Privacy Policy

Last updated: April 30, 2026
Effective: April 30, 2026

HomeBase is a home maintenance app operated by Tendry, LLC, a Delawarelimited liability company (“HomeBase, ” “we,” “us,” or “our”). HomeBase helps you keep track of the services your home needs, the providers who do that work, what you spent, and when each task is due next. This Privacy Policy explains what information we collect, why we collect it, how we use it, who we share it with, and the choices you have. We have written it in plain English. If anything is unclear, email privacy@homebaseapp.io.

This policy applies to the HomeBase website at homebaseapp.io, the web application, our marketing pages, and any other product or service that links to this policy.

The short version

• We collect only what we need to make HomeBase work for you.
• We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising.
• We do not use your home data, services, providers, receipts, or uploaded files to train artificial intelligence models, ours or anyone else's.
• You can export everything we have on you at any time.
• You can delete your account and all of your data at any time.
• We are based in the United States and our vendors process data in the United States.

Information we collect

Account information

When you create an account we collect your email address and a password. Passwords are hashed before they reach our database; we never see them in plaintext and we cannot recover them for you. You can optionally provide your name and a profile photo.

Your home profile

To suggest services and providers that fit your home, we ask you for information about your property: street address, city, state, ZIP code, year built, square footage, home type, move-in date, and a set of optional details about your systems and features such as heating, cooling, electric, gas, water source, sewer, water heater, plumbing, bedrooms, bathrooms, interior, stove, appliances, exterior, roof, driveway, garage, and outdoor features. Address information is geocoded to coordinates so we can find providers near you. You can edit or delete any of this information at any time from your profile.

Services, providers, and history

Anything you put into HomeBase belongs to you. This includes the services you track, the providers you save and rate, completion records (the date a service was done, the provider who did it, what you paid, and any notes you add), and any photos or receipts you attach. We use this information only to provide HomeBase to you.

Forwarded email and attachments

HomeBase gives each account a private email address at the in.homebaseapp.io domain. When you forward an invoice, quote, or receipt to that address we receive the message and any attachments, parse them, and propose a matching service event for you to approve. We retain the original message body and attachments on your behalf so you have a copy of the source document. We verify SPF and DKIM on inbound mail and reject messages that fail authentication. There are size and attachment-count limits described on our Security page.

Usage information

We collect basic information about how the product is used: which pages you visit, which features you interact with, browser and device metadata such as user agent, screen size, and approximate location derived from your IP address, and the time and outcome of requests. This helps us understand what is working and what is not. We do not link this information to data brokers or advertising networks.

Cookies and similar technologies

We use a small number of cookies and equivalent local storage entries:

• Strictly necessary: session tokens that keep you logged in, CSRF tokens that protect form submissions, and preferences like your last selected page. These cannot be turned off without breaking the product.
• Product analytics: we use PostHog to understand feature usage. PostHog uses first-party cookies that respect Do Not Track and Global Privacy Control signals. We do not share this data with advertisers.
• Performance: Vercel Analytics measures basic page load timings without setting third-party cookies.

We do not run third-party advertising cookies, retargeting pixels, or social media trackers.

Communications with us

If you email us we keep that correspondence so we can respond and maintain a record of support history. If you fill out our contact form we receive your name, email address, and message.

How we use your information

We use the information described above to:

• Provide, maintain, and improve HomeBase, including showing you relevant services and providers, calculating when each service is due next, and storing your history.
• Send service reminders, account notifications such as password resets, and occasional product announcements. You can opt out of non-essential email at any time.
• Authenticate you, prevent fraud and abuse, and enforce our Terms of Service.
• Diagnose and fix bugs, monitor performance, and prevent or investigate security incidents.
• Comply with legal obligations and respond to lawful requests from government authorities.
• Aggregate de-identified information to understand product trends. For example, we may report internally on the average number of services tracked per home. Aggregated and de-identified data is not personal information and is not subject to this policy.

How automated processing and AI fit in

HomeBase uses the Anthropic Claude API to read invoices and receipts you forward to your private HomeBase email address. The model extracts structured fields (service name, category, provider name, cost, date, notes) and proposes a draft service event for you to review. You always see the proposal before it is committed to your history, and you can edit or dismiss it.

We send only the email body and the necessary attachments to Anthropic for this single task. Per Anthropic's API terms, your content is not used to train Anthropic's models, and API logs are retained for a short period for abuse prevention only. We do not use any personal information for automated decisions that produce legal or similarly significant effects on you.

Information we share

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only in the following limited situations:

• Service providers (sub-processors). We rely on a small number of vendors to operate the service. Each one only handles the data needed to do its job, and is bound by a written data processing agreement. The current list is below.
• Legal and safety. We may disclose information if we believe in good faith that disclosure is necessary to comply with a law or legal process, to enforce our terms, to protect the rights or safety of HomeBase or others, or to investigate fraud.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
• With your direction. If you choose to share something, for example by exporting your data and sending it to a contractor, that disclosure is on your terms.

Sub-processors

We use the following sub-processors. Each one is contractually required to protect your data and to use it only for the purpose described.

If we add or change a sub-processor we will update this list. We will not add a sub-processor that requires us to sell or share your data for advertising purposes. You can request to be notified of sub-processor changes by emailing privacy@homebaseapp.io.

Provider directory

HomeBase maintains a separate directory of approximately half a million home service businesses. The directory is built from publicly available business information (name, category, phone, website, public reviews, city, state, ZIP). The directory is not your personal information; it exists so that when you add a provider HomeBase can suggest matches. We do not sell or share access to this directory with third parties.

How long we keep your information

We keep your account data for as long as your account is active. If you delete your account or your account is closed:

• Live database records (your profile, services, providers, history, uploads, inbound receipts) are deleted within thirty days.
• Encrypted database backups age out of our system within ninety days. We do not selectively restore individual records from backups.
• System and access logs are retained for up to ninety days for security and debugging.
• Email logs at our outbound email vendor are retained for up to forty-five days.
• Anthropic API logs for forwarded-receipt extractions are retained by Anthropic for up to seven days for abuse prevention only.
• Records we are legally required to keep (for example, financial records or records subject to a legal hold) are retained for the period required by law.

Your choices and rights

Everyone

You can, at any time:

• Edit your profile, services, providers, and uploads.
• Export your data from account settings as a portable file (currently JSON; CSV export is coming).
• Delete individual records or your entire account.
• Opt out of non-essential email by following the unsubscribe link in any message or by emailing privacy@homebaseapp.io. You will still receive transactional messages such as password resets.

If you live in California

The California Consumer Privacy Act (CCPA), as amended by the CPRA, gives California residents specific rights. For the categories of personal information we collect, the categories of sources we collect from, the business or commercial purposes for which we collect it, and the categories of third parties to whom we disclose it for a business purpose, please see the table below.

You have the right to know, the right to delete, the right to correct, the right to portability, and the right to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing for you to opt out of in that regard. We honor the Global Privacy Control browser signal as an opt-out where applicable. To exercise any right, email privacy@homebaseapp.io. We will verify your request by reference to information already on file (typically the email address on your account). You may use an authorized agent; we will require proof of authorization. We will not discriminate against you for exercising these rights.

If you live in the European Economic Area or the United Kingdom

The General Data Protection Regulation gives you the right of access, rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with your local supervisory authority. The legal bases on which we rely:

• Contract. Most processing is necessary to deliver HomeBase to you.
• Legitimate interests. Product analytics, security monitoring, and abuse prevention are based on our legitimate interest in operating a safe and reliable service. You can object to any of this by contacting us.
• Consent. Optional features and non-essential email rely on your consent, which you can withdraw at any time.
• Legal obligation. When we must respond to a lawful request.

HomeBase is based in the United States. When you use HomeBase from outside the United States, your information is transferred to and processed in the United States. Where required, we rely on the European Commission's Standard Contractual Clauses and equivalent UK and Swiss frameworks for these transfers.

If you live in another US state with a privacy law

Several US states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) have enacted consumer privacy laws. These laws give you rights similar to the CCPA. To exercise any right, email privacy@homebaseapp.io.

Children

HomeBase is intended for adults who own or maintain a home. It is not directed at children under thirteen, and we do not knowingly collect personal information from children under thirteen. If you believe a child has provided us with personal information, contact us and we will delete it.

Security

We use encryption in transit and at rest, row-level access controls in our database, hashed passwords, audited infrastructure, and a documented vulnerability disclosure process. Full details are on our Security page. No system is perfectly secure. If you ever suspect your account has been compromised, contact us immediately and rotate your password.

Changes to this policy

We may update this policy from time to time. If we make a material change we will notify you by email and update the “last updated” date at the top. Your continued use of HomeBase after a change takes effect means you accept the updated policy.

Contact

For privacy questions, requests to exercise your rights, or complaints, email privacy@homebaseapp.io. For general questions, email hello@homebaseapp.io. You can also write to us at:

Tendry, LLC
c/o Privacy
[Mailing address to be added]