HomeAtlas: Privacy Policy

This Privacy Policy explains how OMNIA VINCULA PTY LTD ACN 700 615 498, trading as HomeAtlas (ABN 28 700 615 498) (“HomeAtlas”, “we”, “us” or “our”), collects, uses, shares, and protects your personal information when you use the HomeAtlas website, mobile applications, and related services (the “Service”).

We are committed to handling your personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), the EU/UK General Data Protection Regulation (GDPR), the New Zealand Privacy Act 2020, the U.S. California Consumer Privacy Act / CPRA, the Children's Online Privacy Protection Act (COPPA), Canadian privacy law (PIPEDA), and the UK Age Appropriate Design Code, to the extent each of these applies to you.

1. Who we are and how to contact us

HomeAtlas is operated by OMNIA VINCULA PTY LTD ACN 700 615 498, an Australian proprietary limited company (ABN 28 700 615 498), trading as HomeAtlas. We are the data controller (and, in Australian terms, the “APP entity”) for the personal information described in this policy. information described in this policy.

Privacy contact: [email protected]
Postal address: Level 2, 58 Gawler Place, Adelaide SA 5000, Australia
Website: https://homeatlas.org

For users in the EU/EEA or UK who prefer to write in their own language, you can also contact us at the same email. We will respond in English.

2. Information we collect

2.1 Account and profile information

• Email address, password (stored hashed), display name, optional username, optional bio and phone number;
• Authentication identifiers from Google, Apple, Microsoft, or Facebook if you choose Sign in with that provider, typically your email and a stable user ID;
• Time zone, preferred currency, region, colour palette and other UI preferences;
• Subscription tier, Stripe customer/subscription ID, Apple/Google in-app purchase receipt identifiers, credit balance, top-up history.

2.2 Household and location information

• Home and garage names and postal addresses. We do not store map coordinates for them: an address is geocoded only to answer a question at the time you ask, and the coordinates are discarded;
• Garden, project, and event addresses, and a Google Place ID where you picked a place from the address suggestions;
• Household membership records, invite codes, roles (owner, co-parent, carer, viewer), and permissions you grant other members.

We do not collect continuous, background, or precise GPS location from your device. Apart from the addresses you type, we do not hold location data.

Location data in photos. Photos taken on a phone often carry hidden location data (GPS coordinates) recorded by the camera. We remove that hidden data from every photo you upload, including photos you store in the document vault, before we store it. Other documents, such as PDFs, are stored exactly as you upload them.

2.3 Family and care records

• Child profiles you create: preferred name, date of birth, gender, height, weight, school name, allergies, medical conditions, health notes, emergency contact, and any AI-generated avatar (a stylised illustration, not a photo);
• Adult/household person profiles with similar fields, where you record them;
• Care plans: medications, dosages, schedules, dose logs (taken/skipped/notes), and care tasks;
• Documents you upload to the family paper inbox (school letters, consent forms, medical results, prescription labels) and the structured data we extract from them using AI vision;
• Family events and tasks (calendars, reminders, checklists);
• End-to-end encrypted family messages: we store ciphertext and metadata (participants, household, timestamps), but the content is decrypted only on your devices.

2.4 Kitchen, garage, garden, pets, and projects

• Recipes, meal plans, dietary preferences, palate questionnaire answers, shopping lists, and cocktail recipes;
• Pantry / fridge / freezer items, including barcode scans, expiry dates, brand and quantity, photos of groceries you upload;
• Garage projects with materials, tools, tasks, budgets, timelines, and any reference photos you upload;
• Garden, plant, lawn, and pet records, including pet vaccinations, parasite treatments, test results, and any photos or AI-generated avatars;
• Event project details (venue, theme, guests, menu) and any AI-generated invitation images.

2.5 Chat content

• Messages you send to the AI assistant (“Atlas”) and the responses we generate, stored against the relevant project, recipe, or thread.

2.6 Calendar and tasks (when you connect them)

• If you connect Google Calendar, Google Tasks, or Microsoft Outlook, we receive, at your direction, calendar IDs, event titles, times, descriptions, attendees, and similar fields, plus a refresh token (encrypted at rest with a Fernet key) so we can keep your HomeAtlas calendar in sync. You can disconnect at any time.

2.7 Payment information

• For web subscriptions, Stripe processes your card directly. We never see or store your full card number; we receive metadata such as customer ID, plan, last four digits, country, and the result of the transaction.
• For mobile in-app purchases, Apple or Google tells us the product purchased, the transaction/receipt ID, and the subscription state. They do not share your card details with us.

2.8 Device and technical information

• IP address, user-agent, device type, OS version, app version, and timestamps for requests;
• Authentication tokens (JWT access/refresh), session cookies, and a CSRF token;
• Crash and error logs, basic performance metrics, push subscription identifiers (if you opt in to web/mobile push).

2.9 Information we do NOT collect

• We do not knowingly collect biometric data, government identifiers, sexual orientation, religion, political opinions, or trade union membership;
• We do not collect background or continuous device location;
• We do not collect data from your device's contacts or health records unless you actively pick a file to upload;
• Your camera and microphone are used only by features you start. Photos you take in the app (for example homework and receipt scans, chat photos, cover photos) are uploaded and, for an AI feature, sent to our AI provider to produce the result you asked for (section 4). Voice commands (Talk to Atlas) use the microphone: on the mobile apps your speech is turned into text on your device; Android uses the offline Vosk engine, and until that engine is ready (or if it fails) Android's built-in speech recogniser, which on many devices processes audio on Google's servers; iOS uses Apple's speech recognition, on the device where supported and otherwise on Apple's servers. On the website, Talk to Atlas sends the audio you record to our server, which sends it to a speech provider (currently OpenAI, or Google Gemini Live in the realtime mode) to transcribe it. We do not store audio recordings; only the transcript text is kept where the feature saves it.

3. How we use your information

We use the information described above to:

• Create and run your account, authenticate you, and keep your data in sync across devices;
• Operate and personalise the Service: for example, display your pantry, generate shopping lists, sync your calendar, and remember your preferences;
• Generate AI suggestions you ask for (recipes, project plans, care plan templates, images, document extraction);
• Process payments, manage subscriptions, allocate credits, and prevent fraud;
• Send transactional emails (verification, password reset, daily digests, billing receipts, household invites) and the in-app or push notifications you have enabled;
• Provide customer support and respond to your queries;
• Investigate misuse, enforce our Terms, and meet our legal obligations;
• Improve the Service, including through our own first-party product analytics, which use pseudonymous usage events (see section 7) and aggregated statistics. We do not train our own AI models on your content, and we do not allow our AI providers to use your content to train their general-purpose models, where that option is available to us.

3.1 Legal bases (EEA / UK)

If GDPR applies to you, we rely on the following legal bases under Article 6:

• Contract: to deliver the Service you signed up for (most processing).
• Legitimate interests: security, fraud prevention, service improvement, analytics. We balance these against your rights.
• Consent: for marketing emails (where applicable), optional features you turn on, sensitive AI features, and special-category data (such as health and child data: see below).
• Legal obligation: tax records, lawful requests from authorities.

For special-category data (Article 9 GDPR): such as health information you record in care plans, allergy notes, medication logs, or prescription label scans. We rely on your explicit consent, given when you choose to record that information. You can withdraw your consent at any time by deleting the data, or your account, in the app.

3.2 Sensitive information, health, medication and allergies

Some information you can choose to record is sensitive: medications and dosages, allergy lists, health notes, care plans, dose logs, and prescription-label or medical-result scans. We hold this to a higher standard:

• What we collect. Only what you choose to enter or upload, medication names and doses, schedules, dose logs, allergy and health notes, and the documents you scan into the family paper inbox.
• Why. So you can record and manage your family's care in one place, and so the AI features you actively ask for (for example reading a prescription label) can use that specific input to produce the result you wanted.
• Not used for anything else. Sensitive health information is never used for advertising, never sold, and never used to train AI models. It is shared only with the providers needed to deliver the feature you used, and only the minimum required (see sections 4 and 7). Where processing is based on consent, you can withdraw it at any time by deleting the data or your account in the app.

4. AI features and how data is sent to AI providers

HomeAtlas uses third-party AI providers to power features like Atlas, recipe suggestions, project planning, document extraction, and image generation (cocktail covers, event invites, child or pet avatars, DIY inspiration). When you use one of those features, the relevant input: for example your message, a project description, the photo you uploaded or took in the app, or a child's profile fields needed for an avatar, is sent to our AI provider to produce the result.

How we limit what is shared:

• We only send the data needed for the specific feature you used (data minimisation).
• We use AI provider plans that, where offered, opt out of training the provider's general-purpose models on your content.
• Image-generation prompts about a child or pet use the profile fields you have recorded (name, age range, interests). We do not send a child's photo to image-generation models for avatar generation.
• Family E2E messages are never sent to AI providers, the plaintext exists only on your devices.

Before any of your personal data is sent to an AI provider for the first time, we ask your permission with a separate “Use AI features?” prompt. We store the exact wording you were shown, together with when and where you accepted it. You can withdraw this permission at any time in Profile → Settings → Privacy; from then on AI features stop sending your data. Data already sent before you withdrew it was processed under the limits in this section and is not recalled.

We engage third-party AI providers as sub-processors. Every AI provider we currently use is named, with the features it powers and what it receives, in the service provider table in section 7.

We only send each AI provider the specific input needed for the feature you used, and we use plans that, where offered, opt out of the provider using your content to train its general-purpose models. You can email [email protected] at any time to ask which providers we currently engage; we will answer in line with this policy and applicable law.

5. Children's data and family records

HomeAtlas households are run by adults. Children do not sign up for HomeAtlas themselves: records about a child are created and managed by a parent or guardian (the household administrator). We do not allow direct sign-up by children under 13.

Children in your household. A child does not currently have a HomeAtlas login of their own: no separate sign-in, username, password, or QR code. They are a household member their parent or guardian manages: the parent creates the child's household record, decides what is recorded about them, and can change or remove it at any time.

What a child's record is. A child's record is information the parent or guardian enters and manages from their own account. It holds the child's name, date of birth and the profile details listed in section 2 (school, allergies, health notes and emergency contacts), chores and tasks assigned to them, calendar entries about them, care plan items, and school documents the parent uploads. The child does not currently sign in and does not use HomeAtlas themselves, so nothing is collected from a child: no photos, messages, task ticks or activity of their own.

What a child cannot do. Because a child does not currently have a login, a child cannot buy anything, see prices or upgrade offers, change a subscription, message anyone, or use the general AI assistant (Atlas, chat and voice).

AI features and a child's record. One parent-side AI feature can process information about a child: avatar illustrations generated from the profile fields you have recorded (name, age range, interests). We do not send photos of children to image models. The Homework Helper, which sent homework photos to our AI providers to read them and build a step-by-step plan, is not offered: using its steps and study coach needed a child's own login, and no child currently has one, so no homework is sent to AI providers. While it was offered, homework requests went to OpenAI under zero data retention, with Anthropic as a backup, and never to Google Gemini. We also never send the requests of account holders under 18 to Google Gemini.

AI safety for teen account holders. Every AI request from an account holder under 18 carries extra safety instructions, and both the question and the AI's answer are checked by an automated content-safety filter. If either is flagged, the answer is not shown, and a flagged answer is reviewed by a person. The first time a teen uses Atlas, we tell them that Atlas is an AI, not a person, and every Atlas answer they see is labelled as written by AI. A child makes no AI requests, because a child does not currently use HomeAtlas.

Parental consent. The parent or guardian who adds a child to their household confirms they are the child's parent or legal guardian and consents on the child's behalf to the processing described in this policy. We may ask for additional verification.

No ads, no tracking, nothing collected from a child. HomeAtlas shows no advertising to anyone, and we do not sell children's data or share it for third-party advertising or tracking. A child does not currently sign in, so no analytics are collected from a child's device and we record no product-analytics usage events about a child at all.

Parent rights. A parent or guardian can review, change, export, or delete their child's information at any time from Family settings, or by emailing [email protected]. Deleting a child's records removes the child's data on the same timeline described in section 13. Family messages are end-to-end encrypted, so they are not included in that download.

Retention of homework data. The Homework Helper is not offered any more, but homework records created before 17 October 2026 are deleted on the same schedule: photos after 180 days (or 12 months if a parent chose to keep them longer), and assignments, their steps and study-coach conversations 24 months after they were last used. A parent can download or delete these records at any time from Family settings, like any other part of the child's record.

Teen accounts (13 to 15). A young person aged 13 to 15, or up to their country's digital age of consent where that is higher, can create their own account only with a parent or guardian's consent, given through an email link. Until that link is used, the account is paused. The parent can withdraw consent in Settings, which pauses the account again; the account is not deleted automatically. Teen accounts cannot buy or change subscriptions, do not receive marketing email, and do not show alcoholic drinks content (mocktails only). Where local law allows, 16 to 17 year olds may sign up on their own.

Limits for young people. Account holders under 18 cannot comment on public recipes, except that a parent can allow a 16 or 17 year old to see and post comments; if one of their comments is reported, we tell their parent. Those aged 13 to 15 cannot publish recipes, projects or pet profiles publicly, cannot like or follow public cooks, cannot send household invites, and can only add friends or message people in their own household; a parent can allow them to view public recipes. HomeAtlas does not suggest DIY projects or assign DIY tasks to anyone under 18, and the workshop area opens only with a parent's permission. A household's owner, and any co-owner the owner appoints, can set these permissions in Family settings.

Turning 18. On their 18th birthday these limits end automatically. The young person becomes a full adult member of the household, and both they and the household's parents are told.

Age question. We ask every account holder for their date of birth, or to confirm they are 18 or over, so we can apply the right protections.

If you believe a child under 13 has created an account directly, outside of a parent's household management, please contact [email protected] and we will investigate and delete it.

Child safety. Our Child Safety Standards describe how we prohibit and respond to child sexual abuse and exploitation, and how to report a safety concern from inside the app.

6. Sharing with household members

When you invite someone to your household, you choose what they can access: for example the family calendar, child records, the pantry, or shopping lists. Anything you grant access to becomes visible to that household member while their access is active. Household members may also create their own content (events, messages, dose logs) inside shared spaces. You are responsible for choosing who you invite. You can revoke access at any time from Profile → Settings → Home management.

Data about other people. You may add information about other people to your account: for example a partner, a child, a carer, or a pet. Those records belong to the people (or animals) they describe, and you should add them only with that person's consent or, for a child in your care, where you are entitled to as a parent or guardian (see section 5). If you delete your account, the records you created about other people are deleted on the same timeline as your own data (see section 13). If a person is also a household member with their own account, deleting your account does not delete their account or the data in it, but they will lose access to anything they could only reach through your account.

7. Service providers and data sharing

We share personal information only with service providers who process it on our behalf under written agreements that require confidentiality, security, and use restricted to our instructions. We do not sell personal information and we do not share it for cross-context behavioural advertising.

Product analytics are first-party: we run them ourselves, on our own infrastructure, and we never send usage events to an analytics company. A usage event records which feature was used and when, your plan tier, and the app version. Usage events are pseudonymous, not anonymous: when you are signed in, each event is linked to your account's internal ID number (not your name or email address), so we treat it as personal data. When you are not signed in, events are not linked to an account; if you have accepted analytics cookies, they are linked to the random cookie identifier described in section 10. No message contents, health records, or other sensitive data go into them. We delete usage events after 13 months (page-view events after 90 days), and straight away when you delete your account. We currently record no usage events at all about a child.

We may also disclose information where required by a binding legal request, to enforce our Terms, or to protect the safety of users or the public, and, if HomeAtlas is sold, merged, or restructured, to a successor entity that takes on this policy's obligations.

8. International data transfers

Our servers are located in Adelaide, South Australia, Australia and are operated by us. Your traffic reaches them through Cloudflare, which provides our network edge and DNS, over a secure tunnel.

Some of the providers named in section 7 are in other countries. The overseas recipients in the United States are: the AI providers (OpenAI, Anthropic, Google Gemini, and Together.ai), Google for its other services we use (sign-in, Maps Platform, Calendar and Tasks, and Firebase Cloud Messaging push), Apple (App Store purchases, Apple Push Notification service, and Sign in with Apple), Microsoft (sign-in and Outlook calendar sync), Stripe, Postmark, Cloudflare, and the U.S. Department of Agriculture's FoodData Central food database. When personal information is transferred outside of Australia or the EEA / UK, we rely on lawful transfer mechanisms, which may include the European Commission's Standard Contractual Clauses, the UK's International Data Transfer Addendum, equivalent provisions for Switzerland, or the recipient's certification under the EU-U.S. Data Privacy Framework and its UK Extension (the UK-US "data bridge"), where applicable. For Australian users, we take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles, as required by APP 8.

9. Where your data is stored and processed

Your data is stored on servers we operate ourselves, located in Adelaide, South Australia, Australia. Uploaded files are stored on those same servers.

Backups run nightly and are encrypted before they are written, with a key that is held offline and is not stored on our servers. They are kept for 14 days on our servers, plus an encrypted off-site copy in Cloudflare R2 kept for 30 days.

Some processing of your personal information happens outside Australia, by the providers named in section 7 that are based in the United States: the AI providers (OpenAI, Anthropic, Google Gemini, and Together.ai), sign-in (Google, Apple, and Microsoft), in-app purchases (Apple's App Store and Google Play), push delivery (Apple Push Notification service, Firebase Cloud Messaging, and your browser's push service), payments (Stripe), email delivery (Postmark), our network edge (Cloudflare), and the U.S. Department of Agriculture's food database. For the few providers whose processing location we have not yet confirmed, the safeguards in section 8 apply and we update this section as we confirm each location.

When personal information is transferred outside Australia or the EEA / UK, we rely on lawful transfer mechanisms as described in section 8.

10. Cookies and similar technologies

We use a small number of cookies and similar technologies on the website:

• Strictly necessary: session cookie, CSRF token, JWT refresh token, load-balancer cookies. Without these the site cannot work securely.
• Functional: UI preferences such as your colour palette, dismissed hints, and selected calendar.
• Referral attribution: if you arrive through a referral or influencer link, a first-party cookie remembers that code for up to 90 days so the referrer is credited when you sign up. It is not used for advertising.
• Analytics: aggregated, privacy-respecting product analytics, all first-party and stored on our own infrastructure. If you are not signed in, one first-party cookie holds a random identifier for up to 90 days so that ten pages read by one visitor are not counted as ten visitors. It contains no name, email address or anything else about you, it is never shared, and it is not used for advertising. If you arrive from one of our ads or campaign links and you have accepted analytics cookies, a second first-party cookie (ha_acq) remembers which ad or campaign brought you, for up to 90 days; it holds only the campaign tags in the link, never your name or email, and is never shared with advertisers. We do not use third-party advertising or behavioural-tracking cookies.

You can manage cookies through your browser settings. Mobile apps do not use browser cookies but use the equivalent local storage and secure keychain entries to keep you logged in.

11. Marketing and notifications

We send transactional messages by default: for example email verification, password reset, billing receipts, household invites, and the daily/expiry digests you have configured.

Marketing consent is separate from accepting these terms: agreeing to the Terms of Service does not sign you up for marketing. We do not send promotional or newsletter emails unless you have opted in separately (for example by ticking a marketing box during sign-up or in Profile → Settings → Notifications). Every marketing message we send includes an unsubscribe link, and you can also unsubscribe at any time by emailing [email protected]. Withdrawing marketing consent does not stop transactional messages required to operate the Service.

Push notifications and in-app reminders are controlled per-device in your operating system settings and per-feature in Profile → Settings.

12. Security

We use a combination of technical and organisational safeguards, including:

• HTTPS for all traffic between your device and the Service;
• Hashing of passwords using industry-standard algorithms;
• Encryption at rest, with keys kept separately from the database, for sensitive tokens (for example calendar refresh tokens) and for your children's health, allergy, medication and care-plan details and the contents of documents you add for them;
• Encrypted backups (see section 9), so a copy of a backup cannot be read without a key we keep offline;
• End-to-end encryption for family messaging, message content is encrypted on the sender's device and decrypted only on the recipient's device, so we never see the plaintext;
• Limited, logged access: no one at HomeAtlas, including our administrators, can open your calendar, family messages, Atlas conversations or children's records without a time-limited grant tied to a support request, and every such view is logged; and strict access controls with our service providers;
• Regular dependency updates, monitoring, and incident response procedures.

No internet service can be 100% secure. If we become aware of a personal-data breach that creates a likely risk of serious harm to you, we will notify you and the relevant regulator (for example the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, your supervisory authority under GDPR, or the Office of the Privacy Commissioner of New Zealand) within the timeframes required by law.

13. Retention

We keep your personal information for only as long as we need it for the purposes described in this policy. In practice that means:

• Account and content data: kept while your account is active. When you delete your account, your data is deleted immediately, the moment you confirm, not on a delay. Three things are not deleted with it: a tombstone (a SHA-256 hash of your email address, your user-id-at-deletion and the deletion reason) kept for fraud prevention; tax, billing and fraud records the law requires us to hold (next bullet); and copies inside encrypted backups, which rotate out on the schedule in section 9 (14 days on our servers, 30 days off-site).
• Tax, billing, and fraud records: retained for the period required by law (typically up to 7 years in Australia under tax law).
• Backups and logs: nightly backups are kept for 14 days on our servers and for 30 days in the encrypted off-site copy (section 9), then deleted. Application logs are kept for short windows for troubleshooting and security and then deleted or de-identified. Staff audit records (who did what in our admin tools) are kept for up to 2 years. Support requests and bug reports are kept for up to 1 year after they are resolved. Image-moderation records are kept for 90 days.
• Encrypted family messages: stored as ciphertext while the conversation is active. When you leave a household or delete your account, the encrypted record is removed on the same 30-day timeline.
• Short-lived caches: for example barcode lookups or one-off document-extraction evidence files are deleted within hours to days.
• Product usage events (analytics): 13 months, and page-view events 90 days.

14. Your rights and choices

Subject to your country's law, you have the right to:

• Access the personal information we hold about you;
• Correct data that is inaccurate or incomplete;
• Delete your data (the “right to be forgotten” under GDPR, the right to erasure / opt-out of sale or sharing under the CCPA/CPRA, etc.);
• Export a portable copy of your data in a machine-readable format;
• Object to certain processing or restrict it;
• Withdraw consent at any time, where processing is based on consent (this does not affect the lawfulness of processing before withdrawal);
• Lodge a complaint with a privacy regulator (see section 18).

We do not sell your personal information and we do not use it for cross-context behavioural advertising. We do not subject you to decisions made solely by automated means that produce legal or similarly significant effects on you.

15. How to access, export, or delete your data

You can exercise the rights above as follows:

• In-app deletion: go to Profile → Settings → Delete account. You will be asked to confirm. Deletion is immediate, subject to the carve-outs in section 13 (tombstone, lawful-retention records, and rotating backups).
• In-app export: go to Profile → Settings → Download my data to receive a JSON archive of your data within a reasonable timeframe.
• By email: write to [email protected] with the subject line “Privacy request”. We may need to verify your identity (for example by emailing your registered address). We will respond within the timeframes required by your law (within 30 days under GDPR / Australian Privacy Act, 45 days under the CCPA, extendable as permitted).

Requests are free, except where they are manifestly unfounded or excessive (for example repetitive), in which case we may charge a reasonable fee or refuse to act, as permitted by law.

16. Region-specific notices

16.1 EEA / UK (GDPR / UK GDPR)

We act as the data controller for personal data we collect through the Service. The legal bases we rely on are described in section 3.1. You have the rights listed in section 14. You can lodge a complaint with your local supervisory authority, for the UK, that is the Information Commissioner's Office (ICO) at ico.org.uk.

16.2 Australia (Privacy Act 1988)

We handle your personal information in line with the Australian Privacy Principles. You can ask us to access or correct your information at [email protected]. If you are unhappy with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

16.3 New Zealand (Privacy Act 2020)

We comply with the Information Privacy Principles. You can complain to the Office of the Privacy Commissioner at privacy.org.nz.

16.4 California (CCPA / CPRA)

We do not sell your personal information and we do not share it for cross-context behavioural advertising. You have the right to know, delete, correct, and limit the use of sensitive personal information; we honour these rights without discrimination. You can designate an authorised agent to make a request on your behalf. We will require proof of authorisation. The categories of personal information we collect (mapped to CCPA categories) are: identifiers; commercial information; internet/network activity; geolocation (general); audio/visual content (the photos and documents you upload); inferences (preferences); and sensitive personal information including health information, account log-in credentials and information about a person under 16 collected with consent.

16.5 Children under 13 (United States, COPPA)

HomeAtlas does not allow children under 13 to register a HomeAtlas account, and a child does not currently have a login and does not sign in: a parent or guardian adds a child to their household and manages the child's record from their own account (see section 5). We do not collect personal information from children online: a record about a child is the parent's own household record, entered and managed by the parent. The parent or guardian who adds the child confirms they are the child's parent or legal guardian and consents on the child's behalf, and we may ask for additional verification. Children cannot buy anything or change a subscription, and no child uses the general AI assistant, because no child currently signs in. Parents can review, change, export, or delete a child's information at any time from Family settings or by emailing [email protected]. The only AI that can process information about a child is parent-side: avatar illustrations generated from the profile fields a parent has recorded. The Homework Helper is not offered, because using it needed a child's own login, so no homework is sent to AI providers. Homework records created before 17 October 2026 are deleted on the same schedule: photos after 180 days (or 12 months if the parent chose to keep them longer), and assignments, steps and study-coach conversations 24 months after they were last used, and a parent can download or delete them at any time. Google Gemini is never used for any account holder under 18.

16.6 Canada (PIPEDA)

We comply with the Personal Information Protection and Electronic Documents Act and applicable provincial laws. You can contact our Privacy Officer at [email protected], or complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

16.7 Under-18s in the United Kingdom (the Children's Code)

The UK Information Commissioner's Age Appropriate Design Code (the Children's Code) applies to online services likely to be used by people under 18. We apply the protections below to everyone under 18, wherever they live. Section 5 has the full detail.

• We ask everyone's age. Every account holder gives their date of birth or confirms they are 18 or over, so the right protections apply. Children under 13 do not currently sign in: a parent manages them from their own account, and 13 to 15 year olds need a parent's consent.
• Private by default. A child does not currently sign in, so there is nothing a child can use to contact anyone: their record is seen only by the adults their parent has allowed into the household. Account holders under 18 start with "searchable by friends" switched off. Account holders under 18 cannot comment on public recipes (a parent can allow a 16 or 17 year old to), and 13 to 15 year olds cannot publish anything publicly.
• No advertising, and no selling data. HomeAtlas shows no advertising to anyone. We do not sell the data of anyone under 18, share it for advertising or tracking, or use it to build a marketing or advertising profile. Account holders aged 13 to 15 cannot buy or change a subscription and receive no marketing email.
• No analytics about children. A child does not currently sign in, so we record no product-analytics usage events about a child at all. For account holders aged 13 to 17, analytics in the browser or app are switched off; a small set of pseudonymous usage events is still recorded on our own servers (section 7), and these are left out of our product statistics.
• No location tracking. HomeAtlas does not collect device or GPS location from anyone, including children (section 2.2).
• Parental controls. A parent creates, manages, and can remove their child's household record from their own account. Nothing a child does is recorded, because a child does not currently use HomeAtlas.
• AI is labelled and filtered. A child makes no AI requests, because a child does not currently use HomeAtlas; the only AI that can touch a child's record is a parent-side feature (section 5). For every account holder under 18, each AI request carries extra safety instructions and is checked in both directions by a content-safety filter. Atlas tells young people it is an AI, not a person, and labels its answers as written by AI.
• Your rights. A young person, or their parent or guardian, can ask us to access, correct, export or delete their data (sections 14 and 15), and can complain to the Information Commissioner's Office (section 16.1).

17. Changes to this policy

We may update this policy from time to time. If a change is material we will notify you by email and / or in-app at least 30 days before it takes effect (or the minimum period required by your local law, if longer). The “Last updated” date at the top of this policy tells you when we last revised it. Continuing to use the Service after the change means you accept the updated policy.

18. Complaints

If you have a privacy complaint, please email us first at [email protected]. We aim to respond within 30 days. If you are not satisfied with our response, you can refer the complaint to your local privacy regulator (see the relevant region-specific notice in section 16).

© 2026 OMNIA VINCULA PTY LTD trading as HomeAtlas. All rights reserved.