Privacy Policy

1. Who we are

Homio is developed and operated by Štichauer s.r.o., a company registered in the Czech Republic (IČO: 23312980, DIČ: CZ23312980), with registered address at Starobělská 1937/4, 700 30 Ostrava.

Štichauer s.r.o. is the data controller under GDPR for personal data processed through Homio.

If you have any questions about this policy or about your personal data, contact us at: privacy@homioplanner.com

2. Data we collect and why

The table below describes every category of data that Homio touches, where it lives, and why.

We do not collect phone numbers, precise location, photos, or payment card details. We do not sell your personal data.

3. Legal basis for processing (GDPR)

As an EU-based company, we process personal data only where we have a valid legal basis under GDPR:

• Performance of a contract (Art. 6(1)(b)) — creating and maintaining your account, household membership, household content (CRUD), and sync across members and devices are necessary to provide the Homio service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — routing AI queries through our Cloudflare Workers proxy to OpenRouter to deliver the AI assistant features you actively use.
• Consent (Art. 6(1)(a)) — any optional features we may introduce in the future will request explicit consent at that time.

Processing of shared household data takes place at our processor Supabase Inc. on the instructions of the controller (Štichauer s.r.o.), under a data processing agreement.

4. Third-party services (subprocessors)

Homio relies on the following third-party infrastructure:

• Supabase Inc. / Supabase Pte. Ltd. — authentication (Sign in with Apple sessions), Postgres database, and Realtime sync. Region: EU (Ireland, eu-west-1). Role: processor. We have a signed Data Processing Addendum (DPA) with Supabase (executed July 20, 2026). Public reference copies: Supabase DPA → · Transfer Impact Assessment (TIA) → · Supabase Privacy Policy →
• Apple Sign in with Apple — identity provider for authentication. Apple Privacy Policy →
• Cloudflare Workers — secure proxy layer for AI requests. We operate a lightweight proxy on Cloudflare's edge network between the app and OpenRouter. The proxy relays request content for delivery and is configured not to persist the content. Cloudflare may process technical metadata (such as IP address and timing data) as part of network operations. Cloudflare Privacy Policy →
• OpenRouter — AI request routing. After passing through our Cloudflare Workers proxy, we transmit the text content of your AI queries to OpenRouter, which forwards them to the underlying AI model provider. OpenRouter states it does not use API request data to train models. OpenRouter Privacy Policy →
• Apple App Store — payments and subscriptions. Apple Privacy Policy →

Apple CloudKit is not used for household sharing on current Homio builds. Shared household data is stored on Supabase as described above.

We do not use advertising networks, analytics SDKs, or tracking tools.

5. Data retention

• Shared household data — retained in Supabase while your account and household membership exist.
• Local cache (SwiftData) — retained on your device until you uninstall the app or use Delete account.
• Recipes (local-only) — retained on your device until you delete them or delete the app/account.
• AI query content — not retained by us. OpenRouter's retention is governed by their own policy.

Delete account in the app (More → Delete account) wipes local data on your device and ends your Supabase session (sign-out). It does not automatically permanently delete all remote rows in our Postgres database or your auth user record.

To request deletion of your cloud account and associated remote data, email privacy@homioplanner.com. We will respond within 30 days.

6. Your rights under GDPR

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — request correction of inaccurate data.
• Right to erasure — request deletion of your data ("right to be forgotten").
• Right to restriction — request that we limit processing of your data.
• Right to data portability — request your data in a structured, machine-readable format.
• Right to object — object to processing based on our legitimate interests.
• Right to lodge a complaint — you may file a complaint with the Czech supervisory authority, ÚOOÚ (uoou.cz), or with the authority in your country of residence.

To exercise any of these rights, contact us at privacy@homioplanner.com. We will respond within 30 days.

7. Children's privacy

Homio is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

8. International data transfers

Our primary household database is hosted in the European Union (Ireland, eu-west-1) via Supabase.

Where Supabase or its subprocessors involve transfers outside the EEA, those transfers are covered by our signed DPA with Supabase, including Standard Contractual Clauses (SCCs), and by Supabase's public Transfer Impact Assessment.

AI queries are first processed by our Cloudflare Workers proxy on Cloudflare's edge network, then transmitted to OpenRouter's infrastructure in the United States. Those transfers are subject to standard contractual clauses (SCCs) or other appropriate safeguards under GDPR Chapter V.

Sign in with Apple may involve processing by Apple according to Apple's privacy policy and your Apple ID region settings.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you within the app. Continued use of Homio after changes take effect constitutes your acceptance of the updated policy.

10. Contact