Last updated: 25 October 2026
This policy covers the Homeduo app (iPhone, Apple Watch, Android, Wear OS) and the website homeduo.app.
In short: Homeduo needs no email address and no password. There are no ads, no tracking and no tools of our own for usage analytics or crash reporting. We do not sell data.
1. Who is responsible
Marcel Kietsch, MK Websolution
c/o Autorenglück #32103, Albert-Einstein-Straße 47, 02977 Hoyerswerda, Germany
(service address; place of business in Olsberg)
Email: hello@homeduo.app
We have not appointed a data protection officer because we are not required to. For privacy questions, write to the address above.
2. The website homeduo.app
The website sets no cookies, stores nothing in your browser and loads no content from other servers. Fonts and images are stored on our own server.
The website runs on Cloudflare, Inc. (USA). When you visit, Cloudflare processes technically necessary data, mainly your IP address, the time and the page requested. Without this, no page can be delivered. We do not keep access logs of the website ourselves. Anything Cloudflare briefly logs to keep its network secure is governed by Cloudflare's own terms.
The legal basis is our legitimate interest in running a secure, accessible website (Art. 6(1)(f) GDPR). The website only accesses your device as strictly necessary to display the page (Section 25(2) no. 2 TDDDG).
3. The app: what data, and why
Your account
On first launch, the app creates an anonymous account. It consists of a random identifier, with no email address, no phone number and no password. The server uses it to know which households you belong to and what you may see.
You enter your first name. The others in your household can see it.
What you add in the app
- name and type of the household, a short note for everyone
- areas, tasks with a title, note, due date, recurrence, reminder times, priority, who takes care of them and whose turn it is
- checklists and the shopping list
- who completed something and when, and a "thanks" for it (without text)
- your settings, for example which notifications about others you want to receive
- optional photos for you, areas and tasks
Before uploading, the app reduces photos to at most 1600 pixels and saves them as JPEG. They are kept in private storage. Only members of your household can retrieve them.
Everything you add is visible to all members of the household. You decide what you add. Please do not add anything about others that they would not want shown in the household.
Purpose: so the app works and shows the same data on all devices in the household. The legal basis is the contract for using the app (Art. 6(1)(b) GDPR).
Invitations
Anyone inviting someone creates a six-character code. It is valid for 7 days, or 10 minutes for a child with a phone, and can only be used once. The app reads the QR code on the device. The image does not leave the device.
Anyone entering a valid code sees a preview before joining: the inviting person's first name, the first names of members with their own accounts, the number of areas and whether the household has Plus. A code for a child's phone also shows the child's first name. Legal basis: Art. 6(1)(b) GDPR.
Abuse protection
To prevent anyone from trying out invitation codes, the server stores your account identifier and the time whenever you request an invitation preview or attempt to join, including from watches. After 10 attempts in an hour, further attempts are blocked. Every night, the server deletes entries older than one day. The legal basis is our legitimate interest in a secure service (Art. 6(1)(f) GDPR).
Technical data on every connection
When the app connects to the server, our service providers (section 5) necessarily see your IP address and the time. They log this to run the service and troubleshoot errors. The providers keep these logs only for a limited time under their own rules, usually a few days.
For each sign-in session, the sign-in service also stores the IP address and the technical identifier of the app and system (User-Agent) used to start the session. This protects the account. These details are deleted with the account.
Legal basis: Art. 6(1)(f) GDPR.
Reminders on your device
The app schedules task reminders on your device. The system asks whether the app may send notifications. On Android, the app uses the exact alarm permission for timely reminders and restores the schedule after the device restarts. These reminders do not pass through our server.
Notifications about others
This feature is not yet enabled. However, the server already prepares for it. When someone is assigned something, checks something off or adds a shopping item, it creates an outbox entry. This contains the recipient's identifier, the household identifier, the person's first name and the title. The server deletes these entries after no more than two days.
Once the feature is enabled, the following applies: if you allow notifications, your device registers with Apple or Google and receives a device identifier (push token). We store it with your account. When someone is assigned something, checks something off or adds a shopping item, a notification is sent to the others. It contains the person's first name and the title of the task or item. For this, the notification sits briefly in an outbox on the server and is delivered through the Apple Push Notification Service (Apple Inc.) or Firebase Cloud Messaging (Google). You choose which notifications you receive in the app. You can turn them off completely in your phone's settings.
Legal basis: Art. 6(1)(b) GDPR. You allow the associated access to your device through the system prompt (Section 25(1) TDDDG).
Homeduo Plus subscription
You buy Plus through the App Store or Google Play. Payment and billing are handled entirely by Apple or Google under their privacy policies. We do not see payment details. So that Plus applies to the whole household, the app passes the household identifier to Apple or Google with the purchase. The app checks with Apple or Google whether Plus is active. The date until which Plus is active may also be stored with the household.
On Android, the app uses the Google Play Billing library for this. It checks the purchase status when the app starts and when you return to it. It also sends technical events for purchase processing and troubleshooting to Google, even if you do not buy anything. Google is responsible for this under its privacy policy.
Deleting your account does not cancel a subscription. Cancel it in your Apple or Google account.
Legal basis: Art. 6(1)(b) GDPR.
4. What is stored on your device
A copy of your households' data is stored on your device so that the app also works offline. Changes and deletions reach the other devices the next time they sync.
The following stay only on your device:
- shopping list suggestions from earlier entries
- the selected household, which "thanks" you have seen, the reminder schedule
- search
- data for widgets and the watch. Between iPhone and Apple Watch, this passes directly over the connection between the devices. A Wear OS watch gets its own anonymous account and syncs through the server like a phone.
Apple Reminders and Calendar
If you choose, the app writes your tasks into its own list in Apple Reminders and, with Plus, tasks with dates into its own calendar. The system asks for permission. On iPhone, the system requires full access to reminders or calendars for this. The app still works only with its own list and calendar. Calendar entries may contain the title, due date, recurrence, area, the first names of those responsible and the note. If you check off an entry in Apple Reminders, the app also marks the task as complete in the household.
On iPhone, the list and calendar are stored in the account your device uses by default for reminders and calendars. This is often iCloud, but may be another provider. That provider processes the entries under its own terms, not on our behalf. On Android, the app creates a calendar only on the device, without a cloud account.
Photos and camera
You select photos through the system's photo picker. The app receives only the image you select. It does not gain access to your entire photo library. The app uses the camera only when you tap to take a photo or scan an invitation code. The app reads the code directly on your device, using the free ZXing library on Android. The camera image does not leave your device during scanning.
5. Who processes data for us
| Service | Purpose | Location |
|---|---|---|
| Supabase (contracting party Supabase Pte. Ltd., Singapore) | database, sign-in, photos, notification outbox | data center in Frankfurt am Main (AWS eu-central-1) |
| PowerSync Cloud (JourneyApps) | sync between devices | EU instance |
| Cloudflare, Inc., USA | delivering the website | global network |
| Apple Inc. and Google LLC | notifications to your device, see above | USA and worldwide |
The data processing agreements of Supabase and Cloudflare under Art. 28 GDPR apply. We will enter into such an agreement with PowerSync before the app launches.
Data may reach countries outside the EU, for example through maintenance or sub-processors of these services. These transfers are safeguarded by the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and, for US companies certified under the EU-US Data Privacy Framework, by the Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR).
Within your household, the other members see what you add. Otherwise, we do not disclose anything unless the law requires us to.
6. Children
Adults can add children to the household and confirm that they have parental responsibility.
- Child without a phone: first name, an optional photo, assigned tasks and what the child has completed. The child has no account.
- Child with a phone: additionally, an anonymous account on the child's phone, without an email address. The child can only check off and undo their own tasks. The child's phone also syncs the household's data.
Adults can remove a child at any time. The server then also deletes the anonymous account on the child's phone. It also does this if the whole household is deleted. The app shows no ads and has no open chat. People outside the household can only join with an invitation code.
The legal basis is use of the household by those with parental responsibility (Art. 6(1)(b) GDPR).
7. How long we keep data
| Data | Retention |
|---|---|
| account | until you delete it |
| first name and own photo in a household | until you leave the household or delete your account |
| IP address and User-Agent of the sign-in session | until the session expires or the account is deleted |
| household content | until you delete it, at the latest until the household is deleted |
| photos no longer used anywhere | deleted by the server after no more than 31 days |
| invitation codes | valid for 7 days (child with a phone: 10 minutes); the server deletes used codes immediately and expired codes every night |
| join attempts and invitation preview requests | one day, deleted every night |
| notification outbox | no more than two days |
| push tokens | until you sign out, delete your account or Apple or Google declares the token invalid |
| logs and backups at service providers | for a limited time under the providers' rules |
| accounts not used for a long time | no automatic deletion yet; you can delete your account in the app at any time |
8. Delete, leave, export
Delete account: in the app under Settings, "Delete account". The server then deletes your account, your first name, your own photo and paired watches. If you are the last adult in the household, the whole household is deleted. Otherwise, an entry without a name remains in the others' history. The app shows it as "former member". On your device, the app clears its data, cached photos, scheduled and displayed notifications, the Reminders list, its own calendar and the widgets. The server deletes notification outbox entries and join attempts during its nightly runs.
Without the app: see homeduo.app/en/delete-account.
Leave household: the server removes your membership, your first name and your photo in that household. An entry without a name may remain in the others' history. Your account remains. You can remove anything the app created for this household in Apple Reminders or its own calendar through the app's settings or in the respective application.
Export data: in the app under Settings, "Export my data". You receive a JSON file with the data of all households stored on your device, including shopping list suggestions. Photos appear as paths. Settings, sign-in details and data stored only on the server are not included. You can obtain these on request (section 9).
If you simply delete the app, your account remains on the server. Because it is anonymous, the app cannot find it again afterwards. Delete your account in the app first.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Write to the address in section 1. Since we do not know your email address, we need an indication of which account you mean.
If you have given consent, for example to notifications through the system prompt, you can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). The easiest way is through your phone's settings. This does not affect the lawfulness of processing before the withdrawal.
Right to object
Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), for example for abuse protection and technical data on connection, you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we demonstrate compelling legitimate grounds which override your interests, or the processing is for the establishment, exercise or defence of legal claims. Write to the address in section 1.
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in your country. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2 to 4, 40213 Düsseldorf, www.ldi.nrw.de
You are not required by law or contract to give us data. Without a first name and an account, however, the app does not work.
There is no automated decision-making or profiling under Art. 22 GDPR.
10. Switzerland and the United Kingdom
For users in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies. For users in the United Kingdom, the UK GDPR applies. Your rights are the same as above. You can lodge a complaint with the FDPIC in Switzerland (www.edoeb.admin.ch) or the ICO in the United Kingdom (ico.org.uk).
11. Users in the United States
Categories we collect: identifiers (anonymous account ID, device token), your first name, content you add (tasks, lists, photos), purchase status, and technical data such as IP address. Sources and purposes are described in section 3.
We do not sell personal information and we do not share it for cross-context behavioral advertising, as these terms are defined in the California Consumer Privacy Act. We have not done so in the past 12 months. We do not use or disclose sensitive personal information to infer characteristics about you.
Do Not Track: the app and website do not track you across other sites or apps, and no third party does so through Homeduo. We therefore do not respond differently to Do Not Track signals.
You can access, correct, export and delete your data as described in section 8. If a privacy law of your state gives you further rights, write to us at the address in section 1. We will not treat you differently for using your rights.
Children under 13
Homeduo is a household app for adults and is not directed to children. Parents can add their children to the household. A child's own phone can be paired only by a parent, and the app collects no contact details from the child.
If you are a parent and believe your child has given us data without your consent, write to us. We will delete it.
12. Changes
If the app changes so that it processes different data, we update this policy. The date at the top shows the current version.