Trust · HomeBook
HomeBook holds things that matter — vehicle papers, insurance, ID proofs, receipts and your household's money. This page explains, plainly, how that information is protected, what HomeBook deliberately doesn't do, and what you can do to keep it safe. It describes the app as it actually works today.
Your records and files are stored on your phone first. If you sign in, they're copied to your household's private space on Google Firebase, sent over encrypted connections, and protected by rules that only let members of your household read them. HomeBook doesn't create public links to your documents, doesn't show ads, and doesn't send your documents or amounts to analytics.
No system is perfectly secure. Keep your phone locked, turn on HomeBook's App Lock if others use your phone, and before giving your phone to someone else, sign out and choose to remove HomeBook's data from it (or uninstall HomeBook).
On your phone. Every record and attached file is kept in HomeBook's private app storage, which other apps on your phone can't read. HomeBook works fully without an account.
In the cloud, only if you sign in. Your household's records sync to Google Cloud Firestore and your attached photos and PDFs to Firebase Cloud Storage. All traffic uses encrypted connections (HTTPS) — the app contains no unencrypted network addresses — and Google encrypts this data at rest.
Backups you export from Backup & Restore are a plain file of your records (not your photos or PDFs). Wherever you save or send that file, treat it like the documents themselves.
In the cloud, every read and write is checked by server-side security rules — not by the app. A request is only allowed when the signed-in account is recorded as a member of that exact household, and only owners and editors can change anything. Knowing a household's or a file's identifier is never enough on its own; there is no public or anonymous access to household records or files.
Today, a household's cloud data is accessible to the account that created it. Adding someone to Family Members in the app records them for things like "Paid by" — it does not give their account access to your household.
As with any cloud service, the people who operate HomeBook's Firebase project have administrative access to the underlying storage; we don't browse household data.
HomeBook uses Firebase Crashlytics to fix crashes and Firebase Analytics to count feature usage, and these may run whether or not you sign in. They are built to carry no personal household content: no document contents, file names, file links or storage locations, amounts, ID or registration numbers, or family details. Events record things like "a document was added" and its general type; analytics identifies an install or a signed-in account by an anonymous ID, never your email.
Notifications are prepared on your phone from your own records — no server decides or sends them. Settings → Show amounts and names keeps money details off your lock screen when turned off.
HomeBook doesn't ask for access to your photo library, videos, files or camera. When you attach something, Android's own Photo Picker, file picker or camera app hands HomeBook only the single item you chose. HomeBook asks for notification permission only when a notification is actually useful to you — never at startup — and uses the internet only to sync and check for updates.
Signing out stops cloud access from this phone, and can also remove HomeBook's records and files from it. Deleting your account removes your sign-in, your account profile and photo, and your household's cloud records and files — the Delete Account page lists exactly what goes and what stays. If the cloud data can't all be removed, the account isn't deleted, so nothing is left behind half-removed.
We review HomeBook's security regularly. Work currently planned includes:
Found something that looks like a security or privacy problem? Please email support@homebook.app with the details and give us a chance to fix it before sharing it publicly. We'll acknowledge your report and keep you updated.