Privacy Policy
Last updated: 7 October 2026
This policy explains how Homesy handles personal data when you visit our website or use our web and mobile applications. Homesy helps residents, property owners, administrators and service companies organise buildings, communicate and manage everyday activities.
1. Who is responsible for your data?
Homesy, 1814 La Tour-de-Peilz, Switzerland, is responsible for account management and operation of the Homesy service. For privacy questions and requests, email [email protected].
When a property owner, administrator, cooperative or service company uses Homesy to manage personal data about residents, contractors or other people, that organisation generally acts as controller: it determines why the data are used and who may access them. Homesy acts as processor for processing performed on that organisation’s instructions, while remaining controller for its own account, security and service operations. The organisation is responsible for a lawful basis and for informing the people concerned, including those without a Homesy account. Contact the organisation about its use of your information, or contact [email protected] about Homesy’s processing or for help directing a request. This policy does not replace a data processing agreement with an organisation.
Homesy accounts are intended for adults aged 18 and over. People under 18 should not create or use an account. Information about minors may nevertheless appear in household records, photos, documents or messages entered by adults. Such information should be included only where necessary and lawful, with access limited to people who need it. If you believe that a person under 18 has an account or that their data have been submitted inappropriately, contact [email protected] so we can assess the situation and handle any necessary correction or deletion.
2. What personal data do we collect?
Account data includes your user identifier, name, email address, sign-in method, profile picture, language, settings and any phone number you provide. If you sign in with Google or Apple, we receive the identity information made available by that provider. Authentication credentials are handled through Firebase Authentication.
Depending on the features you use, we process building and apartment details, addresses and map positions, membership and roles, resident and service-company contact details, tasks, comments, messages, reminders, shopping lists, shared loyalty-card numbers, visitor vehicle plates, and uploaded documents, photos or videos. We also record creation and update times and activity histories. These data can come from you, other authorised members or a property administrator. Uploads and messages can contain sensitive information, such as health details, identity documents or information about legal disputes. Include only information needed for the activity concerned, ensure that you are entitled to share it, and restrict access appropriately.
Technical data includes IP addresses, browser and device information, app versions, installation identifiers, notification tokens, online status, crash reports and performance measurements. If you consent to usage analytics, we also collect usage events as described in section 4. When you submit feedback, we receive your message, a screenshot, device and app details and diagnostic logs; if you are signed in, the report also includes your account identity and contact details. Screenshots and uploaded files may contain personal information about you or other people.
3. Why do we use your data?
We use personal data to create and secure accounts, provide the features you request, manage permissions, synchronise information across devices, deliver service emails and notifications, enable communication, process files, show maps, answer support requests and operate AI-assisted information search. With your consent, usage analytics helps us understand how Homesy is used and improve its features. Diagnostic and performance information helps us identify errors and improve reliability.
Where the EU General Data Protection Regulation applies, processing account, membership and feature data necessary to deliver agreed services relies on performance of a contract (Article 6(1)(b)). Processing technical and access information necessary for security, abuse prevention, troubleshooting and administration of access may rely on legitimate interests (Article 6(1)(f)), subject to your rights and interests. Those interests are maintaining a reliable service and protecting users and their information. Processing required by law relies on Article 6(1)(c). Optional Google Analytics for Firebase processing relies on your consent (Article 6(1)(a)); refusing or withdrawing it does not prevent you from using Homesy. An organisation acting as controller determines the legal basis for the resident and other personal data it manages through Homesy.
Information needed to create an account or use a particular feature must be provided for that function to work. Profile extras, uploads and feedback depend on your choices. You can decline device permissions, although the related functions may then be unavailable. We do not sell personal data, display advertising or send marketing emails. Account, security and other service messages are separate from marketing.
4. Cookies, device permissions and analytics
The application uses essential authentication cookies and local storage to maintain your session, remember preferences and support caching and offline use. The Homesy session cookie expires after four hours and can be renewed while you use the application. Firebase Authentication also maintains sign-in information. Logging out clears your user data stored by the app on that device, including offline and cached account data. Browser or device settings also let you clear locally stored data. Fonts used in the app are bundled locally, so displaying them does not require requests to Google Fonts. The current simple landing website uses local fonts and does not include an analytics tracker. The full version of the landing website still loads fonts from Google; those requests disclose technical connection information such as your IP address and browser details to Google.
With device permission, Homesy can access your location for maps and address selection, and your camera or selected photos and files for uploads and scanning. Coordinates or an address query are sent to Positionstack when you request address lookup. Loading maps requests map tiles from OpenStreetMap, directly in the mobile app or through Homesy’s map endpoint on the web. Such requests can reveal your IP address and the geographic area displayed. You can change device permissions in your system settings.
Google Analytics for Firebase is disabled by default. The app asks whether you allow usage analytics and enables collection only after you agree. If enabled, it records events such as app opening, screen views, registration and sign-in. You can refuse or withdraw consent at any time using “Usage analytics” in your profile; withdrawal stops future analytics collection and does not affect processing that took place before withdrawal. Your choice is stored per device or browser, so check it on each device you use. Firebase Crashlytics and Performance Monitoring collect diagnostic and performance information separately from optional usage analytics. Notification and location permissions are also separate. Reading this policy or using Homesy does not itself constitute consent to analytics.
5. Who can receive your data?
Your building’s information is visible by default only to authorised members of that same building. Access also depends on each member’s role and the permissions of the task, file or other item; membership does not automatically give access to every item. Members of other buildings and the general public do not have automatic access. An exception applies when a person with sharing permission explicitly makes a file accessible through a public link or grants a contractor or service company access for a task or offer request. Anyone who obtains a public link may access the shared content without a Homesy account until the link expires or public access is withdrawn, and may forward the link or keep a downloaded copy. A contractor or service company can access the shared items and related building information covered by its permission. Public service-company profiles are also publicly visible.
We use providers to deliver the service: Infomaniak for email; Google/Firebase for authentication, analytics, crash reporting, performance monitoring and push notifications; Google and Apple for their sign-in options; Positionstack for address lookup; OpenStreetMap for maps; and OpenAI for embeddings and content moderation. These providers process the data needed for the functions concerned. Processing by a service provider is separate from visibility to other Homesy users.
For AI-assisted search, relevant text from building documents, tasks and comments is sent to OpenAI to create embeddings: numerical representations used to find related information. The resulting embeddings are stored in Homesy’s own databases, including our locally hosted vector database in Switzerland. This processing may include names and other personal information present in the source text. We also use OpenAI to analyse text and images for adult or sexual content and violence. The content being checked is sent to OpenAI for moderation. We may disclose information when legally required, to address abuse or to protect legal rights.
6. Where are data stored and processed?
Homesy’s own servers, database, file storage and backups are located in Switzerland. Email is provided by Infomaniak. This Swiss hosting does not mean that all processing by external providers takes place in Switzerland.
Firebase Authentication processes data in the United States. Other Firebase and Google services can process data on international infrastructure. OpenAI processing depends on the service and project configuration and may take place outside Switzerland, including in the United States. Map and address providers may also process requests abroad. Applicable provider terms and their current processing-location information describe these external services in more detail.
International transfers are subject to the safeguards required by Swiss data protection law and, where applicable, the GDPR. These can include an applicable adequacy decision or recognised standard contractual clauses, depending on the recipient and country. You can contact [email protected] to request information about the recipients, processing countries and safeguards relevant to your data.
7. Retention, security and account deletion
Account data are kept while your account is active and during the seven-day deletion period described below. Tasks, messages, files and other shared records are retained to support the activities of the building or service company concerned, subject to its controller’s instructions and applicable deletion rules. Deleting an individual item can mark it as deleted rather than immediately erase every copy. Account deletion does not automatically delete a building or service company that still has other real members, its shared records or copies already received by others. Security and diagnostic records are retained as needed to investigate incidents and maintain reliability; support correspondence is retained as needed to handle the request and any follow-up or dispute. Records may be kept longer where required by law or needed for a specific legal claim. Homesy’s own backups are retained for one month, so a backup copy can remain after deletion from our active databases.
You can request account deletion from your profile using “Delete account”. Once you confirm the request, your user data are cleared from the app on the device used to make it and you are signed out on all devices. Deletion is scheduled for seven days later; your account is not erased immediately. You can cancel deletion by signing back into the app during those seven days and confirming “Restore account”. Signing in alone does not cancel deletion; if you choose to keep deletion and sign out, it remains scheduled. If you do not cancel, your account is permanently removed from Homesy’s active databases after the seven-day period, and your building and service-company memberships are removed. If you were the last real member of a building or service company, that building or company and its related data are also deleted; entries for people without an account do not by themselves keep it active. After permanent deletion, the account cannot be restored. You can also email [email protected] for help requesting deletion or exercising your rights; we may verify your identity. The backup and external-provider periods described in this section are separate from this seven-day account deletion process.
We use authentication and access permissions to restrict access to service data and check uploaded files for viruses. Virus scanning has technical limits and cannot guarantee detection of every threat. Protect your credentials and devices and check sharing permissions. Logging out clears user data held by the app on that device; requesting account deletion also triggers local cleanup on the requesting device and revokes sessions on all devices. Files you exported or saved outside the app, and copies held by other recipients, must be removed separately. External providers apply their own retention and deletion schedules; for example, Firebase authentication deletion can take up to 180 days across its live and backup systems after deletion is requested from Firebase. Those periods are separate from Homesy’s seven-day account deletion period and one-month backup retention.
8. Your rights and changes to this policy
Depending on the applicable law, you can request information and access to your personal data, correction, erasure, restriction of processing and a portable copy of eligible data. Where processing is based on legitimate interests, you may object on grounds relating to your situation. Where processing relies on consent, you can withdraw it without affecting processing that took place before withdrawal. These rights have legal conditions and exceptions.
Send requests to [email protected]. We normally respond within 30 days or one month, as the applicable law requires, and inform you if a permitted extension is necessary. We may verify your identity before disclosing or changing personal data. You can also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, lodge a complaint with the competent supervisory authority, including in the EU country where you live or work.
We may update this policy when Homesy’s operator, features, providers or data practices change. The date above identifies the current version. Material changes will be brought to your attention as required by applicable law. Questions about this policy can be sent to Homesy at [email protected].