Privacy Policy

Last updated October 18, 2026

This Privacy Policy explains how Homesteader (“we,” “us,” or “our”) collects, uses, and shares information when you use our web application (the “Service”). By using the Service, you agree to the practices described here.

Information we collect

Account information — your email address, used to sign you in and contact you.
Property & design data — the site plans, maintenance records, projects, and related content you create in the Service.
Payment metadata — billing details handled by our payment processor (Stripe). We do not collect or store full payment card numbers.
Usage & device data — basic technical information such as log data, IP address, and browser type, used to operate, secure, and improve the Service.

How we use information

We use information to provide and maintain the Service, authenticate you, process subscriptions and payments, respond to support requests, send service-related email, monitor and improve performance and security, and comply with legal obligations. We do not use Your Content to build advertising profiles.

How we share information

We share information only with service providers that help us operate the Service, and only as needed for the purpose listed. We do not sell your personal information. We do not share personal information for cross-context behavioral advertising.

Hetzner Online GmbH (Hetzner Cloud) — hosts the application and its database. The production server is in Hillsboro, Oregon, United States. Coolify, the tool that deploys the app, runs on that same server.
Cloudflare — provides DNS for homesteader.farm. The site’s name servers are Cloudflare’s, and the address record points at the Hetzner server. Web requests go to that server.
Stripe — processes subscription payments, including checkout, invoices, and the card on file (brand, last four digits, and expiry). We do not store full payment card numbers.
Resend — sends transactional email: magic-link sign-in, household invitations, email-address changes, maintenance reminder digests, and in-app bug reports.
Google Workspace — receives and stores email sent to addresses on homesteader.farm, including cameron+support@homesteader.farm and cameron+privacy@homesteader.farm.
PostHog — product analytics, when a project key is configured. The browser and server send page views and product events (such as signup and subscription changes). After you sign in, events are tied to an account id. We do not send your email address as an analytics property. The default host is PostHog’s US cloud.
Sentry — error monitoring, when a DSN is configured. Before an error report is sent, we strip cookies, query strings, authorization headers, email addresses, and IP addresses. A stable account id may be included so related errors can be grouped.
U.S. Census Bureau — address lookup. When you look up a property address, we send that address to the Census geocoder to obtain coordinates, city, state, and ZIP code.
OpenStreetMap Nominatim — address lookup when the Census geocoder does not return a match. We send the same address you entered to the public Nominatim service at nominatim.openstreetmap.org.
U.S. Geological Survey (USGS) — location data. After a successful address lookup we send the resulting coordinates to the USGS Elevation Point Query Service for elevation. When you turn on the aerial layer, we send a bounding box around those coordinates to the USGS National Map for NAIP aerial imagery.

We may also disclose information to comply with the law, enforce our terms, or protect the rights, safety, and security of our users and the Service, or in connection with a merger, acquisition, or sale of assets.

Data retention

We keep your information while your account is active and as needed to provide the Service. To ask us to delete your account and personal information, email cameron+privacy@homesteader.farm. We will delete or anonymize that information within a reasonable period, except where we need to keep it to comply with the law, resolve disputes, or enforce our agreements.

Security

We use industry-standard technical and organizational measures to protect your information, including encryption in transit and access controls. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Your choices & rights

You can access and update your account information from within the Service. To request access, correction, or deletion of your personal information, email cameron+privacy@homesteader.farm.

California (CCPA/CPRA). If you are a California resident, you may request that we:

Know the categories and specific pieces of personal information we collect about you, the sources, the purposes, and the categories of third parties we disclose it to.
Delete personal information we hold about you, subject to exceptions the law allows (such as records we must keep for a transaction or a legal obligation).
Correct inaccurate personal information we hold about you.
Opt out of sale or sharing. You may direct us not to sell your personal information or share it for cross-context behavioral advertising. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We will not discriminate against you for exercising these rights. That includes denying the Service, charging a different price, or providing a different level of service because you made a request. Send know, delete, correct, and opt-out requests — including a request to delete your account — to cameron+privacy@homesteader.farm. We will verify the request and respond within the time the law requires. You may use an authorized agent where the law allows it; we may ask the agent for proof of authorization and ask you to confirm your identity.

EU/UK (GDPR). You may have the right to access, rectify, erase, restrict, or object to processing, and to data portability. We process personal data to perform our contract with you, to comply with the law, and for our legitimate interests in operating the Service. Contact cameron+privacy@homesteader.farm to exercise these rights.

International transfers

The Service is hosted in the United States (Hillsboro, Oregon). Some of the providers above also process information in the United States, and some may process it in other countries. Where we transfer personal data across borders, we take steps to ensure it receives an adequate level of protection consistent with applicable law.

Children's privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us at cameron+privacy@homesteader.farm and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the last updated date above and notify you by email or through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

Contact

Questions or requests about your privacy, including CCPA/CPRA requests and account deletion, go to cameron+privacy@homesteader.farm. Other questions about the Service go to cameron+support@homesteader.farm.