Privacy Policy

1. Introduction

Hob ("Hob", "we", "our", or "us") operates the Hob household management platform, available as a mobile application on the Apple App Store and Google Play Store, and through our website at gethob.app (collectively, the "Service").

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the Service. By creating an account or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with these practices, please do not use the Service.

2. Information We Collect

We collect information you provide directly to us, information generated automatically when you use the Service, and information from third-party services you connect to Hob.

2.1 Information You Provide Directly

Account and Profile Information

• Email address (used for authentication, account notifications, and account deletion confirmation)
• Household name and configuration
• Household member names, roles, and date of birth (used to determine age-appropriate features and COPPA-required protections for members under 13)
• Member avatar color and display preferences

Grocery, Food, and Meal Data

• Shopping list items, quantities, categories, and assigned member
• Receipt photos and images captured through the in-app camera
• Purchase history including item names, prices, quantities, store names, and purchase dates derived from receipt scanning
• Meal plans, recipes selected or saved, and meal assignments
• Barcode scan data used to look up product information in food databases

Health and Dietary Information

• Dietary restrictions and preferences (e.g., vegetarian, vegan, gluten-free, halal, kosher, custom)
• Food allergen profiles — including life-threatening allergens — entered on behalf of any household member

Task and Calendar Data

• Tasks, projects, due dates, assignees, and completion status
• Calendar events, recurring events, and event visibility settings
• Calendar connections you authorize (Google Calendar, Apple Calendar)

2.2 Information Generated Automatically

• App usage events (screens visited, features used, actions taken) — collected only with your consent per your Privacy Profile setting
• Error logs and crash reports via Sentry
• Device type, operating system version, and app version
• Push notification delivery status

3. How We Use Your Information

• Provide, maintain, and improve the Service
• Personalize your household experience and generate AI-powered suggestions via our Hob Intelligence Engine (HIE)
• Send transactional communications (account confirmations, security alerts)
• Enforce allergen safety checks before grocery items are added to your household list
• Detect errors and improve reliability via crash reporting
• Comply with legal obligations

We do not use your personal information for targeted advertising. We do not sell your personal information.

4. How We Share Your Information

4.1 Service Providers

We share personal information with the following service providers who process it on our behalf:

4.2 Within Your Household

Data you enter is shared with other members of your household account. You control which household members can see event details via the visibility settings in Calendar.

4.3 Legal Requirements

We may disclose personal information if required by law, court order, or government authority, or to protect the rights and safety of our users.

5. Data Retention

We retain your personal information for as long as your account is active. When you delete your account, we delete your personal information within 30 days, except where we are required to retain it by law. Provider-managed backups (Supabase) are retained per their standard schedule.

We never delete your data upon subscription lapse — data created during a paid period remains fully accessible.

6. Your Privacy Choices

• Privacy Profile: Choose Standard, Balanced, or Private in Settings → Privacy to control analytics data collection
• Push Notifications: Manage push notifications in your device’s notification settings
• Data Export: Request a JSON export of all your household data in Settings → Privacy Settings → Export My Data (available to the household admin)
• Account Deletion: Delete your account and all associated data in-app via Settings → Delete Account, or by emailing support@gethob.app — see gethob.app/delete.html
• Dietary Data: Edit or remove allergen profiles at any time in Family → Member Details

7. Security

We implement industry-standard security measures including:

• TLS encryption in transit for all API communications
• AES-256 encryption at rest in our database infrastructure
• Row-level security (RLS) policies ensuring household data is isolated
• JWT-based authentication with short-lived tokens via Clerk
• Automated security scanning in our CI/CD pipeline

No system is completely secure. If you believe your account has been compromised, contact support@gethob.app immediately.

8. Children's Privacy (COPPA)

The Service is not directed to children. Children’s profiles are created and managed by a parent or legal guardian who holds the household’s Admin account, and are protected by verifiable parental consent as described below.

Age thresholds by jurisdiction. The age below which parental consent is required depends on where your household is located, captured during onboarding: 13 in the United States (COPPA), 16 in Germany (GDPR Art. 8), and 13 by default elsewhere. Thresholds are applied automatically from each member’s date of birth, which is required when a child profile is created and re-evaluated whenever a date of birth is added or changed.

How consent works (email-plus). When a profile is created for a member under the applicable threshold, the profile is placed in a restricted “Consent Required” state. To activate it, we use the email-plus method of verifiable parental consent under 16 C.F.R. § 312.5: we send a direct notice to the parent’s verified account email describing what information the child’s profile uses, that it is used for internal household features only, and how our AI processor (Anthropic) handles it; the parent takes an affirmative consent action in the app; and we send a delayed confirmation email explaining how to revoke. We rely on this method because children’s information in Hob is used for internal purposes only — never disclosed beyond the service providers in Section 4.1, never used for advertising, and never sold.

• A child under the applicable threshold cannot create an independent login or access the app independently
• A child’s profile data is visible only to Admin and Adult household members
• A child’s data is never used for AI training, product improvement, or analytics — regardless of the household’s opt-in settings
• The parent can revoke consent at any time from the child’s profile; revocation returns the profile to the restricted state and stops further collection. We retain records of notice, consent, and revocation as required by law.

If you believe we have collected information from a child outside this consent process, contact us at support@gethob.app.

9. Apple App Store Compliance

Our iOS application complies with Apple's App Store Review Guidelines and App Privacy requirements. Our App Store privacy nutrition label accurately reflects our data collection practices. We collect only data necessary to provide the Service.

We do not use device fingerprinting, track users across third-party apps, or share data with data brokers. We do not use the Advertising Identifier (IDFA).

10. Google Play Compliance

Our Android application complies with Google Play's User Data Policy. We have completed the Data Safety section of our Play Store listing accurately. We do not share user data with third parties for advertising or data broker purposes.

11. Important Disclaimers

12. California Privacy Rights (CCPA/CPRA)

California residents have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is needed.
• Right to Limit Use of Sensitive Personal Information: We use sensitive personal information — dietary and allergen data, and transaction records derived from the receipts you scan and review on your device — only to provide the Service. No bank accounts are linked to Hob and no external financial aggregation occurs. We do not use this information for any secondary purposes.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise your rights, visit Settings → Privacy Settings in the app, or email support@gethob.app. We will respond within 45 days.

13. Other U.S. State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Texas, Oregon, and other states with comprehensive privacy laws have similar rights to access, delete, correct, and export their personal data, and to opt out of profiling. Submit requests via Settings → Privacy Settings or email support@gethob.app.

14. Cookies and Tracking Technologies

Our mobile applications do not use cookies. Our website is a static landing page: it sets only strictly necessary cookies and does not run analytics or error-tracking. We do not use advertising cookies or cross-site tracking technologies.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date, notify you by email at least 30 days before changes take effect, and display a prominent in-app notice. Older versions are archived and available upon request.

16. Contact Us

17. Definitions