Privacy Policy

Last updated: November 12, 2026

Household is open-source software that you run on your own computer or server. The Household maintainers do not operate a central service that receives your conversations, files, credentials, or connected account data. Household does not send usage analytics, crash reports, or telemetry to its maintainers.

Data on your own installation

Your installation processes and stores the information needed to run your bots: configuration, credentials for services you connect, conversations, bot memory, tasks, inbox events, files, sessions, logs, and local operational metrics. This data stays on the machine you choose, except when your configured bots or integrations send it to a service to perform a task. Local storage is not a cloud backup provided by Household.

If someone else hosts Household for you, that operator controls the installation and its data. Ask them about their access and retention practices. This policy describes the official project, not independent hosting providers or modified versions.

Services you choose to connect

Household connects to the AI providers, messengers, MCP servers, and other services you configure. Prompts, relevant files, retrieved information, and tool results may be sent to your selected AI provider to answer a request. Replies may be delivered through your selected messenger. These services receive data needed for their functions and process it under their own terms and privacy policies. Running Household locally does not mean that an external AI model runs locally.

Household's maintainers do not sell your personal data, use it for advertising, or collect it to train AI models. Review your providers' data-use and retention settings before sharing sensitive information with them.

Google: Gmail, Drive, and Calendar

In Household builds that support the Google connector, connecting an account is optional. You choose Gmail, Drive, Calendar, or a combination, and which bots in a workspace can access the connection. Publishing this policy does not connect your Google account or grant access to its data.

When explicitly connected by you, Gmail access reads and searches mail; Drive access searches file metadata and reads supported Google document text; Calendar access reads calendars and events. If you choose read and write access for a connection, your bots can also send, draft, label and trash mail; create, edit, move and trash Drive files; and create, change and delete calendar events, acting as you. These features serve user-requested assistance, such as finding messages, summarizing documents, answering mail, keeping notes and scheduling. Data processed may include your account identity, message metadata and bodies, file metadata and content, and event details including attendees. Google shows the requested permissions before you grant access. Read-only connections never change anything in your account. No connection permanently deletes data or changes Drive sharing permissions.

Authorization tokens are stored in the private database on your Household host and included in its backups, not on a server operated by the maintainers. Relevant email, document, and calendar content may be sent to the AI provider you choose to fulfill your request, and results may appear in your configured messenger and local conversation history. The Connectors page discloses this transfer before you connect. Google data must not be used for advertising, sold, or used to train generalized AI models. Only providers and configurations compatible with these restrictions may be used for Google data.

Household's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Slack connector

When you authorize Slack, your Household instance reads and searches conversations, profiles and files available to your Slack user. If you explicitly enable message sending, selected bots may also send messages as that user. Tokens remain on your Household host. Read content may enter your selected AI provider, chat and local history. Disconnect locally to remove the credential; revoke the app in Slack to revoke its authorization.

The static Slack callback page receives an OAuth authorization code and state in its URL, which is processed by Cloudflare hosting infrastructure. Browser JavaScript removes the query from the address bar and lets you copy the result to your Household instance. This page has no analytics, third-party assets, persistent browser storage, or token-exchange backend. The private PKCE verifier is held by your Household instance; access and refresh tokens are exchanged directly with Slack and never sent to this website. Hosting request records may include the original callback URL.

Microsoft To Do connector

Connecting Microsoft To Do is optional. You choose read-only or read-and-write access and which bots may use the connection. Household reads account identity and accesses task lists, tasks and checklists directly through Microsoft Graph. With write access, selected bots can create, edit, complete and delete those items as you. Task content may enter your selected AI provider, chat and local history.

Device-code sign-in and token refresh happen directly between your Household host and Microsoft, without a maintainer-operated callback or token-exchange server. Account identity, access and refresh tokens, and bot access grants stay in the host's existing private database and backups. The connector does not maintain a local copy of your tasks or run background task synchronization. Disconnect removes the local credential; revoke the app separately in your Microsoft account or organization to remove account-wide consent.

Retention, removal, and access

You control your installation's storage and backups. Conversations, memory, files, and credentials may remain until you remove them; local metrics are pruned on a seven-day retention schedule. Backups can include credentials and conversation data. Keep them secure and remove copies you no longer need.

You can disconnect an account from a workspace to delete its locally stored tokens and stop future use by its bots. This does not revoke other installations or remove backups. You can revoke Google access at any time in your Google Account connections. Revocation stops future authorized access; it does not erase previously saved messages, summaries, or backups. Remove those from your Household host and any destination services separately. To remove all installation data, stop Household and remove its configuration, data, bot storage, and backups. Uninstalling only the executable does not remove those files.

The maintainers cannot retrieve or delete data held only on your host or by providers you chose. If you need help locating it, contact us without sending credentials or private mail.

This website and voluntary contact

This website has no Household analytics or advertising trackers. It is hosted on Cloudflare Pages, whose infrastructure processes technical request information such as IP addresses to deliver and protect the site. Some pages load Google Fonts, which sends a request to Google. Those providers' privacy policies apply to their processing: Cloudflare and Google.

If you email the maintainers or open a GitHub issue, we receive the information you choose to send and use it to respond or maintain the project. GitHub issues are public. Do not include secrets or private data. Contact correspondence may remain in the support mailbox or issue history; email us to request removal of information we control, subject to any necessary legal retention.

Contact and changes

For privacy questions or requests, contact the Household maintainer at [email protected]. Changes to this policy will be published here with an updated date. Material changes to connector data use must be disclosed before that use begins.