The short version
Homebird is built so that we cannot see where you are. Your location, places, photos, nest names, messages, and alerts are encrypted on your phone before they reach our servers, and only the phones in your nest can decrypt them. We do not sell data, show ads, or use trackers.
What we collect
Account: your email address (to sign in), the display name you choose, and your birth year (only to confirm you are 13 or older; other members can’t see it).
Nests: which accounts belong to which nests and their role, plus each phone’s public encryption key.
Encrypted data: locations, places, profile photos, nest names, nest type and family agreement, sharing status, trips and pickup requests, emergency cards (which can include health information such as allergies and medications, if you choose to add it), nest messages, family calendar events and replies, your birthday (month and day only; you can remove it in Profile), family vault documents and notes, arrive-by checks, drive summaries you choose to share, and alerts. We store these only as encrypted data we cannot read.
Timing: when encrypted data was updated, who sent a nest message and when, whether an alert should trigger a notification and, for a pickup request, which member to notify, and, for temporary guest nests, when the nest ends.
Push tokens: if you allow notifications, a token so we can tell your phone that something new arrived. What the notification says is decrypted on your phone; we never send names, places, locations, or message text.
What we cannot see
Where you or anyone in your nest is or has been, the names or locations of your places, your profile photo, your nest’s name, what your messages say, or what any alert says.
How long we keep it
We keep only each member’s latest encrypted location (it is overwritten, not stored as history). Encrypted alerts are deleted after 7 days, and encrypted nest messages after 30 days (you can also unsend your own messages at any time). Your drives (routes and stats) are detected and stored only on your own phone for 7 days; a summary is shared, encrypted, only if you turn that on or agree to a family agreement that asks for it. The 7-day location history in Homebird Plus is stored only on your own phone, encrypted with a key that never leaves it; it is deleted after 7 days, when you sign out, or when you delete the app. Temporary guest nests and everything in them are deleted when they end. When you delete your account, your account data, devices, and encrypted data are deleted, and your nests get a new encryption key.
Who we share with
Service providers that run Homebird: Supabase (database and sign-in), Expo and Apple/Google (delivering push notifications, which carry no readable content), and, for subscriptions, Apple/Google and RevenueCat. They receive only what they need to provide the service, and none of them can read your encrypted data. Address searches, the street addresses shown under each person, and directions use your phone’s built-in map service (Apple or Google) directly: your phone sends that map service the coordinate it needs (never names or your nest). Homebird doesn’t see these lookups. We do not sell or rent personal information.
Children
Homebird is for people 13 and older. We do not knowingly collect information from children under 13. If you believe a child under 13 has an account, contact us and we will delete it.
Your choices and rights
You can pause sharing, switch to share-on-request, leave a nest, or delete your account in the app at any time. Depending on where you live, you may have rights to access, correct, or delete your data. Contact us at support@homebirdapp.com.
Security
Encryption uses libsodium (X25519 sealed boxes and XChaCha20-Poly1305). Private keys stay on your phone. Our full design is described in our public security document. No system is perfectly secure; if you find a problem, please tell us at security@homebirdapp.com.
Changes and contact
We’ll post changes here and update the date above. Questions: support@homebirdapp.com. Homebird, support@homebirdapp.com.