Cookie Policy

For Homedrawer · a product by FNDRY39 · Last updated October 8, 2026

Version française

What changed

  1. October 8, 2026

    • The Terms of Service were rewritten for launch. They now say plainly that Homedrawer is not a warranty, insurance or advice; that dates can be estimates and reminders or recall alerts can be late or missed; and that renewing insurance and registration, claiming warranties and acting on recalls stay your responsibility.
    • The Terms now also cover the iPhone app, your household’s email address, calendar and invitation links, household roles as they work today, what stays with a household when you leave it, the other services Homedrawer relies on, a promise to cover our costs only if someone claims against us because of something you had no right to upload, and the usual closing terms.
    • A change to the Terms or the Privacy Policy that takes away a right, adds a duty or changes how your information is handled now comes with 30 days’ notice by email, up from 14 days for the Terms alone.
    • The Privacy Policy now lists everything we collect and every service involved, including the relay that carries our email, Google’s and Apple’s parts and your calendar app. It says the servers that run Homedrawer are in Montréal, beside the database, and gives the real retention: database backups 30 days, copies of deleted files gone from backups within 60 days, error reports 30 days, and the record of an email nobody approved 30 days.
    • The Cookie Policy now describes Google Analytics as it is set up — a random ID in a cookie, with Google signals and ad personalisation off — and says that signing out removes this browser’s push subscription and its offline copies of your pages.
    • Applied on publication: at publication the only account holders were the operator’s own accounts, so there was nobody outside the company to give notice to.

  2. September 21, 2026

    • Privacy Policy: Anthropic is listed as a provider for reading an item’s label or receipt from a photo you take; recall checks against public recall databases, push notifications per device, the household summary email, the export and the insurance PDF, and nightly backups kept for 30 days are described.
    • Cookie Policy: the service worker’s caches are listed with the cookies.

  3. September 5, 2026

    • Cookie Policy: every cookie the app sets is listed again, and the onboarding slide became opt-in.

Material changes are emailed to every account holder, with the notice the Terms promise.

Homedrawer uses a small number of cookies, keeps two small things in this browser’s session storage, and, in browsers that support it, keeps three stores for its service worker. Everything the website stores on your device is listed on this page; what the iPhone app keeps on your phone is in the Privacy Policy. Only the essential ones are set without asking; everything else is off until you turn it on, and you can change your mind at any time.

Manage cookie preferences

Categories

CategoryPurposeConsent
EssentialKeeping you signed in, security, finishing a sign-in with Google or Apple, holding a pending household invitation while you sign up or sign in, remembering which household you are viewing and your cookie and theme choices, remembering an update prompt you waved away, and — in browsers that support it — keeping Homedrawer’s own code and images so it starts quickly and can show you an offline page.Always on
AnalyticsGoogle Analytics 4 — counts of which public pages are visited, under a random ID in the _ga cookie, not tied to your name or account. Google signals and ad personalisation are turned off and no advertising features are enabled; Google says it does not store IP addresses for this.Opt-in
FunctionalSmall conveniences remembered in this browser. Two things use it today: which onboarding step you came from, so the next one slides in from the side you were heading; and, if you install Homedrawer or open it in a browser that supports it, the last copy of each page you opened in your account, so you can read your own records without a connection. Nothing here is needed to use Homedrawer.Opt-in
MarketingNot used. Reserved for measuring a campaign if we ever run one; nothing loads unless enabled.Opt-in

The cookies themselves

NameSet byPurposeLifetime
sb-*-auth-token (plus a short-lived sb-*-auth-token-code-verifier while an emailed link is pending)Homedrawer (Supabase Auth)Essential — your sign-in sessionUp to 400 days, refreshed while you stay signed in
hd_oauth_intentHomedrawerEssential — whether you were signing in with Google or Apple or linking one to your account, so you land in the right place on the way back10 minutes, cleared the moment you come back
hd_householdHomedrawerEssential — which household you last viewed1 year
hd_inviteHomedrawerEssential — the household invitation you followed, so it is still there once you have signed up or signed inUp to 7 days, cleared as soon as you accept the invitation
hd_consentHomedrawerEssential — your cookie choice6 months
hd_themeHomedrawerEssential — light or dark, only if you chose1 year
_ga, _ga_*Google AnalyticsAnalytics — only after you opt inUp to 2 years

Not cookies, but the same promise

Two things are kept in this browser’s session storage rather than in a cookie. Session storage belongs to a single tab and is emptied when you close it, and unlike a cookie it is never sent to us with a request — it stays on your device. We list it here anyway, because what matters is that something was stored on your device, not what the storage is called.

NameSet byPurposeLifetime
hd_update_dismissedHomedrawerEssential — the update you said “Not now” to, so that version stops asking in this tabThis tab only, until you close it
hd_onboarding_stepHomedrawerFunctional — the step you came from, so the next one slides in from the side you were headingThis tab only, until you close it

Kept by the service worker

In browsers that support it, Homedrawer registers a service worker — a small script that lets the app be installed, receive push notifications and open without a connection. It keeps three named stores in the browser’s Cache Storage. Nothing in them is ever sent to us; they stay on your device until a newer version of Homedrawer replaces them, until you uninstall, or until you clear site data.

NameSet byPurposeLifetime
hd_assetsHomedrawerEssential — Homedrawer’s own code, fonts and images, and the offline page, so the app starts quickly and can tell you when you have no connectionUntil a new version of Homedrawer replaces it
hd_pagesHomedrawerFunctional — the last copy of each page you opened inside your account, so you can read your own records without a connection. Kept only while Functional is on; emptied when you turn it off, when you sign out, and when you delete your accountUntil you sign out, turn Functional off, or a new version replaces it
hd_flagsHomedrawerEssential — whether Functional is on, so the worker knows what it may keep, and the public key it uses to renew a push subscription the browser has rotatedUntil you uninstall or clear site data

Push notifications are a browser permission rather than something we store on your device: when you turn them on under Settings → Reminders, your browser creates a subscription and keeps it, and we keep its address and keys, and your browser’s type, on our server for as long as push stays on. Turning it off, signing out on this browser, or signing out everywhere removes both.

Of the two session-storage entries, only the second is optional, and the difference is deliberate. Remembering that you said “Not now” is how we carry out what you asked for — put behind a switch, an update you had already waved away would simply come back on the next page. The onboarding slide is the opposite: where you actually are in onboarding is kept in your account, so this remembers nothing but which way a panel should move. It is set only if you turn Functional on, and without it each step fades in instead.

Your control

Accepting and rejecting are equally easy in the banner, and neither is pre-selected or pre-focused (Quebec Law 25, GDPR). To change your mind later, open the cookie preferences page (also linked from the footer of every public page), or Settings → Cookies once you are signed in. Your theme choice (light or dark) is an essential cookie: it has to follow you to every page for the site to look the same everywhere, so it is never optional.

Rejecting stops the optional scripts from ever loading. Functional is the one optional category that stores anything today — the onboarding slide and the offline copies of your pages — and turning it off throws away what it had remembered. Withdrawing analytics after you had accepted does more than mute it: we delete the Google Analytics cookies and reload the page, because a tag that has already loaded cannot be removed any other way and would otherwise keep sending data without cookies. You may also delete cookies in your browser. We record your choice in the cookie itself and nowhere else.

Analytics runs only on our public pages — the home page, the legal pages, the sign-in, sign-up and forgot-your-password screens, and the goodbye page you see after deleting your account. It is never loaded inside your account — when you move from a public page into your account, the page loads afresh so the analytics script is gone — and never on an invitation link, so the addresses of your own records and your invitation links are not shared with Google. We never send query strings to analytics.