Privacy

Moss & Mortar is being built. This page says what the app stores today, and it is brought up to date each time that changes. It is a draft until the app opens to the public.

Signing in

You sign in with Google. Moss & Mortar asks Google only for your basic profile: your name, your email address and your profile picture. It cannot see your mail, files, calendar or contacts.

It keeps:

• your name and email address;
• the ID Google uses for your account, so it knows it is you next time.

It does not keep your Google profile picture, or any key that would let it act on your Google account.

Your household

For each household it keeps:

• the household’s name and the name each person chose to go by;
• who is an owner and who is a member;
• the email address of anyone invited, until they join or the invitation is cancelled. An invitation that runs out unanswered or is cancelled is cleared within about a day. Where email is switched on for the site, the invitation is emailed to that address, once, saying who invited them and to which household;
• a short record of changes to the household, such as an invitation sent or a person removed.

Only the people in a household can see it. The app has no admin screen for looking into households. It never asks for a street address.

Your home

When you answer the home interview, the household keeps:

• a nickname for the home and its ZIP code, which sets the time zone and the seasons;
• your answers about the home: its age and size, its roof, walls, heating, hot water, plumbing and yard;
• when you say each job was last done;
• the log: each job marked done, its date, who did it, and any cost, company name and notes you add;
• jobs you snoozed or marked as not applying to your home;
• any photo you add to a log entry. Before a photo is stored, everything in the file that is not the picture is removed: where and when it was taken, the camera, and any names. Photos are kept privately and shown only to the people in your household. Deleting the entry, the photo or the household deletes the photo.

Each person’s own answers (how comfortable they are with ladders, plumbing and electrical jobs, which tools they have, and whether they have the book) are kept with their place in the household.

The interview asks for a ZIP code, never a street address. Please leave your address out of nicknames and notes.

The story of your home

If an owner imports a story, or anyone adds to “Our chapter”, the household keeps:

• the story’s chapters, as the file gave them, with the notes for editors that the app never shows;
• what each person adds to “Our chapter”: a date, a line or two, and who wrote it;
• any picture put in a chapter’s frame or on an entry, handled like every other photo: stripped of where and when it was taken, kept privately, shown only to the household.

A story file is read on your own device first, so you can look it over. It is sent only when you press Save. A story belongs to its household alone and is never used anywhere else.

Reminders

Reminders are off until you turn them on, and each person chooses their own. If you do, the app keeps:

• your choices: email, push or both, how far ahead to nudge you, and your quiet hours;
• for push, the address and keys your browser hands over so a message can reach that phone or computer. They are removed when you sign out on that device, when the device stops accepting messages, or when you delete your account;
• a list of the reminders it has sent you (which job, and on which day), so the same one is never sent twice. Lines are removed after about 13 months, and at once if you leave the household.

Email reminders go to the address you sign in with, through Cloudflare’s email service. Every one has a link that stops them, which works without signing in.

A push reminder travels through the notification service of whoever makes your browser (Apple, Google, Mozilla or Microsoft). It is encrypted so that only your device can read it. It names the job, such as “Clean the gutters”, and never your household, your home or anything you typed.

On your device

• A cookie that keeps you signed in. Scripts on the page cannot read it, and no other website receives it.
• A cookie that remembers which household you were looking at.
• A note of when the app last renewed your sign-in, so it asks about once a day.
• If you follow an invitation link before signing in, the invitation is held in that browser tab until you have signed in.
• A copy of the app’s own pictures, fonts and its “you are offline” page, kept from your first visit so the app can open without a connection. It holds nothing about you or your home.
• A copy of your Story page as you last saw it, so the Story opens without a connection. It is removed when you sign out, and whenever the sign-in page is opened on that device. Uploaded pictures are not kept.
• For a few minutes while you sign in, a cookie that ties the sign-in to your browser.
• If you turn on push, your browser remembers that this site may show notifications. You can take that back in the browser’s settings at any time.

To keep the service safe

• To slow down abuse, Cloudflare counts recent sign-in requests from each network address for a few seconds. The app’s own database never holds your network address.
• Cloudflare, which hosts the app, keeps a technical log of requests (which page, when) for a short time.

What it does not do

No advertising, no analytics, no tracking, and nothing is sold. The only others involved are Cloudflare, which hosts the app and sends its email, Google, for signing in, and the notification service of your browser’s maker, if you turn on push.

Taking your data with you

An owner can download everything the household has stored as one file, from the Reminders and household page: the home’s answers, the log and the story. Anyone in the household can download the log as a spreadsheet file from the Log screen. Neither file holds anyone’s email address.

Leaving

You can delete your account from the Reminders and household page. That removes your sign-in, your reminder choices and devices, and your place in every household. A household you were the only owner of is deleted with everything in it. Households you leave keep what you logged there, without your name, and a note that a member left.

Questions

A contact address will be listed here before the app opens to the public.