Privacy Policy

1. Who is responsible

Hi, Alf! (the hialf.com website, the app.hialf.com web app and the iOS and Android apps) is run by Luis Pérez, an individual based in Brazil, who is the data controller under Brazil's General Data Protection Law (LGPD, Law 13,709/2018). For any privacy matter, contact support@hialf.com.

2. What data we process

• Account: name, email, password (stored only as a hash), language and time zone. If you sign in with Google or Apple, we receive your identifier, name and email from them.
• Household data you enter: family members (name, date of birth, adult or child), pets, properties, tasks and routines, home maintenance, shopping list, wish list, recipes, meal plans, food profiles (restrictions and allergies) and trips (destination, dates, who is going, bookings and confirmation codes).
• Health data: appointments, vaccines, medications, questions for the doctor and their answers, and any medical documents you attach. This is sensitive data under the LGPD.
• Documents and files you upload (photos, PDFs, etc.).
• Usage and device: a device identifier for notifications, IP address (for security and rate limiting), technical error logs and app usage events (which screens and features are used).
• Support: the messages you send us through support or by email.

We do not collect your location, your contacts or payment data.

3. Why we use it, and on what legal basis

• To provide the service you asked for: store and show your household information, send reminders and the daily summary, and share the household with people you invite (performance of a contract, LGPD art. 7, V).
• Health data and children's data are processed only for the purpose you chose when entering them, with your consent as the data subject or as the legal guardian (art. 11, I, and art. 14). You can delete them at any time.
• Emails and notifications: daily summary, task reminders, trip reminders and doctor's answers. You can turn each one on or off under Notifications.
• Security and abuse prevention: protecting accounts, limiting attempts and investigating failures (legitimate interest, art. 7, IX).
• Improving the app with usage statistics (legitimate interest).
• Complying with legal obligations when they apply (art. 7, II).

We do not sell your data, we do not show ads, and we do not use your data for advertising.

4. Who we share it with

Only with those needed to run the app, and only for that purpose:

• Amazon Web Services (AWS): hosting, database and file storage (United States).
• Twilio SendGrid: sending emails (United States).
• Apple (APNs) and Google (Firebase Cloud Messaging): delivering phone notifications; they receive the notification content.
• PostHog: usage statistics for the website and the app (United States).
• Google and Apple: if you choose to sign in with those accounts.
• People in your household: those you invite see the shared household data; documents marked as private are visible only to the people you choose.
• Your doctor, if you want: when you create the 24-hour link for an appointment, anyone with the link sees only the questions for that appointment (no patient name or other data) and can answer them.
• Authorities: when required by law or court order.

5. International transfers

Our servers and some providers are in the United States. Transfers happen to provide the service you signed up for, with providers that adopt data protection safeguards compatible with the LGPD (art. 33).

6. How long we keep it

For as long as your account exists. When you delete a record, it leaves the app immediately. When you delete your account, we erase the data within 30 days; automatic backups, where they exist, are discarded within 35 days. We may keep the minimum necessary for longer only to comply with a legal obligation.

7. Your rights

Under the LGPD (art. 18) you can: confirm whether we process your data and access it; correct incomplete or wrong data; request anonymization, blocking or deletion; request portability; learn who we share it with; withdraw consent; and object to processing. You can do much of this in the app itself (edit and delete). For anything else, write to support@hialf.com; we reply within 15 days. You may also file a complaint with Brazil's National Data Protection Authority (ANPD) or your local data protection authority.

8. How to delete your account

In the app, go to Account → Delete my account (on the web at app.hialf.com and in the iOS and Android apps). If you prefer, ask by email at support@hialf.com, from your account's email address.

When you delete it, we erase your account (name, email, password, preferences, devices and sessions). If you are the only person with an account in the household, the household and everything in it (members, pets, health, documents, tasks, trips, etc.) are also erased. If other people with accounts share the household, it stays for them, and your member profile becomes a member without an account, which they can edit or remove.

9. Children

Hi, Alf! is for people aged 18 and over. Children's data is only entered when a parent or guardian adds it to care for the family (vaccines, appointments, routine), with their consent, and they can delete it at any time.

10. Security

All communication is encrypted (HTTPS). Passwords are stored as hashes. Files are kept in private storage and opened only through temporary links. Access to our systems is restricted. No system is 100% secure; if an incident may put you at risk, we will notify you and the ANPD.

11. Cookies and on-device storage

The app uses a session cookie, needed to keep you signed in, and stores preferences such as language and the active household in your browser or device. The website stores your chosen language. Both use PostHog for usage statistics.

12. Changes to this policy

If we change something important, we will let you know in the app or by email before it takes effect. The date at the top shows the current version.