Dwellera policies

Privacy Policy

This policy explains what information Dwellera collects, how we use and share it, how long we may keep it, what choices you have, and how to contact us about privacy.

Effective date: September 29, 2026

Dwellera is designed to help people organize information about their homes, including property details, systems and appliances, maintenance history, reminders, documents, photos, and related records.

This policy applies to the Dwellera website and authenticated Dwellera service.

1. Information Dwellera collects

What Dwellera collects depends on how you use the service.

Account and authentication information

Dwellera uses Auth0 to provide authentication and identity management.

Account and authentication information may include:

your name;
your email address;
authentication identifiers;
authentication and session information; and
other information necessary to create, secure, and maintain your Dwellera account.

Dwellera does not use Auth0 to store ordinary homeowner property records.

Home and household information

When you use Dwellera, you may provide information about your home and its contents, including:

home names and addresses;
property details;
systems and appliances;
manufacturer, model, and serial-number information;
purchase, installation, and warranty information;
service and maintenance history;
service-provider information;
maintenance reminders;
notes; and
other information you choose to record about your home.

Documents & photos

You may upload private documents and photos to Dwellera.

These may include:

receipts and invoices;
manuals;
inspection or service reports;
permits;
insurance-related documents;
photographs; and
other records you choose to upload.

Because users control what they upload, these files may contain personal or sensitive information selected by the user.

Notification information

If you use Dwellera features that send email notifications or reminders, Dwellera processes information necessary to deliver those messages, including:

the recipient email address;
the content of the transactional or reminder message; and
delivery-related information.

Billing and payment information

Dwellera uses Stripe for paid subscriptions. Payment-card information is processed through Stripe-hosted interfaces, and Dwellera does not store full payment-card numbers.

Dwellera may retain limited billing and transaction information from Stripe, including provider identifiers, billing details, payment status, refunds and disputes, receipt availability, and information needed to reconcile billing with account access.

Operational and security information

Dwellera may create or process limited operational and security information necessary to operate and protect the service.

This may include information used to:

maintain account and authorization state;
deliver notifications;
diagnose errors and service failures;
prevent unauthorized access or abuse;
enforce rate limits;
process account deletion;
recover safely from incomplete deletion operations;
investigate security incidents; and
support backup and disaster-recovery processes.

Dwellera does not intentionally maintain a broad behavioral history of every page view, search, download, or ordinary edit merely for tracking purposes.

2. How Dwellera uses information

Dwellera uses information reasonably necessary to:

provide and operate Dwellera features;
authenticate users and maintain account sessions;
store and display home records;
store and provide access to documents and photos;
send requested transactional and reminder emails;
create supported home-data exports;
maintain archived-home history;
provide support;
process paid subscriptions and billing;
reconcile payments, refunds, disputes, cancellations, and account access;
provide billing history and access to Stripe-hosted receipts;
protect users and the service;
detect, investigate, and resolve technical or security problems;
process permanent account deletion;
maintain reliable backups and disaster-recovery capabilities; and
comply with applicable legal obligations.

Dwellera aims to collect and keep only the information reasonably needed for these purposes.

3. Cookies and similar technologies

Dwellera uses cookies that are necessary for authentication and session management.

Auth0 authentication may use:

authentication and session cookies; and
temporary authentication-transaction cookies used during sign-in and related authentication flows.

These cookies are necessary to provide secure account access and authentication functionality.

Dwellera does not use cookies or browser storage for advertising or behavioral advertising.

Dwellera uses a self-hosted, cookieless analytics service on its public website. This service does not use cookies, Local Storage, Session Storage, or IndexedDB for analytics.

Because the analytics service is loaded only on public pages, Dwellera does not intentionally associate public-site analytics events with authenticated account identity or private home information.

Dwellera currently does not display a cookie-consent banner because its only cookies are necessary authentication cookies and its analytics configuration is cookieless. Dwellera will reevaluate this approach if its technologies or legal obligations change.

4. How Dwellera shares information

Dwellera does not sell user-provided home information.

Dwellera may disclose information in the limited circumstances described below.

Service providers

Dwellera relies on service providers to operate portions of the service. Dwellera seeks to limit the information and access provided to these services to what is reasonably necessary for their functions.

Current relevant providers include:

Auth0, for authentication and identity management;
Google, for social authentication when a user chooses Google sign-in;
RackNerd, which provides the VPS infrastructure hosting the Dwellera application, database, and private uploaded-file storage;
Backblaze B2, which stores encrypted off-site disaster-recovery backups;
Resend, which processes recipient email addresses and message content needed to deliver transactional and reminder email;
Stripe, for payment processing and subscription billing; and
Porkbun, which provides domain, DNS, and hosted email services used for Dwellera business and support communications.

When a user chooses Google sign-in, Google provides basic identity/profile information to Dwellera through Auth0. Dwellera does not send ordinary homeowner property records to Google as part of that authentication flow.

Dwellera also uses infrastructure and development services that do not intentionally receive ordinary homeowner records as part of their normal function.

Access authorized by users

Where Dwellera allows you to grant another person access to a home, that person may be able to view or work with home information according to the access level granted to them.

You are responsible for considering what information is stored in a home before granting another person access.

Revoking access prevents future access through Dwellera, but it cannot erase copies that another authorized person previously downloaded, exported, photographed, copied, or otherwise retained outside Dwellera.

Legal, safety, and security disclosures

Dwellera may disclose information when:

you direct or authorize the disclosure;
disclosure is reasonably necessary to provide the service through an approved service provider;
Dwellera reasonably believes disclosure is required by law or valid legal process; or
disclosure is reasonably necessary to protect Dwellera, its users, or others from fraud, abuse, security threats, or unlawful activity.

Dwellera seeks to disclose only information reasonably necessary for the applicable purpose.

5. User-provided content

You retain your rights in the home information, documents, photographs, and other content you provide to Dwellera.

Dwellera does not claim ownership of your user-provided content.

You provide Dwellera only the rights reasonably necessary to host, store, process, display, secure, back up, export, and otherwise handle that content as needed to provide and operate the service.

Additional responsibilities relating to user content are addressed in the Dwellera Terms of Service.

6. Your choices and controls

Dwellera is designed to provide practical control over your information.

Depending on the applicable feature, you may be able to:

add, update, or remove home information;
archive a former home while preserving its history;
delete supported records and uploaded files;
export supported active-home information in JSON or PDF format;
manage account settings; and
permanently delete your Dwellera account.

Some information may need to be retained for limited security, deletion-integrity, operational, backup, or legal purposes as described below.

7. Data retention

Dwellera retains information only as long as reasonably necessary for the purpose for which it is maintained.

Active accounts and home information

Account and active-home information may be retained while necessary to provide the Dwellera service.

Archived homes

Archived-home history may remain associated with your account while the account is active unless that information is removed through an applicable deletion workflow.

Uploaded files

Uploaded files may be retained while their associated Dwellera records remain valid and the files have not been deleted through an applicable workflow.

Local backups

Dwellera maintains local PostgreSQL database and private-file backups for operational recovery.

These local backups use a 30-day retention period.

Encrypted off-site backups

Dwellera also maintains encrypted off-site backups for disaster recovery.

Dwellera currently retains:

30 daily backup snapshots;
6 monthly backup snapshots; and
no yearly backup snapshots.

Backup snapshots may temporarily contain information that has since been deleted from the live service. Deleted information expires from backups as the applicable snapshots age out of the retention schedule.

Dwellera does not ordinarily restore intentionally deleted account information merely because an older backup contains a copy.

Account-deletion records

Dwellera maintains limited records necessary to safely complete and verify permanent account deletion.

A deletion operation that is incomplete or has encountered an error may remain recorded until the deletion is successfully completed or the problem is otherwise resolved.

After account deletion is fully completed, the associated deletion tombstone is retained for 24 months. This limited record supports deletion integrity, recovery safety, and investigation of deletion failures or disputes.

Dwellera may also maintain limited deletion-integrity information necessary to prevent intentionally deleted accounts from being unintentionally restored during disaster recovery.

Billing records

Dwellera may retain billing and transaction records necessary to administer subscriptions, reconcile payments, handle refunds or disputes, maintain accounting records, prevent fraud or abuse, and comply with applicable legal obligations. Stripe may retain information according to its own legal, regulatory, contractual, and operational requirements.

Operational and security records

Ordinary production application, security, diagnostic, delivery, and operational logs are normally retained for no more than 30 days.

Information formally preserved as part of a security-incident investigation may be retained for up to 12 months after the investigation is closed when reasonably necessary for security, follow-up, or documented legal obligations.

Certain service providers may maintain their own operational records according to their applicable service terms and retention practices.

8. Permanent account deletion

Dwellera provides a permanent account-deletion process within the authenticated service.

Permanent account deletion requires recent authentication and explicit confirmation before destructive processing begins.

When a normal account deletion completes successfully, Dwellera removes the account's eligible Dwellera records and private uploaded files and deletes the associated Auth0 identity.

After deletion is fully complete, you may register for Dwellera again using the same email address. Depending on the identity provider, the new sign-in identity may also use the same provider identifier. Any later registration creates a new, empty account and does not restore or reconnect the deleted account's homes, relationships, history, files, or other information.

Deletion may involve multiple systems. If part of the process fails after other information has already been deleted, Dwellera may retain limited deletion state necessary to safely complete or recover the deletion.

Deletion from the active service does not mean that every historical backup copy disappears immediately. Older backup copies expire according to the backup-retention schedules described in this policy.

Dwellera's disaster-recovery processes are designed not to intentionally reactivate account data that a user previously deleted.

9. Security

Dwellera uses administrative, technical, and operational measures intended to protect user information.

Depending on the system or data involved, these measures include:

HTTPS for browser connections;
authenticated access to private Dwellera features;
authorization controls for protected home information;
secure and HTTP-only authentication cookies;
private uploaded-file storage;
file-type and file-signature validation;
malware scanning of uploaded files before they are made available;
security-related HTTP headers;
rate limiting for selected higher-risk operations;
restricted administrative access;
multi-factor authentication on selected infrastructure-provider accounts;
private backup storage; and
encryption of off-site Restic backups before they are stored with Backblaze B2.

No security system can guarantee absolute protection.

Dwellera does not claim that all production information is encrypted at rest. Encryption and other safeguards vary depending on the system, storage layer, and information involved.

Dwellera describes its security safeguards according to the protections actually implemented rather than promising complete or absolute security.

10. Administrative access

Technical operation of Dwellera may make it possible for authorized Dwellera personnel to access private information in some circumstances.

Dwellera personnel should access private user information only when reasonably necessary for purposes such as:

providing user-requested support;
investigating service failures;
resolving account-deletion failures;
maintaining service security;
responding to abuse;
performing disaster recovery; or
complying with applicable legal obligations.

Administrative access should use the least privilege reasonably appropriate for the task.

11. Error tracking and analytics

Dwellera uses a self-hosted instance of Umami to understand aggregate traffic and engagement on the public Dwellera website. Umami is configured without cookies and is not used for advertising or cross-site behavioral profiling.

The analytics service may process limited technical and usage information needed to produce aggregate reports, such as the page visited, referring page, browser or device characteristics, and request-related information used to estimate general traffic patterns.

The analytics script is not loaded on authenticated Dwellera application pages. Dwellera does not intentionally send account identifiers, home records, documents, photos, or private application content to Umami.

Dwellera also does not currently operate Sentry as an active production data processor because production Sentry reporting is disabled. Dwellera does not currently use Session Replay, behavioral advertising, or profiling.

12. Children's privacy

Dwellera is intended for adults managing home and household information and is not designed or directed as a service for children.

Dwellera account holders must meet the eligibility requirements stated in the Terms of Service.

If Dwellera learns that an account was created or personal information was provided in violation of those eligibility requirements, Dwellera may take appropriate steps to close the account and remove the information, subject to applicable legal and operational requirements.

13. Changes to this Privacy Policy

Dwellera may update this Privacy Policy when the service, its data practices, service providers, legal obligations, or other relevant circumstances change.

Material changes to areas such as authentication, sharing, billing, integrations, file storage, telemetry, advertising, analytics, backup infrastructure, deletion behavior, or Dwellera's legal structure will require reevaluation of the affected privacy disclosures.

The effective date at the top of this policy will be updated when a revised policy becomes effective.

When appropriate, Dwellera may provide additional notice of material changes through the service or another reasonable communication method.

14. Contact Dwellera

For privacy questions or requests, contact:

privacy@dwellera.co

For general support:

support@dwellera.co

For security-related reports:

security@dwellera.co