Privacy policy

Effective 2026-11-04

Homebloom: Shared Chores is a chore app for couples, run by Suhendra Suhendra, an individual developer, under the brand Aksaworks. This page says what the app and this website keep about you, why, who helps us run it, and how to get it deleted. Questions about any of it: [email protected].

What we store, and why

Your email address (if you have one) and display name

To sign you in, to show your partner who did what, and to send the sign-in and account emails described below. If you use Sign in with Apple you may give us Apple’s private relay address instead of your real one.

How you sign in

Whether it is email, Apple or Google, plus that provider’s stable account ID, so the same person lands in the same account next time. We do not store Apple or Google refresh tokens.

Your home: its name, Budley’s name, time zone, whether coins are on, your colour, and when you joined or left

It is the shared space the two of you use. The time zone makes due times and repeats land on the right day.

Your chores: title, effort, who it belongs to, repeat, due time, and whether it is paused or deleted

It is the thing the app is for.

History: each check-off, skip, Thanks, edit, join, leave and shop action, with who did it and when

Budley’s growth and coins, and the home’s history, are worked out from it. It also lets a phone that was offline catch up.

The home’s coin balance and Budley’s growth

To show Budley. These belong to the home, not to one person.

Sign-in sessions: a hashed refresh token, a device name the app sends, and when it was created, last used or revoked

To keep you signed in and let you sign out of a device.

Push notification tokens (the Firebase Cloud Messaging token for each phone, and whether it is iOS or Android) and the notifications queued for you

To send reminders, Thanks and “your partner joined”. A token is removed when you sign out of that device.

Notification settings: reminders, Thanks, recap, quiet hours

To respect your choices.

Sign-in links and codes: the email a link was sent to, and a hash of the link

So a link works once, for fifteen minutes. Sign-in with Apple or Google uses a one-time value we store as a hash.

Invites: a 6-character code, a hash of the link, who made it, and when it expires

So your partner can join. The link lasts 7 days and the code 24 hours, or until you cancel them.

An operator log of changes to accounts, homes, memberships, chores and invites

For running and debugging the service only. It never holds email addresses (they are blanked) or secrets. It is never shown in the app.

Ordinary server request logs, such as your IP address and the time of a request

To run the service, fix faults and stop abuse (the sign-in and invite endpoints limit requests per IP address). They are not used for analytics or advertising.

The app asks for one permission, to show notifications. It does not ask for your location, contacts, photos or advertising ID. Homebloom does not take payments or hold payment details today; if that changes, we will update this page first.

What your partner sees

Everyone in a home sees the same home: its name, each member’s display name and colour, the chores, who did what and when, Thanks, the coins and Budley. They do not see your email address. Homes are separated from each other in the database, so people in another home cannot see yours.

Before someone joins, anyone who holds your invite link or code can see the home’s name, your display name and colour, and which colours are taken. Cancel the invite in the app, or let it expire, to close that.

Who helps us run it

• Resend sends our sign-in and account emails. It receives your email address and the text of the message.
• Firebase Cloud Messaging (Google) delivers push notifications. It receives your device token and the notification text.
• Hostinger: we rent a virtual private server from Hostinger. The API and the database run on it, so all the data above is stored there.
• Cloudflare provides DNS and proxies traffic for homebloom.app. Requests to this website and to our API pass through it, so it sees them, including your IP address.
• Apple and Google, only if you choose to sign in with them, confirm who you are. We receive a stable account ID and your email address. The App Store and Google Play handle downloads.

These companies may handle data in countries other than yours. We do not sell your data, share it for advertising, or give it to anyone else, except where the law requires it.

This website sets no cookies, loads no third-party scripts, fonts or trackers, and has no analytics. Our server for this site keeps no access log, though Cloudflare and our hosting layer handle requests as described above.

Deleting your account

You can delete your account in the app: open Us, tap the gear for Settings, then Delete account. No app? Email [email protected] from the address on the account and we will delete it for you. This is what the app tells you:

When: you leave the home now; your account is erased after 30 days. Sign in before then to keep it.

• When you delete, you leave the home straight away and we sign you out everywhere. Chores that were yours go back to “Anyone” so your partner can pick them up.
• For 30 days your account is waiting to be erased. If you sign in during that time you can keep it, or choose “Continue deleting” to erase it immediately.
• If your account has an email address, we send one reminder email 3 days before the erasure. We also send one email when you ask for deletion.
• When it is erased, we remove your account, your sign-in methods, sessions, device tokens and notification settings. Chores you did stay in the home’s history, without your name and with no link to an account. We delete operator-log entries about you or made by you, and blank your ID in the rest of that log. The home’s history may keep an internal ID that no longer points to anyone.
• If you were the last person in the home, the home closes. You can bring it back within 30 days; after that it is deleted for good, with its chores and history.

Other things clean themselves up too: used and expired sign-in links, sign-in values and invites are deleted 30 days after they were used, expired or cancelled; sign-in sessions 30 days after sign-out, or once they have sat unused too long to refresh; the operator log after 90 days.

You can also email [email protected] to ask for a copy of your data, to correct it, or to have your account deleted. We will ask you to write from the address on the account.

Children

Homebloom is not directed at children under 16. We do not knowingly collect data from them. If you think a child has an account, email us and we will delete it.

Security

Traffic to the app and this website is encrypted in transit. Sign-in links, refresh tokens and invite links are stored as hashes, not in readable form. No system is perfectly safe, and we cannot promise it. If we learn of a breach that affects you, we will tell you.

Changes to this policy

If we change what we collect or who we share it with, we will update this page and its effective date. For significant changes we will also tell you in the app or by email. Small wording fixes only change the page.