Last updated: 29th September 2026
The full policy is below, but here is the substance of it.
- You do not need an account. The app identifies your installation with a random ID it creates on your phone. We do not ask for your name, email or a password to diagnose a problem.
- We collect what you send us for a diagnosis. Your photos, what you tell us about the problem, your follow-up questions, and, if you use Find a Pro, your ZIP code and an email address or phone number.
- AI providers process it to answer you. Your photos and descriptions are sent to OpenAI, and details of the problem are sent to Perplexity, to produce the diagnosis, the repair guidance, videos and product suggestions. Section 8 explains exactly what goes where.
- We do not sell your personal information. We do not share it for cross-context behavioral advertising, we do not run ads in the app, and we have not done any of these in the past twelve months.
- You can delete your data from inside the app. Delete one diagnosis, your whole history, or everything, from the Profile screen. Section 12 explains what that removes and the few things it does not.
- Photos capture more than you intend. Frame tightly on the equipment. Section 4 explains why this matters.
HomeFlash, Inc. is responsible for the information described here. Under California law we are a "business", and under the other state privacy laws we are a "controller".
This policy covers the HomeFlash mobile app for iOS and Android, the website at homeflashpro.com including its contractor interest form, and the emails you send our support address. It is part of our Terms of Use.
It does not cover sites and apps you open from HomeFlash, such as YouTube, Amazon, The Home Depot, Lowe's, or a business's own website, or what an independent contractor does with information after you contact them. Those are governed by their own policies.
HomeFlash does not have user accounts. The first time you open the app, it creates a random installation ID and keeps it in your phone's secure storage (the iOS Keychain or the Android Keystore). The app sends that ID with each request so our servers can show you your own history and nobody else's. It is not linked to your name, your Apple or Google account, or your phone number.
Because your history is tied to that ID, it lives with the app on that phone. If you delete the app, reset your phone, or move to a new one, the ID is lost and we cannot restore your history, because we have no way of knowing it was yours. We do not sync history between devices.
The name and profile picture you can add on the Profile screen stay on your phone, in encrypted storage. They are never uploaded to us.
- Photos of your home. Up to three per diagnosis, taken with your camera or chosen from your photo library. The app resizes each one and saves it as a new image file before uploading it, and we store it privately. This is the heart of the product, and it is also the most sensitive thing you send us. A photo of a water heater can also capture the rest of the utility room, paperwork on a shelf, a laptop screen, or a person walking past. We do not want that information and you should not send it. Frame the shot on the equipment.
- What you type. Your description of the problem, the name or make and model of the equipment, your answers to follow-up questions, and the questions you ask the assistant in chat.
- Find a Pro requests. If you ask HomeFlash to look for local professionals, we collect your ZIP code, a description of the problem, which you can edit, and an email address or phone number.
- Feedback, ratings and reports. Whether a diagnosis was helpful, a star rating, any comment you add, and reports you make about guidance that looks wrong or unsafe.
- Support messages. What you write to us, and any screenshots or attachments you include.
- Contractor interest form. If you are a contractor and fill in the form on our For Contractors page, we collect your name, business name, email address, and the other details you choose to give: phone number, website, trade, service area, state, team size, whether you are licensed and insured, how you find work today, and your answers to our questions about the program.
- App details. Your app version, build number and platform (iOS or Android), attached to feedback, ratings and reports so we can tell which version produced a problem.
- Crash reports. When the app crashes or hits an error, it sends a crash report to our crash reporting provider, Sentry. The report contains technical details: the app version, the device model, operating system version, available memory, battery level and screen size, and where in our code the error happened. We configure it not to include your installation ID, your photos, what you typed, screenshots of the app, or error messages that could contain your content.
- Network address, for abuse prevention. To enforce usage limits and stop abuse, our servers convert your IP address and installation ID into one-way codes that cannot be turned back into the originals, and keep those codes for up to 45 days. We do not store your IP address in our own database. Our hosting providers, like any web service, see IP addresses in their ordinary server logs.
- Diagnosis activity. When each diagnosis starts and finishes, whether it succeeded, its confidence level, and which AI model produced each answer.
- Website visits. Our website host records ordinary server logs, such as IP address, browser type, the page requested and the time. We also use Google Analytics on the website, which uses cookies to tell us which pages are read, how visitors arrived, how long they stay, their browser and device type, and their approximate city or region. Google Analytics does not give us your IP address. See section 11.
So that there is no doubt, HomeFlash does not do any of the following today:
- Ask for, or collect, your location from your phone. The only location information we have is a ZIP code you type in, and the approximate area your IP address suggests to our hosting providers.
- Use your microphone.
- Use an advertising identifier, track you across other companies' apps or websites, or show ads.
- Use analytics tools in the app, or advertising cookies on the website. The website uses Google Analytics, as described in section 11.
- Send push notifications, marketing email or text messages.
- Take payments, or receive your payment card details.
If we add any of these, we will update this policy before we do and, where the law or the app stores require it, ask your permission first.
- To give you a diagnosis. Your photos and description are processed by automated systems, including AI models provided by OpenAI, to identify the equipment and the likely problem, ask follow-up questions, write repair steps, and answer your questions in chat.
- To find videos, products and local professionals. Details of the diagnosis are used to search for relevant repair videos and parts. For Find a Pro, your ZIP code and description are used to search for businesses near you.
- To keep people safe. We check what you describe for signs of an emergency, such as a gas leak or live wiring, and when we find one we withhold repair steps and tell you to get help. We also flag higher-risk work, such as electrical, gas, plumbing and structural repairs.
- To run and protect the Services. Showing you your history, enforcing usage limits, preventing fraud and abuse, fixing bugs and crashes, and keeping the system secure.
- To make the guidance better. Authorized people on our team may review photos, descriptions, diagnoses, chat, feedback and reports to find where HomeFlash got something wrong, investigate a report of unsafe guidance, and improve how the service works. We do not currently use your content to train AI models. If we decide to, we will update this policy before we start and give you a way to say no.
- To respond to you. Answering your support messages, and following up on a contractor interest form.
- To meet legal obligations. Complying with law, responding to lawful requests, and enforcing our Terms of Use.
- To produce aggregate insight. We analyse de-identified and aggregated data, such as which problems are most common and how often a diagnosis is rated helpful. We will not attempt to re-identify data once it has been de-identified.
8. AI providers and other service providers
We use a small number of companies to run HomeFlash. They act on our instructions, receive only what they need to do their job, and are not permitted to use your information for their own purposes. We list them by name so you know exactly where your information goes.
- OpenAI (AI analysis). Receives your photos, through a private link that expires within an hour, along with your description, the equipment details, your answers to follow-up questions, and your chat questions with the conversation so far. It returns the diagnosis, repair steps and chat answers. It does not receive your installation ID, ZIP code, email or phone number.
- Perplexity (web search). Receives a text summary of the diagnosis, such as the equipment, the problem, the part and the repair steps, to find repair videos and product links. For Find a Pro, it receives your ZIP code, the type of problem and your description, to find local businesses. It does not receive your photos, your installation ID, your email or your phone number.
- Supabase (database, storage and servers). Stores your photos, diagnoses, chat, feedback and Find a Pro requests, and runs the server code that talks to the AI providers.
- Sentry (crash reporting). Receives the crash reports described in section 5.
- Prismic (website content). Hosts the content of this website and stores the submissions from the contractor interest form.
- Website hosting. Our website host serves the pages you read and keeps ordinary server logs.
- Google Analytics (website analytics). Receives information about your visits to the website, as described in sections 5 and 11. It does not receive anything from the app.
Under their business terms as they stand today, OpenAI and Perplexity may keep what we send them for a limited period, for example to monitor for abuse, and may not use it to train their models. You can read their policies on their own websites.
The app asks for your agreement before it sends anything to these providers for the first time.
Apart from the service providers in section 8, we share personal information only in these situations.
- Businesses you choose to contact. Find a Pro shows you businesses and lets you call, email or visit them yourself. We do not send your contact details, photos or diagnosis to any of them. If you contact one, what you tell them is between you and them.
- Business transfers. If HomeFlash is involved in a merger, acquisition, financing or sale of assets, information may transfer as part of it. We will tell you before your information becomes subject to a different policy.
- Legal and safety. To comply with applicable law, a subpoena or a court order, to enforce our terms, or to protect the rights, property or safety of our users, the public or us. We review requests and object to those we consider overbroad.
- Professional advisers. Our lawyers, accountants and insurers, under a duty of confidentiality, where they need it to advise us.
- At your direction. Anywhere you explicitly ask us to send something.
- We do not sell personal information for money or other valuable consideration, as "sale" is defined by California and other state privacy laws.
- We do not share it for cross-context behavioral advertising or for targeted advertising as those terms are defined in state privacy law.
- We do not knowingly sell or share the personal information of anyone under 16. Regardless of consent.
10. Videos, product links and other sites
HomeFlash shows repair videos from YouTube and links to products at Amazon, The Home Depot and Lowe's. Video thumbnails load directly from YouTube, so YouTube receives your IP address and ordinary device information when they appear. When you tap a video or a product, it opens in YouTube, your browser, or the retailer's app, and that company's privacy policy applies from then on.
Amazon links carry our Amazon Associates tag, so Amazon can credit us if you buy something. The tag identifies HomeFlash, not you. Amazon may use cookies to record that you arrived from our link, and it reports our earnings to us in totals, not by customer. The Home Depot and Lowe's links carry no tag. See our Terms of Use for more about product links.
11. Cookies and similar technologies
The website uses two kinds of cookies. Strictly necessary cookies make the site work, such as those our content system uses when our own team previews unpublished pages. Analytics cookies, set by Google Analytics, tell us which pages get read and how people find the site, so we can improve it. We do not use advertising cookies, and we have turned off Google Analytics' advertising features, so your visits are not used to target ads at you.
You can block or delete cookies in your browser settings, or install Google's opt-out add-on for Google Analytics. Blocking analytics cookies does not affect how the site works. Google's own use of the data is described in its privacy policy.
The mobile app does not use browser cookies. It stores your installation ID and your settings on your phone, as described in section 3, and nothing that tracks you across other apps.
Where state law requires it, we treat a Global Privacy Control signal sent by your browser as a valid opt-out request for that browser.
12. Your choices, and deleting your data
- Camera and photos. The app asks for camera or photo library access only when you choose to add a photo. You can turn either off in your device settings. Diagnosis needs at least one of them.
- Delete a diagnosis. Remove one diagnosis from your history in the app. This deletes its photos, the diagnosis, its repair steps, its chat, any feedback on it, and any Find a Pro request made from it.
- Delete your history. On the Profile screen, choose Delete repair history to do the same for every diagnosis at once.
- Delete everything. On the Profile screen, choose Permanently delete account. This deletes your history as above, removes our abuse prevention records for your installation, and wipes the installation ID and everything the app stored on your phone.
- What deletion does not remove. Reports you made about unsafe or wrong guidance are kept after deletion, with a copy of the guidance you reported and your comment but not your photos or installation ID, because we need them to investigate safety issues and show how we handled them. App ratings and the comments you left with them are also kept. De-identified and aggregated data, and anything an AI provider already holds under its own retention period, are not affected. Copies in our providers' backups are overwritten on their normal backup cycle.
- Contractor interest form. Email us to have your submission corrected or deleted.
Depending on where you live, state law may give you specific rights over your personal information. These states have comprehensive privacy laws in force or coming into force: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island.
We extend the core rights below to everyone in the United States, whether or not your state has passed a law. It is simpler for us and fairer to you.
- To know. What categories of personal information we hold about you, where it came from, why we have it, and who we have given it to.
- To get a copy. Access the specific pieces of personal information we hold, in a portable format where that is technically feasible.
- To correct. Fix personal information that is inaccurate.
- To delete. Have us delete personal information we hold about you, subject to the narrow exceptions the law allows, such as records we must keep for legal, safety or security reasons.
- To opt out. Of the sale or sharing of personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects. We do not do any of these, so there is nothing to opt out of, but the right stands.
- To limit sensitive information. Restrict our use of sensitive personal information to what is necessary to provide the service.
- Not to be punished for asking. We will not deny you service, charge you a different price, or give you a worse experience because you exercised a privacy right.
For data in the app, the fastest and most reliable route is the deletion options on the Profile screen, because the app can prove the data is yours. For anything else, email [email protected] with "Privacy request" in the subject line and tell us what you want.
We verify requests before acting on them, because handing your data to the wrong person is the worse failure. Because the app has no accounts, we may ask for details that match what we hold, such as the approximate date and subject of a diagnosis, or the email address or phone number you gave in a Find a Pro request. If we cannot match a request to data with reasonable certainty, we will tell you and explain how to use the in-app controls instead. We use what you send us for verification and nothing else.
An authorized agent may make a request for you with written permission. We may still ask you to confirm directly that you authorized it.
We acknowledge a request within ten business days where the law requires it, and respond substantively within 45 days. If a request is complex we may take another 45 days, and we will tell you before we do.
You can appeal. Reply to our decision with "Appeal" and tell us why you disagree. A different person reviews it, and we will respond in writing within 45 days explaining the outcome. If we deny the appeal, you can complain to your state Attorney General, and we will tell you how.
California asks us to describe what we collect using its own categories. Over the past twelve months we collected the following. In every case the source is you, your device, or automatic collection as described in sections 4 and 5, the purposes are those in section 7, and the only recipients are the ones in sections 8 and 9.
- Identifiers. Your app installation ID, one-way codes derived from your IP address, and the email address or phone number you give in Find a Pro, a support message or the contractor form.
- Customer records. Contact details, and for contractors, name, business name and the other details on the interest form.
- Internet and network activity. Diagnosis activity, app version, crash reports, website server logs, and website usage recorded by Google Analytics.
- Geolocation data. A ZIP code, only when you enter one, and the approximate city or region Google Analytics derives from a website visit. We do not collect precise location.
- Audio, electronic and visual information. The photos you submit for diagnosis.
- Professional information. Trade, service area, licensing and business details, for contractors who use the interest form.
- Inferences. Conclusions our systems draw from your photo and description about what the equipment is and what is likely wrong with it.
We do not ask for sensitive personal information, and we do not use any information to infer characteristics about you. If a photo happens to reveal something sensitive, we use it only to provide the diagnosis you asked for.
We do not disclose personal information to third parties for their own direct marketing purposes, so there is nothing to report under California Civil Code section 1798.83.
- Photos, diagnoses and chat. Kept so you can look back at your history, until you delete them or delete everything as described in section 12.
- Find a Pro requests. Kept with the diagnosis they came from, and deleted with it.
- Abuse prevention codes. Deleted after 45 days, or sooner if you delete everything.
- Reports about guidance, and app ratings. Kept as long as we need them to investigate safety issues, improve the service and show how we handled a report.
- Crash reports. Kept by Sentry for its standard retention period, usually 90 days.
- Website analytics. Kept in Google Analytics for up to 14 months, then deleted automatically.
- Contractor interest form submissions. Kept while we are building the contractor program, and deleted when you ask or when we no longer need them.
- Support emails. Kept as long as needed to deal with your request and any follow-up.
- De-identified and aggregated data. May be kept indefinitely, because it no longer identifies you and we will not try to re-link it.
We encrypt information in transit between the app and our servers, and our providers encrypt it at rest. Photos are stored privately and are reachable only through links that expire. Our database only lets an installation read its own records. On your phone, your history and profile are kept in encrypted storage whose key never leaves the device. Access to production data inside HomeFlash is limited to the people who need it.
No system is perfectly secure, and we are not going to claim otherwise. Protecting your phone and your screen lock is the part that is yours. If we experience a breach affecting your personal information, we will notify you and the relevant regulators as state law requires.
HomeFlash is not directed to children under 13 and we do not knowingly collect personal information from them. If we learn that we have, we delete it promptly.
If you are a parent or guardian and believe your child under 13 has given us information, email [email protected] and we will remove it.
People aged 13 to 17 may use HomeFlash only with the agreement of a parent or guardian, as our Terms of Use explain. We do not sell or share the personal information of anyone under 16.
There is still no agreed standard for how a site should respond to a browser's Do Not Track header, so we do not respond to it. We do not use your visits to target ads, and we honour Global Privacy Control signals as described in section 11.
HomeFlash is operated from the United States and your information is processed here. Some of our service providers operate infrastructure in other countries, and where that happens we require contractual protections for the data they handle.
HomeFlash is intended for people in the United States. If you use it from elsewhere, understand that your information will be transferred to and processed in the United States, where privacy law differs from your own.
We may update this policy, and the date at the top will change when we do. If a change materially affects how we handle your information, we will tell you in the app, and ask you to accept it, before it takes effect. Where the law requires your consent, we will not apply the change to you without it.
If you want to see a previous version of this policy, ask us and we will send it.
HomeFlash, Inc.
Email: [email protected]
Put "Privacy request" in the subject line if you are exercising one of the rights in section 13, and "Appeal" if you are appealing a decision. Anything else, just write.
