Privacy Policy

Who this applies to

This policy explains how Homefront Pro handles personal information when you use homefront.pro, our dashboard, a Homefront Pro mobile app, or a pro's client portal. It applies to both:

• Pros: account holders running their business on Homefront Pro.
• Homeowners: clients who view estimates, approve work, sign documents, or pay invoices through a pro's portal.

Our role with client information

A pro decides what client information to add to Homefront Pro and why to use it for that pro's business. In that situation, the pro is generally responsible for its relationship with the client and for responding to requests about that business information. Homefront Pro processes that information to provide the service, secure it, and meet legal obligations. We may also use limited information as an independent business for security, support, billing, and legal compliance.

What we collect

From pros

• Name, email, phone, account credentials, and sign-in details when you use Google or Apple sign-in.
• Business info: company name, address, website, logo, team members, years in business, services you offer.
• License, insurance, bonding, and certification details you choose to show clients.
• Content you create: estimates, invoices, clients, photos, documents, messages.
• Subscription, payment, and payout information from Stripe or, for iOS subscriptions, Apple and RevenueCat. Payment processors handle card and bank-account details; Homefront Pro does not store full card or bank-account numbers.

From homeowners

• Name, email, phone, and property address.
• Your signature (drawn or typed) when you approve an estimate or sign a document.
• Signature details, consent text, IP address, browser details, and a timestamp when you sign a document. We keep this audit information to support the signing record.
• Messages, approvals, payments, and anything else you do on the portal.

Collected automatically

• IP address, browser, device, and pages you visit, used for security, troubleshooting, and to keep the service running.
• Push notification tokens, only if you turn on push notifications. On the web this is a Web Push endpoint; in our iOS and Android apps, it's an Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) token.
• Error and performance reports, including technical details about the device, browser, request, and error. We configure these reports to filter direct personal information where practical.
• Product-use and performance information collected through Vercel Analytics and Speed Insights to understand how the service performs and is used. We do not use it for personalized advertising.
• If you allow analytics cookies on our marketing site, Google Analytics measures page visits and marketing actions. We use those reports to understand which marketing pages bring in new pros.
• Cookies and similar storage for sign-in, language preference, security, and your marketing-analytics choice. Marketing analytics run only after you allow them and you can decline them from the banner when you visit the marketing site.

When you use address search or a map, we send the address or search text needed for that feature to Google Places or Mapbox.

Our iOS and Android apps

Our mobile apps use a few device features. Each one only runs when you choose to use it:

• Camera: to take photos of job sites and attach them to estimates and invoices. We only access it when you tap the camera button.
• Photo library: to attach existing photos to estimates and invoices. We only see the photo you pick.
• Push notifications: only after you grant permission. You can turn them off anytime in your device settings or in the app's Notification Preferences.
• Subscriptions: iOS subscriptions are processed through Apple and managed with RevenueCat. Apple's App Store terms and privacy information also apply to those purchases.

We don't track you across other companies' apps or websites for advertising. We don't use Apple's App Tracking Transparency identifier (IDFA), and we don't share your data with advertising networks or data brokers. Our Apple App Privacy declarations and PrivacyInfo.xcprivacy manifest describes the categories of data collected in the iOS app.

How we use it

• Run the service and keep your account working.
• Send estimates, invoices, reminders, and receipts.
• Process payments and pay pros through Stripe.
• Prevent fraud, abuse, and security problems.
• Answer your support questions.
• Improve the product based on how people use it.
• Meet legal, accounting, and recordkeeping obligations.

Who we share it with

We share the minimum needed to run the service. Here's every provider we use and the reason we use it:

• Stripe: payment processing and payouts to pros.
• Resend: sending transactional email (estimates, invoices, receipts).
• Twilio: sending SMS, only when SMS notifications are turned on.
• Cloudflare R2: storing files you upload (logos, photos, documents, signatures).
• Neon: hosting our Postgres database.
• Google: Google sign-in when you choose it, Firebase Cloud Messaging for Android push notifications, and Google Analytics only after you allow marketing analytics. We also use Google Places when you use address search.
• Mapbox: geocoding an address and displaying a job-location map when you use that feature.
• RevenueCat: managing iOS subscription status and purchase restoration.
• Sentry: error monitoring and troubleshooting.
• Apple: only if you sign in with Apple. Apple may share a private relay email instead of your real one; that's fine, we'll use whatever Apple sends us.
• Apple Push Notification service (APNs): only if you turn on push notifications in our iOS app.
• Firebase Cloud Messaging (FCM, by Google): only if you turn on push notifications in our Android app.
• Vercel: hosting the app, analytics, and performance monitoring.
• Law enforcement or regulators, when we're legally required.
• A buyer or successor, if Homefront Pro is ever sold or merged. We'll tell you before that happens.

How long we keep it

We keep information for as long as needed to provide the service, meet legal obligations, resolve disputes, and enforce agreements. The period depends on the information and the reason we collected it. We delete or de-identify information when we no longer need it, unless a longer retention period is required or permitted by law.

If you request account deletion, we delete or de-identify account and business information as part of that process, subject to the retention reasons above. Deletion may remove information from the service before it disappears from backup systems.

After account deletion, we keep a one-way account fingerprint to enforce one free trial per person and prevent abuse. It is made from your sign-in identity with a secret HMAC key, cannot be used to recover your email or provider ID, and is kept indefinitely.

Your choices

• Update your info anytime from Settings.
• Export your estimates, invoices, and clients as PDF or CSV.
• Delete your account from Settings. We'll remove your data except information we need to retain for legal, accounting, security, or fraud-prevention reasons.
• Turn off email, SMS, or push notifications anytime in Notification Preferences.
• Reply STOP to any SMS to unsubscribe. HELP for help. Message and data rates may apply.
• Revoke Google sign-in access at myaccount.google.com/permissions.
• Revoke Sign in with Apple access from your iPhone in Settings → Apple ID → Sign-In with Apple, or at appleid.apple.com.

California residents (CCPA)

If the California Consumer Privacy Act, as amended, applies to our processing of your personal information, California residents may have rights to know, access, correct, delete, and receive a copy of certain personal information, subject to exceptions. We do not sell personal information or share it for cross-context behavioral advertising. To make a request, contact us through our support form.

EU and UK residents (GDPR)

If EU or UK data-protection law applies, we process information as needed to take steps toward or perform a contract, comply with legal obligations, pursue our legitimate interests in operating and securing the service, or with consent when consent is needed, such as for optional marketing analytics.

You may have rights to access, correct, delete, restrict, or port your information, to object to certain processing, to withdraw consent, and to complain to your local data-protection authority. If a pro supplied your information, we may refer your request to that pro. Reach us through the support form.

Our service and providers may process information in the United States and other countries. Where required, we use an approved transfer mechanism for those transfers.

Security

We use reasonable administrative, technical, and organizational measures designed to protect information. They include HTTPS for data in transit, access controls, and providers that handle payment-card and bank-account details. No method of transmission or storage is completely secure.

If we learn of a security incident that requires notice, we will provide notice as required by applicable law.

Children

Homefront Pro is for adults running a business. We don't knowingly collect personal information from anyone under 18. If we learn we have, we'll delete it.

Changes to this policy

If we make meaningful changes, we'll email you and update the date at the top. Small edits (typos, clarifying wording) just get a new date.

Contact

Questions about this policy or your information? Email support@homefront.pro. You can also use our support form.