Privacy Policy

The short version

Who we are and what this policy covers

Your Hearth LLC ("Your Hearth," "we," "us") is a software company and a limited liability company registered in Illinois, United States. We publish this website at yourhearth.net and we are building applications for Apple devices.

We are the data controller for the personal information described in this policy, and the "business" or "controller" under US state privacy laws. We are a small company, so the person who decides how information is handled is the same person who reads your email.

This policy covers the website at yourhearth.net, the applications Your Hearth LLC publishes once they are released, and email correspondence with us.

We are developing two applications: Deja Dish, a meal-planning application, and a volunteer-scheduling application for organizations that run on volunteers. Neither is available yet, so where this policy describes our applications, it describes how we are building them.

This policy does not cover other websites you reach through links, or Apple's own practices. We have not appointed a data protection officer or a representative in the EU or UK. Privacy questions go to the email address in the Contact us section.

Information we collect

When you visit the website

Our website is a static brochure site. It sets no cookies, runs no analytics, and has no tracking pixels or advertising tags. It loads no third-party fonts, scripts or CDN resources; the one webfont we use is served from our own domain. There are no user accounts and no web forms. To contact us, you send an email.

Our hosting provider, Render Services, Inc. ("Render"), keeps standard server access logs. For each request to the site, those logs record:

• your IP address;
• the date and time of the request;
• the URL you requested;
• the HTTP status code returned;
• your user agent (the browser and operating system details your browser sends); and
• the referrer (the page that linked you to us), if your browser sends one.

An IP address can identify a person, so we treat these logs as personal information. We use them only for the purposes below, not to build visitor profiles.

When you use our applications

Neither application has been released, so this section describes our design approach rather than data we hold. Data you enter into an application is kept on your device by default, and we do not receive it. Our applications will not include advertising SDKs, third-party analytics SDKs, session-replay tools or device fingerprinting.

If a future application or feature needs an account, cloud sync or a backend, we will say so in the app itself and in its App Store privacy label, and we will update this policy before that version ships.

When you email us

If you email us, we receive your email address, the name shown on your message, the message itself, any attachments, standard headers such as the date and time, and anything else you choose to tell us. Please do not send government ID numbers, payment card numbers or other sensitive details. We never need them.

How we use information

We use personal information only for these purposes:

• Running and protecting the website. Server logs help us diagnose errors and spot abuse, such as floods of malicious requests.
• Answering you. We use your email address and message to reply to you, including on privacy requests. We do not use your address for anything unrelated to your message.
• Keeping records and meeting legal duties. We keep ordinary business records, respond to lawful requests, and protect our legal rights.

Legal bases for processing (EEA and UK)

If you are in the European Economic Area (EEA) or the United Kingdom, the GDPR and UK GDPR require us to have a legal basis for processing your personal information. Ours are:

Purpose	Legal basis
Serving the website, keeping server logs, and protecting the site from abuse	Legitimate interests: operating a working, secure website (Article 6(1)(f))
Answering your emails	Legitimate interests: responding to people who contact us (Article 6(1)(f)); or steps you ask us to take before entering a contract (Article 6(1)(b))
Keeping business records, responding to lawful requests, and handling your privacy requests	Legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f))
Any optional feature that depends on your permission, such as a device permission an application asks for	Consent (Article 6(1)(a)), which you can withdraw at any time

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see EEA and UK rights).

What we do not do

We do not:

• sell personal information;
• share personal information for cross-context behavioral advertising, under any definition in US state privacy law;
• use cookies, analytics, tracking pixels or advertising tags on our website;
• use advertising SDKs, third-party analytics SDKs, session-replay tools or device fingerprinting in our applications;
• use personal information for automated decision-making or profiling that produces legal or similarly significant effects;
• receive your payment card details; or
• knowingly collect personal information from children under 13.

Biometric information. We collect no biometric identifiers and no biometric information. As an Illinois company, we take the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14) seriously. We do not collect, capture, purchase, receive or otherwise obtain retina or iris scans, fingerprints, voiceprints, or scans of hand or face geometry. If that ever changed, we would first give the written notice and obtain the written release that BIPA requires.

Service providers

We use a small number of providers. We do not give personal information to anyone else, except where the law requires it or to protect our legal rights.

Render (website hosting)

Render Services, Inc. is a US hosting provider. It serves our website and therefore receives the request data described above: IP address, timestamp, requested URL, HTTP status, user agent and referrer. It keeps these as server access logs for operations, debugging and abuse prevention. Render acts as our service provider and processor, and its own privacy policy also applies.

Apple (app distribution and payments)

Our applications will be distributed through the Apple App Store. If any paid distribution takes place, Apple processes the transaction. We never receive payment card details, and Apple provides us only aggregate sales reporting. Apple handles your Apple Account and purchase information under its own privacy policy.

Email

The email service that hosts our mailbox stores and delivers our correspondence on our behalf.

How long we keep information

We keep personal information only as long as we need it for the purpose it was collected. In practice:

• Server logs. Render keeps them for as long as needed for operations, debugging and abuse prevention, and then removes them under its own retention schedule.
• Email. We keep correspondence for as long as needed to answer it and to maintain ordinary business records. If you ask us to delete a conversation, we will, unless we must keep it to meet a legal obligation or to resolve a dispute.
• Privacy requests. We keep a record of your request and our response for as long as needed to show we handled it properly.
• Application data. Data kept on your device is under your control, and deleting an application removes its data from the device. Device backups are managed by you and Apple.

Security

In practice:

• our website is served over HTTPS;
• we collect as little as we can, because data we never collect cannot be lost;
• our applications keep data on your device by default; and
• access to our email and to the hosting account is limited to the company principal.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. We make no claims here about formal certifications or audits; we would rather describe what we actually do. If a breach affects your personal information, we will give the notices the law requires.

Your rights and how to use them

Depending on where you live, you may have the right to access, correct or delete your personal information, to object to or restrict our use of it, to withdraw consent, and to opt out of sale or sharing. The sections on US state rights and EEA and UK rights give the details. Whatever your location, ask us and we will handle your request as described here.

How to ask. Email hello@yourhearth.net. Say what you want. There is no special form.

How we verify you. We will match your request to the email address you wrote from, and may reply to that address to confirm you control it. We will not ask for a government ID or for more personal information than we need. If we cannot verify you, we will tell you why. If you have only visited the website, note that our logs are held by Render and are not organized by person, so we may need your IP address and the approximate time of your visit to find your entries.

When we respond. We respond within 30 days. If the law allows more time and your request is complex, we may extend that period and will tell you why.

No charge, no retaliation. We do not charge a fee for requests, and we do not discriminate against you for exercising your rights. In the rare case that a request is manifestly unfounded or excessive, we may decline it and will explain our reasons.

US state privacy rights

California

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), California residents have the right to:

• know what personal information we collect, use and disclose;
• delete personal information we hold about them;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information;
• limit the use of sensitive personal information; and
• not be discriminated against for exercising these rights.

In the past 12 months, we collected identifiers (IP address, and an email address and name when you write to us), internet or network activity (the URL, user agent and referrer in server logs), and whatever else you put in an email. We collect it from you and your browser, use it for the purposes in this policy, and disclose it only to the service providers named above.

We do not sell or share personal information. We have not sold or shared personal information in the past 12 months, as "sell" and "share" are defined in the CCPA, and we do not knowingly sell or share the personal information of anyone under 16. There is nothing to opt out of. We do not collect sensitive personal information to infer characteristics about you, so there is nothing to limit. If you volunteer some in an email, we use it only to respond.

You may use an authorized agent to make a request for you. We will ask for written proof of authority and may contact you directly to confirm.

California's "Shine the Light" law (Civil Code section 1798.83) lets California residents ask which personal information a business has disclosed to third parties for their direct marketing. We make no such disclosures.

Illinois

We collect no biometric identifiers or biometric information, as explained under What we do not do. Under the Illinois Personal Information Protection Act (815 ILCS 530), if a breach of the security of our systems affects Illinois residents' personal information, we will notify those residents, and the Illinois Attorney General where required, in the most expedient time possible and without unreasonable delay.

Other states

Many other states have comprehensive privacy laws, including Colorado, Connecticut, Virginia, Texas, Utah, Oregon, Montana, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota and Maryland, with more taking effect over time. Residents generally have the right to confirm whether we process their personal information, to access, correct and delete it, to obtain a portable copy, and to opt out of targeted advertising, sale and profiling. We do not sell, target or profile, but you can still use the other rights.

If we refuse your request, or do not act on it, you may appeal. Email hello@yourhearth.net with the subject line "Appeal" and explain what you would like reconsidered. We will answer in writing within the time your state's law requires. If you are not satisfied, you may contact your state attorney general.

EEA and UK rights

If you are in the EEA or the UK, you have the following rights under the GDPR and UK GDPR:

• Access to your personal information and a copy of it;
• Rectification of inaccurate or incomplete information;
• Erasure where the law provides;
• Restriction of our processing where the law provides;
• Portability of the information you gave us, in a structured, commonly used format;
• Objection to processing based on our legitimate interests; and
• Withdrawal of consent at any time, where we rely on consent. Withdrawal does not affect earlier processing.

To use these rights, follow the steps in Your rights and how to use them. You also have the right to lodge a complaint with a supervisory authority. In the EEA, that is the authority in the country where you live or work, or where you believe a violation took place. In the UK, it is the Information Commissioner's Office (ICO), at ico.org.uk. You are welcome to contact us first, but you do not have to.

International transfers

Your Hearth LLC is based in the United States, and so is our hosting provider. When you visit our website or email us, your information is transferred to and processed in the United States, where data protection law differs from the law in the EEA and UK. We reduce the effect of this by collecting very little and keeping application data on your device. Where the GDPR or UK GDPR requires a basis for that transfer, we rely on the grounds those laws make available for a transfer of this kind, including the necessity of the transfer to respond to a request you initiated yourself. If we later add a service that requires standard contractual clauses or an equivalent safeguard, we will put one in place and update this policy before that service launches.

Children's privacy

Our website and applications are not directed to children under 13, and we do not knowingly collect personal information from them. We comply with the US Children's Online Privacy Protection Act (COPPA). Where your country sets a higher minimum age, up to 16, we do not knowingly collect your information without any consent the law requires.

Our applications are not submitted to the App Store Kids Category. Because the website has no forms or accounts, a child's information could reach us only by email. If you believe a child has sent us personal information, email hello@yourhearth.net. If we learn that we hold personal information from a child under 13, we will delete it promptly.

Apple and the App Store

When our applications are distributed through the Apple App Store, Apple handles the download, your Apple Account and any purchase. Apple processes payments, and we do not receive your payment card details. Apple gives us only aggregate sales reporting, and its own privacy policy governs what it does with your information.

Each application will have an App Store privacy label describing the data it collects, and the label will match this policy. If an application's data collection changes, we will update both.

An application may request certain device permissions, where a feature needs them. Examples are notifications and photo library access. These permissions are:

• optional. You can decline, and the rest of the application keeps working;
• purpose-limited. We ask only when a feature needs it, and use it only for that feature; and
• revocable. You can change or remove any permission at any time in iOS Settings.

Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track" signal. Our website does no cross-site tracking, so there is nothing for that signal to switch off.

Global Privacy Control (GPC) is a browser signal that tells a website you want to opt out of the sale or sharing of your personal information. We do not sell or share personal information, so there is nothing to opt out of. We honor GPC as a valid opt-out signal regardless.

Changes to this policy

We may revise this policy as our website, our applications or the law change. When we do, we will update the effective date at the top of this page. Before any application ships that needs an account, cloud sync or a backend, we will update this policy.

If we make a material change that affects people who already use our applications or have corresponded with us, we will give notice before it takes effect, in the application, on this website, or by email where we have your address. You can ask by email for an earlier version of this policy.

Contact us

For privacy questions, requests or complaints, email hello@yourhearth.net. This is our only contact address. If you need to write to us by post, ask by email and we will arrange it.

The rules for using our website and applications are in our Terms.