Privacy notice
Version: 2026-08-28
Effective: 28 August 2026
This notice tells you how LohiSoft s.r.o. processes personal data when you use Homnest: the iOS and Android apps, the web app at https://app.homnest.eu, and the marketing site at https://homnest.eu. It is given under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Controller
The controller is:
LohiSoft s.r.o.
Komenského 317/135
943 01 Štúrovo
Slovak Republic
Company ID (IČO): 53253914
Tax ID (DIČ): 2121316725
VAT ID (IČ DPH): SK2121316725
Privacy and legal contact: hello@lohisoft.com
Product support: support@homnest.eu
We have not appointed a Data Protection Officer. Article 37 GDPR does not require us to designate one in our current circumstances. Questions about this notice go to hello@lohisoft.com.
2. What Homnest is
Homnest is household software. One Home is one subscription. Members join a Home that already exists, including on the web. You cannot buy a subscription on the website. Purchases are in-app purchases in the Apple App Store or Google Play; Apple or Google is the merchant of record.
3. Categories of personal data
3.1 Account and Home
- Email address, password hash (Argon2id; we do not store the password), display name.
- Email-verification status and related tokens.
- Home membership, role (Administrator, Parent, Adult, Teen, Child, or a custom group) and permissions.
- Device identifiers used to register push tokens and to scope a session.
- Support messages you send from the marketing site or by email (name, email, message).
3.2 Data stored with server-side AES at rest
We can read this class of data when we operate the service, when you ask for an export, or when the law requires it:
- Calendar events and related settings.
- Tasks and reminders (non-E2E fields).
- Finance records and budgets.
- Shopping-list metadata (not receipt photos).
- Home settings and household metadata.
- Audit logs (security and permission events; some identifiers are pseudonymised on account deletion).
3.3 End-to-end ciphertext (zero-knowledge)
We store ciphertext and technical metadata (for example timestamps, conversation or call identifiers, size). We cannot decrypt the content. If the Home key is lost, that content is gone.
This class includes:
- Messages and encrypted mention lists.
- Calls, call signalling metadata we need to connect peers, and call recordings.
- Photos, receipts, and file attachments.
- Live location pings, last-known location, location history, favourite places and geofence definitions (coordinates live only in ciphertext). Sharing preferences (who may see you, precision level, ghost mode, schedule) are stored as plaintext metadata so we can enforce them without seeing coordinates.
3.4 Data we do not collect as described here
We do not use an SMS provider. We do not put Homnest behind a CDN. We do not run product analytics, advertising pixels, crash reporters such as Sentry, or similar trackers in the apps or on the marketing site.
3.5 Data from Apple and Google
If you subscribe on a store, Apple or Google send us the minimum we need to know whether the Home is entitled (transaction identifiers, product id, expiry, environment). They remain controllers of the payment itself. See their privacy notices.
3.6 OS and local storage
On a device we store a session token (JWT), a device id, and application data in localStorage and IndexedDB (including a wrapped copy of keys on the client). That is not a cookie. See the cookie policy.
4. Purposes and legal bases
| Purpose | Data (summary) | Legal basis |
|---|---|---|
| Create and run your account and Home membership | Account, roles | Contract, Art. 6(1)(b) GDPR |
| Provide calendar, tasks, finance, shopping metadata, Home settings | AES-at-rest household data | Contract, Art. 6(1)(b) |
| Store and relay E2E ciphertext | Ciphertext + metadata | Contract, Art. 6(1)(b) |
| Push delivery (APNs / FCM) | Device token; generic or non-E2E notification text | Contract, Art. 6(1)(b); for the OS permission, your device setting |
| Optional location sharing | Sharing metadata; ciphertext of coordinates | Consent, Art. 6(1)(a) (opt-in; off by default) |
| SOS: alert household; 30-minute exact-location override | SOS event metadata; location ciphertext at exact precision | Consent for SOS features you trigger; legitimate interest of household members in an emergency, Art. 6(1)(f), and vital interests where Art. 6(1)(d) applies |
| Call recording (only if every participant agrees) | E2E recording ciphertext | Consent of all participants, Art. 6(1)(a) |
| Entitlement after an in-app purchase | Store transaction fields | Contract, Art. 6(1)(b) |
| Security, abuse, fraud, rate limits, audit | Logs, IP on request, device id | Legitimate interests, Art. 6(1)(f) |
| Account deletion, tax and accounting records we must keep | Billing entitlement metadata | Legal obligation, Art. 6(1)(c), where applicable |
| Answer a support or DSA notice | Contact fields, ticket metadata | Contract or legitimate interests, Art. 6(1)(b) or (f); legal obligation for DSA notices, Art. 6(1)(c) |
| Marketing email | We do not send marketing from this site | Consent would be required, Art. 6(1)(a) — not sought here |
We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22 GDPR). Entitlement (trial / paid Home) is a contractual status, not a profiling decision.
5. Location, SOS and calls
Location sharing is off until you turn it on. You choose who in the Home can see you and at which precision (city / about 100 m / exact). Ghost mode and schedules are enforced on the server using that metadata, without reading coordinates.
If you trigger SOS, for 30 minutes we override ghost mode and schedules and share exact precision with the SOS recipients. SOS is push only. There is no SMS.
A call recording starts only if every participant consents. Recordings are E2E. We cannot play them back.
TURN (turn1.lohisoft.com) relays encrypted media when a direct peer connection is not possible. The relay does not keep a recording of the call.
6. Recipients
We use processors listed in the subprocessor list. In short:
- MongoDB Atlas — EU (Frankfurt) — database.
- Amazon Web Services — EU (
eu-central-1) — object storage for files (ciphertext for E2E objects). - Our own VPS in the EU — API, web, admin, Redis used as an event bus, map tiles.
- Our own SMTP — transactional mail (verification, invitations, similar).
- Our own coturn —
turn1.lohisoft.com.
Apple Inc. (APNs) and Google LLC (FCM) receive a device token and the notification payload so the OS can show a push. Apple and Google are independent controllers for Store billing.
Staff who handle support see ticket text and account metadata. They cannot decrypt E2E rooms.
We disclose data if Union or Member State law requires it, or to establish, exercise or defend legal claims. We cannot hand over plaintext of E2E content we do not hold.
7. Transfers outside the EEA
Household data at rest is in the EU (Atlas Frankfurt, S3 EU, VPS EU).
Pushes and store billing involve the United States:
- Google LLC — EU–US Data Privacy Framework certification. Transfer basis: Art. 45 GDPR and Commission Implementing Decision (EU) 2023/1795, for as long as Google remains on the DPF list. Where Google acts as our processor for FCM, Art. 28 terms also apply.
- Apple Inc. — where Apple is DPF-certified, Art. 45 likewise. Otherwise we rely on Art. 46 GDPR: the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), as incorporated in Apple’s applicable developer or data-transfer terms. Check the DPF list for the current status; we do not treat a lapsed certification as adequacy.
You may ask hello@lohisoft.com for a copy of the relevant clauses, with commercial secrets redacted.
8. Retention
| Data | Period |
|---|---|
| Account after you request deletion | 30 days grace, then purge over the following 60 days (90 days in total), except where a shorter or longer statutory period applies |
| Location history (E2E, only if you enabled server sync) | 30-day MongoDB TTL on recorded_at |
| Previous Home-key versions after rotation | 90 days; the current version is kept while the Home exists (daily purge job) |
| Push delivery receipts | Intended 90 days. Technically enforced by a MongoDB TTL index on sent_at for as long as that index exists |
| Push retry queue | 7 days TTL |
| Password-reset and similar tokens | Until expiry |
| Audit log | Up to 365 days TTL, then deletion or pseudonymisation as designed |
| Support / contact-form messages | Until answered and for a limited follow-up, unless a legal hold applies |
| Store entitlement records | For the life of the Home plus a limited close-out, and as tax law requires |
E2E ciphertext is deleted with the account or Home purge. Deleting ciphertext does not recreate a lost Home key.
9. Security
Passwords are hashed. E2E modules use per-Home keys held on devices (XChaCha20-Poly1305). AES-at-rest modules are encrypted in the database. Device push tokens are stored encrypted at rest. Transport uses TLS. We do not log E2E plaintext.
10. Your rights
You may request:
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction (Art. 18)
- Portability (Art. 20)
- Objection to processing based on legitimate interests (Art. 21)
- Withdrawal of consent where we rely on consent (location sharing, call recording, SOS features you can switch off), without affecting processing before withdrawal
Use in-app privacy tools where they exist, or email hello@lohisoft.com. We may need to verify that the request comes from you.
Export (Art. 15 / 20)
An export contains AES-at-rest modules as JSON we can decode, and E2E modules as ciphertext plus a manifest. We cannot turn E2E content into readable files. Decryption happens only on a device that still has the Home key. If the key is gone, that part of the archive stays unreadable.
11. Children
Independent account
An independent account (own email) is for a person who has reached the digital age of consent of the EU Member State that applies to them. GDPR Article 8 default is 16; Member States may lower it, not below 13.
| Age | Member States |
|---|---|
| 16 | Germany, Hungary, the Netherlands, Slovakia, Poland, Romania, Croatia, Ireland, Luxembourg |
| 15 | France, Greece, Czechia, Slovenia |
| 14 | Austria, Bulgaria, Cyprus, Spain, Italy, Lithuania |
| 13 | Belgium, Denmark, Estonia, Finland, Latvia, Malta, Portugal, Sweden |
Registration (POST /auth/register) requires a date of birth (birth_date) and applies this Art. 8 age (with country_code when given). Below that age we do not issue an active independent account. We ask for a parent or guardian email (parent_email); the account stays pending until that person confirms. Greece is GR (ISO 3166-1); Slovenia is 15 (ZVOP-2 Art. 8).
National contract-capacity rules (often 18) still apply to forming a paid contract (Art. 8(3) GDPR). Only a Home Administrator buys; that person must be able to contract with Apple or Google under store and national rules.
We do not knowingly keep an active independent account for a child below the applicable Art. 8 age. If you believe we have one, write to hello@lohisoft.com.
Managed Teen / Child inside a Home
A parent (or other authorised adult in the Home) may create a Teen or Child profile from age 6. That profile has no separate email. It is not an independent information-society contract with the child. App Store age rating is 13+; Google Play is PEGI 12 / IARC 13. Store rules and Homnest roles both apply.
12. Cookies and similar storage
See the cookie policy. The marketing site sets homnest_locale (strictly necessary). The native apps do not show a cookie banner.
13. Supervisory authority
You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov, ÚOOÚ), Hraničná 12, 820 07 Bratislava 27, Slovak Republic, https://dataprotection.gov.sk/, or with the authority of the Member State where you live, work, or where the alleged infringement occurred.
14. Changes
We will publish a new version date when this notice changes. Continued use after the effective date is use under the updated notice, except where the law requires consent again.
Version 2026-08-28.