Privacy Policy

Information we collect

• Account: your email address, used for passwordless sign-in (a one-time link and 6-digit code) and account-related messages. We never ask for a password.
• Association profiles & documents: the community details you enter and the documents you generate and edit, stored so your archive works across your devices.
• Generation inputs:the form fields you submit are sent to OpenAI's API to draft your document (see processors below).
• Mobile device data:for the app, a secure sign-in token is stored on your device, along with a device label (e.g. "Pixel 7") and coarse session info so you can review and sign out your devices. If you enable notifications, we use a push token to deliver them.
• Walk-through photos (app): photos you take in the app to jog your memory stay on your device only — they are not uploaded to our servers.
• Usage & diagnostics: first-party, cookie-light page counts (path, referrer, campaign) and basic error logs to keep the service reliable. No third-party ad trackers, no data brokers.
• Payments: handled entirely by our merchant of record; we never see or store card numbers.

How we use your information

• To provide the service: sign you in, generate and store your documents, and sync your archive.
• To operate reliably: prevent abuse, enforce fair-use limits, and fix errors.
• To communicate: sign-in codes, receipts, and (only if you opt in) notifications.

We do notsell your personal information, and we do not use your documents to train our own models or to market to your community's homeowners.

Service providers we share data with

We use a small set of vetted processors, each only for its stated purpose:

• OpenAI— generates document drafts from your form inputs. API inputs are not used to train OpenAI's models.
• Resend — delivers sign-in and account emails.
• Lemon Squeezy — processes subscription payments as merchant of record.
• Google Firebase Cloud Messaging— delivers push notifications to the Android app when you enable them (uses a device push token; no message content is stored by us beyond what's needed to send it).
• Hosting infrastructure — runs our servers and database.

Data retention & deletion

We keep your account and content until you delete them or ask us to. You can delete individual documents in the app or on the web at any time. To delete your entire account and associated data, email support@hoaboardstudio.comand we'll remove it within 30 days (excluding records we must retain for legal or accounting reasons, such as payment history).

Security

Traffic is encrypted with TLS. On mobile, your sign-in token is kept in the device's encrypted storage and is excluded from backups; you can revoke any device from Settings, and we can revoke a lost device's access server-side.

Your rights

Depending on where you live (e.g. the EU/UK under GDPR, or California under the CCPA/CPRA), you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. To exercise any of these, email support@hoaboardstudio.com. We will not discriminate against you for exercising these rights.

Children

HOA Board Studio is a tool for HOA boards and is not directed to children under 13, and we do not knowingly collect their personal information.

Changes to this policy

We'll update this page when our practices change and revise the date below. Material changes will be announced in-app or by email.

Contact

Questions about privacy? Email support@hoaboardstudio.com.