Published verbatim from the maintained policy. When this document and the code disagree, the code wins and this document gets updated first.
Effective [EFFECTIVE_DATE]
HomeAtlas is built by Private Intelligence Systems LLC. This policy explains, in plain English, what data the HomeAtlas iOS app collects, where it lives, who can read it, what we send to service partners, and what happens when you leave. It is the hosted version of the disclosures inside the app (Settings → Privacy & Security); the two are kept in step, and where wording differs, they tell the same story.
Questions, requests, or concerns: privacy@yourhomeatlas.com.
The rest of this policy is the detail behind those sentences.
HomeAtlas is an iOS app made by Private Intelligence Systems LLC. It helps you document your home’s equipment and keeps a private, intelligent record of it — like a home inspector who never leaves. Our backend runs on Supabase (Postgres database, authentication, and serverless functions); subscriptions are managed through Apple and RevenueCat.
HomeAtlas keeps your home record in three places. Each tier has a different blast radius for what HomeAtlas can read.
WiFi passwords, garage codes, lock codes, alarm codes, and access codes you save go directly to the Apple Keychain on your device, synced across your Apple devices by iCloud Keychain. Their values never reach HomeAtlas servers — encrypted or otherwise. Our database stores only a stub recording that a credential of a given type exists. If you turn off iCloud Keychain, credentials exist only on the device that captured them.
Equipment photos, receipts, damage photos, walk-through proof photos, and owner’s manuals you upload are written to a folder named HomeAtlas in your iCloud Drive — you can browse it in the Files app. Our servers store a pointer to each file, never the file itself. One disclosed exception: when you scan a label or ask the AI to identify equipment from a photo, that photo is sent to our processing partners to read it (see §5 and §8) — and then discarded, not stored.
Most structured equipment data lives in HomeAtlas’s database (Supabase Postgres, protected by per-household access rules). It is split into two deliberately different classes:
Encrypted on your device before it syncs (we cannot read these). The following are encrypted with AES-256-GCM using a key that lives in your Apple Keychain — HomeAtlas servers store only the encrypted bytes and never hold the key:
A database breach or a subpoena of our servers yields ciphertext for these fields, not your content. One rare exception, stated plainly: if your device ever cannot encrypt — a damaged encryption runtime — HomeAtlas saves your content unencrypted rather than losing it, flags it, and re-encrypts it automatically once encryption is working again.
Stored readable on our servers, by design (the analytical set). These fields power features that must read them — recall matching, the Home Pulse, the 5-year Forecast, maintenance scheduling, and Q&A search:
We document what’s readable so you can decide what to share. We never describe the readable set as “end-to-end encrypted” — it isn’t, on purpose.
The trade-off, disclosed: the device-side encryption uses a key in your Apple Keychain. If you turn off iCloud Keychain and lose all your Apple devices, the encrypted fields cannot be recovered — by you or by us. We chose this so our servers can never read them.
Everything HomeAtlas collects, grouped the way Apple’s privacy labels group it:
| What | Examples | Why |
|---|---|---|
| Contact info | Your account email (sign-in). Names and contact details can also appear inside content you add — a contractor contact you save, names inside an inspection report you upload | Account access; the contacts and records features you use |
| User content | Equipment you document, photos you scan, questions you ask, Memory notes, service history, documents and inspection reports you choose to import | The product itself — your home record and the intelligence on top of it |
| Approximate location | Your ZIP code (entered at setup); coordinates derived from that ZIP (the center of the ZIP area, not your address). If no ZIP code is set, the app has no location at all | Climate-aware maintenance guidance, regional cost context, and local weather alerts (§5). Never GPS, never your IP — the app never reads your device’s location |
| Identifiers | Your account ID (a random UUID); a random device ID used only for pre-signup analytics (§7); the device vendor identifier collected by the RevenueCat subscription SDK | Keeping your account, subscription, and (pre-signup) funnel analytics working |
| Purchases | Subscription state and transaction identifiers via RevenueCat | Knowing whether your subscription is active. Apple processes payment — we never see your card |
| Usage data | Opt-in, de-identified product analytics (§10); household-linked service metering — AI call counts, costs, latency, and a content-free stamp per AI answer (§6) | Improving the product (opt-in); enforcing fair-use caps and cost controls (always on, content-free) |
| Diagnostics | AI-call latency and outcome telemetry. No crash-reporting SDK is installed | Keeping the AI features reliable and affordable |
What we never collect: device GPS coordinates, street address, income, occupancy patterns, cross-app identifiers, or children’s data. HomeAtlas is not directed at children and we do not knowingly collect data from them. There are no fields for any of these in our database.
HomeAtlas’s only outbound destinations are our own backend (Supabase), your own iCloud, the subscription service (RevenueCat), the AI and processing partners below, and the weather-related services below. Every AI partner is reached from our servers, not directly from your device; requests to them carry no account identifier — though the content itself (a question, a photo, a report) is still yours and is treated as personal data.
Codes and passwords never reach the AI. A credential check runs before any capture is classified: for a typed note it runs entirely on your phone; for a photo, the image is first read by Google Cloud Vision to extract its text, and the check runs on that text. Anything identified as a credential goes to your Apple Keychain and is not sent on to Anthropic or stored on our servers — and a photo that looks like it contains a code is held back too.
To show local weather and warn you when severe weather threatens your equipment, the app contacts two public weather services directly from your device:
These requests carry no account information. Like any internet request, the services can see your device’s IP address.
RevenueCat manages subscription state. It receives your account ID and purchase/entitlement status (plus standard SDK device signals such as the vendor identifier). Apple handles the payment itself — we never see your card. RevenueCat retains subscription records per its own policy.
When you ask HomeAtlas a question, the question is sent to the AI partners above to produce the answer. Here is precisely what persists afterward:
If you try scanning before creating an account, we record anonymous scan-progress events tied to a random device ID — never to you or an account (none exists yet), and the ID is never joined to your identity later. This is disclosed on the capture screen where it happens. It exists so we can see where new users get stuck.
Every photo is stripped of metadata — GPS position, device identifiers, timestamps — by re-encoding it before it is stored or uploaded anywhere. If the strip cannot run, the photo is blocked, never sent unstripped. Label photos sent for text extraction (§5) are processed and discarded; the original stays in your iCloud Drive. We never ask for or receive your camera roll — only the photos you take or pick.
NSPrivacyTracking = false.If you opt in (Settings → Privacy & Security), we study patterns across all HomeAtlas homes in aggregate — which equipment types fail early, how long appliances last by climate zone. Identity fields (household ID, user ID, email, name, address, phone, ZIP, serial numbers) are stripped at the application layer before any analytics row is written, and exact model numbers are coarsened. We never publish or share anything that could be connected to your home. The toggle is honored at the single code chokepoint every analytics write passes through.
Your photos and documents live in your iCloud Drive, and your credentials in your Apple Keychain — you keep them no matter what happens to us. For everything else, Vault Export gives you the complete archive. In the event HomeAtlas discontinues operations, we commit to providing at least 60 days notice and ensuring Vault Export remains functional through the wind-down period.
Owner’s manuals you upload live in your iCloud Drive — HomeAtlas does not custody copies. We have a DMCA designated agent registered with the U.S. Copyright Office; if you believe a document on a system we operate infringes your copyright, see yourhomeatlas.com/dmca.
We may update this policy as the product evolves. The effective date at the top reflects the current version, and we will notify you in-app of material changes before they take effect.
Private Intelligence Systems LLC · privacy@yourhomeatlas.com