Privacy

Privacy policy

Last updated July 26, 2026

Home Handoff keeps a private record of a property: what is installed in it, what has been done to it, who has worked on it, and the documents that prove it. That record is personal information about a home and the people connected to it, and this policy sets out exactly what we hold, who else touches it, and what you can ask us to do with it.

The service is operated by Werner Harmonic Labs LLC, Woodland Hills, California. For anything in this policy, write to wernersantos@wernerharmoniclabs.com.

What we collect

Your account. Your email address, and a password we never see in readable form. If you sign in with Google we receive your email address, name, and profile image from Google, and no password at all.

The property record. The address, and whatever you choose to add: systems and appliances, maintenance history, scheduled work, documents and images you upload, inventory, and the trades you use, which usually includes their business name and phone number. Some of that is personal information about other people, and you should only add it where you are entitled to.

Connected home credentials. If you connect a Home Assistant instance, we store its address and an access token, encrypted with AES-256-GCM. That token can read the state of devices in your home, and depending on your own setup it may be capable of operating them, including locks. We treat it as the most sensitive value in the system: it is never returned to a browser, never exposed to other members of your home, and is readable only by our server. You can remove the connection at any time, which deletes the stored token.

Vessels, for Marine OS and Yacht Passport.Where a marine service company uses the product, we hold the vessel and berth details, the inspections carried out, the findings and notes recorded against them, photographs taken during a visit, and the owner's email address so the owner can reach their own record.

Enquiries. If you contact us through the site we keep your name, email, what you told us, and the browser user-agent string that came with the request.

Operational records. An audit trail of significant actions taken on a property record, and ordinary server logs needed to run and secure the service.

Who else processes it

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We use the following processors, and no others:

Artificial intelligence

Astra answers questions about a property from that property's own record. To do that, the relevant entries, systems, maintenance, vendors including their phone numbers, and document titles and summaries: are sent to OpenAI along with your question. When you ask us to read a document you have uploaded, the file itself is sent to OpenAI so its contents can be summarised.

We instruct OpenAI not to retain those requests, and your private records are not used to train public models. Astra is grounded: it is told to answer only from the supplied record and to say when something is not in it. Even so, it is software, and its output is not inspection, legal, insurance, emergency, or licensed-trade advice.

If you would rather nothing left our systems, do not use Astra and do not use document extraction. The rest of the product works without them.

Who can see a record

A property record is private to its members. Access is enforced in the database itself rather than only in the interface, so a member of one home cannot reach another, and a signed-out visitor cannot reach any.

In Marine OS, a service company sees its own fleet and nothing else. A boat owner sees their own vessel, and only the visits their service company has chosen to publish, work in progress is not visible to them.

When a home is transferred, the previous owner's access ends and the incoming owner's begins. Anyone the owner has invited keeps only the access the owner gave them.

Retention and deletion

We keep a record while it is in use. You can ask us to export or delete your data by writing to wernersantos@wernerharmoniclabs.com, and we will respond within 45 days. Some audit entries documenting security or ownership events are kept where we need them to show what happened and when.

If you are in California

California residents have the right to know what personal information we hold and where it came from, to have it corrected or deleted, to receive a portable copy, and not to be treated worse for exercising any of those rights. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of, but you may still ask us to confirm that. Requests go to the address above.

Security, and its limits

Access is controlled at the database level, files are held in private storage, connected home tokens are encrypted before they are stored, transfer links expire, and secrets stay on the server. None of that makes any system perfect. Please do not upload national identity numbers, financial account numbers, or documents unrelated to the property.

Children

The service is for adults managing property and is not directed at children under 13. We do not knowingly collect their information; if you believe we have, tell us and we will remove it.

Changes

If this policy changes in a way that materially affects you, we will update the date at the top and, where we hold your address, tell you directly.