a) GDPR; withdraw any time in your phone's settings |
| Calendar subscription | calendar token, chores | performance of a contract – Art. 6(1)(b) GDPR; only if you turn it on |
| Change log, server logs: detecting abuse and errors, security | change log, IP address, technical data | legitimate interest – Art. 6(1)(f) GDPR |
5. Processors and transfers
We use the following providers, who process data only on our instructions to provide the service:
| Provider | Role | Data involved |
|---|---|---|
| WorkOS, Inc. (USA) | sign-in, authentication | name, e-mail, profile picture, ID |
| Google LLC / Apple Inc. | provider of the sign-in method you choose | account data they hold, under their own privacy terms |
| 650 Industries, Inc. (Expo, USA) | relaying push notifications | push token, notification text |
| Apple Push Notification service, Google Firebase Cloud Messaging | delivering notifications to the device | push token, notification text |
| Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) | running the server and database | all data stored on the server |
Transfers outside the European Economic Area (USA) rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or the Standard Contractual Clauses adopted by the European Commission.
6. How long we keep data
- Account and household data: until you delete your account.
- Access token: until you sign out on that device, or after 180 days without use.
- Push token: until you sign out, or as long as the notification service reports it as valid.
- Change log: up to 365 days, then deleted automatically.
- Server logs: up to 14 days; backups: up to 30 days.
- If you leave a household, the history of your work there (completions, point transactions) is kept so the other members' scores stay accurate.
7. Deleting your account
You can delete your account in the app at any time: Profile picture → Settings → Delete account. If you cannot access the app, you can request it by e-mail. On deletion:
- your name, nickname, e-mail address and profile picture are irreversibly removed (the account is anonymized),
- your access and push tokens, personal settings and your WorkOS account are deleted, and your Sign in with Apple authorization is revoked at Apple,
- households you created are deleted for all their members,
- you leave households created by others; the shared history there is attributed to an anonymous "Deleted user" that cannot be linked to you.
Details: Delete your account and data.
8. Your rights
Under the GDPR you have the right to:
- access – ask what data we hold about you and get a copy;
- rectification – change your nickname and language in the app, your name and e-mail in your Google/Apple account;
- erasure – see section 7;
- restriction and to object to processing based on legitimate interest;
- data portability – on request we provide the data you gave us in a machine-readable format;
- withdraw consent – turn off push notifications in your phone's settings at any time.
Send requests to the e-mail address above; we reply within one month. If you believe the processing infringes your rights, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, Falk Miksa utca 9–11, 1055 Budapest, naih.hu), with the supervisory authority of your country of residence, or go to court.
9. Children
A "child" role exists within households, but creating an account requires an own Google or Apple account. Children under 16 may only use the app with the consent and supervision of a parent or legal guardian. A parent can request the deletion of a child's data at the e-mail address above.
10. Security
All data between the app and the server travels over an encrypted (HTTPS/TLS) connection. Access tokens are stored only as hashes, household data is accessible only to its members, and the server only serves requests from the official HomeQuest app.
11. Changes
If this policy changes materially, we will let you know in the app and on this page. The current version is always available at this address.