Privacy

Moss & Mortar is being built. This page says what the app stores today, and it is brought up to date each time that changes. It is a draft until the app opens to the public.

Signing in

You sign in with Google. Moss & Mortar asks Google only for your basic profile: your name, your email address and your profile picture. It cannot see your mail, files, calendar or contacts.

It keeps:

• your name and email address;
• the ID Google uses for your account, so it knows it is you next time.

It does not keep your Google profile picture, or any key that would let it act on your Google account.

Your household

For each household it keeps:

• the household’s name, whether its card shows a dog or a cat, and the name each person chose to go by;
• who is an owner and who is a member;
• the email address of anyone invited, until they join or the invitation is cancelled. An invitation that runs out unanswered or is cancelled is cleared within about a day. If the person inviting ticks the box to email it, and email is switched on for the site, the invitation is emailed to that address, once, saying who invited them and to which household. Otherwise nothing is sent to them;
• a short record of changes to the household, such as an invitation sent or a person removed.

Only the people in a household can see it. The app has no admin screen for looking into households. It never asks for a street address.

Your home

When you answer the home interview, the household keeps:

• the home’s name, which is the household’s, and its ZIP code, which sets the time zone and the seasons. Where the ZIP code cannot say which time zone, the one your phone or computer is set to is used, once, when you save that screen;
• your answers about the home: its age and size, its roof, walls and garage, its heating and hot water, its plumbing, where its water comes from and where its drains go, and its yard;
• when you say each job was last done;
• the log: each job marked done, its date, who did it, and any cost, company name and notes you add;
• jobs you snoozed or marked as not applying to your home;
• any photo you add to a log entry. Before a photo is stored, everything in the file that is not the picture is removed: where and when it was taken, the camera, and any names. Photos are kept privately and shown only to the people in your household. Deleting the entry, the photo or the household deletes the photo.

Each person’s own answers (how comfortable they are with ladders, plumbing and electrical jobs, which tools they have, and which home repair book they have, if any) are kept with their place in the household.

The interview asks for a ZIP code, never a street address. Please leave your address out of the home’s name and notes.

The story of your home

If an owner brings in a story, the household keeps:

• the story’s chapters, as the file gave them, with the notes for editors that the app never shows;
• any picture put in a chapter’s frame, handled like every other photo: stripped of where and when it was taken, kept privately, shown only to the household;
• entries people added to “Our chapter” before that was taken out of the app, if any: a date, a line or two, and who wrote it.

A story file is read on your own device first, so you can look it over. It is sent only when you press Save. A story belongs to its household alone and is never used anywhere else.

When Claude writes or reshapes a story

An owner can ask Claude, the AI made by Anthropic, to write a draft of the home’s story. Nothing is sent to Anthropic unless an owner asks.

• A deep dive sends Anthropic the street address the owner types, the home’s ZIP code, and the line about the home that the app shows (such as “Detached house, built 1924”). Claude searches the web and reads public pages to research it. Moss & Mortar does not store the address anywhere: not in its database, not in its logs.
• Reshaping a document sends Anthropic the words of the document the owner chooses. The app keeps those words only until the draft is checked against them, then deletes them.
• The app keeps the draft, already checked, until an owner saves it as the story or sets it aside, and a record that a draft was made for a month after, so the monthly limit holds. It also keeps the ID of the Claude session while Claude works. Once the draft is collected, usually within the hour, the app asks Anthropic to delete the session and everything in it, the address included.
• Old photos Claude finds are copied in only when their archive says they are free to use, and only when an owner saves the draft. They are handled like every other photo, and shown with the credit their archive asks for.
• If the owner asks to be told when the draft is ready, the app sends them one notification where they turned notifications on, or else one email. It says only that the draft is ready, or did not work out: nothing about the home.

Anthropic handles what it is sent under its own terms. See Anthropic’s privacy policy.

Reminders

Reminders are off until you turn them on, and each person chooses their own. If you do, the app keeps:

• your choices: email, push or both, how far ahead to nudge you, and your quiet hours;
• for push, the address and keys your browser hands over so a message can reach that phone or computer. They are removed when you sign out on that device, when the device stops accepting messages, or when you delete your account;
• a list of the reminders it has sent you (which job, and on which day), so the same one is never sent twice. Lines are removed after about 13 months, and at once if you leave the household.

Email reminders go to the address you sign in with, through Cloudflare’s email service. Every one has a link that stops them, which works without signing in.

A push reminder travels through the notification service of whoever makes your browser (Apple, Google, Mozilla or Microsoft). It is encrypted so that only your device can read it. It names the job, such as “Clean the gutters”, and never your household, your home or anything you typed.

Feedback

If you send feedback (with the button in Household and settings), your note is emailed to the person who makes Moss & Mortar, with the address of the page you were on, your kind of device in a word (such as “Android”), and your name and email address, so she can write back. The app keeps no copy, and the email holds nothing about your household or your home beyond what you write.

On your device

• A cookie that keeps you signed in. Scripts on the page cannot read it, and no other website receives it.
• A cookie that remembers which household you were looking at.
• If you choose to look around before finishing the home interview, a cookie that says so for 12 hours, so the app does not send you back to the interview in the meantime. It holds nothing else.
• A note of when the app last renewed your sign-in, so it asks about once a day.
• While you fill in a screen of the home interview, your answers on that screen are kept in the browser tab until you tap to go on, so a reload does not lose them. They are removed when the screen is saved, when the tab is closed, and when you sign out.
• If you follow an invitation link before signing in, the invitation is held in that browser tab until you have signed in.
• A copy of the app’s own pictures, fonts and its “you are offline” page, kept from your first visit so the app can open without a connection. It holds nothing about you or your home.
• A copy of your Story page as you last saw it, so the Story opens without a connection. It is removed when you sign out, and whenever the sign-in page is opened on that device. Uploaded pictures are not kept.
• For a few minutes while you sign in, a cookie that ties the sign-in to your browser.
• If you turn on push, your browser remembers that this site may show notifications. You can take that back in the browser’s settings at any time.

To keep the service safe

• To slow down abuse, Cloudflare counts recent sign-in requests from each network address for a few seconds. The app’s own database never holds your network address.
• Cloudflare, which hosts the app, keeps a technical log of requests (which page, when) for a short time.

What it does not do

No advertising, no analytics, no tracking, and nothing is sold. The only others involved are Cloudflare, which hosts the app and sends its email, Google, for signing in, the notification service of your browser’s maker, if you turn on push, Anthropic, only when an owner asks Claude to write or reshape the story, and YouTube, only when you tap play on a how-to video: the video then loads from youtube-nocookie.com, which sees that request like any website would. Nothing loads from YouTube before you tap.

Taking your data with you

An owner can download everything the household has stored as one file, from the Reminders and household page: the home’s answers, the log and the story. Anyone in the household can download the log as a spreadsheet file from the Log screen. Neither file holds anyone’s email address.

Leaving

You can delete your account from the Reminders and household page. That removes your sign-in, your reminder choices and devices, and your place in every household. A household you were the only owner of is deleted with everything in it. Households you leave keep what you logged there, without your name, and a note that a member left.

Questions

A contact address will be listed here before the app opens to the public.