Privacy Policy

1. Information stored on your device

Your local workspace can include rental nicknames and addresses, tenancy and move dates, deposit details, landlord contact details, rooms, checklists, condition and issue records, notes, photos, photo fingerprints, limited camera metadata when enabled, audit history, report state, export receipts, unfinished drafts, and backup status. New photo imports are processed to remove GPS coordinates from photo metadata. Older retained files may need separate review before sharing.

Standard reports and deterministic message drafts are generated locally. A prepared Plus package also stores its exact PDF, receipt manifest, byte counts, and file fingerprints on the device. Prepared packages are not included in Private backup.

2. Optional account and Private backup

You can use the core organizer while signed out. If you choose email sign-in, Supabase processes your email address, authentication identifiers, login/security information, and the technical data needed to provide and protect the account.

Creating or entering an account does not upload the local workspace. The first cloud action is an explicit Back up or Restore. A backup can include rental records, notes, issue/report fields, audit history, and eligible evidence photos in a private account area. Later saved changes can queue and retry only while CasaProof is open and online.

Private backup is for recovery, not real-time or background multi-device sync. Owner-based access rules separate account data. Conflicts, unavailable files, and device-only photo markers remain visible rather than being silently treated as complete cloud copies.

3. Purchases and subscription status

Apple or Google processes payment. RevenueCat retrieves offerings and applies the CasaProof Plus entitlement. These providers may process a pseudonymous or signed-in app user identifier, product and transaction identifiers, purchase receipt or token, store and device information, trial eligibility, purchase status, renewal, expiration, and cancellation state. CasaProof does not receive full payment-card details.

4. Optional first-party product analytics

Product measurement is paused. Your saved consent preference does not enable collection while intake is unavailable. Updated apps do not collect, queue, or send new events in this state. Historical measurement used eight typed events: intent selection, case creation, first saved record, first report preview, paywall view, purchase start, purchase completion, and prepared export, with a random installation identifier, platform, session, time, and limited workflow context.

These events do not include photos, evidence, addresses, notes, filenames, hashes, report or issue text, landlord details, or account IDs. Sample mode never sends events, and measurement is separate from the signed-in backup session. Turning the preference off stops sending immediately and requests deletion of historical hosted events. Queued telemetry is cleared when local storage can be safely updated. If cleanup is blocked, Settings reports that recovery is needed and earlier queued data may remain in the retained recovery files. CasaProof keeps the deletion identifier until server removal is confirmed and local recovery copies are cleared. Offline, partial, or uncertain responses remain pending for retry. If local cleanup fails after server confirmation, the app reports that separately and lets you retry. Scheduled cleanup targets events older than 13 months in bounded batches. Backlog or failed scheduling can keep events longer, so 13 months is not a guaranteed maximum.

5. Local diagnostic receipts

CasaProof can keep up to eight unexpected-error receipts on the device with time, source, error type, a non-reversible identifier, and repeat count. They do not contain messages, stack traces, routes, accounts, addresses, notes, filenames, photos, or report content. They are not uploaded automatically. You can review or clear them in Settings.

6. AI-assisted messages and condition summaries

AI generation is currently unavailable. The following explains the data boundary if these optional features are made available. Buying Plus does not enable an unavailable feature.

For a signed-in Plus user, AI is invoked only after the user taps Generate and accepts a separate first-use disclosure. CasaProof then sends selected fields through a Supabase function to the OpenAI API.

The prompt is limited to selected issue titles, descriptions, status, room label, dates, notes, whether supporting evidence exists, report type, recipient type, tone, and output language. It excludes photo files, filenames, hashes, the property address, account ID, and landlord contact details.

A condition summary uses the selected property's recorded observations and issues, or the exact scope of a selected report. Before generating, you can review the text, omit notes, and edit the text to be sent without changing the original records. The request includes room labels, selected titles, recorded observation dates, condition or issue status, phase, and optional notes. It excludes photos, addresses, contact fields, tenancy and deposit facts, filenames, hashes, and local record identifiers. Titles and notes may themselves contain personal information, so the preview is not a guarantee of anonymity.

Condition-summary operations use opaque scope/request identifiers, input/output hashes, provider/model and timing/status metadata, and generated prose with source labels for caching and retry handling. Cached condition-summary results can be reused for seven days. Expired results are excluded from retrieval, and scheduled cleanup removes expired content in bounded batches; delayed or failed cleanup can retain stored text longer. Deleting the CasaProof account removes its associated summary content. Generated prose is an AI-assisted draft of the submitted records, not an inspection or verification of the property. Copying, sharing, or adding it to a matching report's PDF appendix requires your review. The appendix is optional and off by default.

For issue-message drafting, operational generation records may include selected issue identifiers, a one-way input hash, provider/model name, quota and token counts, status, error category, and the successful generated subject, summary, and message. OpenAI states that API inputs and outputs are not used to train its models unless the API customer opts in; default abuse-monitoring logs may be retained for up to 30 days unless longer retention is required by law or needed to prevent harm. See OpenAI API data controls.

7. Exports, sharing, and support

Reports and messages leave CasaProof only when you choose to export, copy, share, or send them. The receiving app, email service, cloud drive, printer, or other destination then processes the information under its own terms. CasaProof does not send a report to a landlord on your behalf.

If you contact support, your email provider and our email provider process the message and technical context you include. Do not send sensitive evidence, identity documents, or payment-card details unless a specific item is necessary and has been requested through a verified support reply.

8. Purposes and legal bases

Where the GDPR or a similar law applies, processing is based on the following grounds:

• Performance of a contract or steps you request: authentication, Private backup/restore, subscription entitlement, support, and any user-triggered online feature.
• Consent: optional product analytics and the separately disclosed AI request. You may withdraw consent for future processing without affecting earlier lawful processing.
• Legitimate interests: securing accounts and services, preventing abuse, diagnosing failures, protecting users, and operating a reliable product, balanced against your rights and minimized to the data needed.
• Legal obligations and legal claims: records that must be processed or retained for tax, accounting, fraud, dispute, regulatory, or lawful-request purposes.

CasaProof does not use your rental evidence for advertising, data brokerage, or solely automated decisions that produce legal or similarly significant effects.

9. Service providers and international transfers

Depending on the feature you choose, recipients can include Supabase for authentication, database, private storage, and functions; RevenueCat for offers and entitlement; Apple and Google for store billing; email providers for authentication and support; and OpenAI only when you use AI-assisted drafting. Providers may use their own infrastructure subprocessors.

Information may be processed outside your country, including outside the European Economic Area. Where required, processing relies on an adequacy decision, approved contractual safeguards such as standard contractual clauses, or another lawful transfer mechanism. The operator must maintain current provider agreements and transfer details.

10. Retention

• Local workspace: until you delete a record or all data, uninstall subject to platform behavior, or remove the app files.
• Prepared packages: until you delete the package, choose Delete all data, or uninstall subject to platform behavior; removing the rental alone does not delete its saved package.
• Private backup: current complete graph, one prior committed graph for recovery diagnosis, and unfinished staging generations for up to 24 hours. Unreferenced photo objects are deleted conservatively after a newer complete backup and safety grace. Cloud-backed photos are supported JPEG files of up to 2 MiB each, with a 5 GiB hard ceiling per account. A Plus lapse does not by itself delete Private backup.
• Analytics: new measurement is paused. Withdrawal stops sending immediately. Queued telemetry is cleared when local storage can be safely updated; blocked cleanup is reported in Settings. CasaProof retains the identifier needed to finish hosted deletion and local recovery cleanup. Scheduled cleanup targets historical hosted events older than 13 months in bounded batches; backlog or scheduling failures may extend retention. Opt-out deletion remains a separate request.
• Local diagnostics: at most eight receipts until you clear them or delete local data.
• Account and support: while needed to provide the requested service, secure it, answer the request, and meet limited legal, fraud, accounting, or dispute obligations.
• Store and provider records: under Apple, Google, RevenueCat, Supabase, email-provider, and OpenAI retention rules and the operator’s agreements with them.

11. Deletion choices

CasaProof separates deletion scopes so one action does not silently erase the wrong copy:

• Removing a rental removes its active local graph and queues matching cloud removal on the next successful backup, while an existing prepared package remains local.
• Delete all data removes the local workspace and prepared packages on that device, but not Private backup, the account, or a subscription.
• Delete cloud backup removes the server copy, keeps local data, and pauses upload until another explicit backup or restore.
• Delete account removes the Supabase identity and associated CasaProof database/storage data while preserving the local device workspace.
• Store subscription cancellation is separate from every data-deletion action.

See the data and account deletion guide for exact steps.

12. Your choices and privacy rights

You can use the core organizer without an account, decline or withdraw analytics, disable limited EXIF capture for new photos, edit or delete records, delete Private backup, and delete the account. Depending on your location and the processing involved, you may have rights to information, access, correction, deletion, restriction, objection, portability, withdrawal of consent, and complaint to a supervisory authority.

Email [email protected] with “CasaProof privacy request” and the right you want to exercise. We may need to verify control of the relevant account or identifier without requesting more data than necessary. In Portugal, you may also contact the Comissão Nacional de Proteção de Dados (CNPD); you may contact the competent authority where you live or work.

13. Security

CasaProof uses HTTPS/TLS, private cloud storage, authentication, owner-based access controls, least-privilege credentials, bounded client data contracts, and server-side entitlement checks. No system is perfectly secure. Protect access to your device and email account, review backup status, and keep independent copies of important or time-sensitive evidence.

14. Children

CasaProof is not directed to children under 13 or the higher minimum age required in their country. If you believe a child provided personal information through an online CasaProof feature, contact us so it can be investigated and removed where appropriate.

15. Operator, changes, and contact

CasaProof is operated by the independent developer publishing CasaProof and VScout under the Sassodo developer name. We may update this Policy as the product, providers, or law changes. Material changes will receive a new effective date and, where appropriate, an in-app notice.

Privacy and data-rights contact: [email protected].