1. Introduction

HouseOne is a family location, calendar, and messaging app that helps the people in one household stay connected and safe. HouseOne is operated by Hector DeLeon III, a sole proprietor based in Victoria, Texas, USA ("HouseOne," "we," "us," or "our").

This Privacy Policy explains what information HouseOne collects, how we use it, who can see it, and the choices and rights you have. It applies to the HouseOne mobile app and the services at houseone.ai. By creating an account or using HouseOne, you agree to this policy. If you do not agree, please do not use HouseOne.

2. Information we collect

We collect only what the app needs to work for your family. Everything below is described the way it is actually stored and used.

Account & identity

• Email address — your login identifier. It is visible only to you, not to other family members.
• Password — stored only as a one-way hash (bcrypt); we never store or see your actual password. (Sign in with Google is also supported, in which case Google handles authentication.)
• Display name — shown to your family inside the app.

Family & member profiles may include kids

• Family membership & roles — who is in your family, each member's role (parent, kid, grandparent, caregiver), and who is an admin.
• Managed profiles for children — a parent can create a profile for a child who has no device of their own, including the child's name and, optionally, age, grade, or school.
• Profile details — a chosen color, emoji avatar, nickname, and (optionally) birthday.

Location kid data for kid members

• Location pings — your device's latitude and longitude, shared with your family so you appear on the family map. Today this is foreground-only (while the app is open). If Apple approves an "Always Location" entitlement in the future, background pings would write the same data with the same protections; we will update this policy before enabling that.
• Location accuracy, speed, battery level, connectivity, and a derived motion state — shown to family members as glance-able context (for example, a low-battery warning or "moving" indicator).
• Reverse-geocoded address — a human-readable place name for a location, generated on your device, shown in cards and alerts.
• Places & geofences — places your family saves (like Home or School), with a location and radius, plus internal state used to send an arrival/departure alert only once.

Family activity

• Calendar events — events your family creates (title, time, attendees), and, if you connect it, two-way sync with your own Google Calendar.
• Messages — the content of messages you send in family chat and direct messages, including check-ins.
• SOS events kid data if a kid raises one — when someone presses SOS, an alert with their location is logged and sent to the family.

Safety & travel signals kid data for kid members

• Driving events — hard-brake and rapid-acceleration events, detected on-device from GPS speed changes, used for a weekly family driving report.
• Big-travel events — when consecutive location pings show a jump of more than about 200 miles, HouseOne posts one honest "traveled to <place>" message in family chat.

Waitlist signups (marketing website)

If you enter your email address on our public website at houseone.ai to join the waitlist, we store that address so we can tell you when HouseOne is available. This is separate from an app account — joining the waitlist does not create one.

Website usage (marketing website)

We measure how our public website is used, with our own software rather than a third-party analytics service. We record anonymous events — a page view, scroll depth, time on the page, and whether the waitlist form was submitted — along with the page address, the site that referred you, and your browser type. There are no cookies, no cross-site identifier, and no IP address is stored (only an irreversible hash of it, so repeat visits are not double-counted). If your browser sends a Do Not Track or Global Privacy Control signal, nothing is recorded at all. See section 5 for details and section 6 for how long it is kept.

• Email address — as you typed it, plus a lower-cased copy used only to avoid adding you to the list twice.
• How you arrived — which page or campaign you signed up from, and the referring website address if your browser sent one.
• Browser user agent — the standard description your browser sends with every request.
• A one-way hash of your IP address — used only for spam and abuse limits. The IP address itself is never stored, and the hash cannot be reversed back into it.

We use waitlist emails only to contact you about HouseOne availability. We do not sell them, share them for advertising, or add them to any third-party marketing tool. You can ask us to remove your address at any time using the contact details in section 10.

3. How we use information

We use the information above only to provide HouseOne's features to your family:

• Show family members' locations to each other on the family map.
• Send arrival and departure alerts for the places your family saves.
• Produce a weekly driving report and safety glance-ables for your family.
• Power Nicole, an optional AI family helper who can answer questions and add calendar events when a family member mentions her in chat. Nicole's replies are clearly labeled as AI-generated, and a family admin can turn Nicole off in Settings.
• Keep your account secure and diagnose errors so the app keeps working.

We never use your information for advertising, and we never sell it.

4. Children's privacy (COPPA)

HouseOne is built for families that include children, and we take children's privacy seriously in line with the U.S. Children's Online Privacy Protection Act (COPPA).

• Parental consent. A child's information in HouseOne is provided and controlled by a parent or guardian. A parent creates and manages a child's profile; a child under 13 does not sign up on their own.
• No advertising or tracking on children, ever. We never show behavioral advertising to children and never run third-party analytics or advertising trackers on any child's data.
• Parental oversight. A parent admin can manage a child's location sharing and notification settings, and can see the child on the family map. These controls exist only in a parent's app; a child cannot turn a parent's oversight off.
• Deletion. A parent can delete a child's profile at any time. Deleting the parent's own account removes the family's data as described in section 6.
• Error monitoring is limited. Our error-monitoring tool (see section 5) never receives any data about a child — a child's managed profile never becomes part of an error report.

If you believe a child's information has been collected without proper parental consent, contact us at hectordeleon91@gmail.com and we will delete it.

5. Data sharing & third parties

We do not sell your data and we do not share it for advertising. Within HouseOne, your information is visible only to members of your own family (and, for location and child data, to family members only). We use a small number of service providers strictly to make the app work:

Our public website at houseone.ai makes no third-party requests at all. The typefaces it uses are served from our own domain, so visiting the site does not hand your IP address or browser details to anyone else. There are no advertising pixels and no tracking cookies on it.

We measure the website ourselves, and the measurements never leave our servers. Instead of Google Analytics or any other third-party tool, houseone.ai runs a small script served from our own domain that records anonymous usage — page views, how far down the page people scroll, how long they stay, and whether they joined the waitlist. It uses no cookies and no cross-site identifier. We do not store your IP address: it is converted into an irreversible hash (with a secret value only we hold) purely so repeat visits are not double-counted. If your browser sends a Do Not Track or Global Privacy Control signal, we record nothing at all — and that decision is enforced on our server, not just in the page, so it cannot be bypassed. This data is never sold, never shared, and never used for advertising. None of it is ever collected about a child, because it only runs on our public marketing site.

We may also disclose information if required by law, or to protect the safety, rights, or property of our users or the public.

6. Data retention

• Location pings: kept on a 7-day rolling basis and automatically pruned.
• Driving events, SOS events, and big-travel logs: kept for 30 days.
• Account, family, calendar, and message data: kept while your account is active; you can remove it by deleting your account.
• Waitlist signups (website): kept until HouseOne launches publicly and for 90 days afterwards, then deleted. You can ask to be removed sooner at any time.
• Website usage measurements: kept for 180 days, then deleted. These contain no name, no email, no IP address and no cookie — see section 5.
• Deleted accounts: when you delete your account in the app, it is immediately deactivated and scheduled for permanent deletion after a 30-day grace period, after which your account data is permanently purged.

7. Your rights & choices

Depending on where you live, you may have rights under laws such as the California Consumer Privacy Act (CCPA) and the EU/UK General Data Protection Regulation (GDPR). HouseOne extends these choices to everyone:

• Access. You can view your family's information directly in the app.
• Delete. You can delete your account and personal data at any time from Settings → Delete account (a two-step confirmation, then a 30-day grace period before permanent deletion).
• Export. To request a copy of your data, email us at hectordeleon91@gmail.com (an in-app export is planned for the future).
• Location control. You control whether you share your location, in Settings and through your device's system permissions. (Parent admins may require a child's sharing, as described in section 4.)
• No sale / no ads. We never sell your data or use it for advertising, so there is nothing to opt out of on that front.

To exercise any right or ask a question, contact us at hectordeleon91@gmail.com.

8. Data security

• All traffic between the app and our servers is encrypted in transit using HTTPS/TLS.
• Passwords are stored only as bcrypt hashes; session tokens are stored only as hashes, never in plain text.
• Google Calendar authorization tokens are encrypted at rest (AES-256-GCM).
• Secret keys and credentials are kept in server environment configuration, never in the app or in our public code.

No method of transmission or storage is 100% secure, but we work to protect your information using reasonable, industry-standard measures.

9. Changes to this policy

We may update this policy as HouseOne grows. When we make a material change, we will update the effective date above and notify you in the app or by email. Continued use of HouseOne after a change means you accept the updated policy.

10. Contact us

Questions about this policy or your data? Reach us at:

HouseOne — Hector DeLeon III
Email: hectordeleon91@gmail.com
Victoria, Texas, USA