What the app stores, and what leaves your phone

Tenonfold Home is made by Tenonfold, a brand of Design Matrix Studio LLC, a New York limited liability company. Questions about anything here go to home@tenonfold.com.

The short version

The app keeps a record of your home that you build by photographing and typing. That record is stored on your phone and in our database, so you can reach it from any device and share it with your household. A photo of an equipment label is sent to an AI provider only when you use Scan Label, and only to read the label. There is no advertising, nothing is sold or rented, and we run no analytics of our own. The one exception, diagnostics reported by the barcode scanner's Google library, is named below. You can export everything and delete your account from inside the app.

What we store

Your account. For a saved account: your email address, a password hash (we never see the password itself), and an account id. You can use the app without an account at all. Starting a Home Record creates an anonymous identity on your phone with no email attached, and everything you record belongs to that identity until you save it with an email or it ages out, which is covered under Retention below.

Your Home Record. What you enter and photograph:

• The home: its name, type, the year it was built, when it became yours, and its time zone, which is used to send the morning reminder at 7:00 your time. No street address is asked for.
• Floors, rooms and systems such as heating and plumbing.
• Items: name, category, brand, model, serial number, purchase and install dates, warranty date, notes, and their photos.
• Finishes and materials, such as paint, flooring and tile, and the surfaces they are on.
• Documents you add: receipts, warranties, manuals, permits, plans, inspection and insurance papers, and the files themselves.
• Care reminders, their schedule, and each completion with its date, cost and who did the work.
• Work you record: what was done, when, the cost, who did it, and photos.
• Contacts you enter for the people who work on the house: name, trade, company and phone. These come from what you type. The app never reads your phone's address book.
• Projects, with their notes and photos.
• Household members and invitations, including the email address you invite, and each person's role.
• Notification preferences, the reminders we have sent you, and, if you turn push on, the token your phone gives us so notifications can be delivered.
• Exports you request, for 30 days.
• When you use Scan Label: the proposal the AI reader produced and the version you confirmed, so we can measure how often the reader is right and improve it. No extra image is kept for that purpose beyond the label photo already in your record.

On your phone. A local copy of your captures and their photos, so the app works offline and syncs later. The signed-in session, held in the iOS Keychain or the Android Keystore. Small preferences, such as the last room you used. Signing out or deleting your account clears all of it. On Android the app opts out of system backups, so none of this is copied to your Google account. On iOS the app's local data may be included in your device's iCloud backup, under Apple's terms for device backups.

What we do not collect. No location. No contacts from your address book. No health or financial data. No browsing history. No advertising identifier. We run no analytics on how you use the app, and there is no analytics or advertising product of ours in it. The camera and the photo library are used only at the moment you take or choose a photo.

One exception, named because it is real. The QR scanner uses Google's ML Kit, which bundles a Google component that reports diagnostic data to Google about the library's own operation. Google classifies that as analytics. It is not linked to your identity, it is not used to track you, and it carries nothing from your Home Record: no photo, no document, no room, no item. It is there because the scanner is, and we declare it to both app stores rather than leave it unsaid.

Label photos and the AI reader

When you use Scan Label, the photo of the equipment label, and only that photo, is sent from our server to OpenAI, which reads the label and returns the brand, model, serial number, category and any dates printed on it. We store that proposal next to the photo and show it to you. Nothing becomes part of your record until you confirm it, and fields the reader was unsure about are marked so you can check them against the label yourself.

When you ask the app to find a manual, it sends the brand, model and item name as text, never a photo, to OpenAI's web search to find a PDF, then checks each result on our own server before offering it to you.

OpenAI's API terms apply to these calls. Inputs and outputs sent through the API are not used to train OpenAI's models. We make both calls with storage turned off, so neither the label photo nor the reader's output is kept in our OpenAI account. OpenAI may still retain API inputs and outputs for up to 30 days to monitor for abuse, after which they are deleted.

Scan Label is the only feature that sends a photo anywhere other than our own storage. Room photos, document photos and everything else go only to our database and file storage.

Who else handles your data

We use a small number of service providers to run the app. Each one processes data only to provide its service to us, on our instructions.

• Supabase. Database, sign-in and file storage, on servers in the United States. Handles your account and your whole Home Record, including photos and documents.
• Vercel. Hosts our API and runs the scheduled jobs for reminders, cleanup and exports, in the United States. Requests from the app pass through it; it stores no record of its own.
• OpenAI. Reads equipment labels and searches for manuals, as described above.
• Apple and Google. Their push services deliver notifications to your phone. Each handles a device token and the notification text, which is a reminder title and a link into the app.
• Resend. Sends the app's email: account confirmations, password resets and household invitations. Handles the recipient address and the message.
• Cloudflare Turnstile. A bot check when you start a Home Record and when you delete an account. Cloudflare's own privacy policy governs what it sees.

We do not share your data with anyone else. We do not sell it. We do not use it for advertising. If we are ever required by law to disclose data, we will tell you wherever we are permitted to.

Your household

When you invite someone to your household, they see the Home Record you share: the home, its rooms, items, documents, care, history and contacts. Members can add and edit; viewers can only read. The owner can change a person's role or remove them at any time, and anyone but the last owner can leave. A removed person keeps their own account and sees only their own record.

How long it is kept

• Trash. Anything you remove waits in Trash for 30 days, where you can restore it, and is then deleted along with its photos and files.
• Anonymous records. A Home Record started without an email is deleted after 30 days with no activity. Save it with an email to keep it.
• Exports. Each export's download link works for 30 days and the file is then removed. Exports that failed are removed sooner.
• Push tokens. Deactivated when you sign out or turn push off, and removed when your phone stops accepting notifications.
• Deleted accounts. Everything is removed at once, as described below. Deleted data may persist in encrypted database backups for up to seven days before those roll off.

Deleting your account

In the app: More, then Settings, then Delete my account. You confirm with your password, type DELETE and pass the bot check. The app then removes your account, your household, home, and every photo and document when you are its only member, your device tokens, and the local copy on your phone. If your household still has other members, the app asks you to remove them or leave first, so that nobody loses a record they share.

Without the app, or if you can no longer sign in, the account deletion page explains how to ask us to do it.

Before you delete, the screen offers to export your Home Record first. That is worth taking: deletion cannot be undone.

Security

Data travels over TLS. Each household's records are isolated in the database by row-level security, so one household's data is never readable by another. Photos and documents are stored in private buckets and served through short-lived signed links. Your session on the phone is held in the iOS Keychain or the Android Keystore. Our server logs never contain image bytes, document contents or tokens.

Children

Tenonfold Home is not directed to children under 13, and we do not knowingly collect data from them.

Changes

If this policy changes, the new version is posted at this address with a new effective date. A change that affects what leaves your device is also announced inside the app.

Contact

Email home@tenonfold.com, or write to us:

Tenonfold
Design Matrix Studio LLC
418 Broadway, Ste R
Albany, NY 12207
United States

Tenonfold is a brand of Design Matrix Studio LLC; the company is the data controller for everything described here.