Hundredfold Home — Per-App Addendum to the HullStack House Terms & Privacy Policy

Document set: core · Type: addendum App ID: kingdom-hearth

This Addendum supplements, and is incorporated by reference into, the HullStack House Terms of Service and HullStack House Privacy Policy (together, the "House Documents"). It applies only to Hundredfold Home.

Per House Terms §0/§1, this Addendum is presented for acceptance in the same consent flow as the House Terms and Privacy Policy — it is not merely linked or informational. Any term here that materially affects your rights or obligations is covered by the same recorded acceptance as the House Documents.

Order of precedence. Where this Addendum conflicts with a House Document, the order-of-precedence rule stated in House Terms §0 applies: this Addendum controls for app-specific operational matters (features, data collected, permissions, processors, billing); the House Documents control for core legal mechanisms (Electronic Records §2, Children §4, Arbitration §18, Governing Law §19, Disclaimers §15, Limitation of Liability §16, Indemnification §17), unless this Addendum expressly and specifically names and overrides a numbered House section under §G below.

A. The Service

Hundredfold Home is a private app for one household. It gives a family a single shared place to talk and coordinate: end-to-end-encrypted messaging (direct and group), a shared household calendar, chores with an allowance ledger, shared lists for shopping and the pantry, gift wishlists, kids' activity schedules with optional check-in alerts, photo and media sharing, optional location sharing between household members, local weather, and an in-app assistant that helps you find things in the app and send feedback to our team.

Children participate through Child Accounts created by a Household Adult. A Child Account has no password — its only credential is a per-child login code that a Household Adult issues, reissues, or revokes (House Terms §7 and §10.3). A Child Account is created without an email address; the child may later add an optional contact email (§B).

Hundredfold Home is distributed as a native mobile app through our own F-Droid repository, Google Play, and the Apple App Store.

B. App-Specific Data Collection

In addition to the categories in House Privacy Policy §2, Hundredfold Home collects and stores:

• Messages and media — the messages, photos, videos, and files household members send each other, including in group conversations. Message bodies and attached media are end-to-end encrypted (§D-E2EE below, including its assumptions; House Terms §10, House Privacy §12). Message reactions and group conversation names are not end-to-end encrypted today; we plan to extend encryption to them. We do process the surrounding metadata described in House Privacy §2 and §12. The app does not create link previews: a link in a message stays inside the encrypted message, and the app does not send it to us or fetch it on your behalf.
• Calendar events and comments — dates, times, recurrence, reminders, visibility, and who created or was invited to each event, including kids' activities and which Child Account each activity is for. Event titles, descriptions, locations, and comment bodies are end-to-end encrypted (§D-E2EE). The names and notes of the schools, studios, and other activity places you save for kids' activities, and the dates and labels of any closures you mark for them, are not end-to-end encrypted today; we plan to extend encryption to them. Birthday overlay names and dates are stored so we can project yearly reminders onto the calendar and send a morning-of notification; those names are not end-to-end encrypted.
• Activity check-ins — if a Household Adult turns on check-in alerts for a kid's activity, that adult's device registers opaque tokens for the Place the activity is linked to, the child's device reports arrivals there using matching tokens, and for each scheduled session we record which Child Account and activity it is for, the session's time window, whether the child's device reported arriving at that Place in time, and whether an alert was sent and to which Household Adults. The Place's name and coordinates stay end-to-end encrypted, but whether a child arrived at an activity's Place on time is visible to us. These records are deleted 48 hours after the session's check-in deadline.
• Chores and allowance — chore definitions and schedules, assignments to household members, completion and approval history, and the allowance ledger (amounts earned, adjusted, and paid out) that follows from it. Chore titles and descriptions, and the notes on allowance entries, are end-to-end encrypted (§D-E2EE). The rest of this category is not: schedules, due dates, assignments, completion and approval records, and allowance amounts and balances. We keep those readable so reminders go out on time and balances add up.
• Lists — the contents of shopping lists, pantry and grocery lists, and any list a household chooses to share, including items, quantities, and notes. The titles of lists, and the items on them, are end-to-end encrypted (§D-E2EE). The rest of this category is not: who added an item, whether it is checked off and when, and the item names on shopping and pantry lists. We keep shopping and pantry item names readable so the app can match your shopping list against your pantry.
• Wishlists — gift ideas a Household Adult saves for a child or for another adult in the household. Each item's name, link, and notes are end-to-end encrypted (§D-E2EE); whether an item has been marked purchased, when, and by whom are not. Wishlists are shown only to Household Adults, and an adult is not shown their own wishlist.
• Location — where a household member turns location sharing on, we store that member's live position, a short history of recent positions (deleted after 2 days), arrive and leave events for saved Places (deleted after 30 days), and any Places they save, as ciphertext encrypted to the household location-room key. Coordinates and Place names, latitudes, longitudes, and radii are end-to-end encrypted (§D-E2EE). Location sharing is off unless enabled, is visible only to members of that household, and can be turned off at any time in the app or by revoking the permission in device settings. A Household Adult controls whether a Child Account participates in location sharing, and can keep it on for that child. The surrounding metadata we do process — not the coordinates themselves — includes: that sharing is on; the device and platform; key version; when each location update and each arrive or leave event is sent; for place alerts, a short delay window (one of a few fixed values that roughly reflects a Place's size) and opaque tokens, changed daily, that let our servers tell whether two events concern the same Place on the same day, and whether they go in the same direction, without learning which Place or which direction; and, on iPhone, diagnostic timelines of background-location activity (timestamps, counts, and status values, never coordinates) sent to the diagnostics system we operate (§C).
• Approximate location for weather — separately from location sharing, whenever the app is open and you have granted location permission, the app sends an approximate location — rounded on your device to the center of a grid cell about 1 km across — to our servers to show local weather, sunrise and sunset times, and the nearest city name. This approximate location is not end-to-end encrypted, is sent whether or not you share your location with your household, and is forwarded, without any account identifier, to the U.S. National Weather Service (§C).
• Assistant conversations — the message you type or dictate to the in-app assistant, and the answer it gives. The assistant receives only the message you just sent: not your earlier messages, and none of what you have saved in the app (such as events, chores, lists, or family members' names). It cannot add, change, or delete anything in your household. To keep any one account from overloading it, we keep a record of when each account used the assistant. If you use voice dictation where it is offered, your recording is sent to a speech-to-text service we operate ourselves and the transcript is handled like typed text; voice dictation is not offered where you write end-to-end-encrypted content. Child Accounts cannot use the assistant. See §C for how these are processed.
• Child Account profile data — a display name and optional avatar, household membership and role, and the one-way hash and short public prefix of the child's login code. A Child Account is created without an email address, but the child can add an optional contact email from their own account; we send a verification link to that address and notify the Household Adults when it is added or verified. We do not collect a Child Account's date of birth or phone number.
• Premium feature requests — when a Child Account taps to ask a Household Adult to unlock a Premium-only feature, we store which feature was requested, which child requested it, when, and its status (pending, dismissed, or resolved). This lets a Household Adult see and act on the request; it is not shared outside the household and is deleted on a retention schedule.
• Feedback and support requests — a Household Adult can send us feedback through the in-app assistant (when you tell it about a problem or a suggestion, it offers to send your message to our team) or through a regular feedback form. A Child Account sends feedback through a regular form only. We store the text of the report, an optional screenshot you choose to attach from your photo library, and technical context (app version, the kind of phone, the screen you were on, and whether the account is a Household Adult's or a Child Account's). Feedback text and screenshots are not end-to-end encrypted — our team reads them to follow up. A Household Adult's feedback text is also processed by the same outside AI service that powers the assistant, in an automatic sorting step that also looks at your household's other recent feedback that we have not yet closed (§C). A Child Account's feedback skips that automatic sorting step. See House Privacy §7 ("Support communications") for how long we keep it.

Hundredfold Home does not collect health data, financial account numbers, or payment card data. Subscription payments are handled entirely by the platform store (§E); we never receive your payment credentials.

C. Third-Party Services and Processors

• Push notification delivery — push is delivered through Google Firebase Cloud Messaging (FCM) on Android devices that support it (including installs from our F-Droid repository), through Apple Push Notification service (APNs) on iPhone, and otherwise through a notification relay we operate ourselves (UnifiedPush). Message content is never in a push: the app fetches it directly from us over its own authenticated, end-to-end-encrypted connection. Today, the rest of a notification's readable text is not encrypted before we hand it to Google or Apple, so they receive, in addition to a device push token and the time each notification is sent: a chat sender's display name (or a child's first name) and the group name; a child's first name on chore-help, reward, and new-device sign-in pushes, plus the device name on the sign-in one; the actor's name and the event date/time on calendar and comment pushes; a birthday overlay name and age; list-activity actor names; and chore and event reminder times. We plan to encrypt that text before it reaches Google, Apple, or our relay, decrypting it only on your device. A Child Account session registers for push the same way and can receive push through any of these channels.
• Crash and diagnostic reporting — crash reports, error traces, and performance telemetry are sent to observability infrastructure we operate ourselves; they are not sent to a third-party crash-reporting vendor. These reports can include device model, OS version, app build, and a stack trace, and can originate from a Child Account session. They do not include message content.
• In-app assistant and feedback processing — when a Household Adult sends the assistant a message, that one message is passed through a relay service we operate to an outside AI service, which works out which answer or screen in the app fits it, and whether the message is feedback for our team. When a Household Adult sends feedback, its text, its category and the screen it was sent from go the same way to the outside AI service, together with your household's recent unclosed feedback from Household Adults. The service labels the report, flags likely repeats, and writes a short summary for our team. We do not send stored end-to-end-encrypted message, location, or calendar content to the outside AI service. What you type or dictate to the assistant is not end-to-end encrypted. Assistant and feedback requests are not used to train third-party models. Child Accounts cannot use the assistant, and a Child Account's feedback is not sent to the outside AI service for sorting.
• Email delivery — account-related email (address verification, password reset, welcome messages, and notices to Household Adults when a Child Account adds or verifies a contact email) is sent through our transactional email provider. A Child Account that adds a contact email receives a verification email at that address; a Child Account does not have a password and never receives a password-reset email, and we do not send login codes by email.
• Breached-password check (Have I Been Pwned) — when a Household Adult signs up, changes their password, or resets it, the app checks the new password against Have I Been Pwned's Pwned Passwords service, a public list of passwords exposed in data breaches. Your device makes a one-way (SHA-1) hash of the password and sends only the first five characters of that hash to the service, then compares the matches it gets back on the device itself. The password and its full hash never leave your device, and our servers are not involved. Like any internet request, this one also carries your IP address. If the service cannot be reached, the app skips the check. A Child Account has no password and never makes this check.
• Hosting and storage — the app, backend, and object storage (including photos, other media, and feedback screenshots) run on our cloud infrastructure provider. Media and screenshots are stored as uploaded (ciphertext for end-to-end-encrypted content; plaintext for content that is not end-to-end encrypted, including feedback screenshots) and are subject to the retention schedule in House Privacy §7.
• Network delivery (Cloudflare) — traffic between the app and our servers, including our sign-in pages, passes through Cloudflare, which provides encrypted-connection (TLS) termination, network protection, and content delivery for us, and which stores and serves our own map tiles. Cloudflare therefore processes your IP address, request metadata, and the content of requests that are not end-to-end encrypted (end-to-end-encrypted content passes through only as ciphertext), and receives the map tiles your device requests, which reveal the map area you are viewing. Traffic from a Child Account session passes through Cloudflare the same way.
• Weather (U.S. National Weather Service) — to show local weather, our servers send the approximate location described in §B, with no account identifier, to the National Weather Service's public weather API. The National Weather Service is a U.S. government agency, not our processor, and handles that request under its own policies.
• Subscriptions — in builds distributed through Google Play and the Apple App Store, subscription purchase and entitlement state are handled by that platform's billing system together with RevenueCat, our subscription management provider. They receive a pseudonymous account identifier and purchase state — not your household's content. On Android the billing components are switched on only when the app was installed from Google Play; an install from our F-Droid repository never switches them on, sends nothing to these processors, and cannot make purchases. Subscription purchase is available only to a Household Adult; a Child Account session does not reach these processors.
• App distribution — Google Play and the Apple App Store receive download and, where applicable, purchase information under their own privacy policies. Our F-Droid repository is operated by us.

We maintain a data processing agreement with each processor above that receives personal information (the National Weather Service and Have I Been Pwned, which receive no account identifier, are independent services rather than our processors), and — for any processor reachable from a Child Account session — one that accounts for children's data, consistent with House Privacy §3.

D. Permissions

Hundredfold Home requests these device permissions. Each is optional; the app functions without them, minus the corresponding feature.

• Notifications — to alert you to new messages, calendar events, and chore activity.
• Camera — to take a photo or record a video to send in a conversation, set a profile picture, or scan a household invite or login QR code.
• Photo and media library — to attach an existing photo or video to a message or profile, and to save a video to your photo library when you choose to.
• Storage (Android 9 and earlier) — to save a video to your phone when you choose to.
• Location (precise, coarse, and background) — for location sharing, place alerts, and activity check-ins, and to show local weather from an approximate location, as described in §B. Background location is requested only if you (or, for a Child Account, a Household Adult) choose to share your location continuously with your household or turn on place alerts.
• Microphone — for voice dictation where it is offered (§B), and to record the sound of a video you take in the app to send in a conversation. Recording starts only when you tap the microphone button or start recording a video. A video's sound is part of the video and is end-to-end encrypted with it (§D-E2EE); dictation audio is not.
• Foreground service — to hold the real-time message connection open, to finish preparing and sending a video you chose to send, while the app is in the background, and, if you enable continuous location sharing, to reduce (but not eliminate) the chance that sharing is interrupted while the app is in the background (see §D-LOCATION). Android shows a persistent notification whenever a foreground service is running.

D-E2EE. Encryption and household key recovery

Hundredfold Home does offer end-to-end encryption for messages and the media attached to them (direct and group conversations), live location coordinates and Places, calendar event titles, descriptions, locations, and event comments, wishlist item names, links, and notes, chore titles and descriptions, list titles and list items, and the notes on allowance entries. In plain words, that content is end-to-end encrypted: locked on your phone before it's sent, unlocked on the phones it is meant for. We store it only in its locked form, and we do not hold the keys that unlock it. Whether that keeps it from us depends on the three assumptions below. Message reactions, group conversation names, and the names and notes of saved activity places are not end-to-end encrypted yet; we plan to extend encryption to them.

Parts of this protection also depend on the version of the app you use. Versions of the app earlier than 1.0.964 are no longer supported. The app asks a Household Adult who is using one to update, but it does not ask a Child Account's device, so a child's device can keep running an earlier version, with the limits described below, until someone updates it.

First, our member list. Our servers also run the directory that tells each device which encryption key belongs to which household member, and the app does not yet offer a way to check those keys yourself (for example, by comparing a code in person). End-to-end encryption therefore protects your content from us on the assumption that our servers hand out each member's genuine key. A compromised server could, in principle, substitute a key it controls, or list a member who is not really in your household, and read content locked to that key afterward. Starting with app version 1.0.964, each device remembers the household members' keys and the administrators it has seen, and a parent's device shows a security check when an administrator is added or an administrator's key changes. But a newly set-up or reinstalled device trusts what it sees the first time it loads the household, and the app does not yet tell you when a new member who is not an administrator appears. Earlier versions of the app do not remember keys at all.

Second, a child's login code. A login code made before our September 29, 2026 update was created by our servers. If our servers had kept one, they could use it to open that child's key and the household content the child can open. Codes made since then are created on the parent's phone and never reach us. Refreshing a child's keys stops an old code from opening the child's new key, but content locked before the refresh, and content locked afterwards until the household's shared keys next change, stays within an old code's reach.

Third, the shared "room keys" that lock location, Places, calendar event content, and every group or whole-household conversation. Starting with app version 1.0.964, a device locks new content with a room key only if a household member whose key the device already remembers sealed it, addressed it to that device, and it is not an older key the device has already seen for that room; any other key is used only to unlock existing content. Starting with app version 1.0.969, a device also locks new content only with a room key sealed in the current format, which ties each key to its room and key version, so an older room key copied forward as if it were new is not used. For every version of the app, our servers refuse content stamped for a key newer than the room's current key, so a departed member's phone cannot use such a stamp to keep other devices on an old key. The limits: on a version earlier than 1.0.969, a device that never held the older key (for example, a newly set-up or reinstalled one) can still be made to lock new content with an older room key copied forward by someone who could write to our database or control our servers, so on such a device removing a household member does not reliably cut them off from new content. A version earlier than 1.0.964 also accepts a room key without checking who sealed it, so that same person could give it a room key of their own choosing and read what it locks afterward, a child's location included. None of this removes the first two assumptions.

Hundredfold Home relies on the House Terms §10 and House Privacy §12 disclosures without variation. In particular, and importantly for a family app:

• A household administrator can decrypt a Child Account's encrypted content. Each Child Account's private key is escrowed, in encrypted form, to the household administrators (from app version 1.0.964, only those the escrowing parent's device has recognised or confirmed — see the next bullet), so a parent is never permanently locked out of a child's account. See House Terms §10.3. From app version 1.0.964, an administrator who has not yet received a child's key backup can still issue that child a login code, but the code only signs the child in; it does not unlock the child's encrypted content until another administrator confirms them and a new code is issued.
• A household administrator's key is backed up to the other administrators. In a household with more than one administrator, each administrator's private key is escrowed, in encrypted form, to the other administrators of that household, automatically, when they use the app with encryption unlocked. Starting with app version 1.0.964, a device backs up its own key, and a Child Account's key, only to administrators it saw when it first loaded the household or that a parent has confirmed on it through a security check; an administrator added later, or whose key has changed, receives no backup from that device until then. That check is what keeps those backups limited to people already in your household. Earlier versions of the app back up to every administrator our servers list. We do not hold the keys that open these envelopes. They exist so that a forgotten-password reset does not destroy an administrator's end-to-end-encrypted history: after the reset, the next time another administrator opens the app, their device automatically re-seals the original key back to them, with no action on that administrator's part. That re-seal does not yet ask anyone to confirm, on any version of the app, so someone who takes over an administrator's account (for example, by resetting their password through that administrator's email) could receive the original key this way; we are changing this so a household member's own action is required first. This means another household administrator holds encrypted material that could decrypt your end-to-end-encrypted content; the app uses it only to restore your key and does not give administrators access to your conversations. A sole administrator, and a Household Adult who is not an administrator, have no such backup, so neither we nor another household member can recover that adult's encrypted content after a password reset.
• If a password reset installs a brand-new key instead — because no backup was on file for that administrator — the new key can receive every child's key. Starting with app version 1.0.964, the next time another administrator's app unlocks, it shows a security check saying that administrator's security key changed, and it holds back the backup of each Child Account's key, and of that parent's own key, until that parent confirms the change was really them; that check is what keeps those backups from reaching someone who only looks like that administrator. Earlier versions of the app re-seal those keys to the new key automatically, with no confirmation from anyone. So if someone else gains control of an administrator's account (for example, by resetting their password through that administrator's email), your household's children's keys, and every other administrator's key, can be silently handed to that new key the next time an administrator using an earlier version unlocks — or when a parent confirms the security check without first checking with that administrator.
• Chore schedules and completion records, allowance amounts and balances, whether a list item is checked off, shopping and pantry item names, recipes and meal plans, birthday overlay names, activity check-in records, the approximate location sent for weather, assistant conversations, and feedback submissions (including any attached screenshot) are not end-to-end encrypted. They are encrypted in transit and at rest, but we are technically able to access them. We do not send stored end-to-end-encrypted message, location, or calendar content to the outside AI service. We do not promise backups, snapshots, or any availability SLA for that non-E2EE data; it can be lost through hosting failure, operator error, or deletion on termination (House Terms §10.5, §14, §15).

D-LOCATION. Location accuracy and availability

Location accuracy and availability. Location sharing depends on your device's GPS, network, and operating system, on background-location permissions and battery-optimization settings you or your device manufacturer control, and on push-notification delivery through Google, Apple, or our own relay (§C). Any of these can delay, degrade, or entirely prevent a location update or a place alert from arriving — including while you are actively viewing the map. We do not warrant the accuracy, precision, completeness, or timeliness of any location shown in the Service, or the delivery of any location-based alert or notification. Hundredfold Home is not a safety, emergency-response, or life-monitoring service, and must not be relied on as one. Do not use it, or a household member's absence from it, as the basis for a safety or welfare decision, and do not use it as a substitute for calling emergency services. Interruption or inaccuracy of location sharing is not, by itself, a breach of these Terms, and the disclaimers in House Terms §15 and the limitation of liability in House Terms §16 apply to it the same way they apply to the rest of the Service.

E. Subscriptions and Billing

Hundredfold Home offers a single optional Premium subscription, which covers every member of one household. The app is fully usable without it.

• Price(s) and billing cycle(s): Premium is offered on a monthly and an annual term. The current price for each term, in your local currency, is shown in the app on the subscription screen before you purchase — prices come from the platform store and can vary by country.
• Free trial terms: where a free trial is offered for a term, its length and conditions are shown on that same screen before you purchase. If a trial is not shown, none is offered.
• Auto-renewal and cancellation: a subscription renews automatically at the then-current price for the same term until you cancel. Cancel any time through the store account you purchased with (Google Play or the App Store); cancellation takes effect at the end of the current billing period, and you keep Premium until then.
• Refund policy: purchases are processed by Google Play or the Apple App Store as merchant of record, and refunds are handled under that store's refund policy. Request a refund through that store; we cannot issue one directly.
• Only a Household Adult can purchase or manage a subscription. An install from our F-Droid repository cannot make purchases.

F. App-Specific Acceptable Use

No additional acceptable-use terms beyond House Terms §8. Because Hundredfold Home is a private household app rather than a public social network, House Terms §8 governs conduct within a household, and House Terms §8's note on encrypted content applies to messages: we do not hold the keys to end-to-end-encrypted conversations, so we do not proactively detect a violation inside them, and enforcement there depends on a report from a participant or from a household administrator.

G. Governing Terms for Core Legal Mechanisms

No changes to House Terms §15 (Disclaimers), §16 (Limitation of Liability), §18 (Dispute Resolution and class-action waiver), or §19 (Governing Law and Forum). Those sections apply to Hundredfold Home exactly as written in the House Terms.

H. App-Specific Contact / Data-Subject Requests

See House Terms §23 and House Privacy §13. Hundredfold Home uses the same support, privacy, and security contact as the House Documents.

I. Effective Date and Versioning

This Addendum applies to App ID kingdom-hearth. Its version and effective date are the version and registration date shown alongside this document in the consent record you are asked to accept — that record, not this text, is authoritative. Changes to this Addendum follow the same material/non-material change process described in House Terms §20 and §21.