Privacy Policy

What we collect

Account details: your name, email address, password (stored only as a salted hash), and, if you turn it on, a two-step sign-in key (encrypted). Child accounts use a username instead of an email.

An optional phone number, if you add one at signup or in Settings. Nobody sees it until you choose who can: your co-parent, or people you pick one by one. A child's number is kept only after a parent allows it, and only parents see it. Protective order mode hides every number, and anyone you block can't see yours. We never text it or use it for sign-in codes (two-step text codes use a separate number you give for that). Changes are logged and included in your Download my data.

What your family puts in HomeTwo: messages (including photos and voice notes) and their edit history, calendar entries and requests, custody records, children's profiles and info bank entries (which can include health details such as allergies, medicines, and insurance), documents in the vault, check-ins, expenses and payment records, and your private journal.

Basic usage: the days you open the app, sign-in times with a coarse device label (for example, Safari on iPhone), and counts of views and clicks on directory listings and ads. We do not record what you read or type for analytics.

Location only when you ask: an exchange check-in saves one location at the moment you tap Check in, and a location you choose to send in a message is saved with that message. SOS doesn't send your location. A child's location is shared only from the child's phone while the app is open, after both parents agree; we keep only the latest point. Nothing tracks you in the background. Your ZIP code and state for Local services are saved only if you enter them.

In the App Store and Google Play apps: the age range your device shares (for example, under 13 or 18 and over), used only to send minors to the child sign-up with a parent's consent, and deleted once that check is done.

Support and feedback: what you send through the Help page or Help and feedback in Settings (your name, email, and message), used only to reply and fix problems.

Subscriptions: when you tap Subscribe, we save the plan, price, and the renewal terms you were shown, as proof of your consent. The store or our checkout provider handles your payment details; we never see full card numbers.

Age: adults answer a birth month and year question when they sign up or join with a partner or Family & friends code. We keep only whether the person is 18 or older, not the date.

Family group chat: if every member opts in, both parents and the adults they added can chat in one group; we keep its messages, edits and who joined or left and when, and a parent may include it, as its own section, in a court export.

Kid chats: if every parent approves a relative, family friend or partner for messaging (each approval is logged as that parent's consent), a child can chat with them, text only. Both parents can read these chats; either parent can turn one off; they pause in protective order mode. We keep them 1 year, or until the child account is erased, and leave them out of court exports.

Kid day-change requests: if both parents turn them on, a child can ask both parents at once for a change of days (a day, swap or extra time, and an optional note of up to 140 characters). They never change the calendar, aren't in court exports or the communication summary, and can't be exported or shared in the app. We keep each request and the parents' answers (approved, denied or no response, who decided and when) for 90 days. Courts may still request records through legal process.

Visit requests: if a parent turns them on for their own time, an approved adult family member or friend can ask that parent for a visit with a child on one day (with an optional note of up to 140 characters). Only that parent sees the request; the other parent and the child aren't told. A yes adds an event to that parent's time on the calendar and never changes the custody schedule or anyone's custody rights. Requests and answers aren't in court exports or the communication summary, and we delete them after 90 days.

Check-ins also show in the child's own chat with each parent (one copy per parent, never a shared chat). Those posts follow the check-in rules: kept 90 days and left out of court exports. Parents' replies follow the normal chat rules.

Check-in location: off until a parent turns it on, and only when both parents are in the app and agree. Parents see it for 30 days. Latest check-in location to relatives both parents approved for location; no history.

Notifications: we keep the notification choices you make and when you made them.

Kid accounts: notifications are on, and only parents can change them, in Settings › Kid accounts (each change is logged). Your child's phone tells HomeTwo whether it allows notifications (on, off or blocked) when the app opens, so we can tell parents "Notifications are off on [child]'s phone." The same goes for location: the phone tells parents whether location is allowed (allowed, not allowed or not asked yet), just that, never a position. We keep only the latest status, until the child account is erased.

Fee waivers: if you ask for a fee waiver, we keep the reason you pick and your optional note. Only you and HomeTwo staff who handle waivers see them. We never share them with the other parent or put them in exports. Notes are cleared 30 days after a decision.

Reminders: if a calendar request has an answer-by date, we send one reminder the day before to whoever still needs to answer.

Calendar running out: when the calendar is about to run out of scheduled custody days, we remind both parents 30 days and 7 days before the first day with nothing scheduled, as an in-app notice and a phone notification (never an email, and never to a child, partner, relative or friend). We keep a short log of which reminders were sent, so none is sent twice, and delete it 60 days after that day. Each parent can turn these off in Settings › Notifications › Calendar running out.

Handoffs and drivers: bag lists for each handoff (kept 12 months after the handoff), your reminder choice, and who was named to drive. A parent may enter another adult's name and phone number to name them as a driver. The phone number is used only to show it to the other parent, is never exported, isn't kept in protective order mode, and is deleted 90 days after it was last used. The person whose number it is can ask us to delete it at any time by writing to us at the contact below. Carpool drivers from outside the family are a first name and relationship only, never a phone, and are never contacted. A Medicine item in a bag list is health data (see the Consumer Health Data Privacy Policy) and is hidden from children and masked for drivers.

Adult check-ins: a parent, or a relative both parents allowed, can record a drop-off or pickup for a child without a phone. We save who recorded it, when (set by our server), the place they typed, and a location only if they tap Here. These are part of the family's custody record and can appear in a court export with the recorder's name. Either parent can turn this off for any person at once.

Family names and feedback: nicknames family members choose and a log of changes (kept 12 months after the person leaves), a parent's self-chosen label (like Mom or Dad, which is never a statement of legal parentage), and app feedback you send (stars, optional topic and notes).

If you send feedback, we keep your rating and notes for up to 2 years to improve HomeTwo. Only HomeTwo's owner reads it. We never use your feedback in marketing, testimonials or ads unless you give us separate permission. It's deleted if you delete your account, and it's in Download my data.

Court orders you upload: a parent may save a custody order or agreement to the vault and type transportation limits from it. Reading an order automatically is not turned on; nothing you upload is sent to any outside reading or AI service. If that changes, we'll name the service here first and ask for your consent each time.

Kid check-ins: when a child taps a check-in button (like Home or On the bus), we save which button and when, and tell the people approved for check-ins. A location is included on each check-in when both parents have turned on location: one reading, taken at the tap. Parents see it; a partner or Family & friends member sees it only if every parent approved location for them. Never in protective order mode.

How we protect it

Messages, info bank entries, vault files, journal entries, court exports, and two-step keys are encrypted at rest with AES-256-GCM, using a separate key for each family (and for each person's journal). Connections use HTTPS.

Each database table has row-level security, and our servers check who you are and what your role allows on every request. Owner and staff access to HomeTwo's dashboard requires two-step sign-in and shows account details only, never your messages, files, journal, or children's details.

Who can see what

Your safety settings (Hide my address, blocks and quick exit) are private to you. The other parent isn't told when you change them, and they aren't in court exports. Protective order mode is different: both parents see when it's on.

Parents in a family see the shared record. Partners and Family & friends members see only what the parents allow. A parent can also share the calendar for their own custody days (which days they have the children, and their own notes on those days) with adult partners and Family & friends members they added, without the other parent's approval. It never includes anything a child entered, anything from the other parent, or any location or address, and it pauses in protective order mode. Relatives and family friends in Family & friends (grandparents, aunts and uncles, adult siblings, other caregivers and friends, all 18 or older) see only the categories both parents approve for them one by one: school info, medical, allergy and insurance info (which also needs each parent's separate health-data consent), other key info-bank items, the custody calendar, and the child's current location (never a history, and only while both parents have location turned on). Everything relatives see pauses in protective order mode. Either parent can turn any category off or block a relative at any time; every approval, change and block is logged and included in Download my data. Children can see who sees their location. Children see only their own chats and what parents allow. Your journal is visible only to you.

A lawyer, mediator, or other professional sees a family's record only if a parent invites them. Their access is read-only, the other parent is told, and every view is logged. The parent who invited them can remove them at any time. A court-appointed professional (such as a guardian ad litem) can be removed only when both parents agree.

Verified PDFs you create can be checked by anyone with the verification code. The Verify page confirms a record is unchanged; it does not show names or content.

Partners: a parent's partner sees a child's location or the custody calendar only if every parent approves. Approvals are logged and shown to the child.

You can choose which approved adults see your own location; we don't tell anyone when you change this.

If you turn on live location, only the approved adults you pick see your current location; we keep only your latest position and delete it within 24 hours after you stop.

Chat notifications off: if a parent turns off chat notifications, the other parent sees when and for how long, and it's included in court exports. In protective order mode, the other parent doesn't see it in the app.

Communication summary: Court tools can show both parents the same counts from the Parents chat, requests and exchange check-ins (for example, reply times and messages outside agreed chat hours). These counts are included in the court packet.

Service providers

These companies process data for us only to provide their service:

Ads and the directory

Ads are off today. If they are turned on, parents on the free plan may see one clearly labeled, family-safe sponsor card on some screens. Our servers never send an ad to a child, partner, family member, friend, or professional. Ads never appear in messages, are not targeted using your messages or records, and use no tracking cookies or third-party ad networks. Plus families see no ads. You can report any ad.

Local services lists family services such as mediators and counselors. Sponsored listings are paid, marked Sponsored, and shown first. You can turn the list off in Settings. Listings don't receive your information unless you contact them.

Children

Child accounts are for kids 10 to 17 and are made only with a code from a parent, with the child's birthday. The child signs up with a username, not an email. The account stays on hold until a parent, signed in, reads our notice about children's data and gives consent. If the parent declines, everything the child entered is erased.

From a child we collect a first name, username, password, messages the child sends in family chats, and, only if every parent allows it, the child's location while the app is open (nothing is stored or sent from the child's phone until every parent agrees; only parents turn it on or off, the child can't pause it, and the other parents are told each time), and the check-in buttons the child taps (and, when both parents have turned on location, the location at that moment). A parent reads this notice and gives consent at Add child account, before the child code exists, so a child enters nothing until consent is recorded; after the child signs up, a parent confirms it's the right child. We use it only to run family chats, the calendar view, check-ins, and SOS. A child sees calendar notes from parents only. Children never see ads, and their messages are never sent for translation. Place names near a child's location are looked up only with a parent's separate permission.

Parents can review a child's messages in the Family chat, download the child's data, set a new password, change chat hours, stop location sharing, and erase the child account at any time in Settings › Members. Parents control a child's account settings in Settings › Kid accounts; the child can't change them, and each change is logged. Erasing or removing a child account erases the child's messages, location, profile, and sign-in right away.

Handoffs on a child's account show only handoff times and who's picking them up, never notes, places in protective order mode, medicine items or check-ins. Nothing from a child account is ever sent to a document reader.

Children's data retention: kept only while the child account is active; erased as soon as a parent erases or removes it, apart from backups that roll over on our database provider's schedule. Questions about a child's data: email privacy@hometwo.app, or use the Help page.

Health information

Info bank entries can hold a child's health details. They are encrypted, shown only to the people you choose, never used for ads or analytics, and deleted with your account if they're private. See our Consumer Health Data Privacy Policy at /health-data.

Cookies and similar technology

HomeTwo uses essential cookies only: one keeps you signed in, one remembers your language, and, if someone answers the age question as under 18, one stops the answer from being changed on that device for a year. During two-step sign-in, a cookie holds your place for 5 minutes, and HomeTwo staff accounts use one more for the owner dashboard. HomeTwo also uses storage on your device for drafts, offline messages, and display settings. We don't use advertising or cross-site tracking cookies, so there's no cookie banner. If an app error happens, your browser sends us the error, the page path, and your browser type, but never message text or form contents.

How long we keep data

Because HomeTwo is a record that may be used in court, a parent can't delete the other parent's messages or a locked message, and edits keep earlier versions.

Your choices and rights

You can see and export your family's record (Export), download your own data (Settings › Your account › Download my data), correct your profile, turn optional features on or off in Settings, turn on two-step sign-in, and delete your account in the app. Depending on where you live, you may have more rights, such as the right to know, correct, or delete your information, and to appeal a decision. To make a request, email privacy@hometwo.app, or use the Help page. We respond within 45 days.

If something goes wrong

If we learn of a breach that affects your personal information, we will notify affected people and regulators as required by law, without unreasonable delay, and tell you what happened and what you can do.

Changes and contact

We will post changes here and tell you in the app before a material change takes effect. Questions: email privacy@hometwo.app, or use the Help page.