Privacy and responsible use

Homestead holds personal information about people you love, most of whom never asked to be in anyone’s app. These are the rules it follows, from docs/11-security-privacy.md.

Principles

No platform credentials in Homestead. Logins to Instagram, Douyin and the rest live only in your agent’s browser profile, or your own Firefox, on your own machine.
Only what you can already see. Agents fetch with your own session and never bypass privacy settings, blocks, paywalls or bot checks.
Local by default. Data stays on your household’s server. No telemetry, no analytics, no third-party scripts, no remote fonts.
Least privilege. Roles for members, scopes for agents, short-lived signed media URLs.

What’s stored

Names and notes your household writes.
Public profile links.
Moments that were fetched: their text, and copies of their media when “Keep copies of photos and videos” is on (it is by default).
Seen and visit history, per member.

Everything sits in one data folder: homestead.db, media/ and secret.key.

How long it’s kept

What	Default
Stories	7 days
Posts	60 days
Seen and visit history	180 days
A removed person	30 days of undo, then their accounts, moments and media are deleted
Companion captures	Until the disk quota (20 GB), oldest deleted first

The owner can change story and post retention in the source settings.

Export and delete

Export everything: homestead backup writes one archive. See Backup and restore.
Export a circle: download it as a .homestead.json file from its share page. Available on main (W-07)
Delete a person: remove them; after the 30-day undo window everything about them goes.
Delete the household: delete its Docker volume.

The people you follow

Family members and friends you add never consented to being in someone’s Homestead. The design keeps this respectful:

Their content isn’t re-shared. Share links carry only names and public profile links, never posts or stories.
Relation labels and notes are left out of share links unless you include them.
There are no public pages of anyone’s moments.

Homestead isn’t designed for children’s accounts. Please don’t add minors’ accounts from platforms that restrict them.

Platform terms and agents

Many platforms forbid automated access in their terms of service. Homestead keeps the risk low and leaves the choice with you:

Agent fetching is off until you connect an agent, and each token lists the platforms it may fetch.
Defaults are conservative: every 3 hours, at most 30 fetches per platform per hour, at least 20 seconds between profiles, and stop at the first challenge.
Agents never solve captchas, rotate IPs, spoof devices or use stolen sessions.
The server tier only uses public, documented APIs: the Bluesky AppView, Mastodon-compatible endpoints for Truth Social, and the X API with your own key.

The companion and AI

The extension only captures exact matches for people you follow, on platforms you turned on. It never asks for all sites and never runs in private windows. It strips form values and editable text before sending a page.
The helper only reads Firefox’s cache folder, only for the platform’s media hosts, and only uploads to the server address pinned at install.
AI extraction is off until the owner adds an OpenRouter key. When on, page text, page images and a screenshot are sent to the model, and routing excludes providers that collect data.
The model only returns IDs the server issued, so it can’t add links or code. Summaries are plain text, short, with links stripped, and labelled “AI”.

Update circle opens pages for you, so it carries the same notice as agents.

Secrets

Agent tokens are shown once and stored only as SHA-256 hashes. Their hst_ prefix lets secret scanners spot a leaked one.
The X API key (and later the OpenRouter key) is encrypted with AES-256-GCM using secret.key.
secret.key and the database are written with 0600 permissions. Full-disk encryption on the server is recommended.