Privacy policy — CheckHome

Effective from 1 September 2026

This is a translation for your convenience. The Slovak version is the binding one; if the two ever differ, the Slovak wording prevails. You will find it at Ochrana osobných údajov.

CheckHome is an app for organising family life — tasks, shopping, calendar, maintenance, expenses, recipes and a password vault.

Who processes the data

The controller is CHECKTRUS s.r.o., Karpatské námestie 7770/10A, 831 06 Bratislava, Slovakia, company ID 57 228 884.
Contact for data protection matters: support@checkhome.app

The essential point first: we cannot see most of the content

The content of your modules is end-to-end encrypted. The encryption key is derived from your family password on your own phone and is never sent to the server. Only the encrypted form is stored on the server — neither we nor anyone who got into the database can read it.

A consequence that has to be taken seriously: if you forget the family password and it is not entered on any device, the data cannot be recovered — not even by us. There is no "forgotten password" for the encryption.

What is encrypted and what is not

To be completely clear — not everything is encrypted. This is the exact position:

Data	How it is stored
Module content: tasks, shopping lists, calendar events, maintenance and assets, activities, expenses and planned payments, recipes including photos, the password vault	Encrypted — the server sees only unreadable text
Sign-in e-mail address, account password	E-mail in readable form; the password only as an irreversible hash
Names of family members and their e-mail addresses, the family name, the names of family circles	Readable — the app needs them to assign things to people and to link families together
Feedback, questions and automatic error reports	Not encrypted — otherwise they could not be read and dealt with

The individual purposes

Account and sign-in

We process the e-mail address and the password (stored as a hash), or a sign-in through Google. Without it the data could not be shared between the family's devices. Legal basis: performance of a contract — providing the service.

Children's accounts

A parent can create an account for a child without an e-mail address. The app generates a technical address in the form dieta.xxxx@deti.checkhome.app, which is not used to deliver mail and is never sent anywhere. The child signs in with a code handed over by the parent. The parent keeps control of the child's account, including deleting it.

Feedback and automatic error reports

If you send us feedback, it is stored unencrypted — we say so in the app itself and ask you not to put passwords or sensitive details into it.

The app also reports technical faults on its own: the type of error, the screen, the app version, the operating system and the language. The content of your family data is never sent, and e-mail addresses, account numbers and sign-in tokens are stripped from the text automatically before it is sent. Automatic reporting can be switched off in Settings → Feedback. Legal basis: legitimate interest in keeping the app working.

Microphone — dictation

You can dictate into the lists. Speech recognition is handled by your phone's own recognition service (on most devices, Google's) — the recording therefore goes to that service under its own terms, not to us. CheckHome receives only the finished text and stores no recordings. The microphone is switched on only when you start dictation yourself.

Fingerprint

Used to open the password vault. The verification takes place entirely on the phone; the app learns nothing about the fingerprint and never sends it anywhere.

Notifications

Reminders use Firebase Cloud Messaging from Google. A technical device identifier needed to deliver the message is stored. The content of the reminder is assembled only on the phone.

Sharing between families (circles)

Families can join a "circle" and share selected events and recipes. Shared content is encrypted with the circle key, derived from the circle password — so only someone who knows the password can read it. Families' private data stays separate. Members of a circle see each other's names only when their family explicitly publishes them to the circle; by default they are hidden.

Who the data reaches

Supabase — database and sign-in. The servers are in the eu-west-2 region (London, United Kingdom). Since Brexit the United Kingdom is outside the European Union, but the European Commission has granted it an adequacy decision recognising a comparable level of data protection, so the transfer complies with the GDPR and needs no further safeguards.
Google — delivery of notifications (Firebase), the optional sign-in with a Google account, and processing of subscription payments (Google Play).

We do not sell the data and do not provide it for advertising. The app contains no advertising and no behavioural tracking.

How long we keep it

For as long as you have an account and an active subscription. There are three ways the data gets deleted:

You ask us to. A seven-day period begins, during which it can be undone; after that the account and the profile are deleted. If you are the last signed-in member of the family, the whole family is deleted with all its data. How to do it: Account deletion.
The subscription ends and you do not renew it. A 30-day period then begins. The app is locked, the data is stored and waiting; the app shows how many days are left. If the subscription is not renewed before the period ends, the whole family's data is deleted and the members' accounts are closed — irreversibly. In detail in the Terms of service, point 8.
The trial month runs out and you do not take out a subscription. The same applies: 30 days to think it over, then deletion.

Backups are overwritten continuously; the data disappears from them within 30 days of deletion at the latest.

Your rights

You have the right of access to your data, and the rights to rectification, erasure, restriction of processing, portability and objection. Just write to support@checkhome.app.

A limitation we have to admit: for encrypted content we can only hand you the encrypted form — you can make a readable copy yourself in the app, because only you hold the key. This is not unwillingness but a consequence of how the encryption is built.

If you believe we are handling your data incorrectly, you may contact the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, Slovakia.

Changes

If this policy changes, we will update the effective date and point out any substantial change in the app itself.

See also: Terms of service · Account deletion