Hundredfold Home — Per-App Addendum to the HullStack House Terms & Privacy Policy

Document set: core · Type: addendum App ID: kingdom-hearth

This Addendum supplements, and is incorporated by reference into, the HullStack House Terms of Service and HullStack House Privacy Policy (together, the "House Documents"). It applies only to Hundredfold Home.

Per House Terms §0/§1, this Addendum is presented for acceptance in the same consent flow as the House Terms and Privacy Policy — it is not merely linked or informational. Any term here that materially affects your rights or obligations is covered by the same recorded acceptance as the House Documents.

Order of precedence. Where this Addendum conflicts with a House Document, the order-of-precedence rule stated in House Terms §0 applies: this Addendum controls for app-specific operational matters (features, data collected, permissions, processors, billing); the House Documents control for core legal mechanisms (Electronic Records §2, Children §4, Arbitration §18, Governing Law §19, Disclaimers §15, Limitation of Liability §16, Indemnification §17), unless this Addendum expressly and specifically names and overrides a numbered House section under §G below.

A. The Service

Hundredfold Home is a private app for one household. It gives a family a single shared place to talk and coordinate: end-to-end-encrypted messaging (direct and group), a shared household calendar, chores with an allowance ledger, shared lists for shopping and the pantry, gift wishlists, a Holiday Hub for planning the gifts a household gives each holiday season, a Meal Planner for planning which dinner a household has on which day, kids' activity schedules with optional check-in alerts, photo and media sharing, optional location sharing between household members, local weather, and an in-app assistant that helps you find things in the app and send feedback to our team.

Children participate through Child Accounts created by a Household Adult. A Child Account has no password — its only credential is a per-child login code that a Household Adult issues, reissues, or revokes (House Terms §7 and §10.3). A Child Account is created without an email address; the child may later add an optional contact email (§B).

Hundredfold Home is distributed as a native mobile app through our own F-Droid repository, Google Play, and the Apple App Store.

B. App-Specific Data Collection

In addition to the categories in House Privacy Policy §2, Hundredfold Home collects and stores:

• Messages and media — the messages, photos, videos, and files household members send each other, including in group conversations. Message bodies and attached media are end-to-end encrypted (§D-E2EE below, including its assumptions; House Terms §10, House Privacy §12). Message reactions and group conversation names are end-to-end encrypted too (§D-E2EE), but who reacted to which message, and when, is not. We do process the surrounding metadata described in House Privacy §2 and §12. The app does not create link previews: a link in a message stays inside the encrypted message, and the app does not send it to us or fetch it on your behalf.
• Calendar events and comments — dates, times, recurrence, reminders, visibility, and who created or was invited to each event, including kids' activities and which Child Account each activity is for. Event titles, descriptions, locations, and comment bodies are end-to-end encrypted (§D-E2EE). The names and photos of the schools, studios, and other activity places you save for kids' activities, and the labels of any breaks you mark for them, are end-to-end encrypted too (§D-E2EE); the start and end dates of those breaks are not. Birthday overlay names and dates are stored so we can project yearly reminders onto the calendar and send a morning-of notification; those names are not end-to-end encrypted.
• Activity check-ins — if a Household Adult turns on check-in alerts for a kid's activity, that adult's device registers opaque tokens for the Place the activity is linked to, the child's device reports arrivals there using matching tokens, and for each scheduled session we record which Child Account and activity it is for, the session's time window, whether the child's device reported arriving at that Place in time, and whether an alert was sent and to which Household Adults. The Place's name and coordinates stay end-to-end encrypted, but whether a child arrived at an activity's Place on time is visible to us. These records are deleted 48 hours after the session's check-in deadline.
• Chores and allowance — chore definitions and schedules, assignments to household members, completion and approval history, and the allowance ledger (amounts earned, adjusted, and paid out) that follows from it. Chore titles and descriptions, and the notes you write on allowance entries, are end-to-end encrypted (§D-E2EE). The rest of this category is not: schedules, due dates, assignments, completion and approval records, and allowance amounts and balances. We keep those readable so reminders go out on time and balances add up. Short notes the app adds to an allowance entry on its own, such as "Job reward" or a note that a closed week's earnings were changed, are not end-to-end encrypted either.
• Lists — your household's lists and Shopping, including items, quantities, and notes. On your lists, the list titles and the items on them are end-to-end encrypted (§D-E2EE). Shopping is not end-to-end encrypted: we can read the items on it, how many you need, the names of your stores, and when each item was added and checked off. Shopping also keeps a record of the items you have added to it, even after you buy them. It records when you added and bought each one, and whether you need it again. We can read that too. The app uses this to spot an item or store you added before and to sort items by aisle. On every list, who added an item and whether and when it was checked off are not end-to-end encrypted either.
• Wishlists — gift ideas a Household Adult saves for a child or for another adult in the household. Each item's name, link, and notes are end-to-end encrypted (§D-E2EE); whether an item has been marked purchased, when, and by whom are not. Wishlists are shown only to Household Adults, and an adult is not shown their own wishlist. Those limits are rules in the app and on our servers, not encryption: every household member's phone, a Child Account's included, holds the key that unlocks wishlists.
• Holiday Hub — a Household Adult can use Holiday Hub to plan the gifts a household gives. They make groups of people (called "tiles" in the app), add the people in each group, and keep gift ideas for each person by year, with an optional cost and optional links. They can also write a note for a group or a person for a year, and add a small photo to a group or a person; a photo is shrunk on your phone before it is saved. The first time a Household Adult opens Holiday Hub, the app also creates a tile for your own household, with one entry for each household member, Child Accounts included, taken from your household member list, and it keeps that tile in step as members join or leave. The names of the groups and people you add, gift ideas, costs, links, notes, and photos are end-to-end encrypted (§D-E2EE). The rest of this category is not: which group each person is in; which person or household member each gift and note is about; the year it is for; when it was added, changed, or archived; which Household Adult added or last changed it (the app does not show this to other members); each entry's approximate size; and the names on your household's tile, which come from your household member list. Holiday Hub is shown only to Household Adults. Every Household Adult in the household can see and change what is in it, except that an adult is not shown the gift ideas or notes written about themselves on your household's tile. A Child Account cannot open Holiday Hub, and our servers do not send it to one. Those two limits are rules in the app and on our servers, not encryption: every household member's phone, a Child Account's included, holds the key that unlocks Holiday Hub. We do not show ads in Hundredfold Home, and we do not sell this information or use it for advertising. It is not sent to the in-app assistant or to any outside service other than the hosting and network delivery described in §C. Deleting a tile, person, gift, or note removes it, and deleting a tile or person also removes everything inside it. Archiving only hides a tile or person; its past years stay. What a Household Adult adds stays with the household if that adult later deletes their account. If a household member leaves or is removed, what was written about them stays stored but hidden, so it is there if they rejoin. When a household is deleted, its Holiday Hub entries are removed on the schedule in House Privacy §7.
• Meal Planner — a Household Adult can use the Meal Planner to keep a list of the dinners your household likes (called "Dishes" in the app) and to plan which dinner is on which day. A dish can be a name alone, or have a small photo, and can say how many days one cooking lasts; the app only counts these and never limits them. The name of each dish, how many days it lasts, its photo, and any sides added to a planned dinner are end-to-end encrypted (§D-E2EE). The rest is not: which dates have a dinner planned, which dish is on which date, when each was added or changed, which Household Adult added or last changed it (the app does not show this to other members), and each entry's approximate size. The Meal Planner shows its busy-evening label by reading your calendar on your own phone. A Child Account can see which dinner is planned, on Home and on the Calendar, but cannot change it or open the Meal Planner. That limit is a rule in the app and on our servers, not encryption: every household member's phone, a Child Account's included, holds the key that unlocks it. The Meal Planner is part of Premium. If your household stops having Premium, you can still see and delete your dishes and your plan, but you cannot add or change them until Premium returns. We do not show ads in Hundredfold Home, and we do not sell this information or use it for advertising. It is not sent to the in-app assistant or to any outside service other than the hosting and network delivery described in §C. Deleting a dish removes it, its photo, and every day it was planned on, including days that have passed. What a Household Adult adds stays with the household if that adult later deletes their account. When a household is deleted, its Meal Planner entries are removed on the schedule in House Privacy §7.
• Location — where a household member turns location sharing on, we store that member's live position, a short history of recent positions (deleted after 2 days), arrive and leave events for saved Places (deleted after 30 days), and any Places they save, as ciphertext encrypted to the household location-room key. Coordinates and Place names, latitudes, longitudes, and radii are end-to-end encrypted (§D-E2EE). Location sharing is off unless enabled, is visible only to members of that household, and can be turned off at any time in the app or by revoking the permission in device settings. A Household Adult controls whether a Child Account participates in location sharing, and can keep it on for that child. The surrounding metadata we do process — not the coordinates themselves — includes: that sharing is on; the device and platform; key version; when each location update and each arrive or leave event is sent; for place alerts, a short delay window (one of a few fixed values that roughly reflects a Place's size) and opaque tokens, changed daily, that let our servers tell whether two events concern the same Place on the same day, and whether they go in the same direction, without learning which Place or which direction; and, on iPhone, diagnostic timelines of background-location activity (timestamps, counts, and status values, never coordinates) sent to the diagnostics system we operate (§C).
• Approximate location for weather — separately from location sharing, whenever the app is open and you have granted location permission, the app sends an approximate location — rounded on your device to the center of a grid cell about 1 km across — to our servers to show local weather, sunrise and sunset times, and the nearest city name. This approximate location is not end-to-end encrypted, is sent whether or not you share your location with your household, and is forwarded, without any account identifier, to the U.S. National Weather Service (§C).
• Assistant conversations — the message you type or dictate to the in-app assistant, and the answer it gives. The assistant receives only the message you just sent: not your earlier messages, and none of what you have saved in the app (such as events, chores, lists, or family members' names). It cannot add, change, or delete anything in your household. To keep any one account from overloading it, we keep a record of when each account used the assistant. If you use voice dictation where it is offered, your recording is sent to a speech-to-text service we operate ourselves and the transcript is handled like typed text; voice dictation is not offered where you write end-to-end-encrypted content. Child Accounts cannot use the assistant. See §C for how these are processed.
• Child Account profile data — a display name and optional avatar, household membership and role, and the one-way hash and short public prefix of the child's login code. A Child Account is created without an email address, but the child can add an optional contact email from their own account; we send a verification link to that address and notify the Household Adults when it is added or verified. We do not ask for a Child Account's date of birth or phone number. Birthdays a Household Adult adds to the calendar are described under Calendar events and comments above.
• Premium feature requests — when a Child Account taps to ask a Household Adult to unlock a Premium-only feature, we store which feature was requested, which child requested it, when, and its status (pending, dismissed, or resolved). This lets a Household Adult see and act on the request; it is not shared outside the household and is deleted on a retention schedule.
• Feedback and support requests — a Household Adult can send us feedback through the in-app assistant (when you tell it about a problem or a suggestion, it offers to send your message to our team) or through a regular feedback form. A Child Account sends feedback through a regular form only. We store the text of the report, an optional screenshot you choose to attach from your photo library, and technical context (app version, the kind of phone, the screen you were on, and whether the account is a Household Adult's or a Child Account's). Feedback text and screenshots are not end-to-end encrypted — our team reads them to follow up. A Household Adult's feedback text is also processed by the same outside AI service that powers the assistant, in an automatic sorting step that also looks at your household's other recent feedback that we have not yet closed (§C). A Child Account's feedback skips that automatic sorting step. See House Privacy §7 ("Support communications") for how long we keep it.
• Who changed what — For most things saved in the app, we keep when it was last added or changed and which account, if any, made the change: a Household Adult's or a Child Account's. For your household, its members, Child Accounts and their parental controls, chats and who is in them, messages, and Household Adults' profiles, we also keep a record of every add, change, and delete, and our histories of chores, member roles, and parental controls record which account made each change. None of these records holds message text, titles, names, or notes, and the app does not show them to anyone. We use them to find and fix problems and to look into possible security problems with an account. The records of each change are kept as long as your household exists, even after the item or the account is deleted; the records about your household are deleted with it on the schedule in House Privacy §7.

Hundredfold Home does not collect health data, financial account numbers, or payment card data. Subscription payments are handled entirely by the platform store (§E); we never receive your payment credentials.

C. Third-Party Services and Processors

• Push notification delivery — push is delivered through Google Firebase Cloud Messaging (FCM) on Android devices that support it (including installs from our F-Droid repository), through Apple Push Notification service (APNs) on iPhone, and otherwise through a notification relay we operate ourselves (UnifiedPush). Message content is never in a push: the app fetches it directly from us over its own authenticated, encrypted connection; the message itself is end-to-end encrypted. Today, the rest of a notification's readable text is not encrypted before we hand it to Google or Apple, so they receive, in addition to a device push token and the time each notification is sent: a chat sender's display name (or a child's first name); a child's first name on chore-help, reward, and new-device sign-in pushes, plus the device name on the sign-in one; the actor's name and the event date/time on calendar and comment pushes; a birthday overlay name and age; list-activity actor names; and chore and event reminder times. We plan to encrypt that text before it reaches Google, Apple, or our relay, decrypting it only on your device. A Child Account session registers for push the same way and can receive push through any of these channels.
• Crash and diagnostic reporting — crash reports, error traces, and performance telemetry are sent to observability infrastructure we operate ourselves; they are not sent to a third-party crash-reporting vendor. These reports can include device model, OS version, app build, and a stack trace, and can originate from a Child Account session. They do not include message content.
• In-app assistant and feedback processing — when a Household Adult sends the assistant a message, that one message is passed through a relay service we operate to an outside AI service, which works out which answer or screen in the app fits it, and whether the message is feedback for our team. When a Household Adult sends feedback, its text, its category and the screen it was sent from go the same way to the outside AI service, together with your household's recent unclosed feedback from Household Adults. The service labels the report, flags likely repeats, and writes a short summary for our team. We do not send stored end-to-end-encrypted message, location, or calendar content to the outside AI service. What you type or dictate to the assistant is not end-to-end encrypted. Assistant and feedback requests are not used to train third-party models. Child Accounts cannot use the assistant, and a Child Account's feedback is not sent to the outside AI service for sorting.
• Email delivery — account-related email (address verification, password reset, welcome messages, and notices to Household Adults when a Child Account adds or verifies a contact email) is sent through our transactional email provider. A Child Account that adds a contact email receives a verification email at that address; a Child Account does not have a password and never receives a password-reset email, and we do not send login codes by email.
• Breached-password check (Have I Been Pwned) — when a Household Adult signs up, changes their password, or resets it, the app checks the new password against Have I Been Pwned's Pwned Passwords service, a public list of passwords exposed in data breaches. Your device makes a one-way (SHA-1) hash of the password and sends only the first five characters of that hash to the service, then compares the matches it gets back on the device itself. The password and its full hash never leave your device, and our servers are not involved. Like any internet request, this one also carries your IP address. If the service cannot be reached, the app skips the check. A Child Account has no password and never makes this check.
• Hosting and storage — the app, backend, and object storage (including photos, other media, and feedback screenshots) run on our cloud infrastructure provider. Media and screenshots are stored as uploaded (ciphertext for end-to-end-encrypted content; plaintext for content that is not end-to-end encrypted, including feedback screenshots) and are subject to the retention schedule in House Privacy §7.
• Network delivery (Cloudflare) — traffic between the app and our servers, including our sign-in pages, passes through Cloudflare, which provides encrypted-connection (TLS) termination, network protection, and content delivery for us, and which stores and serves our own map tiles. Cloudflare therefore processes your IP address, request metadata, and the content of requests that are not end-to-end encrypted (end-to-end-encrypted content passes through only as ciphertext), and receives the map tiles your device requests, which reveal the map area you are viewing. Traffic from a Child Account session passes through Cloudflare the same way.
• Weather (U.S. National Weather Service) — to show local weather, our servers send the approximate location described in §B, with no account identifier, to the National Weather Service's public weather API. The National Weather Service is a U.S. government agency, not our processor, and handles that request under its own policies.
• Subscriptions — in builds distributed through Google Play and the Apple App Store, subscription purchase and entitlement state are handled by that platform's billing system together with RevenueCat, our subscription management provider. They receive a pseudonymous account identifier and purchase state — not your household's content. On Android the billing components are switched on only when the app was installed from Google Play; an install from our F-Droid repository never switches them on, sends nothing to these processors, and cannot make purchases. Subscription purchase is available only to a Household Adult; a Child Account session does not reach these processors.
• App distribution — Google Play and the Apple App Store receive download and, where applicable, purchase information under their own privacy policies. Our F-Droid repository is operated by us.

We maintain a data processing agreement with each processor above that receives personal information (the National Weather Service and Have I Been Pwned, which receive no account identifier, are independent services rather than our processors), and — for any processor reachable from a Child Account session — one that accounts for children's data, consistent with House Privacy §3.

D. Permissions

Hundredfold Home requests these device permissions. Each is optional; the app functions without them, minus the corresponding feature.

• Notifications — to alert you to new messages, calendar events, and chore activity.
• Camera — to take a photo or record a video to send in a conversation, set a profile picture, add a photo in Holiday Hub, add a photo to a dish in the Meal Planner, or scan a household invite or login QR code.
• Photo and media library — to attach an existing photo or video to a message, a profile, Holiday Hub, or a dish in the Meal Planner, and to save a video to your photo library when you choose to.
• Storage (Android 9 and earlier) — to save a video to your phone when you choose to.
• Location (precise, coarse, and background) — for location sharing, place alerts, and activity check-ins, and to show local weather from an approximate location, as described in §B. Background location is requested only if you (or, for a Child Account, a Household Adult) choose to share your location continuously with your household or turn on place alerts.
• Microphone — for voice dictation where it is offered (§B), and to record the sound of a video you take in the app to send in a conversation. Recording starts only when you tap the microphone button or start recording a video. A video's sound is part of the video and is end-to-end encrypted with it (§D-E2EE); dictation audio is not.
• Foreground service — to hold the real-time message connection open, to finish preparing and sending a video you chose to send, while the app is in the background, and, if you enable continuous location sharing, to reduce (but not eliminate) the chance that sharing is interrupted while the app is in the background (see §D-LOCATION). Android shows a persistent notification whenever a foreground service is running.

D-E2EE. Encryption and household key recovery

Hundredfold Home does offer end-to-end encryption for messages and the media attached to them (direct and group conversations), live location coordinates and Places, calendar event titles, descriptions, locations, and event comments, wishlist item names, links, and notes, Holiday Hub group and person names, gift ideas, costs, links, notes, and photos, Meal Planner dish names, how many days each dish lasts, dish photos, and dinner sides, chore titles and descriptions, list titles and list items, the notes you write on allowance entries, message reactions and group conversation names, and the names and photos of saved activity places and the labels of their breaks. In plain words, that content is end-to-end encrypted: locked on your phone before it's sent, unlocked on the phones it is meant for. We store it only in its locked form, and we do not hold the keys that unlock it. Whether that keeps it from us depends on the three assumptions below.

Parts of this protection also depend on the version of the app you use. Versions of the app earlier than 1.0.964 are no longer supported. The app asks a Household Adult who is using one to update, but it does not ask a Child Account's device, so a child's device can keep running an earlier version, with the limits described below, until someone updates it.

First, our member list. Our servers also run the directory that tells each device which encryption key belongs to which household member, and the app does not yet offer a way to check those keys yourself (for example, by comparing a code in person). End-to-end encryption therefore protects your content from us on the assumption that our servers hand out each member's genuine key. A compromised server could, in principle, substitute a key it controls, or list a member who is not really in your household, and read content locked to that key afterward. Starting with app version 1.0.964, each device remembers the household members' keys and the administrators it has seen, and a parent's device shows a security check when an administrator is added or an administrator's key changes. But a newly set-up or reinstalled device trusts what it sees the first time it loads the household, and the app does not yet tell you when a new member who is not an administrator appears. Earlier versions of the app do not remember keys at all.

Second, a child's login code. A login code made before our September 29, 2026 update was created by our servers. If our servers had kept one, they could use it to open that child's key and the household content the child can open. Codes made since then are created on the parent's phone and never reach us. Refreshing a child's keys stops an old code from opening the child's new key, but content locked before the refresh, and content locked afterwards until the household's shared keys next change, stays within an old code's reach.

Third, the shared "room keys" that lock location, Places, calendar event content and saved activity places, and every group or whole-household conversation. Starting with app version 1.0.964, a device locks new content with a room key only if a household member whose key the device already remembers sealed it, addressed it to that device, and it is not an older key the device has already seen for that room; any other key is used only to unlock existing content. Starting with app version 1.0.969, a device also locks new content only with a room key sealed in the current format, which ties each key to its room and key version, so an older room key copied forward as if it were new is not used. For every version of the app, our servers refuse content stamped for a key newer than the room's current key, so a departed member's phone cannot use such a stamp to keep other devices on an old key. The limits: on a version earlier than 1.0.969, a device that never held the older key (for example, a newly set-up or reinstalled one) can still be made to lock new content with an older room key copied forward by someone who could write to our database or control our servers, so on such a device removing a household member does not reliably cut them off from new content. A version earlier than 1.0.964 also accepts a room key without checking who sealed it, so that same person could give it a room key of their own choosing and read what it locks afterward, a child's location included. None of this removes the first two assumptions.

Hundredfold Home relies on the House Terms §10 and House Privacy §12 disclosures without variation. In particular, and importantly for a family app:

• A household administrator can decrypt a Child Account's encrypted content. Each Child Account's private key is escrowed, in encrypted form, to the household administrators (from app version 1.0.964, only those the escrowing parent's device has recognised or confirmed — see the next bullet), so a parent is never permanently locked out of a child's account. See House Terms §10.3. From app version 1.0.964, an administrator who has not yet received a child's key backup can still issue that child a login code, but the code only signs the child in; it does not unlock the child's encrypted content until another administrator confirms them and a new code is issued.
• A household administrator's key is backed up to the other administrators. In a household with more than one administrator, each administrator's private key is escrowed, in encrypted form, to the other administrators of that household, automatically, when they use the app with encryption unlocked. Starting with app version 1.0.964, a device backs up its own key, and a Child Account's key, only to administrators it saw when it first loaded the household or that a parent has confirmed on it through a security check; an administrator added later, or whose key has changed, receives no backup from that device until then. That check is what keeps those backups limited to people already in your household. Earlier versions of the app back up to every administrator our servers list. We do not hold the keys that open these envelopes. They exist so that a forgotten-password reset does not destroy an administrator's end-to-end-encrypted history: after the reset, the next time another administrator opens the app, their device automatically re-seals the original key back to them, with no action on that administrator's part. That re-seal does not yet ask anyone to confirm, on any version of the app, so someone who takes over an administrator's account (for example, by resetting their password through that administrator's email) could receive the original key this way; we are changing this so a household member's own action is required first. This means another household administrator holds encrypted material that could decrypt your end-to-end-encrypted content; the app uses it only to restore your key and does not give administrators access to your conversations. A sole administrator, and a Household Adult who is not an administrator, have no such backup, so neither we nor another household member can recover that adult's encrypted content after a password reset.
• If a password reset installs a brand-new key instead — because no backup was on file for that administrator — the new key can receive every child's key. Starting with app version 1.0.964, the next time another administrator's app unlocks, it shows a security check saying that administrator's security key changed, and it holds back the backup of each Child Account's key, and of that parent's own key, until that parent confirms the change was really them; that check is what keeps those backups from reaching someone who only looks like that administrator. Earlier versions of the app re-seal those keys to the new key automatically, with no confirmation from anyone. So if someone else gains control of an administrator's account (for example, by resetting their password through that administrator's email), your household's children's keys, and every other administrator's key, can be silently handed to that new key the next time an administrator using an earlier version unlocks — or when a parent confirms the security check without first checking with that administrator.
• Chore schedules and completion records, allowance amounts and balances, notes the app adds to allowance entries on its own, whether a list item is checked off, everything in Shopping (including store names), birthday overlay names, activity check-in records, the approximate location sent for weather, assistant conversations, and feedback submissions (including any attached screenshot) are not end-to-end encrypted. They are encrypted while they travel over the internet. When we store them in our database or file storage, DigitalOcean, the company that hosts both, keeps them encrypted on its disks. We can still read them. We do not send stored end-to-end-encrypted message, location, or calendar content to the outside AI service. We do not promise backups, snapshots, or any availability SLA for that non-E2EE data; it can be lost through hosting failure, operator error, or deletion on termination (House Terms §10.5, §14, §15).

D-LOCATION. Location accuracy and availability

Location accuracy and availability. Location sharing depends on your device's GPS, network, and operating system, on background-location permissions and battery-optimization settings you or your device manufacturer control, and on push-notification delivery through Google, Apple, or our own relay (§C). Any of these can delay, degrade, or entirely prevent a location update or a place alert from arriving — including while you are actively viewing the map. We do not warrant the accuracy, precision, completeness, or timeliness of any location shown in the Service, or the delivery of any location-based alert or notification. Hundredfold Home is not a safety, emergency-response, or life-monitoring service, and must not be relied on as one. Do not use it, or a household member's absence from it, as the basis for a safety or welfare decision, and do not use it as a substitute for calling emergency services. Interruption or inaccuracy of location sharing is not, by itself, a breach of these Terms, and the disclaimers in House Terms §15 and the limitation of liability in House Terms §16 apply to it the same way they apply to the rest of the Service.

E. Subscriptions and Billing

Hundredfold Home offers a single optional Premium subscription, which covers every member of one household. The app is fully usable without it.

• Price(s) and billing cycle(s): Premium is offered on a monthly and an annual term. The current price for each term, in your local currency, is shown in the app on the subscription screen before you purchase — prices come from the platform store and can vary by country.
• Free trial terms: where a free trial is offered for a term, its length and conditions are shown on that same screen before you purchase. If a trial is not shown, none is offered.
• Auto-renewal and cancellation: a subscription renews automatically at the then-current price for the same term until you cancel. Cancel any time through the store account you purchased with (Google Play or the App Store); cancellation takes effect at the end of the current billing period, and you keep Premium until then.
• Refund policy: purchases are processed by Google Play or the Apple App Store as merchant of record, and refunds are handled under that store's refund policy. Request a refund through that store; we cannot issue one directly.
• Only a Household Adult can purchase or manage a subscription. An install from our F-Droid repository cannot make purchases.

F. App-Specific Acceptable Use

No additional acceptable-use terms beyond House Terms §8. Because Hundredfold Home is a private household app rather than a public social network, House Terms §8 governs conduct within a household, and House Terms §8's note on encrypted content applies to messages: we do not hold the keys to end-to-end-encrypted conversations, so we do not proactively detect a violation inside them, and enforcement there depends on a report from a participant or from a household administrator.

G. Governing Terms for Core Legal Mechanisms

No changes to House Terms §15 (Disclaimers), §16 (Limitation of Liability), §18 (Dispute Resolution and class-action waiver), or §19 (Governing Law and Forum). Those sections apply to Hundredfold Home exactly as written in the House Terms.

H. App-Specific Contact / Data-Subject Requests

See House Terms §23 and House Privacy §13. Hundredfold Home uses the same support, privacy, and security contact as the House Documents.

I. Effective Date and Versioning

This Addendum applies to App ID kingdom-hearth. Its version and effective date are the version and registration date shown alongside this document in the consent record you are asked to accept — that record, not this text, is authoritative. Changes to this Addendum follow the same material/non-material change process described in House Terms §20 and §21.