What Domicusto keeps, where, and who can see it

Who runs Domicusto

Domicusto is an early-access service run by Domicusto, LLC, an Indiana limited liability company, in the United States. The contact address for anything in this policy is [email protected].

What we collect

When you create an account: your email address, your first and last name, and a password, which is stored only as a salted hash (scrypt). A recovery code is generated for you at sign-up; keep it somewhere safe.

When you use the app: the records you enter (properties and their buildings and rooms, with the measurements and openings you record for a room, expenses, loans, work items, bids, findings, vendors, contents, maintenance tasks, checklists, service visits, stays, tenancies, systems and equipment, utilities and shutoffs, meter readings, incidents, timeline events, and the words of a walk through the house, kept until you discard the walk) and the files you upload (photos, receipts, PDFs and other documents). Photos are resized on the way in, which drops what the camera wrote into the file, except the date the picture was taken, which is kept with the photo when the file carries it. Two kinds of picture are stored as you sent them, with whatever the camera wrote: a GIF, and a HEIC photo your browser cannot open. PDFs and other files are stored as you sent them too. Your own details are whatever you choose to put in Settings, Your details: a name, and optionally a phone number, a company and an address.

Email you forward to a property's forwarding address, if you create one: the message text, the sender, and the attachments, stored in your folder until you read or dismiss them.

Sharing grants, if you make any: which property you shared, with which email address or link, when, and when it was last opened. These live outside every account's folder and point at one property only.

Links you hand out for a job, a visit or a household, if you make any: which job, visit or household each is for, when it was made, when it was first opened, and whether it is still open. These live outside every account's folder, like sharing grants, and a link whose record is gone is removed ninety days later.

Usage counts for the features that call paid outside services, property lookups and AI reading: how many of each, by month (kept a year) and by day (kept sixty days), and for each AI reading, how many tokens it used, which model answered and which kind of reading it was. They are kept so that a monthly allowance can be enforced and so that what the included reading costs can be measured. These are counts, not contents.

Notes you choose to send through the Feedback box, with what the box shows you it is attaching. The Feedback section below says exactly what that is.

This site and the app run Cloudflare Web Analytics, and nothing else. It is a small script that Cloudflare adds at its edge, so it is not in our pages' source, and it counts page views and page-load timings. Cloudflare states that it uses no cookies or other client-side storage to track users, and does not fingerprint anyone by IP address, user agent or anything else. What it reports to us is totals: pages viewed, the sites that linked here, and each visit's country, browser, operating system and device type. There is no way for us to tell one visitor from another in it, and nothing in it is tied to your account or your property. We run no advertising scripts, and the app's own server keeps no per-request log in normal operation. Cloudflare, which sits in front of the server, keeps the connection logs any network provider keeps.

How it is used

To run the app for you: show your records back to you, keep them saved, send a password reset email when you ask for one, send the email about what needs you unless you turn it off, enforce any monthly allowance, and measure what the included AI reading costs. That is the whole list. Your records are not used to train anything, are not sold, and are not shared with other users unless you share them yourself.

When you share a property: a household member you invite by email sees that property, and only that property, in their own account and can add to it; what they add carries their email address. A view-only link shows the sections you chose to anyone who has the link, with no account, until it expires or you turn it off. Photos and documents in those sections are visible through the link; your settings, keys and other properties never are. You can see every grant, and end any of them, in Settings.

Feedback

There is a Feedback box in the app (in the header, in the account menu and inside every window), in the footer of this site, and on the pages a cleaner, a contractor or a tenant opens from a link. Using it is voluntary. What you type is yours to decide; please leave out passwords, private links and other people's personal details. The box refuses a note that contains a private Domicusto link.

A note carries, and shows you before you send it: where you were (which part of Domicusto, and the screen, window, page or section, by the names the app gives them, never by what they contained), the size of your browser's visible area, your browser's family, version and operating system, and the build of the page you had open. In the app it also carries what the property is, where it stands, and how full the record is, as counts. Never a web address, a link, a property name, an amount, a file or a screenshot. If you are signed in, your email address goes with the note unless you leave it off; on the site and the link pages, only an address you type goes. A separate box, off unless you tick it, says we may contact you about beta research; a reply about your note is a different thing and needs no box.

A note is stored on this server, and a copy is emailed to the operator's mailbox through Cloudflare's email service. A reply goes to the address you gave, by the same route. If the operator turns a note into an item on the project's issue tracker (GitHub), what goes there is a summary the operator writes, never your words and never your address. To limit volume from the site and the link pages, which need no account, the server keeps a scrambled form of the sending network address in memory for about an hour, keyed so that it cannot be read back, and never stores it with a note.

A note and its replies are kept while the note is open and for twelve months after it is closed, then removed. When an account is deleted, the address comes off every note it sent and the words stay. Backups keep copies on the schedule described below.

What leaves the server, and when

One thing goes out on its own: the nightly backup, which is encrypted on this server before it leaves, so the storage provider (Cloudflare R2) holds only ciphertext and never anything readable. Apart from that, nothing about your property leaves the server unless you take one of these actions:

• Property lookup. The address you type is sent to a property data provider (RentCast or ATTOM) to fetch the public assessor record. Only the address is sent.
• Read it with AI, or tell it what happened. The one document, photo or email you choose, or the words you give it, typed or spoken, are sent to an AI provider, together with a summary of that property's records so the reading can link to them: the property's name, address, what it is used for, its status and the date it was placed in service; its systems; its equipment, with each piece's make, model, system and install year; its vendors and their trades; its upkeep tasks; its jobs, with their status, contractor and category; proposals, with their contractor, amount and status; its documents' titles, types and dates; its loans, with the lender, the amount, the rate, the escrow and the dates of the last six statements you logged; its utilities and their providers; its rooms, with the level, building and area of each; and its other buildings, with their kind, year built and area. It comes back as records you check before any of them is saved; a file you upload is kept in your record from the moment you upload it. If you have saved your own API key for the provider you picked in Settings (Anthropic, OpenAI or Google), it goes to that provider under your own account. Otherwise it goes to Google, the provider Domicusto uses for the included reading, under our account. Each provider's own terms govern how long they keep what they receive. Nothing is sent until you press the button. When you speak instead of typing, the microphone button uses your browser's own speech recognition, which usually sends the sound to the browser's maker (Google for Chrome, Apple for Safari) to be turned into words; Domicusto receives only the words. The microphone on a phone's keyboard works under the phone's own settings.
• Ask. When you put a question to Ask, or press one of the questions it suggests, the question and a copy of that property's records (the entries themselves, not photos or files) go to the same AI provider, so the answer can come from your records and cite them. Same key rules as above, and nothing is sent until you press one of them.
• Matching proposals to work. The app first tries to match a proposal to the job it is for in your browser, by the contractor's name and the words the two have in common, and nothing leaves for that. If you then press the button to have the AI look at what is left, the titles of that property's jobs and the wording of the proposals not yet tied to one go to the same AI provider, and it comes back as suggestions you confirm. No prices are sent and none come back. Nothing is sent until you press it.
• Connecting an assistant. If you connect an AI assistant (Claude, ChatGPT, Gemini, Claude Code, VS Code) to your account, it asks for access through a sign-in page that names it and says what it may do; nothing is shared until you click Allow. From then on that assistant can read your records and propose new ones. What it proposes waits in Domicusto until you check it and save it, and what you save from it carries its name. It cannot save anything on its own, delete anything or attach a file. Nothing goes to the assistant on its own: it reads only when you ask it something, and the reading happens on your plan with that company, under their privacy terms, not ours. Settings, AI lists every connected assistant with when it connected and was last used; Disconnect cancels its access at once. The same applies to a bridge token you paste into an assistant's configuration yourself.
• Password reset. A reset link is emailed to your address through Cloudflare's email service.
• When something needs you. An email about what on your record needs you (an open safety finding, maintenance gone overdue, weather arriving that your systems are in the way of, a policy about to lapse, somebody waiting on an answer) goes to your address through Cloudflare's email service. It names the property and those items, never twice for the same thing, and never more than one a week unless it is urgent. It is on unless you turn it off, in Settings, When something needs you, or with the link in any of these emails.
• Feedback. A note you send through the Feedback box is emailed to the operator's mailbox through Cloudflare's email service, and a reply to you goes the same way. The Feedback section above says what a note carries.
• Forwarded email. A message sent to a property's forwarding address arrives through Cloudflare's email service, which handles mail for domicusto.com, and is handed to the server by a small Cloudflare Worker. The address is random, can be replaced from Quick Capture, and mail to any other address bounces. Nothing in a forwarded message is sent to an AI provider until you press Read it.
• Flood zone, and weather warnings. Each is off until you switch it on for a property, and the screen that switches it on shows you the exact two numbers first. What goes is a latitude and longitude rounded to three decimals, about a hundred metres: to FEMA for the flood map, to weather.gov for severe weather alerts. Not your address, not the parcel, not your name, and nothing from inside the record. Both are US government services, with no account and no key. Turn either off on that property and nothing goes out again.
• Sharing it yourself. A household member you invite, a view-only link, a property passport, or handing the record to another account at a sale: each sends exactly the sections you chose and nothing else. A job link handed to a cleaner or a contractor shows that one visit or job and what it needs (the checklist or the scope, the rooms, the photos you put on it), and a link a tenant holds to report a problem shows them the property's name and address, the label you gave their household, the names of its rooms so they can say where a problem is (each with its building, where two rooms share a name), and what they have sent through that link; neither shows anything else on the record. Each is listed in Settings (a hand-over under Hand this record on, the rest under Sharing), with when it was made and when it was opened, and each can be ended there while it is open. A calendar feed is the same kind of thing and carries the property's name and address in every event, because that is what a calendar entry is for; treat its link like any other view-only link.
• Comparisons. Only if you say yes, on a screen that first shows you the exact banded figures that would go (for example system.furnace, 10 to 14). Nothing identifying you or the property is included, no figure is sent as an exact number, and you can leave at any time, which removes what this record contributed rather than freezing it.
• Backups. The nightly backup is encrypted before it leaves the server, so the storage provider (Cloudflare R2) holds only ciphertext.

Where it is stored

On a server rented from DigitalOcean, with Cloudflare in front of it for HTTPS and network protection. Each account's records and files live in their own folder on that server. The app builds every file path from your signed session, so one account cannot reach another account's folder, even through a bug in a page.

Every time your records are saved, a timestamped copy is kept on the same server (the most recent 200). Every night, a backup of all accounts is encrypted on the server and then copied to Cloudflare R2 storage; nightly backups are kept for 14 days, weekly ones for 8 weeks and monthly ones for 12 months. You can also download your own copy from Settings at any time; everything exports as JSON or a set of CSV files.

Two things are kept on your own device as well. The first is the emergency packet. The app builds it from your record (shutoff locations and their photos, utility and insurance contacts with account and policy numbers, the insurance summary, the proof-of-ownership list, a contents summary, room photos) and stores it in your browser's cache so the page opens without a signal. It stays on that device until you sign out there or clear the browser's site data. A view-only link keeps its own copy, without account numbers.

The second is anything you have typed or said into Tell it what happened and not yet saved. It is kept in your browser's storage for that property, so a reload or a trip to another page does not lose it, and nothing of it is sent anywhere until you press Work it out. It is cleared when what it became is saved, and when you sign out on that device.

Security

Passwords are hashed with scrypt and a per-account salt. Sessions are signed cookies that expire after 30 days. All traffic uses HTTPS. The app itself listens only on the server's own loopback address, so it is reachable from the internet only through Cloudflare's tunnel, and it runs as an unprivileged service that can write to exactly one directory. Like any hosted service, the person who administers the server can technically reach the files on it; we do not open user records except to fix a problem you have asked us to fix.

Keeping and deleting

Your records stay for as long as your account exists. To delete your account, open Settings and choose Delete this account. It is scheduled seven days out and you can call it off at any point before that; on the day, the account and its folder are removed, along with every share link, passport link, forwarding address and connected assistant belonging to it. You can also email [email protected] from the address on the account and we will do the same thing. Either way, copies of deleted data remain inside the encrypted backups until those age out, at most 12 months. An email address is kept with the account that holds it; with an invitation or sharing grant you make to it, until the grant ends; and with a Feedback note when you give one, as the Feedback section says.

Your choices

Download everything at any time from Settings. Use your own API keys instead of the included allowance if you would rather the outside services see your account, not ours. Disconnect an assistant, remove a household member, or turn off a view-only link whenever you like. Ask us at the address above to correct or delete anything.

Children

Domicusto is for property owners and is not directed at anyone under 18.

Changes

If this policy changes, the date at the top changes with it, and anything that affects what leaves the server will be announced inside the app before it takes effect.