Privacy Policy

Who can use Houseload

Houseload is intended for people aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact us and we will delete it.

Information we collect

We collect only what we need to run the Service:

• Account information. Your email address and authentication credentials. With email-and-password sign-in we store a salted hash of your password, never the password itself. With a passkey we store only its public key — never your private key or biometrics. If you sign in with Google, we receive your email address and basic profile information from Google. We process this account, session, email-verification, and chosen sign-in-provider information before Terms agreement so that we can authenticate you and deliver account recovery.
• Terms acceptance record. When you explicitly agree to the Terms, we record the account identity associated with the agreement, the Terms and Privacy Policy versions shown, and the server timestamp. We use this record to document the agreement and enforce access to ordinary inventory features. We do not collect an IP address, browser or device identifier, user-agent, or date of birth for this agreement.
• Content you create. The inventory data you add — items (names, descriptions, quantities, purchase prices, replacement values, dates, categories), collections, and any files you upload such as receipts, invoices, and photos. These files may contain personal information you choose to include.
• CSV scans. In the scan dialog's Receipts and CSV mode, we upload and store the whole original CSV file before you confirm the scan. The server returns the validated header and cells for you to select rows. The preview uses no AI and consumes no scan credits. The cost updates as you change the selection. Rows you omit stay in the stored original, but are not sent to AI. Remove unneeded addresses, payment details, and other personal information before you upload. We do not remove these details from the input for you.
• Emailed receipts. On eligible plans, each home has a private email address for sending receipts in. When you (or a forwarding rule you set up) email that address, we store the original message and its attachments so it can be scanned into draft items and kept as the record behind them. The original message can contain sender addresses, message identifiers, and other personal information; we do not keep separate sender or message-ID fields. Only email sent to your home's private address is processed; rotating the address in Settings immediately disables the old one.
• Amazon order-history import. If you use the separate Amazon importer, it reads the file in your browser and never uploads the original to us. The importer itself uses no AI and consumes no scan credits. After import, eligible drafts in homes whose owner has an eligible plan can receive automatic description lookups that use AI and scan credits, as described below. These lookups use the item name, not the original import file. Only selected mapped item fields are sent by the importer, such as product name, description, category, merchant, price, quantity, order date, any serial number, and Amazon's order and product identifiers (kept so we can link you back to that order's invoice, and so re-importing the same file doesn't duplicate anything). When an import creates drafts, we also keep a record of the import itself — the file's name and when you ran it. Everything else in the file — including the billing and shipping addresses and payment-card details it contains — stays on your device. This applies only to the Amazon importer. If you scan a retailer CSV through the scan dialog instead, we upload the whole file and send all columns of only selected rows to AI after confirmation.
• Homes and membership. Houseload organizes data into shared "homes." We store the homes you create or belong to, your role in each, and invitations you send (including each invitee's email address).
• Support reports. If you report a problem with a scan, we store your report — the issue category and any description you write — together with the scan it concerns, and our support staff review that scan's files and results to investigate and reply to you.
• Billing information. Subscriptions are processed by our payment provider, Lemon Squeezy, which acts as merchant of record and handles tax. We never receive or store your full payment-card number. We store your plan, subscription status, provider customer and subscription identifiers, checkout attempts and their identifiers, links and expiry times, and records needed to investigate conflicting billing identities or purchases. At checkout we send Lemon Squeezy your account email for prefilling and a random checkout reference to associate its billing notifications with your account. We do not use email matching to assign subscription ownership. Manage billing opens a signed link that logs you into Lemon Squeezy's customer portal, which can include other subscriptions for that provider customer.
• Plan usage. We keep current-month scan and lookup counts for the home owner whose plan admitted the work, including when that plan has no monthly scan limit, along with temporary file-size reservations to enforce storage limits. Deleting content or transferring a home does not reset an admitted scan's count. Daily cleanup removes expired monthly counts and their payer references from surviving work; account deletion removes them too. Older work keeps nonpersonal admission markers so retries do not consume another allowance.
• Connected apps. If you connect an AI app to Houseload through our MCP connector, we store the app's identity (the web address of its published app description, and its name), the access you granted, when you granted it, and the sign-in tokens that let it act for you. To identify the app, we fetch the description it publishes on its own website. We remove the access and tokens when you disconnect the app from your Account or delete your account.
• Connection and device information. Houseload is hosted on Cloudflare's global network, so every request to the Service passes through Cloudflare. To deliver and secure the Service, Cloudflare processes standard request data — including your IP address, browser and device characteristics, and an approximate, network-derived location — and compiles aggregate traffic statistics. Houseload does not store your IP address or location on your account or session. To limit authentication abuse, we temporarily store IP-based request counters separately and remove inactive counters during daily cleanup. We add no analytics, advertising, or cross-site tracking of our own.

How we use your information

We use this information to:

• provide, maintain, and secure the Service and your account;
• store and display your inventory and share it with members of your homes;
• process the files you upload or email in, including extracting details with AI (see below);
• authenticate you and protect against fraud, abuse, and unauthorized access;
• document explicit Terms agreement and restrict ordinary inventory features until it is recorded;
• process subscriptions and send related billing messages;
• send transactional email such as verification, password resets, home-invitation notifications, and (on eligible plans) warranty-expiry reminders;
• respond to problem reports and other support requests; and
• comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use your content to advertise to you.

AI processing

When you upload a receipt, invoice, or similar file — or email one to your home's private address — we use Cloudflare Workers AI to run an AI model hosted by Cloudflare and extract structured details (such as item names, prices, dates, and legible individual serial numbers) so you can review and save them. This model performs receipt and emailed-receipt extraction, receipt-image transcription, item-photo identification, description generation for manual and automatic lookups, and replacement-value generation for manual lookups. Cloudflare hosts this processing; we do not send this data directly to the model developer. When you scan an item by photographing it (including any model or serial number label), the model analyzes those photos to identify the item and any legible label details. Cloudflare Images resizes and re-encodes raw scan photos and receipt images before AI analysis. Your original attachments remain unchanged; these prepared scan images are not stored as additional attachments. These files, photos, emails, and their contents are processed only to provide this feature to you and are not used to train any AI models. AI-suggested items are created as drafts for your review — you decide what is saved.

After you confirm a CSV scan, we send all columns of only the selected rows to Cloudflare Workers AI. This includes columns that do not map to item fields. Selected rows are packed into batches of at most 50 rows and 20,000 characters, including the header, source row IDs and separators. We do not truncate the input to fit. Each selected batch consumes one scan credit. The preview shows the updated total cost before confirmation, including any PDF or image receipts in the same submission. Clearing a CSV selection adds zero scans; the receipts still scan. Each selected source row must produce a draft or an explicit AI exclusion. Omitted rows are not AI exclusions. A batch fails if the AI output does not account for every selected row. This check does not establish accuracy. Review the drafts before you add them to inventory. Each draft links to the same whole original CSV file, including omitted rows. Successful batches remain if other batches fail. Retrying failed batches uses the same exact source row IDs and consumes no new scan credits.

In homes whose owner has a plan eligible for automatic description lookups, Houseload automatically looks up missing descriptions for new inbox drafts and the existing draft backlog. You do not need to request each lookup or visit a page. Each automatic lookup counts as one scan, shared across the owner's homes with scans and manual lookups. If the plan has a monthly scan limit, we stop admitting new automatic lookups when that allowance is exhausted. Untouched eligible drafts resume when capacity returns. Plans with no monthly scan limit still record usage but do not stop lookups because of a monthly quota. Any prior description lookup prevents another automatic attempt, even if it failed or returned no description. You can still retry manually.

You can still request a description or replacement-value lookup manually. For manual lookups and automatic description lookups, we send the item's name to Brave Software's search service as a search query. Only manual replacement-value lookups also send the item's name to eBay's marketplace API to find current listing prices. We retrieve a small number of the top matching public web pages through Cloudflare's browser service. We send the item name and this web evidence to Cloudflare Workers AI to write a short description or estimate a replacement price. The sites we fetch see a request for their page; they are not told who you are, and nothing else about you or your inventory is sent to them. A result is only saved automatically when the item's field is still empty, and you can edit or delete it at any time. The item name is the only detail that leaves the Service for this feature.

How we share information

We share personal information only as needed to operate the Service:

• Service providers (sub-processors) that process data on our behalf under contract: Cloudflare, Inc. (hosting, database, file storage, image and AI processing, and email — outbound sending and inbound routing of receipts emailed to your home's address; as our network and security layer it also processes connection data such as IP addresses and request metadata to route traffic, defend against attacks, and produce aggregate analytics), Lemon Squeezy (subscription billing, as merchant of record), Brave Software, Inc. (web search — receives an item's name as a search query for manual description or replacement-value lookups and automatic description lookups for eligible inbox drafts), eBay, Inc. (marketplace price listings — receives an item's name as a search query only for manual replacement-value lookups), and Google (only if you choose to sign in with Google).
• Apps you connect. If you connect an AI app, it receives the inventory data it requests from every home you belong to, within your role in each home. If you allow editing, it can change item details, locations, categories and collections, and add draft items to the Inbox for you to review. The app's provider, not Houseload, controls what happens to that data afterward, including whether it is sent to AI models; its own privacy policy applies. You choose which apps to connect and can disconnect them at any time from your Account.
• Other members of your homes, who can see the content in a shared home according to their role.
• Legal and safety — when required by law or to protect the rights, property, or safety of Houseload, our users, or others.
• Business transfers — if m13n LLC is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction; we will notify you of any change in control of your personal information.

We do not sell or share your personal information for cross-context behavioral advertising.

Cookies and tracking

Houseload sets only essential cookies — such as your sign-in session and a record of your most recently used home (so settings pages can show the right navigation) — and stores your theme preference in your browser. Cloudflare, our hosting and security provider, may set its own strictly necessary cookies (for example, to mitigate bots and abuse). We use no analytics, advertising, or third-party tracking cookies, and we don't track you across other websites; Cloudflare's traffic statistics are aggregate and server-side, with no tracking script or identifier placed on your device by Houseload. Because there is no cross-site tracking, we honor "Do Not Track" and Global Privacy Control signals accordingly.

Data retention and deletion

We keep scan originals and model conversations to provide the scan feature and investigate support reports. We also keep manual and automatic lookup history, generated results, model conversations, and source URLs to provide lookups and investigate problems. CSV scans use these same storage, retention, and deletion rules. The preview stores the whole original even if you omit rows, clear the selection or do not confirm the scan. Omitted rows remain in that file, although they are not sent to AI. CSV scan metadata records each batch's exact original data-row IDs, numbered from 1, and row counts, not cell values. These IDs and counts remain after you delete an item. The scan's row counts cover only selected rows, not omitted rows. The original file can contain all cell values and personal information; model conversations can contain those from selected rows.

We keep your information for as long as your account is active and as needed to provide the Service. You can delete your account from your account page after confirming an emailed link, once subscriptions have expired and any uncertain checkout or billing conflict is resolved. Cancelling a subscription does not immediately make it non-resumable. An expired checkout link alone does not prove that no purchase occurred; contact support if a checkout remains unresolved. Account deletion removes our billing associations and checkout records; Lemon Squeezy retains its own records under its privacy policy and legal obligations. Deletion also permanently deletes homes you own alone, including their items and files. Before deleting your account, transfer ownership of any home you own with other members, or remove those members first.

Shared homes remain available to their other members. We remove your membership and structured account attribution, including creator, scan submitter, import and report references, and invitations you sent or addressed to your account email. Shared inventory, original emails, files, scan results and reports remain. Personal information embedded in those documents or written text is not automatically removed; it remains until that content is deleted. Scans and lookups already admitted in a surviving shared home may finish without account attribution. Account deletion also removes your Terms acceptance record, subject to the billing, legal, tax, and accounting retention limits described here.

Files left by interrupted email intake are reclaimed in the background unless a saved job or shared item uses them. Confirmed deletion removes access promptly. Physical file erasure and cached authentication cleanup are retried in the background if a service is unavailable. We keep limited deletion bookkeeping to finish this work; it contains internal identifiers, not message contents or account names. Completed account-deletion records are removed after eight days. You can also ask us to delete your account and associated data by emailing privacy@houseload.app. We remove deleted information from our live systems promptly and purge it from backups within 30 days, except where we must keep limited records to meet legal, tax, or accounting obligations.

Security

We protect your information with measures including encryption in transit (HTTPS), hashed passwords, and access controls that isolate each home's data. No method of transmission or storage is perfectly secure, but we work to protect your information and to address vulnerabilities promptly.

International data transfers

Houseload is operated from the United States, and our infrastructure providers operate globally. If you use the Service from outside the United States, your information may be transferred to and processed in the United States and other countries whose data-protection laws may differ from your own. Where required, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for these transfers.

Your privacy rights

EEA and UK (GDPR). You have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent where processing relies on it. Our legal bases are performance of our contract with you, our legitimate interests in securing and improving the Service, your consent where requested, and compliance with legal obligations. You may also lodge a complaint with your local supervisory authority, though we encourage you to contact us first.

California (CCPA/CPRA). You have the right to know what personal information we collect and how we use it, to access, delete, and correct it, and not to be discriminated against for exercising your rights. We do not sell or share personal information as those terms are defined under California law, so there is no opt-out to exercise.

Other US states. Residents of other states with comprehensive privacy laws — including Minnesota — may have similar rights to access, correct, delete, and obtain a copy of their personal information.

How to exercise your rights. Email privacy@houseload.app. We will verify your request (typically by confirming control of your account email) and respond within the time applicable law requires. You may use an authorized agent where the law permits.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective" date above and, where appropriate, notify you. This notice explains changed data practices; it does not obtain blanket consent. Where applicable law requires consent for particular processing, we will request it separately.

Governing law

This Privacy Policy is governed by the laws of the State of Minnesota, United States, without regard to its conflict-of-laws rules.

Contact us

m13n LLC
privacy@houseload.app