KeepNest Privacy Policy

Who is the controller

The data controller is Andrei Chelariu, a private individual, who publishes KeepNest on the App Store.

For any privacy question: supporto@casachelariu.com.

No data protection officer (DPO) has been appointed.

Within each household, the administrators decide who joins and with which role, and they upload the family's documents.

What data we process

Only what the app needs to work:

• your account: name, email address, role in the household, the public part of your passkey (the private part stays in your iPhone keychain) and, for administrators, the second-factor secret;
• household members: first and last name, other names they appear under on documents, date of birth, year of birth and sex, citizenship, Italian tax code or Romanian CNP, profile photo, notes;
• household documents: the files (PDFs, photos, scans), the text extracted from them and what is read from them, such as type, title, issuer, place, dates, amounts, document number and notes;
• household assets: vehicles with their plate, properties with their address, pets with their microchip;
• deadlines, tasks, alerts and household money (subscriptions and utilities, with provider and amount);
• if the household has turned on home mail, the emails forwarded to the household address: who sends them, the subject, the date, the text, attached PDFs and the mailbox they come from; if the household has asked for it, also those from healthcare providers and those from public bodies that we recognise as health emails, which may say something about health (see below);
• devices: phone name, model and iOS version, app version, a device identifier and the push notification token; for the website, the browser type;
• technical data about errors: the type of error, where in the program it happened, the app and system versions, the phone model and, for app freezes and crashes, the data iOS collects, already reduced on the phone; the household appears only as a code that does not say which one it is. The errors the app shows you and those of the server also go into a list of problems in our database, which only the people who run KeepNest can see. Never the error message, the text of documents, names, the content of requests or the IP address;
• technical security data: IP address and browser type, to limit sign-in attempts and in the session that precedes sign-in, and the activity log (who did what and when: sign-ins, changes, downloads, exports).

Documents may include identity cards and passports, medical reports and certificates, tax returns, legal deeds and children's school records. Health documents are special category data under Article 9 GDPR, and they may concern family members who are minors.

We do not ask for or read location, contacts or calendar data. From photos (JPEG, PNG, HEIC) the app strips coordinates and identifying metadata before uploading them; a file of another type, for example a PDF made by another app, is uploaded as it is. To add a birthday to your calendar the app opens the iPhone system sheet without reading your events. There is no advertising and no tracking, and data is never sold. We use no third-party analytics tools: the only usage numbers are the household usage counts, which stay off until you turn them on (see below).

Household usage counts. They stay off until you turn them on in Settings, and the switch applies to the phone you use it on. When on, they count which screens are opened and how often a document is added or left halfway, so we can see what to improve. They are counted per household and per day, with the app version: no content, no file names, no amounts, no people. In a household with only one person, though, the household's numbers are that person's. We at KeepNest look at them to improve the app, the household administrator can see them too, and they are deleted automatically after ninety days.

Report a problem. When you write a report in Settings, only what you wrote is sent, with the app version: no screenshots, no logs, no documents. It reaches the people who run KeepNest and the administrators of your household, with your name. No email is sent: the people who run KeepNest get a line in their list of problems that only says there is a report, with a household code and the app version, and a KeepNest notification that says nothing more. The text is stored encrypted, it is included in the copy of your data, and it is deleted when you delete your account.

Why we process it, and on what legal basis

• To provide the service you accepted when you joined through an invitation: storing documents and profiles, calculating deadlines, sending alerts, keeping phones in sync. Basis: performance of the service (Art. 6(1)(b) GDPR).
• To notify you in the Inbox when a supplier writes to the household (or a sender added by the household, or a public body in the households where we have turned on mail from public bodies), suggest the amount and due date written in the email and recognise which household utility the PDFs refer to, if the household has turned on home mail (see below). Basis: performance of the service (Art. 6(1)(b) GDPR).
• To enter clear receipts that arrive with home mail in «Household expenses», already settled and without waiting for a tap (see below). Basis: performance of the service (Art. 6(1)(b) GDPR).
• To notify the administrators when a healthcare provider writes to the household (or a public body, with an email that we recognise as a health email), and keep its PDFs, if the household has also asked for this mail (see below). Basis: the explicit consent of the administrator who created the household's address, given in the app or in writing, for health data about themselves and the minor children they are a parent of (Art. 9(2)(a) GDPR).
• To protect the household's data: activity log, sign-in attempt limits, device revocation, backups. Basis: legitimate interest in security (Art. 6(1)(f) GDPR).
• To suggest the type, title, dates and amount of a document through automatic reading, when needed (see below). Basis: your consent (Art. 6(1)(a) GDPR) and, for data concerning health, your explicit consent (Art. 9(2)(a) GDPR), which you give in the app and can withdraw at any time; documents marked «Private» are not sent in any case. This also applies to PDFs that arrive with home mail, in the households where automatic reading of home mail is on.
• To understand what to improve, with the household usage counts. Basis: your consent (Art. 6(1)(a) GDPR), which you give by turning them on in Settings and withdraw by turning them off.
• To read and solve a problem you report. Basis: performance of the service (Art. 6(1)(b) GDPR).
• To notice errors and fix them. Basis: legitimate interest in the service working (Art. 6(1)(f) GDPR).

When you accept an invitation as an adult, you read and accept the household rule on who sees what. Your acceptance is recorded together with a fingerprint of the exact text you read.

Special category data and minors. KeepNest is currently used by a few invited families: each one uploads its own documents for its own household life, and none of them sees the others' documents. These include health documents and children's documents. Only the members of that household can see them: the database prevents one household from seeing another's data, and within the household the app decides who sees what, according to each person's role; health and identity files are stored encrypted, while other files, such as school reports, are not. A health document goes to automatic reading only if the person uploading it has given permission, which includes explicit consent for data concerning their health and that of their children under 18 of whom they are a parent (Art. 9(2)(a) GDPR).

No decision with legal effects on you is taken solely by automated means, and we do no profiling.

Automatic reading of documents

When a document arrives, KeepNest first tries to understand it on its own: from the file name, the PDF text and the codes read on the phone. Only if something is missing it sends the document to Anthropic's Claude model, which suggests type, title, dates and amount. It may also send identity documents, health documents and documents of an unrecognised type; never documents marked «Private» or sheets with credentials and passwords. A person always confirms the suggestion.

None of this happens without explicit permission. Each adult gives it for themselves in the updated app, on first entry or in Settings, after reading what is sent and to whom; they can withdraw it at any time in the same place, and from then on their documents are no longer sent. The permission is recorded together with a fingerprint of the exact text they read. When the text of the permission changes, the permission given before no longer counts and the app asks again. Without permission the app works all the same: type, title and dates are typed by hand.

• What counts is the permission of the person who uploads the document: with it, KeepNest reads the documents that person uploads, even when they are about other people in the household: children, people without an account, adults it has not recognised yet. If a document is already linked to another adult who has not given permission, it does not read it. An identity or health document that the app has not linked to anyone yet is not read while another adult in the household has not given permission. For documents uploaded by a minor, a household administrator decides.
• Never sent: documents marked «Private» and sheets with credentials and passwords. A document can be marked «Private» when it is uploaded, from the Share button or from the document's page; the mark can be removed by whoever set it or by a household administrator, never by a minor. Documents that were already closed to automatic reading before this change stay private until an administrator reopens them.
• When you send a document with the Share button of another app, you get the «Private» switch, off by default: turning it on keeps the document out of automatic reading. In earlier versions of the app the switch is called «Sensitive» and some documents are closed on their own.
• By default, allowed financial and legal documents may be sent, such as Italian tax forms (ISEE, 730, F24), bank details and notarial deeds. This is a choice of the service controller, one setting for the whole server, which can turn it off.
• What is sent is the document text; if the document has no text, for example a scan or a photo, the file itself is not sent: only the image of its pages goes out, rebuilt by the app without any hidden data, not even its location, only if it is short: up to 3 pages, a photo of up to 5 MB. The document itself may contain names and numbers; family data stored in the app (names, dates of birth, plates, addresses) is not added.
• There is a monthly spending cap: once it is reached, automatic reading stops until the next month.
• Documents already in the archive are not read again on their own: a document still waiting to be checked in the Inbox is sent only if someone in the household asks for it to be read again, under these same rules.

Home mail

Home mail is off by default, and it can be turned on only in the households we enable. In those households an administrator turns it on in the app, with a recent second-factor code, and turns it off whenever they want. Once it is on, the household has its own email address with a secret code inside it: the app shows it only once, and only a fingerprint of it stays in the database. An administrator can change it, and the old one stops working immediately. Once home mail is off, the address no longer leads to the household; notices that have already arrived stay, for the periods given below, except health notices, which are deleted at the first nightly cleanup when consent no longer counts in the household. Consent given in the app counts only while there is an address in use: with home mail off it does not count, so health notices go. When you turn it off or change the address, also remove the forwarding from your mailbox: while it is there, emails keep passing through Cloudflare and our receiver, as described below, even though the household no longer receives them.

The emails of household suppliers and, in the households where we have also turned on mail from public bodies, those of public bodies are forwarded to that address from your own mailbox, for example with a filter. Only emails from suppliers and public bodies that KeepNest knows get in, with a valid digital signature of the domain they write from. A public body that we know only from the official list of Italian public administrations (IndicePA) gets in only if the email carries the exact digital signature of its domain. The others are discarded, and our server keeps nothing of them, apart from the count described below. They still pass through Cloudflare, though, as described below: that is why it is best to forward only the emails of suppliers and public bodies, not all your mail.

In the app, under «Your suppliers», an adult of the household can tick the suppliers the household gets emails from and, in the households where we have turned on mail from public bodies, also public bodies and their own Comune. The choice is saved for the household, and the chosen Comune usually says where the family lives. It only serves to prepare the rules to set in your own mailbox: it does not change which emails get in.

Besides the suppliers KeepNest knows, a household can add its own senders, for example the town council, the school or a hospital, with the digital signature of their domain or, for the senders the household asks us to mark, with the check iCloud makes when the email reaches the mailbox. This check tells which mail service the email left from, not who wrote it: someone using the same service as the sender, for example Aruba, Google or Microsoft, could pass themselves off as them. That is why the mark is set only on the senders the household chooses. That list applies only to that household. Senders are added and removed by an administrator, in the app, with a recent second-factor code; those we added at the household's request are removed by writing to us. The adults of the household see the list in the app, with the date of the last email that got in, except healthcare providers, which only the administrators see. If the household adds a platform that writes on behalf of others, such as the school's electronic register, the town council's services portal or the sports club's app, the mail of everyone who uses it to write to the household gets in: the choice is the household's.

Emails from healthcare providers, for example a hospital or a local health authority (ASL), get in only in the households where the administrator who forwards the mail has given us explicit consent in writing, for health data about themselves and the minor children they are a parent of (Art. 9(2)(a) GDPR). They must forward only the emails about themselves or those children. They can withdraw consent whenever they want by writing to us: from then on those emails are discarded, as in the households that have not given consent. Health notices that have already arrived are deleted at the first nightly cleanup; the documents stay until an administrator deletes them.

Consent can also be given and withdrawn in the app, from «Home mail». An administrator gives it for themselves, and it is recorded together with a fingerprint of the exact text they read; if the text changes, the consent given before no longer counts and must be given again. In the app, what counts for the household is the consent of the person who created the address in use, as long as they remain an active administrator of the household: if they withdraw it, if they are no longer an active administrator, or if another administrator changes the address without having given consent in the app, those emails are discarded, as described above. Consent given in writing counts until we are asked to remove it, and then we remove it ourselves. It counts only as long as nobody in the household has given or withdrawn consent in the app.

• Each accepted email becomes a notice in the Inbox, with a neutral title, «Messaggio di» (message from) and the name of the supplier or public body, and with the date. The title says who wrote, not what about: it may be a bill or an advert. The adults of the household can see it, except health notices.
• If a healthcare provider writes, the notice is called «Messaggio sanitario» (health message), without the provider's name, and only the administrators can see it. We keep nothing of the text of that email, so we suggest neither amount nor due date.
• We also treat as health emails those from public bodies that we recognise as health emails from their subject or text, for example when they are about a sick-leave certificate, a medical report or a civil disability case: the same rules as for healthcare providers apply, consent included. We recognise them by their words: an email about health written with different words may get in as an ordinary email.
• Amount and due date are suggested only if they are written in the text of the email. The server looks for them with fixed rules, without artificial intelligence, and a person confirms them: a notice never creates, on its own, a deadline still to be settled. The exception is clear receipts, those in which KeepNest recognises for certain that you have already settled something, how much and to whom. KeepNest enters those in «Household expenses» on its own, as already settled and marked as having come in by email, and the notice is closed. Today it does this with receipts from the subscription services whose format it knows, which for now means Apple. Only the adults of the household can see these entries, and any of them can undo one with «Undo», as long as nobody has changed it: it goes back to how it was before the email.
• In the households where we have also turned this feature on for pagoPA and the IO app, KeepNest also looks at their receipts, if they arrive after it was turned on, from their official addresses and with the digital signature of their domain. A receipt from IO becomes an entry that is already settled in «Household expenses» on its own only if the figure is certain and it is for a public body that KeepNest knows and that is not a healthcare provider, for example ACI or the Agenzia delle Entrate: if the public body is not clear, or is not one of those, nothing is created on its own. The entry can be moved to another section. Receipts from pagoPA never become an entry on their own, because they do not say for certain who the payment went to. The day of the entry is the day it was settled, if the receipt gives it clearly and the date is reliable; if not, we use the day of the email, and we point this out in the app. KeepNest never joins two receipts on its own: if the household already has an entry that may be the same payment, nothing is created, and the notice stays in the Inbox with a suggestion for a person. From the receipt, the entry keeps only the figure, the day and the name of the public body. The text of the email never goes into the entry. Receipts arriving after the feature was turned on that we recognise as being for a healthcare or social care provider never become an entry, not even as a suggestion, and they count as health emails, with the rules described above. We recognise them by name and by their words: one written another way may get in as an ordinary email, but it does not become an entry, because entries are created only for the public bodies that KeepNest knows. Receipts that arrived before the feature was turned on never become an entry on their own: at most KeepNest suggests the figure, and a person decides. When in doubt nothing is created, and the notice stays in the Inbox as before. Like the others, only the adults of the household can see these entries, and they are undone with «Undo».
• In the households where we have turned this feature on, when a supplier writes that your invoice is available but does not attach it, KeepNest reads from the email, with fixed rules and without artificial intelligence, only the invoice number, customer code, dates, period and total. It keeps dates, period and total encrypted with the notice for 24 months. The number and customer code are kept separately only in a form that cannot be read back; they may, however, remain in the text of the email, which is kept encrypted for the periods given below. When the document of that invoice comes into the household, KeepNest links it to the notice on its own only if it is sure it is the same invoice; otherwise, if it finds a single document that resembles it, it suggests it, and an adult or an administrator of the household decides, never a minor.
• Attached PDFs, up to three and only if they are real PDFs, become documents in the Inbox, «Documento di» (document from) and the name of the supplier or public body, in the name of the administrator who created the address, and from then on they follow the rules of the other documents. From their text the server also reads, with fixed rules, the supply codes (POD, PDR, customer code) and separately keeps only a fingerprint of them, which cannot be read back: it will be used to recognise which household utility they refer to.
• A PDF does not get in when the person who created the address is no longer active in the household, when the same file is already in the household, or when it goes beyond the limits of a normal upload. The notice arrives all the same. If the PDF is missing because the person who created the address is no longer active, the document can be brought in with the Share button.
• PDFs from a healthcare provider are called «Documento sanitario» (health document) and get in only if the person who created the address is still an administrator. They are stored encrypted and start out «Riservato» (private): they do not go to automatic reading, not even with «Read again», until an administrator removes «Riservato». They can be seen by the administrators, the adults who have accepted the rule that adults in the household see everything, and the minors whom an administrator has allowed to see everything.
• The text of emails never goes to the Claude model. Attached PDFs, on the other hand, in the households where we have turned this feature on, go to automatic reading on their own when they come from a supplier that KeepNest knows and, in the households where we have also turned on mail from public bodies, from a public body that KeepNest knows. The same rules described above apply: it takes the permission of the administrator in whose name the PDF came in, and a PDF already linked to another adult who has not given permission is not sent; documents marked «Private» and sheets with credentials and passwords are never sent; PDFs from health emails, including those from public bodies that we recognise as health emails from their subject or text, do not go there on their own, because they start out «Riservato» (private), as described above; the monthly cap applies. A public body that is not a healthcare provider may still attach a document about health: the permission applies to that too, and it includes consent for health data. PDFs from social care providers, such as care homes, from a sender added by the household, and those that arrived before the feature was turned on, go there only if someone in the household opens them and taps «Read again». In the other households everything stays as before: no PDF from home mail goes to the model on its own.
• KeepNest does not show you links or IBANs taken from the text of emails, and you see the attached PDF as it arrived. If the attachment is a pagoPA notice, its card may show a «Pay» button: it lets you copy the notice code and the creditor's code and opens the official website. You make the payment yourself, outside the app, and it is always your choice.

What is kept, and for how long:

• We never save the whole message: our receiver reads it in memory and sends the server only the parts that are needed. The sender's address is not saved. The subject stays together with the text of the email, cleaned and encrypted in the same way and for the same periods, given below; for emails from healthcare providers not even the subject is kept. Separately, the forwarding confirmation code described below is kept.
• The text of the email is cleaned of the links, email addresses, IBANs, phone numbers and long codes that our filters recognise: some, written in a different form, may remain. The text is encrypted with the household key and is used only to suggest amount and due date. It is deleted when the notice is closed or, if it stays open, at the first nightly cleanup after 30 days. For emails from healthcare providers the text is not kept at all.
• The message record, with supplier, date, size, number of PDFs and a fingerprint that prevents the same notice from repeating, is kept for 24 months and deleted at the first nightly cleanup after that. With it go the link between the PDFs and the email they came with and the fingerprints of the supply codes; the documents stay.
• To connect a mailbox, the administrator opens a 15-minute window in the app: during that time the email in which the mailbox asks to confirm forwarding can also get in (today only Gmail's), and of it only the code written in the subject is kept, encrypted. Administrators see it in the app for 15 minutes; after that it stays stored until the window is opened again, the address changes or home mail is turned off.
• Our server may keep a count of the mail deliveries it receives, day by day and by reason: how many got in and how many were discarded, and why. The count does not say who sent them, what they said or which household they were for; if home mail is on in only a few households, however, the count for one day may concern just one of them. The counts are deleted after 13 months.
• What is in the database also stays in the backups, for the periods given below.

Emails pass through Cloudflare, with its Email Routing and Workers services: it receives them, and our receiver, which runs there, takes them to the server. Cloudflare's network is global, so messages may also pass outside the European Union, with the safeguards described below. While they pass, Cloudflare sees the whole emails, with attachments, the household address with its code and the mailbox they were forwarded from. For every email that arrives, including those we then discard, Cloudflare records sender, recipient and subject. The recipient is the household address, with its code; the sender of a forwarded email may be the mailbox it comes from; the subject is chosen by whoever writes, and it may say sensitive things, including about health in emails from healthcare providers: the subject of Gmail's forwarding confirmation, for example, carries the code and the forwarding mailbox. The people who run KeepNest can see this data too: the Cloudflare dashboard shows it for up to 30 days, and its analytics keep it for 31 days. These are the periods for which it can be looked up, not proof that it disappears everywhere. That Cloudflare does not keep the content of emails is stated on the service page; the contract does not cover it, and does not say how long temporary copies of the message are kept. The call logs of our receiver at Cloudflare are turned off.

Who receives the data

KeepNest uses the following providers. Each one receives only what its task requires.

Invitations

Invitations are sent by an administrator through the channel they prefer, for example a WhatsApp message: in that case the invitation text, with the person's name and the link, goes through that service. The link is valid for 48 hours and can be used only once. If you open it in a browser, the address with the invitation code stays in Vercel's request logs for 1 day.

Transfers outside the European Union

Anthropic processes the documents it receives in the United States, including health documents, identity documents and documents of children under 18, under standard contractual clauses. Vercel, Neon, Cloudflare and Backblaze keep the main data in EU regions but are US companies: they participate in the EU-US Data Privacy Framework and use standard contractual clauses, and Vercel states that its primary processing facilities are in the United States. Home mail, in the households that have turned it on, instead passes through Cloudflare's global network, outside the EU as well: for the United States the EU-US Data Privacy Framework applies, for other countries the standard contractual clauses, in the controller-to-processor module (Module Two). Backblaze attaches the clauses in the 2021 module form, without citing the number of the European decision in the text. Scaleway and healthchecks.io process data in the EU; healthchecks.io declares processors of its own outside the European Economic Area as well. Apple delivers notifications worldwide: for notifications there is no data processing agreement and Apple does not participate in the Data Privacy Framework. Sentry processes errors in its EU region in Frankfurt and keeps them for 30 days; it keeps only the account data of whoever manages the dashboard in the United States. It is a US company: it participates in the EU-US Data Privacy Framework and uses standard contractual clauses.

Vercel, Anthropic and Cloudflare in turn use other providers, their sub-processors, which they list on their legal pages. The Cloudflare services we use include file storage (R2), the mail receiver (Workers) and Email Routing: for R2 and Workers Cloudflare lists Google and Oracle, for Email Routing it lists none; in addition there are the companies in its group and its customer support services. We reread those lists every twelve months.

How long we keep data

• Account deleted in the app: it is deleted immediately. Your sign-in email address, passkeys, sessions, second factor and recovery codes are removed, as are the name and notification token of connected phones; the account name and email become anonymous values. The last administrator of a household cannot delete their own account while other people in the household have an account. If they are the only one left, the app tells them and, if they confirm, the household is deleted together with the account, with all its documents.
• Leaving a household: to leave on your own you must first download the copy of your documents. Access ends immediately on all devices, and after 30 days the account is deleted as above.
• What remains in both cases: the person's profile and the documents, which belong to the household; the activity log; the acceptance of the visibility rule; the membership as a closed record; the phones used, as revoked records without a name. When the household goes together with the account, only the activity log remains, with what it refers to: closed memberships, revoked phones and profiles reduced to an identifier, with no names, dates or notes.
• Documents in the trash: after 30 days they are deleted from the database and from file storage, but they remain in backups (see below). Sensitive or health documents concerning a minor wait for the approval of two administrators, which does not exist yet: until then they stay in the trash.
• Copy of your documents requested from the app: available for 7 days, and deleted as soon as you download it in full.
• On the phone: app data is deleted when you sign out, when the phone is revoked, and on the first launch after 7 days without contact with the server. Scanned documents not yet sent stay on the phone until you send or delete them, and are removed when you confirm signing out or when the phone is revoked.
• Database: Neon point-in-time restore can go back up to 7 days, so deleted data remains recoverable for up to 7 days.
• IP address and browser type: in the 15-minute bridge session that precedes sign-in, deleted when it is used and, if it is not used, at the first nightly pass after it expires; in the sign-in attempts table, removed when the window of that limit has passed and in any case by the following night.
• Request logs at Vercel: 1 day.
• Household usage counts: 90 days. Problem reports: until the account of the person who wrote them is deleted, or until that person leaves the household, if that comes first.
• Errors at Sentry: 30 days.
• List of problems: 12 months from the last time the problem was seen, then the line is deleted automatically.
• Home mail: its periods are set out in its own section, above.

Backups on Backblaze: 90 days, for the database backups and for the file copy alike, which live in the same archive. After 90 days the copy is withdrawn and deleted for good within two weeks by a provider rule. Activity log: 24 months, then older entries are deleted every night. Fingerprint of the IP address in the attempt limiters: for as long as the limit it is counting lasts, that is a minute or an hour for almost all of them and 24 hours for the daily limits of access recovery, and in any case deleted by the following night.

• Database and file backups on Backblaze are protected from deletion for 90 days, with a governance-mode lock that the account administrator can remove. After 90 days a provider rule withdraws them and deletes them for good within two weeks; every night a check of ours verifies that nothing older remains in the archive, and warns us if it finds any.

How we protect data

• Connections are always encrypted (HTTPS), and the website tells browsers to use HTTPS only.
• No passwords: you sign in with a passkey, unlocked with Face ID or your phone passcode. Sensitive administrator actions also require a recent second-factor code.
• Encrypted with AES-256-GCM using one key per household, itself protected by a master key (envelope encryption): tax code and CNP, date of birth, document numbers, plates, property addresses, microchips, notes on people, documents and subscriptions, notification tokens, automatic reading results, text of problem reports.
• Encrypted with the master key only: the address and code of whoever opens a household through registration, the links in outgoing emails, the responses the server keeps to recognise repeated requests.
• Readable by the server, because they are needed for search and for the app to work: names and other names, year of birth and sex, citizenship, email addresses of accounts and invitations, titles, issuers, places, dates, amounts and public notes of documents, deadlines, tasks, household money, phone names and models, activity log, household usage counts.
• Identity and sensitive, health, financial and legal files, their extracted text and photos of people are encrypted in blocks with the household key before being stored, and they can only be opened through the server, which checks permissions. Other files and their text are stored without encryption of our own, and are downloaded with a link valid for 5 minutes.
• Everyone sees only what their role and the household rule allow. The activity log is append-only.
• On the phone, access and keys are kept in the iOS keychain, readable only while the phone is unlocked, and the app does not open on an iPhone without a passcode. An administrator can revoke a phone at any time.
• Home mail: how we protect it, and what Cloudflare sees, is set out in its own section, above.

The limits, stated plainly:

• the master key is kept in the protected settings of Vercel: whoever administers that account, currently the controller, can technically decrypt the data;
• a newly uploaded file stays in a holding area, not yet encrypted, while it is being processed;
• separation between different households is enforced by the application code, checked by automated tests, and by the database as well; only a few internal server tasks that do not concern a single household, such as backups and the job queue, run outside this check.

If a data breach occurs, we inform the people in the household with what we know and, where the law requires it, the supervisory authority within 72 hours.

Minors

A household may include children under 18: their profiles and documents are managed by the administrators, as parents.

A minor can use the app only with an invitation from an administrator, who chooses the role; with the minor role they see only what that role allows. The app does not verify age and does not check that the role matches the age.

Documents concerning a minor are not included in document copies requested from the app, except when the person asking is the only one in the household with an account: then the copy contains the whole household, children's documents included.

With automatic reading, children's documents are sent with the permission of whoever uploads them; documents uploaded by a minor are sent only if a household administrator has given their permission. A minor cannot remove the «Private» mark.

Your rights

You can access your data, correct it, delete it, restrict its processing, object, receive it in a readable format and withdraw consent you have given, without affecting what was done before (Articles 15 to 22 GDPR).

• Correct: profiles and documents are corrected in the app, according to your role.
• Get a copy: in the app, Settings, «Ask for a copy of my documents». It contains the documents your role allows you to take out of the household (for an adult, their own identity and health documents); for other documents about you, ask an administrator.
• Delete your account: in the app, at the bottom of Settings, under «Sign out», «Delete account».
• Withdraw the permission for automatic reading: in the app, Settings, «Automatic reading».
• Withdrawing your acceptance of the visibility rule: in the app, Settings, «Who sees what in the household», «Withdraw»; or write to supporto@casachelariu.com.
• Anything else: write to supporto@casachelariu.com.

When you leave a household, the documents stay with the household: to leave on your own you must first download your copy. We reply within the time limits set by the GDPR, normally within one month.

You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live, for example ANSPDCP in Romania (www.dataprotection.ro).

Changes

When something substantial changes, we update this page and the date at the top.