Home Ward Privacy Policy

Version 2 · Effective 1 November 2026

About this version. We have tried to describe what Home Ward actually does, rather than what a privacy policy usually says, including the things we cannot yet do. Where a feature is not switched on for everyone yet, we say what happens when it is on. Version 1 stays published at its own address.

1. Who we are

Home Ward is operated by ASTON VENTURES L.L.C., 354 N 360 E, Vineyard, Utah 84059. Contact us at support@home-ward.com or legal@home-ward.com.

Home Ward is available in the United States only and is for adults 18 and over.

2. What we collect

Account and identity

Your email address — held by our identity provider and in our own database. While you are signing up, before your account exists, we hold it in a pending sign-up record. If you ask to change it, we hold the new address for about an hour while you confirm it, and keep a keyed tag of each address you asked for, for 24 hours, to limit abuse.
Your password — held only by our identity provider. No Home Ward database contains your password or a hash of it. Codes we email you to reset your password or confirm a new address are stored only as keyed hashes, for about an hour.
Your date of birth — collected once at sign-up to decide whether you are 18 or over. ⚠️ We keep it after that decision, and it is never shown back to you or to anyone else. We also record when you were admitted and on what basis.
The age range your App Store account reports, if your device shares it — only the range, not how it was established. We record whether it agrees with the date of birth you gave us. It never decides on its own whether you can join.
A permanent account identifier, used across our systems, logs and traces, and inside the address of every photo you publish (section 7). We treat it, and the other codes this policy describes, as information about you, never as anonymous.

Profile

Your display name, after we remove invisible and control characters from it and normalise how it is encoded.
⚠️ When name review is on, a new display name you choose is seen only by you until a review accepts it; other members see your last accepted name, or a neutral name until you have one. Section 4 says how names are reviewed.
Your bio, if you wrote one before bios closed. We keep it until you clear it, and new bios can't be added.
Your @handle, which we assign at random when you sign up — it is not taken from your name or your email. It is public and cannot be changed.
Your profile photo and the order you arrange your photos in. A profile photo you replace or remove stops being served (section 7 says how soon), but we keep it until your account is deleted.
⚠️ Sensitive information. If you answer the optional onboarding question, we store whether you say you are a member of the Church. If you add a ward, we store it — and a ward is both a religious affiliation and a geographic area. Both are optional, and you can remove them; creating an account does not store either one. We never work out your ward or your location from your network, your GPS or your device; a ward is stored only because you told us. We keep a history of the wards you have joined and left. Who can see your ward and your answer is controlled by your privacy settings.
⚠️ If you verify your profile, you submit a selfie that one person compares with your profile photo by eye. We measure no face, build no face template, ask for no ID and use no verification vendor. The selfie is deleted once the decision is made, unless you have asked us to look at the decision again or it has to be preserved as suspected illegal material. We keep the decision, its reason, the reviewer, the time, and a code identifying the photo it was compared with.

What you create

The text of your posts and replies, when you wrote them, and whether you edited them. When you delete a single post or reply it disappears everywhere in Home Ward, but we keep it until your account is deleted.
Your photos, plus a display copy we generate. A photo you upload but never post is deleted after about a day. A photo our review rejects is kept as a moderation record.
⚠️ The description read aloud to screen-reader users for your photo is written by an AI model during safety review, because the app does not give you a place to write your own.
Your likes, friendships and requests (including when you dismiss a request, which the sender cannot see), blocks and mutes, and any reports you file, including the note you write.

Notifications

Your in-app notifications record only who acted, what kind of thing happened, which item it was about, when it happened, and whether you have read it. They expire after 90 days and are removed, by our database's own clean-up, usually within a few days of that. We also keep a record of each notification we delivered to you until your account is deleted.
If you turn off push alerts of a particular kind, we store that choice on your account until you turn it back on.

Device and technical

For each device you allow notifications on, its push token, platform, app version and when we last saw it — until you sign out on that device, Apple retires the token, or you delete your account.
⚠️ We do not keep your IP address in any Home Ward database or log, with one exception (section 9). It is processed in passing: our services turn it into a keyed code for your network, used only for short-lived limits on sign-up, password-reset and code-resend requests. That code is not anonymous — whoever holds the key could confirm a guessed address — but it cannot be turned back into an address.
We do not collect a hardware or advertising identifier, and our servers do not record your device's user-agent.
⚠️ When crash reporting is on, the app sends crash and error reports to Datadog. They carry the app and operating-system version, your device model, whether you are on Wi-Fi or a mobile network, a random session identifier, and where in the app the problem happened. The report sent when the app launches also carries your device's time zone, language setting, battery level, screen brightness, and processor and memory load. Each upload names the app version, device and operating system in its request header, and Datadog sees the IP address it comes from; Datadog's IP and location collection is turned off for us. No report carries your name, email, account identifier, ward, or anything you wrote or posted.

Product analytics

For each member, we keep at most one record per day — the day only, with no time — of each of these: an account created, a sign-in or session renewal, a post, a comment or reply, and a like. Each record is keyed by a coded form of your account identifier, is linked to your account, and is deleted with it; otherwise it is deleted after 395 days. Deleting a post or removing a like does not remove that day's record.
We also count, per day, how many times invitation or profile links are opened. That count carries no account.
We do not send these records to anyone else, and we use them only to understand how Home Ward is used.

Messages and records about the service

If you write to support@home-ward.com or legal@home-ward.com, we keep your message to handle it. Support messages are deleted once they are more than 30 days old, in a monthly sweep, unless they have become part of a safety, moderation or legal record. Mail to legal@ is kept with the matter it concerns.
Our security and operational logs, keyed to identifiers rather than names, are kept for no more than a year — most for much less — and expire on their own schedule.

3. Why we use it

To run your account and show you the feed.
To review content for safety before it is published (see below).
To enforce the Community Guidelines.
To limit abuse — rate limits and spam controls.
To keep the service working, and to fix it when it breaks.
To understand how Home Ward is used (the product analytics above).
To meet legal obligations, including child-safety reporting.

4. Automated safety review, and third-party AI

Posts, replies and photos — profile photos included — are checked before they appear, and a photo is checked as soon as you upload it. Some of that check happens at Anthropic, a separate company outside our cloud provider. Because that means sharing your content with a third party, we ask for that permission separately from the Terms, and you can decline it or withdraw it later in Settings.

If you decline or withdraw it, you can still read, block, report, contact us and delete your account, but you can't post, reply, upload photos or choose a custom display name. Withdrawing stops us sending anything you submit afterwards. ⚠️ A post, reply or photo you submitted before you withdrew may still be sent to Anthropic and reviewed after you withdraw, and withdrawing does not call back or delete what has already been sent or stored.

What is sent	To whom
A resized, re-encoded copy of your photo (about 512 pixels). The original never leaves our private storage, and the re-encode strips all embedded metadata, including any GPS location.	Amazon Rekognition (inside our AWS account) and Anthropic (outside it)
The text of your posts and replies.	Amazon Comprehend (inside our AWS account). Text identified as English is additionally sent to Anthropic. Text whose language can't be identified is also sent to Anthropic, only to check it for signs of self-harm, and a person decides whether it is published. Text confidently identified as another language is not sent to Anthropic; a person decides.
⚠️ When name review is on, a new display name you choose.	Amazon Comprehend and Anthropic, whatever its language. A name is never rejected automatically: it is accepted, or held for a person to decide, and a name that suggests a risk of self-harm is routed to a person. You can propose a new name at most 5 times in any 24 hours and 20 times in any 30 days, and only with the third-party-AI permission.

The photo we send carries no name, email, account identifier or device information alongside it. Profile photos go through exactly the same review as post photos. Anthropic also writes the accessibility description for your photo on that same call. Your bio is not reviewed, because new bios can't be written.

⚠️ When matching against known child sexual abuse material is on, before any other review we compute a PhotoDNA code from each photo you upload, and from each verification selfie, on our own servers, and send only that code to Microsoft — never the image. A photo that matches is blocked, preserved, and not sent to Rekognition or Anthropic; the account is suspended automatically; and a person reviews the case and reports it to the National Center for Missing & Exploited Children.

Automated review can publish, hold or remove a post, reply or photo with no person involved. Suspending, banning or restoring an account is a person's decision, except the automatic suspension above.

Names and details of other people that you write into a post go to these providers along with the rest of your text. Please think about that before writing about someone else.

5. Who else receives your information

Recipient	What they get
Amazon Web Services	Almost everything runs here: hosting, our database and storage, sign-in (Amazon Cognito), the email we send you (Amazon SES), push delivery (Amazon SNS), queues and logs, and the in-account safety tools above.
Anthropic	Photo copies, the post and reply text described in section 4, and — when name review is on — display names, for safety review; it also writes photo descriptions. By default, Anthropic does not use content sent through its commercial API to train its models. This is the main place your posts and photos leave AWS.
Apple	Through Amazon SNS, your device's push token and an opaque notification identifier, which encodes when our systems created the notification. Push notifications carry fixed wording only — no names, no message text, no counts. If you test pre-release versions of the app through TestFlight, Apple also receives your tester email address, device and build details, and crash reports.
Datadog (US5)	Server performance traces and metrics. They carry your account identifier, and are designed to leave out what you write and your IP address, though a failed database request can occasionally add a value from that request. Datadog keeps them for a limited period. ⚠️ When crash reporting is on, it also receives the crash and error reports described in section 2, and keeps them for 30 days.
Google Workspace	Our email is hosted with Google, so if you write to us — or we contact you after a safety concern — that correspondence and your email address pass through Google. Notices about email we send that could not be delivered, or that a recipient marked as unwanted, also reach our Google inbox, and they name the address the email went to.
Microsoft (PhotoDNA)	⚠️ When matching against known child sexual abuse material is on, the PhotoDNA code of each photo and verification selfie, never the image.
National Center for Missing & Exploited Children	The report a person files about known child sexual abuse material, and the evidence it includes.
PagerDuty	If a known child-abuse match occurs, an alarm pages our responder. The page carries only the alarm's name and state, a count, and our cloud account and region — never member information, an image or a code.
Law enforcement or regulators	Where we are legally required to respond, or where there is a risk to someone's life.

You can stop every transmission to Apple's push service by declining the notification permission, or turning notifications off later in iOS Settings.

6. What we do not do

We do not sell your personal information, and we do not share it for advertising based on your activity elsewhere. We show no third-party ads.
We share nothing with advertisers, ad networks, data brokers or attribution vendors.
We do not track you across other companies' apps or websites, and we show no App Tracking Transparency prompt because we have nothing to ask for.
home-ward.com carries no analytics, advertising or tracking scripts of any kind.

7. Photos are served from public addresses

⚠️ This one deserves its own section. A photo that passes review is served from a public web address that anyone holding the link can open without signing in. The link is not signed, not time-limited and not restricted to your account, and the address contains your account identifier and the photo's identifier.

When you delete a post, or remove or replace your profile photo, its link usually stops working within minutes. If removing the photo fails, we keep retrying, and the link may keep working until it succeeds. A copy someone has already saved may remain. ⚠️ A post we remove, and an account we ban, are hidden in the app, but a photo link someone already has may keep working.

8. How long we keep things, and what survives deletion

You can delete your account from inside the app, whatever its state. After you confirm your password it closes at once on every device, with no undo. We aim to remove its data within 30 days, apart from the records listed below; if a step fails, a person has to finish it, which can take longer. We email you when we accept the request and again when it is complete. If an email can't be delivered we retry it for a while, but the deletion goes ahead either way. Some things deliberately survive, because deleting them would defeat a safety or legal purpose:

Reports you filed and reports filed about you, with your account removed or replaced where it isn't needed.
Moderation decisions about content, including the reason recorded and whether the content was flagged as a possible risk of self-harm, and our record of what each reviewer decided. Your account's own suspension and ban history is deleted, except the record below.
A record that a banned account may not return — a keyed code made from its email address, kept for one year and used only to make signing up again harder.
Your acceptance of these documents — which version, and when — and when you granted or withdrew the third-party-AI permission, linked by a code derived from your account identifier. An acceptance record deleted exactly when it might matter proves nothing.
Preserved child-safety evidence, where the law requires it.
Records we must preserve under a law-enforcement preservation request or a legal hold, for as long as it lasts and only what it covers.

Records that survive are kept for the purpose that justified keeping them, not indefinitely for general use.

9. What we cannot yet do

Most privacy policies do not have a section like this. We would rather write one than imply capabilities we do not have.

⚠️ You cannot download or export a copy of your data. There is no export feature yet.
⚠️ Deleting your account does not erase every copy immediately. Our database backups keep restorable copies for the length of the backup window, and our system logs expire on their own schedule. That residue is not reachable through the product, but it is not zero.
⚠️ A few places deletion cannot reach. If a post or reply repeatedly fails safety processing, the message carrying it — including your text — sits in an internal error queue for up to 14 days. If processing a photo you upload fails repeatedly, the record of that upload — including the IP address it came from and your account identifier — sits in an internal error queue for up to 14 days. This is the one place we keep an IP address. And if an email we send to an address bounces, or its recipient marks it as unwanted, our email provider adds the address to a list it will not send to again; the address stays on that list until we remove it, which deleting your account does not do.
⚠️ Content sent to Anthropic may be retained by them for up to 30 days. We do not currently have a zero-retention arrangement in place.
⚠️ Amazon's service terms permit AWS to use content sent to some Comprehend features to improve those services. The personal-data-detection feature is excluded from that; language and toxicity detection are not.
⚠️ People who are not members. If someone appears in the background of a photo you upload, or you write about them, their image or details go to our safety providers with the rest of your content. The same is true of a mistyped address in an email change: that address receives our code, is held as section 2 describes, and may be added to the list above. Anyone, member or not, can write to support@home-ward.com or legal@home-ward.com to ask about, correct, object to or delete information about them, and we act on it when we can find it and confirm who is asking.

10. Your choices and your rights

Change your church-membership answer at any time, and clear your bio.
Change your display name. ⚠️ When name review is on, a new name is reviewed before others see it, is limited in how often it can change, and needs the third-party-AI permission.
Control who sees your Friends list, your ward, and your church-membership answer.
Block or mute another member.
Grant, decline, or later withdraw the third-party-AI permission.
Turn notifications off, or turn off particular kinds of push alert.
Delete your account.

Wherever you live in the United States, you can ask us for access to your information, to correct it or delete it, or to look again at a decision we made about you. Write to support@home-ward.com or legal@home-ward.com. We act on a request about an account only when it comes from that account's email address. A person reads every message, and we aim to reply within 3 days. If we can't do what you ask, we'll tell you why, and you can reply to ask us to look at it again. Being available only in the United States doesn't take away any right a law gives you.

⚠️ Your @handle cannot be changed, and your date of birth cannot be edited after sign-up.

11. Children

Home Ward is for adults 18 and over. We do not knowingly allow anyone under 18 to hold an account. We rely on the date of birth you give us — we do not verify it — and we record whether it agrees with the age range your App Store account reports. If we learn an account holder is under 18, we ban the account. If they are under 13, we also delete the account and its data, except anything a specific legal preservation duty requires us to keep. If you believe a child has an account, write to legal@home-ward.com.

12. Security

What we can say accurately:

Connections between the app and our servers use HTTPS, and photos are delivered over HTTPS.
Our database, uploaded files, cache and queues are encrypted while stored.
Storage buckets block public access at the bucket level; none is browsable or listable.
Database credentials are generated and rotated by AWS and fetched at run time — never written into our source code.
Every request that reads or changes your account or your content must carry a valid sign-in token, checked at our gateway and again in the service that answers it. Signing up, signing in and resetting a password do not need one. Our databases sit in a private network unreachable from the internet.
Every moderation decision is recorded in a separate store that keeps every version, and every human decision is recorded against the reviewer who made it.
Access to the cloud account holding member data requires a second factor at every sign-in.
⚠️ Home Ward is operated by one person. Only that operator, and the automated systems the operator configures, can reach member data. There is no larger staff to restrict access from — and equally, no separation of duties.
We keep a written procedure for security incidents. If a breach affects your information, we will notify you as the law requires.

No service can promise it will never be breached, and we do not.

13. Changes

When this policy changes we publish a new version with a new effective date; we do not edit a version that has been published. Material changes are brought to you before you carry on using Home Ward.

14. Contact

support@home-ward.com · legal@home-ward.com · ASTON VENTURES L.L.C., 354 N 360 E, Vineyard, Utah 84059.