Hearthfall Privacy Policy

Effective date: 2026-10-07

This policy is published at https://hearthfall.app/privacy.

Hearthfall is built to keep your family's information on your phone.

What we collect: Nothing. Hearthfall has no accounts, no analytics, no ads and no tracking. The developer's only server is a small price service that looks up grocery prices and stores nothing (described below under "Who your phone talks to"). Your schedule, meals, grocery list, reminders, family details and app activity are stored only in a database on your device. Deleting the app deletes them. The one exception is a Shared Hearth that you choose to start, described next; even then the developer receives nothing.

Shared Hearth (optional, off until you invite someone): A Hearth lets the people in your family share one plan, meal list, grocery list and set of notes between their iPhones. It uses Apple iCloud (CloudKit); none of it passes through a Hearthfall server, and the developer cannot see it.

• Where it lives. The shared family data is stored in the iCloud of the person who started the Hearth, encrypted in transit and at rest by Apple, and it is readable only by the people that person invites. It counts against that person's iCloud storage and is handled under Apple's privacy policy.
• What is shared. Schedule events, the meal plan, recipes you saved, your grocery list, pantry, prices you paid, notes, trips, and the family details, meal preferences, favorite stores and "already covered" flags that belong to the family. What is never shared: store keys and passwords (these stay in your phone's secure storage), the contents of your phone calendars (only the Hearthfall events you add are shared), caches of places and calendar events, your daily wins, and per-phone settings such as sounds, haptics and reminder times.
• Shared calendar choices. If you pick which phone calendars to show or save to while you are in a Hearth, the titles of those calendars and the names of their accounts (for example a Gmail address) are shared with the family, so everyone's phone can choose the same calendars. Calendar events themselves are not shared this way.
• Leaving. If someone leaves, is removed, or the Hearth is stopped, every phone keeps its own copy of what was there. The person who started the Hearth can delete the iCloud copy by stopping sharing and then using "Erase all data".
• Names and emails. The member list in the app shows the names (or email addresses) that iCloud provides for the people in the share. They come straight from iCloud and are not stored anywhere else.
• Phone calendars. If you have chosen a calendar to save events to, events from your Hearth are saved to that calendar on your phone, and Hearthfall keeps a small note of which calendar a phone used so two family members who use the same calendar don't get double entries.

Voice: When you tap the microphone, your phone's built-in speech recognition (Apple Speech on iPhone) turns your words into text. Apple may process audio under Apple's own privacy policy. Hearthfall never records or stores audio.

Location: Only if you tap "Use my location" next to Home town. Your phone works out the town name on the device (Apple's built-in geocoder may contact Apple under Apple's own privacy policy). Hearthfall saves only the town name, never your coordinates, and does not track your location.

Who your phone talks to. Hearthfall only contacts these services, and only when you use the feature that needs them:

• Google (search links opened in your browser). Questions Hearthfall can't answer itself open a Google search, just as if you had typed them into Safari. To make results useful, Hearthfall may add context to that search: your kids' ages (never their names or birthdays) and your home town. That text becomes part of the web address you choose to open, and Google handles it under its own privacy policy.
• OpenStreetMap Nominatim and Overpass (place search). When you ask for places to go, Hearthfall sends the place name you said (or your home town) and a map area to find nearby parks, libraries and similar spots. As with any web request, these public services can see your phone's IP address.
• Hearthfall price service (live Kroger and Walmart prices, run by the developer on Cloudflare Workers). When you price a meal plan or fill a store cart, your phone sends it grocery search words (such as "whole milk"), plus the ZIP code you type to find a Kroger store or the Kroger store you picked. If you sign in to Kroger to fill your cart, it also passes Kroger's one-time sign-in code or sign-in renewal token to Kroger on your phone's behalf (your Kroger password never leaves Kroger's page). It forwards these to Kroger or Walmart, answers with prices, and stores nothing: no logs of what you searched, no account, no database. It never receives your grocery list as a whole, your name, your family details or what goes into your Kroger cart (the cart is filled by your phone talking to Kroger directly). Like any web request, Cloudflare can see your phone's IP address, which the service uses only to count requests for a minute to prevent abuse.
• Kroger API (grocery prices and your Kroger cart). Through the price service above, or directly from your phone if you add your own Kroger developer key under Family → Advanced. Kroger receives the grocery search words and the store you picked; if you fill your Kroger cart, the items you choose go to your own Kroger account under Kroger's privacy policy.
• Walmart Affiliate API (grocery prices). Through the price service above, or directly from your phone with your own walmart.io key (kept in your phone's secure storage). Walmart receives only the grocery search words.
• TikTok, Instagram, YouTube and recipe websites ("Add recipe from a link", only when you paste or share a link). Hearthfall requests that one link from your phone, like a chat app's link preview, to read its public caption or recipe data. Nothing else is sent, there is no account, and the result is stored only on your phone.
• TheMealDB (recipe import, optional). "Find new recipes" fetches public recipes from TheMealDB. The request contains no personal information beyond your phone's IP address and, if you entered one, your TheMealDB key.

Ask history: What you type or say into the ask bar is saved in an asks history on your device only. It is never uploaded, and "Erase all data" in the Family tab clears it along with everything else.

Notifications: Reminders are scheduled locally on your device. No push server is involved.

Children: Hearthfall does not collect information from anyone, including children. Kids' names and birthdays you enter stay on the device. Their ages (a number, not a birthday) may be included in a web search you choose to open, as described above.

Contact: hello@hearthfall.app