Privacy policy

Effective August 31, 2026. This policy covers hivestead.co and every Hivestead app (Chores, Journal, Budget, Drive), on the web and in our mobile apps. The short version lives at privacy commitments; this page is the precise version. If they ever disagree, this page wins and we fix the other one.

Who we are

Hivestead is built and operated by Hivestead Labs (Virginia, USA). Contact: [email protected].

What we collect, and why

• Adult account: your email address. It is how you sign in (one-time emailed codes) and how we reach you about your account. No passwords exist anywhere in Hivestead.
• Kid profiles: a first name (or nickname) and an avatar chosen by a parent. We do not collect a kid's email, birthdate, school, location, contacts, or photos of the kid. Kids never create accounts; a parent pairs a kid's device using a one-time code.
• The content your family creates: chores and rewards, journal entries and mood check-ins, budget figures and receipt photos you choose to capture, and driving practice logs. This content exists so the product works, and for no other purpose.
• Operational records: standard server logs (status codes and timing, with failure classes rather than identities) kept briefly for reliability and security, and the records needed for billing when paid plans exist.

What we deliberately do not do

• No advertising, no ad identifiers, no third-party trackers, no analytics SDKs.
• No sale, rental, or sharing of personal data for anyone else's marketing, ever.
• No bank logins. Budget data arrives only as files you upload and photos you take.
• No profiling and no automated decisions with legal effect.

Children

Hivestead is a family product directed at parents. Kid profiles are created and controlled entirely by a parent, contain only a name and an avatar, and kid devices are paired by the parent. We collect no personal information from children beyond what the parent enters, and a parent can edit or delete a kid profile at any time. If you believe a child has given us information outside this design, write to [email protected] and we will delete it.

Where your data lives

Data is stored in the United States with our hosting providers (DigitalOcean for compute and databases, Cloudflare for networking and photo storage). Every family's data is isolated from every other family's twice: in the application and again with row-level security inside the database. Photos and receipts are stored privately and served only through your signed-in session.

Retention and deletion

• Your content stays as long as your hive exists.
• Deleting your hive deletes its data immediately from the live systems.
• Encrypted backups age out within 30 days, after which deleted data is gone from those too.
• You can export your data at any time as ordinary files (JSON plus your photos).

Sharing

We share data only with the processors that run the service (hosting, email delivery for sign-in codes, and payment processing when you subscribe), each bound to use it solely to provide their service to us, and when the law genuinely requires it. There are no other recipients.

Security

All traffic is encrypted in transit. Backups are encrypted before they leave the server. Sign-in codes are single-use and short-lived. There are no passwords to breach. We keep the attack surface small on purpose: no third-party scripts run in the apps.

Your rights

You can access, correct, export, or delete your family's data from within the product, or by writing to [email protected]. We answer within 30 days. If you are in a jurisdiction with specific privacy rights (GDPR, UK GDPR, CCPA and similar), those rights apply and the same address handles them.

Changes

If this policy changes in a way that matters, we will say so plainly on this page and, for material changes, by email. We will never quietly weaken the commitments above.