KHouse Privacy Policy
Version 1.0 · Effective November 11, 2026
1. Who this covers
KHouse Holdings, LLC ("KHouse", "we") runs khousellc.com and the Apps on its subdomains. This policy covers what is common to all of them. Each App has an App Addendum that lists the extra data that App keeps, who can see it, any extra service providers, and any App-specific retention. Where an Addendum is more specific, it applies for that App. Words defined in the Terms of Use ("App", "Services", "Your Content") mean the same here.
Not covered. PropAlert (propalert.khousellc.com) has its own accounts, database and privacy policy, shown on that site; this policy does not apply to it.
We collect the minimum we need to run the Services. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we use no advertising cookies or tracking pixels. The only third-party analytics we use is Cloudflare Web Analytics, which sets no cookie and does not identify you (Section 6).
2. What every App collects
Account (if you sign up). First and last name, email address, organisation (if you give it), and a password stored only as a hash by our authentication provider; we cannot see it. A shared profile is stored once and used by every App you are approved for.
App access. For each App you ask to use: whether access is pending, approved or rejected, and when.
Agreement records. Which version of these terms, this policy and each App Addendum you accepted, when, and (when you accept inside an App) the IP address and browser user-agent at the time. We keep these as evidence of what you agreed to.
Usage events (some Apps). When you are signed in, some Apps record simple events (for example "page view" or "sign-in") with your user ID, the App, the page path and the time, so we can see which features are used. These stay in our own database; no analytics company receives them. The Addendum says whether an App records them. Our administrator's actions on your account (approve, deny, resend confirmation, reset) are recorded in the same table.
Site statistics. Some of our sites use Cloudflare Web Analytics, which gives us aggregate page views, country, browser and referrer. It uses no cookie and no identifier that follows you between visits.
Server and security logs. Our hosting provider processes your IP address, request URL, browser user-agent and timestamps to deliver pages, block attacks and enforce rate limits. Our own application logs record errors and some events, and a log line can include part of a request. We do not use these logs to profile you.
Email. Messages we send you (sign-up confirmation, access approved, password reset, and any notices an App describes) and a record that they were sent. All of them, including sign-in emails from our authentication provider, go out through Resend.
What you send us. If you email us, your message and address.
We do not collect payment card numbers (a payment processor handles them), precise device location, biometric data or government ID numbers.
3. How we use it
To create and secure your account, sign you in across Apps, decide and manage access, run each App you use, send service email, provide support, keep the Services secure and working, understand which features are used, enforce our terms, and meet legal obligations.
Legal bases where required (for example for EU/UK users): performance of our contract with you; our legitimate interests in running, securing and improving the Services; your consent where we ask for it (for example optional text messages); and legal obligation.
4. Who sees it
- You, and the people an App is designed to share with (for example housemates in HouseTab or project members in the Branding Tool). Each Addendum says who.
- The KHouse administrator, for approvals, support, security and abuse handling.
- Service providers that process data for us (Section 5), only to provide their service.
- Authorities or others where the law requires it, or where needed to protect rights, safety or the Services.
- A successor, if KHouse or an App is reorganised, merged or sold; this policy continues to apply to your data.
We do not share personal information with data brokers, advertisers or marketing networks.
5. Service providers used by every account-based App
| Provider | What it does | Data it handles |
|---|---|---|
| Supabase | Authentication, database, file storage | Account, access, agreement records, App data |
| Cloudflare | Hosting (Workers), DNS, content delivery, security | Every request: IP, headers, URL |
| Resend | Sending all service email, including authentication email | Your email address and the message |
Apps that use more providers (for example Anthropic for AI processing, Stripe for payments, Twilio for text messages, Railway for a backend) name them in their Addendum. Some processing happens on computers KHouse itself controls rather than a provider's cloud (for example HouseTab's bill reader runs on a KHouse machine, and for the Branding Tool KHouse uses Anthropic's Claude on its own computers to work with client words, photos and feedback); the Addendum says so where it applies. Our providers are US companies, and we use them to store and process your data in the United States; Cloudflare may deliver pages from a data centre near you.
6. Cookies and local storage
- Sign-in cookies. Our authentication cookies keep you signed in. They are set for
.khousellc.comso one sign-in works across Apps, sent only over HTTPS, and restricted to same-site requests. They are strictly necessary. - Security cookies. Cloudflare may set cookies to detect bots and attacks. Strictly necessary.
- Browser storage. Some Apps keep your work (for example project settings) in your browser's local storage or in files you save yourself. That data stays on your device unless the Addendum says otherwise; clearing your browser storage deletes it.
- Site statistics. Cloudflare Web Analytics (Section 2) runs a small script that sends page-view counts to Cloudflare. It sets no cookie.
- No advertising or cross-site tracking cookies. Because we do not track you across sites, we do not change how we work in response to browser "Do Not Track" or Global Privacy Control signals; there is nothing to opt out of.
7. How long we keep it
| Data | Default |
|---|---|
| Account profile and App access | While your account is open; removed when you delete your account |
| Agreement records | 3 years after your account is deleted, as evidence of what you agreed to; then deleted |
| Usage events | 13 months, then deleted |
| Server and security logs | Deleted automatically by our hosting provider, within 30 days |
| App data | As the App Addendum states |
| Backups | Until they roll off on the database provider's schedule, within 30 days |
We may keep data longer where the law requires it or to deal with a dispute or security incident. Aggregated figures that identify no one may be kept.
8. Deleting your account
Signed in at khousellc.com, open Account and choose delete. This removes your KHouse profile, your App access records and your sign-in identity. What happens to App data:
- Tank Heating, Bulk Terminal, Thermal Relief and SBIR keep no App data under your account, so nothing else is needed.
- Overfill and STR Underwriter data tied to your account is deleted automatically with it.
- HouseTab and AI Quest have their own delete option with rules about shared household data, described in their Addenda; use those first.
- GCV: as described in the GCV Addendum.
You can also email us to ask for deletion. Agreement records are kept for 3 years after deletion (Section 7) and are not removed on request during that time.
9. Your choices and rights
Whatever state or country you live in, you can ask us to:
- tell you what personal information we hold about you and give you a copy in a portable format;
- correct it;
- delete it;
- stop optional messages (every optional email has an unsubscribe link; text messages accept STOP);
- withdraw consent you gave, without affecting earlier processing.
Email scott@bluewatervision.net from your account address. We may need to confirm it is you. We will answer within 45 days and tell you if we need longer. We will not treat you differently for using these rights. If you are in the EU or UK you may also complain to your data protection authority. If we refuse a request you may ask us to reconsider by replying to our answer. We are below the thresholds of the US state privacy laws we know of; we offer these rights to everyone anyway.
10. Security
We use HTTPS for all traffic, encryption at rest by our database provider, row-level security so users reach only their own data, server-only handling of privileged keys, short-lived signed links for private files, rate limits and access gating of App code. No system is perfectly secure. If a breach affects your personal information we will notify you and the authorities as the law requires (in North Carolina, the Identity Theft Protection Act).
11. Children
The Services are for adults 18 and over and are not directed to children. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it. Tell us if you believe a child has used the Services.
12. Changes
Each change gets a new version and date. For a material change we will tell you in the App and by email where we have your address, and ask you to accept the new version at your next sign-in.
13. Contact
KHouse Holdings, LLC · Hampstead, Pender County, North Carolina · scott@bluewatervision.net