Where your data lives

LifeHouse OS does not store your documents, vault items, chats, or any house data on your computer. When you upload a file, the browser holds it just long enough to send it to your account in the cloud, then lets it go.

The only files that ever land on your computer are ones you choose to download — exported CSVs, Vault zips, or individual file downloads. Those live wherever you saved them. We don't reach back into them.

What we keep in browser storage on this device:

• Your sign-in token, so you stay logged in between visits.
• UI preferences — which intro splash you've seen, your room-readiness flags, dismissed coachmarks, the "you've acknowledged the upload privacy notice" flag.
• The encrypted contents of your Private Password Safe (the password manager tucked inside the Vault) — encrypted with your 4-character safe code before being written, never sent anywhere.

Clearing this browser's site data will sign you out and forget your UI preferences. It will not delete your house — that lives in your account.

Documents, room uploads, Vault items, chats with staff, House Facts, contacts, calendars, inventory, health entries, pets, vehicles, students, care recipients, family tree, follow-ups, preferences — all of it lives in your account on Lovable Cloud infrastructure.

Protections we apply by default:

• Per-resident isolation. Every row is scoped to your account via row-level security. Other residents physically cannot read your data.
• Encrypted at rest. Files in your room drawers and Vault are encrypted on the storage layer.
• Admins and testers cannot open your Vault, drawers, or chats. Their access is limited to operational health (counts, error reports) and the things you explicitly submit to admins (suggestions, issue reports).
• AI replies transit the Lovable AI Gateway to Google Gemini or OpenAI to generate a response, and the reply is stored back in your account. The model providers do not retain your prompts for training.
• Outbound messages need your approval. If a staff member drafts an email or external action, it waits in your Front Hall until you sign off.

You can permanently delete your entire account — and every private trace of yourself — in one click, any time.

Open your profile, scroll to Delete my account, and confirm. When the beta ends — or any time you decide you're done — your Vault, room uploads, chats, House Facts, contacts, calendars, and every other piece of personal data are removed for good. We keep only anonymous, de-identified usage numbers (how many residents finished onboarding, average tokens per chat, which rooms get visited) so we can keep improving the product. Nothing in those numbers can be traced back to you.

Want a backup of your Vault before you go? Open the Vault and use Download my Vault to grab a zip of every file you've stored.

We considered shipping a "keep my Vault on this device only" option for beta and decided against it. The browser can evict locally-stored files under disk pressure, and "I lost my Vault because I cleared site data" is the exact failure mode we won't put a tester through. We're designing it for post-beta with proper key recovery and cloud-sync fallback.

Also on the roadmap: a "bring your own cloud" mode where your files live in your OneDrive, Google Drive, or Dropbox and we only keep pointers. Highest privacy story, highest engineering cost — we'll build it if beta feedback shows real demand.