Hearth — Privacy

Last updated 14 September 2026

Hearth is a shared household assistant: groceries, chores, meals, dates, notes and pets, shared between the phones in one home. This page says what Hearth keeps, where, and why — taken from the code, not from memory.

The short version

No accounts. There is no email address, no password, no advertising identifier and no analytics. A household is opened with a house key that only its members hold.
Your content is encrypted before it leaves your phone. Names of groceries, chores, notes, recipes, dates and pets are stored as ciphertext. The server holds them and cannot read them; neither can we.
We keep the schedule in the clear. Dates, cadences, done flags and counts are stored readably, so the morning digest can tell whether something is due without knowing what it is.
Photos and voice clips are read and discarded. They are never stored.

What is stored, and where

What	How it is held	Why
First names of household members	Cloudflare D1, readable	so the digest can say whose turn it is
Household content — lists, chores, notes, recipes, dates, pet notes	Cloudflare D1, AES-GCM ciphertext	the server stores it; only your phones can decrypt it
Dates, cadences, done flags, counts	Cloudflare D1, readable	the scheduled digest needs to know whether something is due
Push notification endpoint and time zone	Cloudflare D1	to send the morning digest at your morning
Which plan the household is on, and how many AI captures it has used this month	Cloudflare D1	the free allowance and the subscription belong to the household

What passes through and is not kept

What	Where it goes	Note
Voice clips	Cloudflare Workers AI (speech to text)	transcribed and discarded
Photos of recipes or shopping	Cloudflare Workers AI (vision)	read and discarded; the image is never stored
Barcodes	Open Food Facts, through our server	only the anonymous product number leaves Cloudflare; your phone never talks to them directly

Cloudflare processes this data on our behalf and does not train models on it. Cloudflare's own privacy notice covers its infrastructure.

Notifications

The morning digest is sent as an empty ping. The words you see are composed on your phone from data it already holds. Nothing about your household travels through Apple's or a browser's push service.

Subscriptions

If a household subscribes, the purchase is made through Apple. Apple handles payment and keeps the receipt; we receive only a confirmation that the household is subscribed and until when, via RevenueCat, which processes receipts for us. We never see card details.

Deleting

Any member can delete the household from Settings. Everything in the database is removed at once. Cloudflare keeps point-in-time backups for around thirty days, so deleted data can persist in those backups for that long before it is gone for good.

Your rights

Because there are no accounts and the content is encrypted end to end, the data we can act on is the household's schedule, member first names and push endpoints. You can export everything your phone holds from Settings, and delete it all from the same screen. If you have a question or a request under data-protection law, write to contact@whativeheard.com.

Who we are

Hearth is made and operated by Roads Untraveled. This page changes when the app does; the date at the top is the one that counts.