Privacy Policy

Updated 28 October 2026

Information you add

Keystone stores your account name and phone number, home addresses and details, uploaded documents and photographs, expenses, maintenance history, pet profiles, service requests and community activity. Passwords are stored as salted hashes. Sign-in uses a session cookie on the website and protected session storage in the native Android and iOS apps. The dedicated household tablet app uses a separate credential bound to its connected home; it does not receive phone-only bills, private documents or personal reminders.

Identity and address verification

If you request verification, we collect a camera selfie and a document or bill displaying your name and full home address. They are private and available to authorized reviewers. Document reading checks the printed name and address; approval requires review. Keystone does not use facial recognition or treat a selfie as proof of ownership. Contact support to request removal of verification materials.

Home records and handover

Personal bills, documents, expenses and pet records belong to their creator and stay in that account during a home handover. Authorised residents can access shared home information such as rooms, equipment and maintenance history. Community managers see community unit and resident contact information, service tickets and community-issued records; they do not receive general access to personal documents or bills.

Architectural plans added as shared home assets remain with the home. A plan saved as a personal document remains with its creator. You choose what to upload and share.

QR codes, links and downloads

House Passport IDs start locked. You can choose visibility, purpose and expiry and whether to include the address or account name. Changing the visible ID retires its previous QR. Sharing an item creates a separate link for that item, with recipient scope, attachment choice, expiry and revocation. Anyone receiving an unrestricted link can use its selected access until it expires or is revoked. One-time quote and invoice submissions close after successful use.

Recipients may retain files they already downloaded. Revoking a link stops future access through it but cannot erase those copies.

AI and address services

When you allow scanning, the chosen image or PDF is sent to Google Gemini to extract editable information. A scan is not saved in your passport until you save it. Assistant uploads with incomplete extraction are stored as private review drafts. Clearly extracted bills may be saved automatically when you approved that permission. Address-proof verification sends the selected document to Gemini for extraction and makes it available to the authorized administrator for review. It does not certify authenticity.

Ask the House sends your question and authorized record context to the configured AI provider, currently Gemini; the application also supports an OpenAI adapter. Home-care suggestions use saved home type, rooms and equipment. Pet suggestions use species, life stage and reminder type, without veterinary contact details or uploaded care documents. Suggestions do not replace professional advice.

Address searches send your typed search and selected place to Google Maps services. Review the returned address and neighborhood before saving. AI and map providers handle submitted information under their own policies. See Google Gemini terms, Google Privacy Policy and OpenAI Privacy Policy.

Community activity

Joining a locality or building community requires approved address evidence. Proof documents are available to their owner and authorized reviewer, not the community feed. Posts and comments display your account name. Worker numbers you choose to publish are visible to members. Posts, comments and messages are sent for AI safety screening before publication; screening failure prevents publication. Messages are available to their conversation participants. You can block members, report content, and restrict private messages to approved contacts. We store blocks, contact approvals and reports to enforce these choices. Community managers see report reasons and can remove reported content; reporting a private message does not grant them access to the conversation text. Moderation actions are recorded for accountability.

Households and support

Family and roommate invitations are bound to a phone number, expire in seven days and work once. Household members can see shared home maintenance and eligible home or community notices. Personal documents, pets and bills remain private unless a bill is explicitly shared with the household. Shared bill payment entries identify the named payer, date and account that recorded the entry. Leaving or removal ends shared home access; personal payment records stay with your account. Support conversations are visible to their customer and authorized support staff. Replies refresh while the screen is open. Authorised billing staff can record external payments and refunds; these records do not transfer money.

Connected assistants

You approve an assistant connection once for a selected home and selected actions: bill imports, service requests and reminders. New connections remain active until you disconnect them. Keys are displayed once and stored hashed. Older temporary connections retain their expiry until you approve an ongoing connection. Approved bill imports and service requests can be saved without repeated confirmation; incomplete scans remain review drafts. Connections can check their own submission status but cannot read your passport, make payments, share records, or access administrator or community-management APIs. Email access is configured separately in the assistant provider. Only use providers you trust.

Keystone shows draft-arrival and confirmation notifications inside the account. Native Android and iOS apps can schedule on-device reminders after you enable notifications. iOS uses Apple Push Notification service through Firebase for configured remote alerts. The household tablet app receives only permitted household care and general reminder alerts; browser alerts remain subject to browser and Home Screen restrictions. If you enable phone alerts, Firebase Cloud Messaging processes a device registration token and generic update notifications. Keystone encrypts saved device tokens. Push messages do not include receipt amounts, document contents or home addresses. Disable phone alerts or sign out to stop alerts on that device. Device permission settings, battery restrictions, force-stop, operating-system scheduling limits and network conditions can delay delivery. SMS and email update notifications are not configured.

Around location

Around does not require address-document approval. With your permission, Follow my location uses foreground location while Around is open to find posts inside your selected radius. You can change the radius or choose a fixed area on the map. We store your latest selected centre rather than a travel history. Around posts stay pinned to their publication location. Regular posts have a maximum reach of 10 km; offer creators can choose a reach up to 20 km. Posts leave the nearby feed after 24 hours, while the author can retain a copy in their private Archive. This visibility period is not a promise of permanent deletion. Other residents see your user ID, not your home ID, address or precise coordinates. Map tiles are supplied by OpenStreetMap; its servers receive map tile requests. You can stop following your location by choosing a fixed area or revoking location permission.

Usage counts

We count website views, tour steps and signup attempts by day to improve onboarding. These counts contain no visitor IDs, cookies, contact details or uploaded content. Internal account, handover and service totals are available only to authorized staff.

Weather and care schedule sharing

Weather uses the selected home city, or an approximate location you explicitly allow. Keystone requests current conditions from Google Weather and forecast information from MET Norway through its server; your account details, home documents and device IP address are not sent to that weather provider. Location fallback uses rounded coordinates and does not track your location in the background. Weather reminders are scheduled only when you choose and save them, subject to device notification permissions. If you enable Weather change alerts, Keystone stores your chosen approximate area and checks forecast changes on its server while the app is closed. You can turn these checks off in the weather section.

You can share selected upcoming care task names and due dates through a read-only link. Anyone with that link can see the shared snapshot for seven days. No home address or account details are included. You can stop sharing from the same screen; links also stop working when your home access is removed. The server stores a hash of the share token.

Bill currency conversion

You can choose a default bill currency. When you request conversion, Keystone sends only the currency pair and bill date to Frankfurter for a published reference exchange rate, not your bill amount or receipt. The saved bill retains its original amount, original currency and applied reference rate. Bank fees and actual settlement rates may differ. Changing the default affects new bills rather than rewriting historical amounts.

Milo assistant and voice

Milo uses Gemini. Questions about your home can use your authorized saved records; private records are not included in public web-search requests. Public questions and a bounded history of public questions can be sent to Gemini with Google Search grounding, along with country, currency and public shopping candidates. Search links open external websites. Chat messages remain in the current app conversation rather than being saved as a chat archive by Keystone; provider handling follows its service terms.

Hands-free voice is optional and requests microphone permission and, on iOS, speech-recognition permission. Keystone prefers on-device recognition when available; otherwise the phone’s speech service may process audio. Milo waits for its name before a voice conversation, then accepts follow-ups during a short active window that can include nearby speech. It does not identify speakers. Listening stops when the chat closes or the app leaves the foreground. Spoken replies use the phone’s text-to-speech service. When you explicitly ask Milo to add a bill and provide the required details, it saves the bill directly; you can edit or delete it afterward. Clear requests to add supported reminders or care tasks may be saved directly; Milo asks for missing details. If you explicitly request review, a draft can be kept for review. You can edit or delete saved reminders. Opening an external calendar editor still requires you to choose whether to save the event, and does not give Keystone access to read your personal calendar. Email drafts are copied or opened in your email app; Milo does not send email automatically.

Storage, controls and requests

Routine home care can be completed without an attachment. Service work completion requires a bill or photo. Uploaded evidence is checked by the configured AI provider for relevance; it cannot certify workmanship, safety or authenticity. Ordinary documents, warranties and reminders may be removed by their authorized owner through supported record controls. Rental agreements and immutable work or audit history have separate protections. Renewals add a new version and retain the previous one. Additions and deletions appear in append-only activity records. Expense activity stays private and separate from house history.

The service runs on Railway with persistent database storage and encrypted uploaded-object storage. Access checks and audit records support account security. Records remain available until removed through supported controls or an authorized support process; safety and operational logs may be retained for investigation. No universal deletion deadline is promised here.

Use Account settings to update your login details, revoke links and connections in their respective screens, download individual files or export your House Passport. For account deletion, use Settings → Delete account in the phone app. For other privacy, correction or export questions, use Help & support in your account. Do not send a password or sensitive document in a public community post.

Account deletion and support

Initiate account deletion from Settings → Delete account in the phone app. No email or support chat is required to initiate it. Processing may take up to 30 days; the request screen shows the expected date, and completion is confirmed after deletion. Follow the account deletion instructions. Contact keystonecommunitysupport109@gmail.com or +1 470 442 9803.