Privacy Policy
Last updated 14 October 2026. Applies to the Ourstead web beta. What changed: Ourstead can now ask an AI service to read a recipe from a public web page its own reader cannot, described in Reading recipes with AI.
Who we are
Ourstead is a household organizer run by Ryan Wright in Kentucky, USA. During the beta, Ryan personally handles support and privacy questions at support@ourstead.casa.
What we collect
Your account. Your name, email address and password. We store the password only as a scrambled one-way hash (scrypt), never the password itself. If you add a passkey, we keep only its public key. Each sign-in creates a random session token, stored in hashed form, that expires after 30 days. We also record which version of these terms you accepted, and when.
If you sign in with Google, Facebook or Apple. That company tells Ourstead who you are: an account number it gives Ourstead, and your name and email address if you choose to share them. We keep the account number so we recognise you next time. If you create a household this way and the company confirms your email address, that address becomes your account's email, used for notices about your account. Your password with that company never reaches us, and Ourstead never posts anything for you or reads your contacts or friends. For Apple, we also keep, encrypted, the token Apple asks us to use if the link is ever removed, so we can tell Apple to forget it.
What your household enters. Ourstead stores what you and your household type in:
- people in the household, their roles and display colours, and optional birthdays for children
- inventory items, where they are kept, and any purchase or replacement values you type
- home maintenance items, schedules, costs and completion history
- calendar events, chores, shopping lists, recipes, meal plans, notes and comments
- recipes you import from a web address, including links you share to Ourstead from another app; our server fetches that public page for you, and if its own reader cannot find the whole recipe, the page's text may be read by an AI service (see Reading recipes with AI)
- if you ask Ourstead to email someone an invitation to your household, their email address, kept only until they accept the invitation or it is cancelled
- events from calendars you connect (see Connecting a calendar)
Technical information. Your IP address is used to limit repeated sign-in attempts, sign-ups and other abuse, and is discarded within about a day. A scrambled form of your IP address is stored with email verification and account recovery links. Our hosting provider keeps short-term server logs.
Cookies and browser storage. Ourstead uses one cookie to keep you signed in. It is required for the site to work. Your browser also stores the app itself and any changes you make while offline, until they reach our server.
What we do not collect in the beta
- No photos, documents or other uploads: those features are switched off.
- No bank, card or payment information.
- No location tracking.
- No advertising, advertising cookies or third-party tracking scripts.
- No AI processing of what your household enters. The only AI use is reading recipes from public web pages, described below.
- No usage analytics. If we turn analytics on later, it will count only anonymous, per-day household activity, every household will be able to opt out, and we will update this policy first.
How we use it
We use your information only to run Ourstead for your household: to show it to you and the household members you share it with, to send reminders and account emails, to keep accounts secure, and to fix problems. We do not sell your information, use it for advertising, or share it for others' marketing.
Inside your household. Members see household information according to their role. Adults see more than children; money and household administration are adults-only.
When the law requires it. We may disclose information if a valid legal demand requires it, or to protect someone's safety.
Reading recipes with AI
Ourstead reads most recipe pages itself, from the recipe information the website publishes. When you import a recipe from a web address and Ourstead's own reader cannot find the whole recipe, Ourstead may send that page to OpenAI, which reads out the ingredients and steps. You check the result before anything is saved.
- What is sent: the web address and the text of that public page. Not your name, your email address, your household or anything else you have entered in Ourstead.
- What is not sent: pages Ourstead can read itself, and pages that do not look like recipes.
- How OpenAI handles it: under OpenAI's terms for its API service, it does not use this information to train its models, and it may keep it for up to 30 days to detect abuse before deleting it.
- Limits: each household has a monthly number of these reads, and Ourstead tells you when they have run out.
Reading recipes from photos is not part of the beta. Before it is offered, we will update this policy: it would send only the cropped photos you choose, and only after you agree each time.
Connecting a calendar
You can connect a Google calendar, or add the private link to a calendar such as an iCloud calendar, so its events appear in Ourstead. Nothing is connected unless you do it, and you choose which calendars.
- What Ourstead reads: the events in the calendars you choose: their titles, times, places, notes and repeat rules, and the names (not the email addresses) of an event's organiser and guests. Ourstead uses them only to show them to your household, as your settings for that calendar allow.
- Two-way, only if you turn it on for a Google calendar: Ourstead also sends the events you choose from Ourstead to that calendar, and keeps them in step when they change. Google asks you to allow this separately.
- Your sign-in with Google for calendars is stored encrypted and used only to keep your calendars in step. A calendar link is fetched from our server and treated like a password.
- Stopping: disconnect a calendar in Settings at any time. Syncing stops, the stored sign-in is deleted, and you choose whether to keep or remove the events already brought in. You can also remove Ourstead's access from your Google Account's security page.
Ourstead's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your calendar information is never sold, never used for advertising, never sent to an AI service, and never read by a person unless you ask us to help with a problem, or for security or a legal requirement.
Who helps us run Ourstead
These companies handle your information only to provide their service to us. Everything is stored in the United States.
| Company | What it does for Ourstead |
|---|---|
| Render | Runs the Ourstead app (Virginia) |
| Supabase | Hosts the Ourstead database (US East) |
| Cloudflare | Directs web traffic to Ourstead and stores our encrypted backups |
| Resend | Sends Ourstead's emails: address verification, password resets, household invitations and reminders |
| OpenAI | Reads recipes from public web pages that Ourstead's own reader cannot (see Reading recipes with AI) |
If you sign in with Google, Facebook or Apple, or connect a Google calendar, that company's own privacy policy also covers what you share with it.
Links you save to recipes or images on other websites open those websites, which have their own privacy policies.
How long we keep it
Your household information stays until you delete it or your account. Some records expire on their own:
| Record | Kept for |
|---|---|
| Signed-in sessions | 30 days |
| Invitations | 72 hours, unless your household sets a shorter time |
| Email verification links | 24 hours |
| Account recovery links | 1 hour |
| IP addresses used to limit abuse | about a day |
| Notification delivery history | 30 days |
| A connected calendar's sign-in and events | Until you disconnect it (you choose whether its events stay) |
| The link to a Google, Facebook or Apple sign-in | Until it is removed or you delete your account |
| Record that a household was deleted | 1 year |
| Security records | 2 years |
| Encrypted backups (taken every hour) | 30 days |
Deleting your information
You can delete your own account in Settings. Ourstead first shows exactly what will happen.
- A household member's account is removed straight away. Chores and other open items are handed back to the household.
- A household owner, or the last adult, gets a 14-day recovery window. During it you can change your mind; afterward the household and its information are deleted.
- Items you added that other members still use, such as a shared shopping list, can remain for them.
- Copies in our encrypted backups disappear when those backups expire.
- Deleting your account also removes any link to a Google, Facebook or Apple sign-in. To remove only that link, email us. You can also remove Ourstead from the company's own settings: on Facebook, under Settings and privacy, then Apps and websites.
During the beta, downloading a copy of your information is not built into the app yet. Email us and we will send you a copy.
Children
Children cannot sign up for Ourstead themselves, and during the beta children do not get a sign-in of their own. A parent or guardian in the household can add a child as a person in the household, for chores and events. We never ask a child for an email address.
- A child's birthday is optional and is shown only to the adults in the household.
- A parent can view, change or delete a child's information at any time from People in the app, or by emailing us.
We use a child's information only to run Ourstead for their household. If we learn that a child's information reached us without a parent's involvement, we will delete it.
Keeping it secure
Ourstead encrypts information on its way between your device and our servers, and between our servers and the database. Passwords are stored only as one-way hashes. Database access is limited to the Ourstead app, and backups are encrypted before they leave our servers. No system is perfectly secure; if a breach affects your information, we will tell you promptly.
Your choices
- See and correct your information in the app at any time.
- Delete your account or your household in Settings.
- Disconnect a calendar in Settings.
- Ask for a copy of your information, or ask any privacy question, by email.
We answer requests within 30 days, usually much sooner.
Changes to this policy
If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect. The date at the top shows the latest version.
Contact
Ryan Wright, support@ourstead.casa, Kentucky, USA.