Privacy Policy

Hearth is a shared household finances app, on the web and on iPhone. It is run by Guilherme Toti, an individual developer. In this policy, “we” and “us” mean him. He decides how your data is used, and you can reach him at guilhermetoti@gmail.com.

This policy covers the Hearth web app, the Hearth iOS app and the Hearth service behind them. If you run your own copy of Hearth from its open-source code, you are the one handling your data, and this policy does not apply to that copy.

We only collect what Hearth needs to work.

• Your account. Your name, your email address and your password. We never store the password itself, only a salted hash of it.
• Your sign-ins. For each device you are signed in on, we keep a session with the IP address and the browser or device description (user agent) it signed in from, and when it was created and when it expires. A session lasts up to 30 days and is renewed while you use the app.
• Your household’s finances. Everything you and your household members enter: the household’s name, currency, locale and time zone; accounts and their balances; transactions with their amount, date, category, payee and note; categories; budgets; recurring bills, income and subscriptions; savings goals and contributions; and invites to join the household.
• What Hearth writes for you. Weekly snapshots, the questions you ask Ask Hearth and its answers, and follow-up questions on a snapshot.
• A change log. A record of what changed in the household, when, and which member made the change. It powers “added by” and keeps every device in sync.
• Server logs. Our server logs each request: the method, the path and the IP address it came from. We use them to keep the service running and to stop abuse. Passwords, session cookies and tokens are kept out of the logs.

On your device. To keep you signed in, the web app uses a session cookie and the iOS app keeps your session token in the iOS Keychain. Both apps remember small preferences, like your theme and which household is open. The web app keeps a copy of recently loaded data, and any entries you added while offline, in your browser’s storage so it works without a connection. This data stays on your device.

What we don’t collect. Hearth has no analytics, no advertising, no tracking and no third-party crash reporting, on the web or on iOS. It does not connect to your bank. It does not ask for your location, contacts, photos or anything else on your device. We don’t track you across other apps or websites.

• To run Hearth: store your household’s data, show it to you and your household, and sync it live.
• To sign you in, and to email you a sign-in link or a password reset link when you ask for one.
• To answer your questions in Ask Hearth and to write your household’s weekly snapshot.
• To keep the service secure, for example by limiting how many requests one IP address can make.

We don’t sell your data, we don’t share it for advertising, and we don’t use it to build a profile of you. We don’t send you marketing email.

If you are in the European Economic Area or the UK: we use your data to provide the service you signed up for (performance of a contract), to keep it secure (our legitimate interest), and, for payees and notes in the AI features, because your household chose to share them (consent, which you can withdraw at any time).

Ask Hearth answers questions about your household’s money, and the weekly snapshot summarizes your week. Both are written by an AI model from Anthropic. Nothing is sent to Anthropic until you allow it. The app asks each member the first time they use these features, and you can turn “Use Hearth’s AI” off in Settings at any time. The weekly snapshot is written on its own on Mondays only for households where an owner has allowed it. Once allowed, our server sends Anthropic the information the answer needs:

• Your question, and the recent questions and answers in the household’s conversation.
• Your name, and the household’s currency, locale, time zone and today’s date.
• Amounts, dates and totals: balances, spending by category, budgets, upcoming bills, the forecast, and your goals with their names and progress.
• The names of your categories.

Payees and notes stay private by default. Transaction payees and notes, and the names of your accounts and recurring bills, are sent only if your household turns on “Share payees with the assistant” in Settings. It is off unless an owner turns it on, and only an owner can change it. The weekly snapshot never includes transaction notes.

Before Ask Hearth answers, a smaller Anthropic model reads your question to check that it is about your household’s money. Anthropic processes this data to produce the answer and sends it back to us; under its commercial terms, it does not use this data to train its models. The answers are stored in your household like the rest of your data.

Your household. Hearth is built for sharing. Everyone in a household sees everything in it: every account, transaction, budget and goal, who added each entry, the weekly snapshots, and the Ask Hearth conversation. Any member can export all of the household’s data. Only invite people you want to share your finances with.

Service providers. We use a few companies to run Hearth. They process data only on our behalf and only to provide their service:

• Railway hosts our server and the database where your data is stored.
• Vercel hosts the web app. Requests from the web app to our server pass through it.
• Resend sends our emails (sign-in links and password resets). It receives your email address and the email’s content.
• Anthropic provides the AI model behind Ask Hearth and the weekly snapshot, as described above.

If you install the iOS app, Apple handles the download and any reviews or support through the App Store under its own privacy policy. Hearth does not share data with Apple.

The law. We may disclose data if the law requires it, or to protect the safety of people or the service. We will tell you first when the law allows it.

We keep your data for as long as your account exists, so your household’s history is there when you come back. When you delete something in Hearth, it is deleted from our database. A household owner can also start the household fresh, which deletes its accounts, transactions, budgets, goals, recurring items and snapshots.

Sessions end when you sign out or after 30 days without use. Server logs are kept by our hosting provider for a limited time and then deleted. Copies in our providers’ backups, if any, are deleted on their schedule.

• See and export your data. Everything is visible in the app. Settings → Export data downloads your household’s data as JSON (everything) or CSV (transactions).
• Correct it. You can edit your name, entries and settings in the app at any time.
• Limit or stop what the AI sees. Turn “Use Hearth’s AI” off in Settings to stop sending anything, or ask an owner to turn “Share payees with the assistant” off.
• Delete your account. In the app, go to Settings → Your account → Delete your account. This deletes your account and your sessions, and every household where you are the only member, with all of its data. In a household you share with others, you are removed from it, ownership passes to another member, and the household’s data stays with the remaining members, because it is theirs too. Entries you added there stay in the household.

Depending on where you live (for example in the EEA, the UK or California), you may have further rights, such as to access, correct, delete or port your data, to object to or restrict how it is used, and to withdraw consent. To use any of them, or if you can’t use the app, email guilhermetoti@gmail.com. We will answer within 30 days. You can also complain to your local data protection authority. We never sell or share personal data for advertising, so there is nothing to opt out of there.

All traffic between the apps and our server is encrypted with HTTPS (TLS). Passwords are stored only as salted hashes. Session tokens are kept in a secure cookie on the web and in the Keychain on iOS. Each household’s data can only be read by its members, and requests to our server, sign-ins included, are rate-limited.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you without undue delay.

Our service providers process data in the United States, and may process it in other countries where they operate. If you live elsewhere, your data is transferred there. We rely on our providers’ standard safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses where they apply.

Hearth is not directed to children. You must be at least 13 to use it, or at least 16 in the European Economic Area. We don’t knowingly collect data from younger children. If you believe a child has created an account, email guilhermetoti@gmail.com and we will delete it.

If we change this policy, we will update it here and change the effective date at the top. If a change matters, for example a new kind of data or a new service provider, we will tell you in the app or by email before it takes effect.

Questions, requests or complaints about your privacy go to Guilherme Toti at guilhermetoti@gmail.com. Using Hearth is also covered by our Terms of Use.