Halfdoor privacy

Last updated 2026-11-08

Privacy in plain words

Mine is private from other members, not from the operator

The operator reads entries only to fix a problem you report.
Access to the database is restricted.
Entry text is kept out of routine logs and error reports.

Forget removes a line from Halfdoor at once

Copies stay in database backups for up to 30 days.
Backups are Cloudflare D1 Time Travel: 30 days on Workers Paid, 7 on Free.
What an assistant already showed or recorded is outside Halfdoor's control.
The same holds for a review item you discard, or one that expires.
Forgetting a file deletes it from Halfdoor's file storage too, retried until the deletion is confirmed. File storage keeps no backups, so a forgotten file is gone for good, and a database restore cannot bring it back.

Photos and documents you upload

You can upload photos and PDF documents on the members page, to Mine or to Home. They are stored in Cloudflare R2, private file storage at Cloudflare, which already hosts Halfdoor.
A photo is resized and re-encoded, and its location and other hidden details are removed. Halfdoor keeps that copy, never the original. A PDF is kept as uploaded.
A file is shown only to people who can see its line: you for Mine, current members for Home. It is never reachable by a public link.
File storage has no backups. If Halfdoor's database is ever restored to an earlier point, a file uploaded after that point can be lost.

Removing a member, or leaving, stops future access

It cannot take back what was already seen.

Join emails, and the emails telling an author their Home line was hidden or restored, are sent through Resend

Resend sees names (the joiner's, the household's) and email addresses.
It never sees entry text.

Halfdoor does not sell personal data or use it for ads

This covers entries, names, email addresses and the Google sign-in identifier.

Halfdoor is for adults

You must be 18 or older. Each person confirms it when they accept Halfdoor's privacy policy.

Ask sends your question and your household's record to Anthropic

Ask, on the members page, answers a question with an AI model run by Anthropic. To answer, Halfdoor sends Anthropic your question, your household's current record items (what each is, its brand, model, serial number, place in the home, dates and note, and how and when it was checked) and its community notes (topic, text, source name and date).
It never sends your Mine, Home lines, review list, names or email addresses.
Anthropic processes them under its commercial API terms and deletes them within 30 days. It keeps them longer only to enforce its usage policy (content its systems flag, up to 2 years), where the law requires, or, where its contract with Halfdoor allows, in anonymized form for research.
Anthropic does not train its models on them: it does not train on commercial API data by default, and Halfdoor sends it no feedback and has not opted in.
Halfdoor keeps no copy of your question or the answer on its servers. Your browser may keep the answer page in its own history.

What Halfdoor keeps, and for how long

Your lines

Mine and Home lines: kept until you forget them.
Forget removes the text at once. A marker without the text stays: who wrote it, where, which assistant saved it, and when.
A hidden Home line is kept, hidden, until a member brings it back or its author forgets it.
When you leave, your Mine stays yours and your Home lines stay with the household. You can forget a Home line only while you are a member.

Photos and documents

The stored copy (for a photo, the re-encoded copy and a small preview), its size, its type and a checksum, with the caption as the file's line. Kept until you forget it.
Nothing of the original photo, its location or its other hidden details, and not the file's name.
Upload attempts: a count per person per hour, with no file or text. Kept about a day.

Your review list

An item's text stays in your review list until you approve, move or discard it, or for 30 days, whichever comes first.
Then the item's text is cleared and a record without the text stays. An item you approve or move lives on as a line.

Your account and household

The email you were added or invited with, your display name, your Google account identifier, and your household memberships, past ones included. No set time limit.
Invites: a link works for 7 days. The invite's record (who invited which email, under which display name, and when). No set time limit.
Consent records (which policy version you accepted, when, and your adult confirmation). No set time limit.

Halfdoor's security record

A separate record of every security change: people added, Google accounts linked, joining and leaving, suspensions, revoked connections, policy versions and consents, forgets, invites, hides, the review hold, record deletions and community changes.
It includes the email and display name each person was added or invited with, their Google account identifier, household names, and the address each queued email goes to. It holds no entry text.
No set time limit: Halfdoor uses it to restore after a failure.

Emails

Each join notice and hidden-or-restored notice keeps the recipient's address and the email as sent (names, never entry text). No set time limit.
Resend keeps its own copy under its own terms.

Sign-in sessions

A members-page sign-in lasts 1 hour.
An unfinished sign-in expires after 10 minutes.
An invite link, once opened, must be finished within 30 minutes.
An assistant's access token lasts 1 hour. Its connection stays while you use it, and ends after 30 days without use. It ends sooner if it is removed, Halfdoor revokes it, or a new privacy policy asks everyone to reconnect.

Ask

How many questions each person and each household asked each day, kept 35 days, and how many each household and all households together asked each month, kept 13 months.
Never the question or the answer.

How often Halfdoor is used

For each person and day, how many times they used each Halfdoor action (saving, recalling, forgetting, reading the record or community notes, seeing who is in the household, help, signing in on the members page, review decisions, hiding or restoring a Home line, and Ask), and which household they were in.
Counts only: never what was saved, searched, asked or uploaded.
Kept 400 days. Halfdoor uses them only to see whether households keep using Halfdoor.

Billing references

As listed under "Payments through Stripe" below. No set time limit.

Backups

Copies stay in database backups for up to 30 days.
Photos and documents have no backups: a forgotten file is deleted for good, and a database restore cannot bring one back.

Logs

Error logs hold no entry text, names, email addresses or payment details. Cloudflare keeps them for its standard period.

Halfdoor's website and invite requests

Halfdoor's website, https://halfdoor.ai, is hosted by Vercel. It sets no cookies and runs no analytics. Vercel keeps its standard request logs.
If you ask for an invite, the request form (Google Forms, in the operator's Google Workspace) collects your name, email, neighbourhood, which assistant you use, whether you are interested in the checking visit, and anything you add. Halfdoor uses it only to reply to you about Halfdoor and the checking visit, and deletes it within 12 months of the last contact, or sooner if you ask at admin@halfdoor.ai.

Who receives your data

Your assistant's provider receives what Halfdoor returns to your assistant: OpenAI for ChatGPT, Anthropic for Claude, or whoever runs any other assistant you connect. It handles that data under its own terms and privacy policy. Halfdoor does not control what it keeps.
Other members of your household see your display name, your Home lines and which assistant saved each one. They never see your Mine, your review list or your email address.
When you join, each member gets an email with your display name. When you hide or restore someone else's Home line, its author, while still a member, gets an email with your display name.
Anthropic runs the AI model behind Ask. When you use Ask, it receives your question and your household's current record and community notes, as described above. This is separate from what Halfdoor returns to Claude, if Claude is your assistant.
Cloudflare hosts Halfdoor. Vercel hosts Halfdoor's website. Google signs you in and holds invite requests. Resend sends Halfdoor's emails. Stripe handles payments. Each is described on this page.
No one else. Halfdoor does not sell personal data or use it for ads.

What your assistant receives

recall: each line's text and id, Mine or Home, when it was saved, which assistant saved it, and its author's display name and person id, with whether you wrote it. For a line with a file: the file's type, its size and a link to it on Halfdoor, which opens only for someone signed in who can see the line; for a photo, possibly a small preview image, which goes to your assistant's provider.
who: each current member's display name and person id, and which one is you.
save: the new line's id, Mine or Home, and the time. A save to your review list returns the item's id, whether your review hold sent it there, how many items wait, and a link to your review page.
forget: the line's id and the time it was forgotten.
help: the same setup guide for everyone.
record and community: see "Your home record" and "Community notes" below.
Never another member's Mine or review list, and never a member's email address or Google identifier.

What to leave out, and why

Home is readable by current members and anyone who joins later, including older lines.
Mine is private from other members, but the operator may read it to fix a problem you report.
Forgotten text can remain in backups for up to 30 days, and your assistant may keep its own chat history.

Health records and tracking

Practical household notes, such as where the water shutoff is, are what Halfdoor is for.
Please do not use Halfdoor for ongoing measurements (heart rate, sleep, blood pressure), test results or medical files.
This shared memory is not designed to protect a health history.

Financial details

Amounts, due dates, payees and who pays are fine, for example "Mortgage: $3,200 monthly, due on the 1st."
A utility or maintenance charge, or the last four digits of an account, is fine too.
Please leave out full statements; passwords, PINs and security answers; full account, routing and card numbers; and government ID numbers.
Those details can expose your transactions or help someone commit fraud. Halfdoor is not a vault.

This is guidance for what you choose to save; Halfdoor does not screen saved text for these details. Whether health or financial privacy rules would apply to Halfdoor has not been reviewed.

Google user data

At sign-in, Halfdoor asks Google only for your basic identity and email address (the openid and email scopes), and receives what those return.
Halfdoor keeps your Google account identifier.
Your email address is kept as the one you were added or invited with. At sign-in, Halfdoor checks it against your verified Google email.
Halfdoor uses them only to sign you in, to match you to your invite or enrollment, and to send Halfdoor's emails (join notices, and notices that a Home line was hidden or restored).
Halfdoor does not send your Google account details to Stripe.
Your display name comes from your enrollment or invite, not from Google.
Halfdoor does not sell personal data or use it for ads, Google user data included.
Join emails go through Resend, which sees names and email addresses, never entry text.

Your home record

Written only by Halfdoor, after checking

The record lists your home's equipment, key locations such as shutoffs, and service history.
Only Halfdoor writes it. Nothing you or your assistant saves becomes part of it, and no web form or assistant can change it.
Each fact shows how it was checked (read from the label, told by the owner, or taken from a document the owner showed), who checked it and when.
The record keeps no photos. A manual link points to the maker's own page.

Who can see it

Every current member of your household, including people who join later, and Halfdoor. A member who leaves loses it. No other household ever sees it.
Members see it on the record page, and their assistants can read it, with or without an active plan.

Corrections and deletion

A correction adds a new version; older versions stay in the record's history and in the export.
Any current member can ask Halfdoor to delete the whole record, from the record page. Asking deletes nothing by itself. When Halfdoor processes a valid request, after checking that the person who asked is still a member, it deletes every version, later corrections included, keeping no text. Halfdoor does not act on an email alone.
If the plan ends, Halfdoor adds nothing new. The record stays readable on the record page, through assistants and in the export, until Halfdoor processes a current member's valid request to delete it, or the household closes.
After deletion, copies stay in database backups for up to 30 days.
Record details are kept out of logs.

Community notes

Halfdoor's own short summaries of sources about the community your home is in (HOA rules, amenities, trash and utilities, official contacts), each with its source and date, and a link to the original where there is one.
Written only by Halfdoor. The same notes are shared with every household Halfdoor places in that community.
They hold no residents' personal details; contacts are official ones only.
Halfdoor records which community your household is in, and only Halfdoor sets it.
Members' assistants can read them, with or without a plan.

Payments through Stripe

Stripe is the payment processor

The paid plan pays for Halfdoor checking your home and keeping its record current. It is started on Halfdoor's billing page and paid through Stripe. Nothing is sold inside an assistant.
The payer enters their details on Stripe's own pages: an email address and, once a card is added, the card details and the name on the card. Card details never reach Halfdoor.
To identify your household and the payer, Halfdoor sends Stripe random identifiers, never their names or email addresses, and never entries. Beyond those, it sends only the plan's checkout settings, requests to read or cancel the plan, and the addresses to return to.
Stripe handles what it receives under its own privacy policy. Stripe, not Halfdoor, emails the payer before a trial ends and before a renewal; Halfdoor sends no billing email.

What Halfdoor keeps

Stripe's references for the household's customer and subscription, which member pays, the plan's status, the trial end, the renewal or end date, whether a cancellation is scheduled, whether a card is on file (never the card itself), and whether the household has used its trial.
A record of each checkout started (who started it, its settings and status), and the ids, types and outcomes of the Stripe notifications it processed, never their contents.
Other members see the plan's status and the payer's display name, never card details.
Billing details are not in the export, and names, email addresses and payment details are kept out of logs.

Downloading your data

Signed in, you can download a file of your data at https://app.halfdoor.ai/household/export.
While your account is active, it holds your own Mine lines and your review list.
While you are a current member who has accepted Halfdoor's current policy, it also holds your household's Home lines, hidden ones included, with their authors' display names and who hid each hidden one, and the home record with every version.
It never holds other members' Mine or review lists, email addresses, Google identifiers or billing details.
Once downloaded, the file is on your device, outside Halfdoor's control.

What it cannot promise

These depend on the assistant, not on Halfdoor.

That a save really came from your request.
That an assistant ignores instructions written inside someone's Home line.
That an assistant's "Always allow" setting never saves something unwanted.

Risks we accept

Assistant mistakes, and transcripts the assistant keeps.
Access by the operator and by the infrastructure (Cloudflare).
Names and email addresses seen by the email provider (Resend).
Payment details seen by the payment processor (Stripe).
Your question and your household's record seen by the AI provider (Anthropic) when you use Ask.
Database history that can be restored, within its backup window.

Contact

Questions or requests: admin@halfdoor.ai

Help and support: Support