HoardIQPrivacy Policy
1. Introduction
HoardIQ ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our home inventory application (the "App").
The App is operated by HoardIQ, registered in Denmark (CVR: 35944117). HoardIQ is the data controller for the personal data described in this policy.
This policy applies to:
- The HoardIQ mobile app (Android and iOS)
- The HoardIQ web application (web.hoardiq.com)
- The HoardIQ API (api.hoardiq.com)
- Our analytics and monitoring services
By using the App, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Personal Information You Provide
Account Information:
- Email address
- First and last name
- Password (hashed with BCrypt, never stored in plain text)
Home Inventory Data (User Content):
- Home details (name, description, address)
- Room names and descriptions
- Storage unit names, types, and descriptions
- Item names, descriptions, categories, tags
- Item photos (stored on our server)
- Purchase dates, expiration dates, estimated values
- Barcode data (for item lookup)
Collaboration / Home Sharing:
- Home sharing (Premium): when you invite someone, we collect the invitee email address, access role (Viewer or Editor), invite token/expiry metadata, and join/leave timestamps so we can send the invite and enforce permissions. Accepting requires an account whose email matches the invite.
- Anyone with a valid invite link may preview the invite (including the invitee email) before signing in; this disclosure is intentional and rate-limited. Accepting still requires an account email that matches the invite exactly.
Feedback (Settings → Send Feedback):
- When you submit feedback, we collect: your message text, an optional contact email, app version, and platform (for example Android or iOS)
- Submissions are linked to your account (user id). Your account email may be included when we notify our support inbox
- Feedback is stored on our servers and may be emailed to [email protected] so we can respond
- Sending feedback is optional and user-initiated
Premium / Subscription Metadata:
- We store plan type (Free or Premium), source (for example trial, voucher, or store purchase via Play Billing / StoreKit), start/end dates, auto-renew flag, and related voucher linkage on our servers
- Premium is available via Subscribe ($4.99/month; a free trial may be offered) or voucher/trial where supported. Store billing is fulfilled by Google Play / Apple; we do not process card numbers ourselves
- We do not store full payment card numbers
- Purchase tokens or identifiers may be stored server-side as needed to fulfill entitlements
2.2 Information Collected Automatically
Device Information (Mobile App):
- Device type, operating system, app version
- Unique device identifiers (for push notifications)
Browser Information (Web App):
- Browser type and version
- Operating system (from User-Agent header)
- Screen resolution and language preference
- These are standard HTTP request headers and are not stored permanently
Usage Analytics (Self-Hosted Matomo) — opt-in:
- Pages/screens viewed
- Features used (search, photo capture, export) — search events may include query length or filters, not raw query text
- Session duration and frequency
- When you are logged in and have consented, the analytics visitor id may equal your account user id (events may be linked to your account)
- Client IP addresses are masked (last octet removed) before geolocation; Matomo is configured for IP anonymisation
- Analytics is off by default; you must opt in via Settings (or the web consent toggle)
Crash Reports (Self-Hosted GlitchTip):
- Error stack traces and device/app context (OS, app version)
- Screenshots of the app are not attached to crash reports
- Crash reports are not used for advertising; we do not intentionally bind them to your account identity
Log Data (Seq Structured Logs):
- API request logs (endpoint, response time, status code)
- Error logs (for debugging)
- IP addresses (for rate limiting and security)
Browser Storage (Web App):
The web app uses three browser storage mechanisms:
| Storage | Key / Item | Purpose | Retention |
|---|---|---|---|
| localStorage | hoardiq_cookie_consent | Cookie banner decision (preferences + analytics); also mirrored to a shared cookie | Until user clears browser data |
| localStorage | hoardiq_web_lang | Language preference (EN/DA/RU/ES); after Preferences consent or explicit language choice | Until user clears browser data |
| localStorage | hoardiq_web_theme | Theme preference (light/dark/system) | Until user clears browser data |
| localStorage | hoardiq_analytics_consent | Analytics opt-in/out toggle | Until user clears browser data |
| localStorage | hoardiq_interstitial_shown | Onboarding interstitial shown | Until user clears browser data |
| localStorage | hoardiq_first_search_completed | First search completed (for onboarding) | Until user clears browser data |
| localStorage | hoardiq_nps_dismissed | NPS prompt dismiss flag | Until user clears browser data |
| sessionStorage | User profile | User ID, email, display name | Until tab is closed |
| sessionStorage | Preferences | Current home, theme, language, analytics consent | Until tab is closed |
| sessionStorage | Session state | Beta banner dismissed, onboarding state | Until tab is closed |
localStorage data persists across browser sessions until the user clears it. SessionStorage data is cleared automatically when the browser tab is closed.
2.3 Information from Third Parties
Our AI engine (Image Analysis and Text Enrichment):
- When you use AI-powered features, we may send to our AI engine: item photos (for vision analysis) and item text/metadata (for refine, price estimate, and related features) such as name, description, brand, and similar inventory fields
- Photo analysis requests are routed via Zero Data Retention (ZDR) endpoints — our AI engine does not store, log, or retain photo data under ZDR
- We do not send personal identifiers (email, name) to our AI engine with these requests
- You can create and edit items manually without using AI analysis
- Our AI engine's data processing is governed by contractual zero-retention terms with our processing providers
Barcode product lookup:
- When you scan a barcode, we query product databases to retrieve product information
- No personal data is sent with these lookups
Fonts (Web / Marketing / Blog):
- We self-host DM Sans and Fraunces font files on our own servers (same origin as the site)
- Your browser does not load fonts from Google Fonts CDN; no font-related IP transmission to Google LLC
3. How We Use Your Information
We use your information to:
- Provide and Maintain the App — create and manage your account, store your home inventory data, manage Premium entitlements (trial, voucher, or store purchase via Play Billing / StoreKit), enable camera-based photo capture (web app)
- Improve the App — analyze usage patterns (via Matomo for mobile app; server-side event tracking for web app), fix bugs and crashes (via GlitchTip), review user-submitted feedback, optimize performance
- AI-Powered Features — analyze item photos and item text/metadata to suggest names, categories, values, and refinements
- Communicate with You — send push notifications for item expiration reminders; respond to feedback you submit (via our support inbox); send collaboration invite emails when you invite someone to a shared home (Premium)
- Ensure Security — detect and prevent fraud, monitor for unauthorized access, enforce rate limits
4. Legal Basis for Processing (GDPR)
We process your personal data based on:
- Contractual Necessity: To provide the App's core features (inventory management)
- Legitimate Interests: To improve the App, ensure security, and prevent fraud
- Consent: For analytics (Matomo), AI features (our AI engine), and camera access (browser permission prompt) — you can withdraw consent at any time
5. Data Sharing and Disclosure
5.1 We Do NOT Sell Your Data
We do not sell, rent, or trade your personal information to third parties.
5.2 Service Providers (Data Processors)
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| AI engine providers | AI image analysis and text enrichment | Item photos and item text/metadata (temporary) | USA |
| Matomo | Self-hosted analytics (opt-in) | Usage events; visitor id may equal account id when logged in; masked IP | Denmark (self-hosted) |
| Seq | Structured logging | API logs | Denmark (self-hosted) |
| GlitchTip | Crash reporting | Error stack traces and device/app context (no screenshots) | Denmark (self-hosted) |
5.3 Legal Requirements
We may disclose your information if required by law or in response to valid requests by public authorities.
6. Data Retention
We retain your data for as long as your account is active or as needed to provide you services.
- Account data: Until you delete your account
- Home inventory data: Until you delete the home or your account
- Photos: Until the associated item is deleted
- Feedback submissions: Until you delete your account (cascaded with account deletion)
- Premium / subscription metadata: Until you delete your account
- Analytics data (Matomo): 12 months
- Log data (Seq): 30 days
- Crash reports (GlitchTip): 90 days
Account deletion: When you delete your account via Settings → Delete Account, we permanently delete your account and associated inventory data immediately (no grace or restore period), including feedback submissions and Premium / subscription metadata linked to your account. Where possible, we email you a one-time link to download an export of your data before deletion completes. Analytics events previously collected under your visitor id may remain in Matomo until the retention period above expires. Copies of feedback previously emailed to our support inbox may remain in email systems until those systems’ normal retention applies.
7. Your Data Protection Rights (GDPR / CCPA)
You have the following rights regarding your personal data:
- Right to Access: Request a copy of your personal data by contacting [email protected] or via Settings → Export Data.
- Right to Rectification: Update your account information directly in the App.
- Right to Erasure: Delete your account via Settings → Delete Account. Deletion is permanent and immediate (no grace period); an export link may be emailed first. This removes inventory data, feedback submissions, Premium / subscription metadata, and any collaboration / home-membership records associated with your account (if any exist).
- Right to Data Portability: Export your data in JSON or CSV via Settings → Export Data.
- Right to Object / Restrict Processing: Manage analytics consent in Settings (off by default / opt-in).
- Right to Withdraw Consent: Withdraw consent for analytics and AI features via Settings.
8. Cookies and Browser Storage
We use httpOnly cookies on the web app and device-level secure storage on the mobile app to maintain your session and preferences. We do not use cookies for advertising or cross-site tracking.
Cookie consent banner: On first visit to the marketing site (hoardiq.com), blog (blog.hoardiq.com), and web app (web.hoardiq.com), we show a cookie banner so you can Accept all, Reject non-essential, or Customize. Categories:
| Category | Examples | Consent |
|---|---|---|
| Essential | hoardiq_access, hoardiq_refresh (auth); hoardiq_cookie_consent (banner decision, shared across subdomains) | Always on (required for sign-in / remembering your cookie choice) |
| Preferences | hoardiq_lang cookie and related language localStorage | Off until you Accept / Customize Preferences, or explicitly pick a language |
| Analytics | Matomo via server-side /api/events | Off until you Accept / Customize Analytics (also controllable in Settings) |
You can reopen Cookie settings from the site footer or web Settings → Privacy.
Web App — Authentication Cookies:
The web app uses two httpOnly cookies set by the API server to store JWT authentication tokens:
| Cookie | Purpose | Attributes |
|---|---|---|
hoardiq_access | JWT access token (short-lived, ~1 hour) | HttpOnly, Secure, SameSite=None, Path=/, IsEssential=true |
hoardiq_refresh | Refresh token (30 days, or 90 days with “Remember Me”) | HttpOnly, Secure, SameSite=None, Path=/, IsEssential=true |
These cookies are:
- Inaccessible to JavaScript — cannot be read by browser scripts, preventing cross-site scripting (XSS) token theft
- Automatically sent with each request to the API server
- Cleared on logout
- Essential cookies — required for authentication; they do not require consent under GDPR (ePrivacy Directive Art. 5(3))
The SameSite=None attribute is required because the web app (hoardiq.com) and API server (api.hoardiq.com) are on different subdomains.
Marketing / Blog / Web — Shared Cookies:
| Cookie | Purpose | Attributes |
|---|---|---|
hoardiq_lang | Remember language preference (EN/DA/ES/RU) | Path=/, Domain=.hoardiq.com, Max-Age=1 year, SameSite=Lax |
hoardiq_cookie_consent | Remember cookie banner decision across hoardiq.com, web.hoardiq.com, and blog.hoardiq.com | Path=/, Domain=.hoardiq.com, Max-Age=1 year, SameSite=Lax |
The language preference cookie is set only after Preferences consent (or when you explicitly choose a language in the language switcher). The consent cookie is set when you Accept, Reject, or Save choices on the banner (and mirrored into localStorage on each origin).
Web App — Browser Session Storage: The web app stores the following in your browser’s session storage (cleared when the tab is closed):
- User profile: User ID, email, display name
- Preferences: Current home selection, theme, language, analytics consent
- Session state: Beta banner dismissed, onboarding state
Session storage data stays in your browser and is only sent to our server as part of authenticated API requests. You can clear it at any time by closing the browser tab.
Web App — Browser Local Storage: The web app stores non-sensitive preferences in localStorage, which persists across browser sessions until the user clears it:
- Cookie consent decision (
hoardiq_cookie_consentlocalStorage; also mirrored to the sharedhoardiq_cookie_consentcookie) - Language preference (
hoardiq_web_lang) — gated by Preferences consent as above - Theme preference (
hoardiq_web_theme) - Analytics consent toggle (
hoardiq_analytics_consent) - UI state flags (onboarding shown, NPS dismissed)
You can clear localStorage at any time via your browser’s developer tools or by clearing site data.
Mobile App — SecureStorage (auth tokens only): The mobile app stores authentication tokens in platform-secure storage (iOS Keychain, Android Keystore). Token data is encrypted at rest and inaccessible to other apps.
Mobile App — local offline cache (not Keystore): Separately, the Android/iOS app may store an unencrypted local offline inventory cache (SQLite), photo thumbnails (PhotoCache), and pending offline capture files (queued-captures) under the app’s private storage so the app can work offline and upload when back online. This is not Keystore/Keychain-protected. On Android, those paths are excluded from Android Auto Backup / cloud backup and device-transfer backup via fullBackupContent / dataExtractionRules. Clearing app data or using Settings → Sync clear-cache removes local offline data; server-side inventory remains unless you delete your account.
Matomo Analytics (Self-Hosted): Analytics is opt-in (disabled until you enable it via the cookie banner, Settings, or the web consent toggle). Uses a visitor id to distinguish unique visitors; when logged in this may equal your account user id. Client IP addresses are masked before being sent for geolocation. All analytics data is stored on our own infrastructure — no data is sent to Matomo’s cloud or any third-party analytics service. No data is shared with third-party advertising networks.
9. Data Security
We implement appropriate technical and organizational measures to protect your data:
- Password Security: BCrypt hashing with 12 rounds
- API Security: JWT tokens with short expiry (1 hour) and refresh token rotation
- Transport Security: TLS 1.2+ for all API communication
- Database Security: SQL Server with encrypted connections
- Photo Storage: Server-side photo files are served as capability URLs under
/api/static/photos(path-validated; not end-user authenticated on each GET). Do not treat photo URLs as private “restricted access” without that caveat. - Secrets Management: Environment variables and SecureStorage for auth tokens (no hardcoded secrets)
- Android device backup: Offline SQLite,
queued-captures, andPhotoCacheare excluded from Auto Backup / cloud backup; auth tokens remain in Keystore (not backupable as ordinary files) - Web App Storage: Authentication tokens stored in httpOnly cookies with
SecureandSameSite=Noneattributes (inaccessible to JavaScript), mitigating cross-site scripting (XSS) token theft. We also implement Content Security Policy headers and input sanitization.
However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
10. International Data Transfers
Your data may be transferred to and processed in countries other than your country of residence:
- Primary Storage: Denmark (SQL Server on romank.dk)
- Analytics & Monitoring: Denmark (self-hosted on Unraid — Matomo, Seq, GlitchTip, Uptime Kuma). No data leaves our infrastructure for these services.
- AI Processing: USA (AI engine providers) — we rely on Standard Contractual Clauses for data transfers
- Font Delivery: Self-hosted on our servers (same origin as the site) — no Google Fonts CDN
By using the App, you consent to this transfer.
11. Children's Privacy
The App is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal data, we will delete it.
12. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page, sending an in-app notification, and updating the "Last Updated" date.
13. Contact Us
If you have any questions about this Privacy Policy, please contact us:
- Data Controller: HoardIQ (CVR: 35944117)
- Email: [email protected]
- Data Protection Officer: [email protected]
14. Supervisory Authority
If you are in the European Economic Area (EEA), you have the right to lodge a complaint with your local data protection authority.
List of EU Data Protection Authorities
15. California Privacy Rights (CCPA)
If you are a California resident, you have the following rights:
- Right to Know: You can request information about the personal information we collect, use, and disclose
- Right to Delete: You can request deletion of your personal information
- Right to Opt-Out: We do not sell your personal information, so this right does not apply
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
To exercise these rights, contact us at [email protected] or use the in-app data export/delete features.