Privacy policy

1.Who is responsible

Torus Solutions, South Africa, is the responsible party for the personal information described here. Registration number [Company registration number]; registered address [Registered address].

Our information officer is [Information officer name and contact]. You can also reach us at support@homora.co.za.

This policy covers homora.co.za and the Homora app at app.homora.co.za. It should be read with our terms of use and cookie notice.

2.What we collect

We collect only what Homora needs in order to work.

• Your sign-in identity: your name and email address, the sign-in method you chose (email, Google or Apple) and the identifier that method gives us. If you use Apple’s Hide My Email, we hold the relay address Apple gives us. We never see or store your password; Microsoft Entra External ID handles it.
• What you and your household enter: incomes, bills, purchases, payments, goals and savings, agreements and approvals, month-end records, check-ins and life events. If you save how you like to be paid for a settlement (an account number or a payment ID), we store it encrypted.
• Attachments: receipts, invoices, screenshots and PDFs you add to a record, with who added them, when, the cleaned file name, an optional caption and a fingerprint of the file. We remove location and camera details from images before storing them.
• Technical data: your language and time zone settings, your device and browser type, your IP address and logs of requests to our servers, used to run, secure and fix the service.
• Billing status: your plan, its status and when the paid term ends, with a reference to your Polar customer record. Polar holds your payment details. We never receive card numbers.
• Push notifications, when we turn them on: a token that identifies your device to the push service.
• Your messages to us, if you write to support@homora.co.za.

3.Why we use it and our lawful basis

We use your information to give you Homora: to sign you in, work out splits and settlements, remind you of bills, store your attachments, take payment for Premium, keep the service secure, and answer your questions. We do not sell your information, and we do not use it for advertising.

Under POPIA we rely on these grounds. Most of what we do is necessary to carry out our agreement with you. Some of it is needed to meet a legal duty, such as keeping tax records. Some is in our legitimate interest and yours, for example preventing fraud and keeping the service safe. Where none of those applies, we ask for your consent, and you can withdraw it at any time.

We send service messages: security notices, billing notices, and notifications about things that need your decision. We send other kinds of email only if you switch them on.

4.Who sees what inside a household

Homora is private by default. What others can see depends on membership and on choices you make.

• Personal records are visible only to you. Your partner or housemates never see them.
• Household records are visible to the household’s current members. Changes to them are recorded in an audit trail showing who changed what and when.
• Your income has four visibility levels: private, shared total, shared detail, or agreed ratio only. Homora warns you before an income-weighted split could let someone work out a private figure.
• Payment details for settling up are shown to you, your current household and the other person in an open balance. Lists show them masked, and every time the full details are revealed it is logged.
• Attachments follow the record they are on. A personal record’s files are visible to you alone.
• Former members can read, and cannot change, the months they were members of, including only the attachments that existed while they were members.
• A person who pays for your Premium seat sees no private data about you, only your name in billing.
• Notification text on a lock screen is generic by default, with no names or amounts, unless you choose otherwise.
• Our own team does not browse your records. We may look at your account when needed to fix a problem or keep the service secure, and only for that. [Owner to confirm: support access practice.]

5.Operators and third parties

We use these providers to run Homora. They process information for us under agreements that require them to protect it, and only as we instruct, except where noted.

• Microsoft Azure hosts the app, the database and the attachments storage.
• Microsoft Entra External ID handles sign-in and holds your sign-in identity.
• Google or Apple, if you choose to sign in with them. They tell us your name and email address under their own privacy policies.
• Polar.sh is the merchant of record for Premium. It processes your payment and tax details under its own terms and privacy policy.
• Azure Communication Services Email sends our email, once email is switched on.
• Expo, with Apple’s and Google’s push services, delivers push notifications, once push is switched on.

6.Where your information is kept

Your records, database and attachments are kept in Microsoft Azure’s South Africa North region. Our marketing site is static and holds no personal information; Azure keeps only its hosting settings in West Europe.

Some providers may process information outside South Africa: Polar for payments, Expo and the push services for notifications, Azure Communication Services for email, Google and Apple for the sign-in methods you choose, and Microsoft Entra External ID for your sign-in identity [Owner to confirm: region of the Entra External ID tenant]. When information leaves South Africa we make sure it is protected by law, by a binding agreement that gives similar protection to POPIA, or with your consent, as section 72 of POPIA requires.

7.How long we keep it

We keep your records for as long as you have an account. Premium ending never deletes your data.

• Closed months in a shared household are the reconciled record of everyone in it, and are corrected by auditable adjustments rather than edited.
• A removed attachment is kept for 30 days so you can restore it, then deleted. Storage keeps a safety copy for 7 more days.
• Database backups are kept for 7 days.
• Tax and accounting law may require us and Polar to keep billing records for several years.
• To close your account and delete your information, email support@homora.co.za from the address on your account. We will check it is you, tell you what we will remove and what we must keep, and confirm when it is done. Records that other members of a household still need for their own accounts may be kept in a form that no longer identifies you where we can. [Owner to confirm: timing, and how shared household records are treated.]

8.How we protect it

We use technical and organisational measures that match the sensitivity of what we hold.

• The database has no public address; it can be reached only from inside our private network.
• Attachments are in private storage with no public access and no shareable links. Our server checks that you may see a record before it gives you a file.
• Passwords never reach us. Secrets and keys are kept in Azure Key Vault, not in code, and saved payment details are encrypted.
• Traffic to Homora is encrypted, and access is checked on our servers, not only in the app.

9.Your rights

Under POPIA you may ask us whether we hold information about you and to see it, ask us to correct or delete it, object to our using it, and withdraw consent you have given. Write to support@homora.co.za and we will answer within a reasonable time. We may need to confirm your identity first.

If you believe we have not handled your information properly, please tell us so we can put it right. You may also complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; complaints.IR@inforegulator.org.za; inforegulator.org.za.

If something goes wrong with your information, POPIA requires us to tell the Information Regulator and the people affected, and we will.

10.Children

Homora is for people aged 18 and over. We do not knowingly collect information about children. If you think a child has an account, tell us and we will delete it.

11.Changes to this policy

We will change the date at the top when we update this policy. For changes that matter, we will tell you by email or in the app before they apply.

12.Contact

Questions about your information: support@homora.co.za. Information officer: [Information officer name and contact]. Post: [Registered address].