Homedrawer is operated by FNDRY39 WEB DESIGN (“FNDRY39”, “we”), a sole proprietorship registered in Alberta, Canada. This policy explains what we collect when you use Homedrawer, why, who sees it, and the rights you have. We wrote it to be read. Questions: privacy@homedrawer.com.
1. What we collect
Account data
Your email address, a display name you choose, a password (stored only as a hash by our authentication provider), your time zone and your reminder preferences.
Household data you enter
Home and room names, an optional address, the items you record (names, brands, model and serial numbers, purchase dates and prices, locations, notes), warranties, maintenance schedules and completion history, parts, and the documents you upload (receipts, manuals, warranty documents, service records, photos). This can include information about other people in your household who you invite; you are responsible for having their permission to do so.
Technical data
Server logs (IP address, browser type, timestamps, the pages requested) kept for security and debugging for up to 30 days. An audit log inside your household recording who added, changed, completed or removed things, visible to your household’s admins.
Cookies
Essential cookies for sign-in, security and remembering your cookie choice. Optional analytics cookies (Google Analytics 4) load only if you turn them on. See the Cookie Policy.
What we do not collect
Payment details (there is no billing in the current version), precise location, contacts, or anything from other apps on your device.
2. Why we use it
- To provide the service — storing your records, calculating warranty countdowns and due dates, sending the reminders you asked for, and sharing the household with the people you invite. Legal basis: performing our contract with you.
- To keep it secure — logs, rate limiting, fraud and abuse prevention. Legal basis: our legitimate interest in running a safe service.
- To improve it — aggregate, anonymised analytics, only with your consent.
- To communicate — service emails (verification, password reset, invitations, reminders you enabled). We do not send marketing email without your express consent (CASL).
3. Who else sees it
We do not sell personal information and we do not share it with advertisers. We use a small number of service providers who process data on our instructions:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | Canada (ca-central-1) — see note |
| Vercel | Hosting and serverless compute | Global edge; functions in North America |
| Hostinger | Outbound email (reminders, invitations) | EU / global |
| Google Analytics | Usage analytics — only with consent | Global |
Members of your household see the household’s data according to their role. If you are invited to a household, its owner can see what you add. We may disclose information if required by law, or to protect the rights and safety of users and the public.
Note on region: the production database region is chosen at deployment; this table is to be confirmed before launch.
4. How long we keep it
- Account and household data: for as long as your account exists.
- Deleted items and documents: removed immediately from the live database and storage; database backups roll off within 30 days.
- Deleted accounts: removed immediately (see section 6); backups roll off within 30 days.
- Server logs: up to 30 days. Email delivery logs: up to 90 days.
5. Your rights
Wherever you live, you can: access your data (Settings → Export gives you a complete JSON copy, including document listings); correct it (edit anything in the app); delete it (Settings → Delete account, or delete individual items and documents); port it (the export is machine-readable); withdraw consent for cookies at any time (Manage cookies in the footer); and complain — in Canada to the Office of the Privacy Commissioner of Canada, in Quebec to the Commission d’accès à l’information, in the EU/UK to your local supervisory authority. Email us first at privacy@homedrawer.com; we respond within 30 days.
6. Deleting your account
Deletion is real, not a hidden flag. When you delete your account: your profile, sessions and notifications are deleted; households you own are deleted with all their items, warranties, tasks, history, parts and documents (the confirmation screen lists them and their other members — transfer ownership first if others should keep the household); your membership in households owned by other people is removed, and the records you added there remain with that household. The deletion runs immediately; backup copies expire within 30 days.
7. Security
Traffic is encrypted (HTTPS/HSTS). Data is encrypted at rest by our providers. Every database table is protected by row-level security so that one household cannot read another’s records, whatever identifier is sent. Documents are in a private bucket and served only through short-lived signed links to members of the household. Passwords are hashed; sessions can be ended on all devices from Settings. No system is perfectly secure; if we learn of a breach affecting you we will notify you and the relevant regulator as the law requires (PIPEDA, Quebec Law 25, GDPR).
8. Canada, Quebec, and international users
We comply with PIPEDA and Alberta’s PIPA. For Quebec residents, the person in charge of the protection of personal information is Ryan Murrell, reachable at privacy@homedrawer.com; we obtain consent before any non-essential tracking and honour its withdrawal. For users in the EU/UK, we act as the controller, rely on the bases listed in section 2, and where data leaves your region we use providers offering standard contractual clauses or equivalent safeguards. For US users, we do not sell or “share” personal information as those terms are used in state privacy laws.
9. Children
Homedrawer is for adults managing a home. It is not directed at children under 16 and we do not knowingly collect their information. If you believe a child has created an account, email us and we will delete it.
10. Changes
We will post changes here with a new date at the top and, for material changes, email account holders before they take effect.