Version 2.7 · Effective 28 October 2026 · BERFLOW LTD · info@berflowit.com
Domaiya is a household organiser. It holds the practical details of running a home (who lives there, what needs doing, what is for dinner, what has been spent) and shares them with the people in that household. This policy describes what Domaiya collects, why, who it goes to, and how to get rid of it. It is written against what the app actually does.
This version replaces version 2.6, effective 22 October 2026. It corrects how sign-in works and explains household visibility, AI processing and deletion more fully.
BERFLOW LTD is the data controller for Domaiya. We are a private company limited by shares, registered in Cyprus under number HE 446915, with our registered office at Miltonos 109A, 3047 Limassol, Cyprus. BerflowIT is a brand name we use, including as our developer name on Google Play; it is not a separate company. Domaiya has iPhone and Android app versions; the Android package identifier is com.nizasiwale.homeharmonyhub. App-store availability depends on the current release.
Write to info@berflowit.com for any question about this policy, to ask for a copy of your data, or to ask us to delete it. You can also reach us on +41 78 350 04 42. Please put “Privacy” in the subject line of an email so it reaches the right place.
The sign-in methods available in your version determine what we hold:
| Method | What we hold |
|---|---|
| Email and password | Your email address and a salted password hash. The password you submit is checked by the authentication service; the stored hash is used to verify subsequent sign-ins instead of storing a readable password. You can reset it by email. |
| Previous phone sign-in | Phone sign-in and SMS codes have ended. Existing account and verification records may remain under the retention criteria below; ending SMS does not itself erase historical records. Use the account-recovery route offered by Domaiya rather than creating a second account. |
| Google sign-in | The account identifier and basic profile details Google returns when you choose to sign in with Google. |
| Apple sign-in, where available | The account identifier and any name or email details Apple returns when you choose this method, including a private relay email when you select that option. |
Passwords are stored as salted hashes. Social sign-in uses the account information the provider returns with your chosen sign-in.
SMS is discontinued. Domaiya no longer offers SMS sign-in codes, SMS reminders or SMS credit purchases. Email, in-app and push features remain separate.
| Data | Why we hold it |
|---|---|
| Name | Shown to the other people in your household. |
| Date of birth | Age or date of birth can be recorded during household-profile setup, including the profile form reached after sign-in. It supports birthdays and age-dependent presentation. This is not verified age or guardian consent, and not every authentication route collects it. |
| Profile photo | Optional. Shown to your household. |
| Household name, address and membership | Membership and roles determine access to shared content. City or postcode and country are used for weather geocoding; city and country support shop suggestions. An assistant household-settings lookup includes city, postcode and country; the saved street line is excluded from that lookup. Information you write in a request or another accessible free-text field may still be sent. |
Domaiya collects allergies, dietary restrictions, dietary notes and health goals for household members, to tailor meal suggestions and flag possible conflicts. AI and recipe information can be wrong; this does not guarantee that a meal is safe for a person with an allergy. It also records medication reminders: the medicine’s name, dose, instructions, schedule, whether the reminder is on or off, and which members you have chosen to share it with. It interprets nutrition information from food and product labels you scan.
We treat all of this as health data, which the law protects more strictly. Medication reminders are private to their owner unless explicitly shared with named members. Other health-related profile information is stored with the household and visible according to role. Relevant allergies, dietary needs and health goals are sent to Google’s Vertex AI when meal suggestions or meal plans are generated. Medication reminder names and their on/off state can also reach the AI service when you ask the assistant about them; the medication lookup excludes doses and schedules. However, health details you put into your request or other accessible free text may also be sent. Current phone notifications use a generic update message and routing information, not medicine names or doses. Notification display and delivery also depend on your device settings. None of it is ever sold, and none of it is used for advertising.
Children’s profiles are created by an adult in the household, and the allergies and dietary needs recorded on a child’s profile are included in meal planning in the same way as an adult’s. We say so plainly because you are entitled to know it before you type it in.
Separate health-profile choices. Where the health-approval controls are available, an eligible adult linked to the profile can choose storage, household sharing and AI use separately, and withdraw approval. A manager cannot give these approvals for another adult. Declining sharing or AI use may prevent a shared meal or AI operation that would otherwise disclose those fields. These controls concern the health-profile fields they name; they are not blanket permission for health details written in chat, notes, requests or other free text.
Guardian-managed child profiles without their own login are handled separately and can contribute recorded allergies and dietary requirements to meal planning. The adult entering the information must have lawful authority. An ordinary household role does not establish guardianship. Contact info@berflowit.com if the available controls cannot respect a person’s choices or if you need access, correction, restriction or deletion.
Domaiya no longer sends SMS sign-in codes or household reminders, verifies new phone numbers for those services, or sells SMS credits. Ending the feature does not automatically delete previous phone, verification, consent, delivery, opt-out or accounting records. If such records exist, their retention and deletion depend on their purpose and applicable requirements. We do not promise that provider records or backups have been erased merely because SMS is no longer offered.
We ask for these only when you use the feature that needs them: the camera for barcode scanning and for food, receipt and task photographs; the photo library when you attach an existing picture; the microphone for the voice assistant, family chat voice messages and note recordings. We do not use the camera or microphone in the background, and we do not scan your photo library.
Optional address lookup. You can type and save a home address manually. If you use address suggestions, the entered address text and country filter are sent through our server to Geoapify. If you choose to use your current location and allow the phone permission, a one-off precise latitude and longitude are sent to our server and Geoapify to suggest an address. The suggestion does not change your saved home until you save it. This is not background location tracking. You can decline location access and enter the address yourself. Weather follows the selected home’s saved location; it does not continuously track where your phone is.
Domaiya has no advertising SDKs and does not track you across other apps or websites. We do not include Google Analytics or a general user-behaviour analytics SDK. Our Firebase notification components do collect the technical information described above for notification delivery, reliability and improvement of Firebase services. Firebase’s platform/version adoption information is not linked by Firebase to a user or device identifier.
Some features use generative artificial intelligence provided by Google Cloud Vertex AI (Gemini models). When you use them you are interacting with an AI system, not a person. AI can be wrong. Check anything that matters, especially amounts, dates, allergens and nutrition.
| Feature | What is sent to the AI service |
|---|---|
| Assistant (voice or text) | Your request as you wrote or said it; your household’s date, time zone and currency; and a summary of records your role allows you to see. When the assistant looks something up, it sends only the fields on a reviewed list for that lookup: file and picture links, who uploaded a file and file fingerprints are removed, and a lookup with no reviewed list is refused rather than sent. The fields that are sent still include free text people have written, such as note bodies, descriptions and bill notes, and, if you ask about household settings, your saved city, postcode and country. Street-address lines are excluded from this AI lookup. |
| Voice transcription | The audio of your request, when your own device cannot transcribe it. |
| Receipt, bill, grocery, list, meal and label scanning | The photograph or PDF you scan. |
| Meal suggestions and meal plans | Members’ allergies, dietary restrictions and notes, preferences, cuisines and health goals, including children’s profiles added by an adult; plan dates; household size and number of children; recent meals; and selected pantry items. |
| Calorie estimates and ingredient lists | Dish names, meal notes and the number of servings. |
| Statement categorisation | Merchant names only, never amounts. |
| Chore suggestions | Member names and task counts. |
| Shop suggestions | Your household’s city and country, and item names. |
| Generated pictures | For meals: the dish name and, where the feature supplies them, the cuisine, your meal notes, the recipe ingredients and the cooking instructions. For products: the item name. Your own photographs are not used to make these pictures. |
Assistant action proposals. The assistant proposal workflow shows the proposed changes and requires confirmation before applying them. It keeps action history and offers undo where supported, for a limited period. Other features, such as saving a generated plan or confirming a scan, follow their own controls; this is not a guarantee that every AI operation uses the same confirmation screen.
Training and storage. Domaiya uses Google’s managed models; it does not itself train a model. Google's published service terms restrict using customer data for model training without permission or instruction. That is not a guarantee that no provider processing, caching or abuse-monitoring retention occurs.
No significant automated decisions. Domaiya does not use AI to make decisions about anyone that have legal or similarly significant effects.
Ordinary generated meal and product illustrations use the public-image path described below. Where a request is classified and authorised as health-related, its generated meal picture uses private storage and access controls instead; it must not enter the public shared cache. These are different from your uploaded original photographs. Read the following public-image limitations before entering personal information:
Please do not type personal information, such as people’s names or health details, into dish or product names or meal notes.
Private health-related pictures. The health-related generation path checks the relevant sharing and AI choices before using a provider and again before releasing a result. It uses household-bound private storage and authenticated retrieval. Revocation, failed checks or discarded previews can prevent access or trigger cleanup; cleanup is not a promise that all provider or backup copies disappear immediately.
Access depends on your household role, management permissions and individual sharing choices. The owner and family members can access shared household areas, including money; this does not make private direct messages or private medication reminders visible to everyone.
Shared records can remain with the household after a member leaves or deletes an account. Household management status does not make someone the guardian of a child or authorise them to consent to another adult's health-data processing.
| Provider | Purpose | What they receive |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Cloud Storage, Secret Manager, Cloud Logging, Cloud Scheduler) | Hosting, database, file storage, scheduling, logging | All stored app data |
| Google Cloud Vertex AI | The AI features in section 4 | Only what section 4 lists, for the feature you use |
| Firebase Cloud Messaging and, on iPhone, Apple Push Notification service | Delivering push notifications; Firebase service reliability and improvement | Push tokens, notification text and Firebase installation identifiers; Firebase also receives device/app metadata and technical SDK diagnostics described in section 3.5 |
| Twilio | Historical SMS provider only; no new Domaiya sign-in codes, phone verification, reminders or SMS credit purchases | Phone number and verification request/result. For enabled reminders: verified destination, sender, generic reminder text, delivery-status information and opt-out/help replies |
| Resend | Sending service emails, such as verification and invitations | The recipient email address and the message |
| Geoapify | Optional address suggestions and reverse geocoding | Address text and country filter, or precise coordinates when you request current-location lookup; technical request information from our server. See Geoapify’s privacy policy. |
| Apple speech recognition on iPhone; Google or the configured speech service on Android | Live speech-to-text when you request it | Voice input may be processed by the phone’s speech provider under its service settings and terms; on-device processing depends on the device and service. Server-assisted audio transcription, when used, is described in section 4. |
| Open-Meteo (Switzerland) | Weather for your household | The city or postcode you entered and the country, turned into approximate coordinates. Requests come from our servers, not your device. Weather data by Open-Meteo.com, licensed CC BY 4.0; values are rounded |
| Open Food Facts (including Open Beauty Facts and Open Products Facts) | Looking up scanned barcodes and product information | The barcode number and technical request information from our servers, including the server IP address and application identifier. Loading a returned product image directly on your device also sends a request to its image host. Our lookup does not send your account or household identifiers |
| Apple App Store and Google Play | App distribution, testing and any purchases offered through the Store | Store-account and installation information is processed under the Store’s terms. Domaiya receives purchase identifiers, product, entitlement status and relevant dates for verification and support, rather than your payment-card details. Test and public availability can differ. |
We do not sell your personal information, and we do not share it with data brokers or advertisers. We may disclose information where we are legally required to, or to protect the rights and safety of users; we will not do so voluntarily otherwise.
Our application backend and database are hosted on Google Cloud in the United States, in us-central1. This does not mean all processing stays in that region. Vertex AI uses global routing; email, historical SMS and push providers may process information in the United States or other countries where their services operate.
International transfers require a valid legal mechanism where applicable. Depending on the recipient and transfer, that may be an applicable adequacy decision, current certification under the relevant Data Privacy Framework, or appropriate contractual safeguards with any necessary supplementary measures. An appeal against an adequacy decision does not by itself invalidate it, and contractual clauses alone do not establish that every transfer is lawful.
You can ask us at info@berflowit.com which safeguard applies to a particular provider.
Account and household records support ongoing use while the account or household exists. You can delete supported individual records or request deletion; the account-deletion rules below distinguish personal information from shared history. Generated public images have no confirmed automatic deletion period and are not guaranteed to disappear when an account is deleted. Their cache instructions allow copies to be cached for up to a year; copies outside our control may persist longer.
Technical and security logs support operation and investigation. Information deleted from active records may remain in backups until replacement.
We keep technical logs, notification records, assistant records, moderation records, generated public images, purchase identifiers and backups only as long as they are needed for the purposes described in this policy, or longer where the law requires it or to establish, exercise or defend a legal claim.
Historical SMS records. SMS is discontinued. Existing verification, consent, opt-out, delivery or credit-accounting records, if any, have different purposes and retention criteria. A verification challenge expiring or the service ending does not itself erase provider records, suppression history, accounting entries or backups. Contact us about a retained record.
Separate households. Homes are added or joined deliberately. Shared records and saved reviews remain associated with their original household; switching homes does not transfer them. An Owner may delete a home they own using the available confirmation controls. That removes its shared active records for all members, while other homes and the account remain. File cleanup, retained records, backups and exported copies follow the rules below.
In the app: open Settings → Delete account. A recent sign-in is required. The deletion process removes your login and sessions, private medication records, device tokens, notification preferences and records, and saved assistant plans. Your linked member profile is cleared and shown as “Former member”. Limited action history is retained with its actor and payload de-identified or cleared.
A household with remaining members is preserved. If you are its owner, ownership passes to an eligible existing family member aged at least 16 who can manage the household. If none qualifies, account deletion is blocked and the transaction is rolled back. You can appoint an eligible person or separately delete that household through Settings, then restart account deletion. Home deletion requires its own confirmation and permanently removes shared active records for all members; save needed records first. If those controls are temporarily unavailable, contact info@berflowit.com for assistance. If no members remain, the household and its household records are deleted. These rules apply separately to each household you belong to or own.
Shared content may remain. Messages, notes, documents, images and other shared history can remain with a surviving household, including personal information written inside that content. Referenced shared files are preserved. Unreferenced private uploads are cleaned up after database deletion, and that clean-up can fail or take longer. Exported copies and copies held by other people are outside our control. Contact us about information you cannot remove yourself.
If you delete the account that pays for a multi-home Premium plan, its existing household access is not extended by later store renewals. Access ends at the existing paid-through date, or earlier if a verified refund or expiry removes it. The Store may continue billing until you cancel. Deleting an account or household does not cancel a Store subscription. Cancel renewal using the purchasing Apple or Google account in the relevant Store. Cancellation and refund are separate. Billing references needed to prevent purchase reuse, process Store events or maintain an eligible household’s access may remain without the deleted account link; such references are pseudonymous, not necessarily anonymous. Section 8 explains retention.
Without the app: use the account deletion instructions or email info@berflowit.com. We may need proportionate evidence of your authority. Do not send passwords, one-time codes or complete identity documents in an initial email.
Historical SMS records. SMS is discontinued. If you contact us about an SMS-related record, we will distinguish account data from any information needed to keep an opted-out number blocked or resolve a recorded delivery or credit transaction. Account deletion must not be taken as confirmation that every provider record has been erased. Contact info@berflowit.com about retained data or a phone number that has been reassigned to a new owner.
Depending on where you live, you have the right to ask us to give you access to the personal data we hold about you, correct anything inaccurate, delete it, give you a copy in a portable form, restrict or object to certain processing, and withdraw consent where processing relies on it. You can also complain to a data protection authority.
Exercise any of these by emailing info@berflowit.com. We do not charge for it. Where the GDPR applies we will respond within one month, and will tell you if we need up to two further months and why.
You may complain to the Office of the Commissioner for Personal Data Protection in Cyprus or, where applicable, to the authority where you live, work or believe an infringement occurred. Naming our registered office does not determine which authority is the lead authority for every processing operation.
Domaiya’s standard Account minimum age is 16, subject to the Terms and applicable local law. People aged 16 or 17 may hold their own Account and exercise their data-protection rights; any guardian approval required by law remains necessary. Standard Accounts, guardian-managed child profiles and supervised sign-in are different. An age declaration for AI or purchasing does not itself verify identity, legal capacity or permission to process health information. A person can contact us directly about their information regardless of their household role.
Current availability. Creating a child profile does not create an account or send an invitation. New supervised sign-in enrollment is currently unavailable. A household role, date of birth or access to a screen is not verified identity, legal guardianship or consent. An account identified as requiring guardian review may be held from household access. Do not use another person’s account to bypass that hold.
Adults may maintain profiles for children without giving them a sign-in. Any future supervised sign-in must be explicitly available, satisfy the guardian-review process and meet the applicable local age requirements. The minimum policy age is 13 or a higher local minimum; this is not a statement that enrollment is available today. AI and purchasing have separate eligibility checks.
Children’s profile data, including allergies and dietary requirements, may be used for guardian-requested meal planning as described in section 4. A guardian or young person can contact us directly about their information. We do not ask for a child’s password.
Domaiya does not currently provide end-to-end encryption. The server and the service providers used for a feature can process data as described in this policy. HTTPS and encryption at rest are different protections.
No system is perfectly secure and we will not claim otherwise. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.
This policy shows its version and effective date at the top. Where a change requires additional notice or consent, we will give that notice or ask for that consent before the new processing starts. Posting a revised policy does not itself obtain consent. Earlier versions can be requested from our contact address.
This notice describes processing; it is not a blanket consent request and does not turn account registration or accepting Terms into permission for every use.
Where the GDPR or similar laws apply, we rely on these legal bases:
Health data. We process health data only to provide the features described in section 3.2. You can edit or remove health details on a member profile, and you can ask us at any time to stop processing health data about you. If you add health information about another adult, please make sure they know about it and agree; being a household manager does not give you authority to consent for another adult.
Information may come from you, another household member, a sign-in provider, a scan or AI inference. A person whose information was added by someone else can contact us directly. If you add information about someone else, please point them to this policy.
BERFLOW LTD, Miltonos 109A, 3047 Limassol, Cyprus · registered number HE 446915
info@berflowit.com · +41 78 350 04 42
A home can have a shared picture and colour, separate from a person’s profile photo. A person with permission to edit the home chooses a photo from the camera or library, can crop it, and saves it for that home. The picture is uploaded to private storage and accessed through authenticated household permissions; it is not one of the public AI-generated food pictures described above. Other authorised members of that home can see it. Replacing or removing the picture retires that home’s reference; other lawful references and cleanup or backup timing can affect when the underlying file disappears. We also save the home’s colour and a revision number to avoid silently overwriting a newer edit.
You may choose ordinary saved family notes to show on Home. The phone stores the selected note identifiers for the signed-in account and home, not an additional copy of their text as that preference. Home previews exclude protected documents and notes classified as health information; access to the original notes remains governed by their own controls. You can choose titles only or show a short preview of ordinary note text. The phone stores this display choice for the signed-in account and home, without an additional stored copy of note text in that preference. Other people looking at your unlocked screen may see the preview. Removing a note from Home does not delete the original note.
If you choose to find a suggested kind of shop in Maps, Domaiya opens Google Maps with that shop category and the selected city/country. The external search does not include your shopping-list contents, street address or precise device coordinates. Google receives your browser or Maps request under its own terms; Maps results are not a promise of stock, price or opening hours.
Invitation, verification and password-recovery messages use Domaiya’s shared email layout. Their action links keep their existing single-use or expiry rules. The layout does not add remote tracking images or scripts.
To recover a nutrition reading when the connection to your phone is interrupted, Domaiya temporarily keeps an encrypted copy of the result on its server. It includes the product and nutrition information read from the label and proof linking that reading to your account and home. This recovery copy does not include the photograph itself. Photo processing and any photo you choose to save follow the separate rules above.
The result is available for recovery for up to 24 hours from the scan request. After that, the app refuses recovery and scheduled cleanup removes the encrypted result. A limited record containing your account and home identifiers, a random request identifier, a one-way digest and processing times remains for a further 24 hours and 5 minutes to prevent accidental duplicate processing. Cleanup failures are retried; expiry still prevents the app from returning an expired result. Database backups follow the backup-retention rules in this policy. Account or household deletion removes the related recovery rows from the active database.
The phone may retain the unfinished scan and its original photo privately until you save or discard it. A short diagnostic stored with that draft records only a failure category, a time range, a response phase, a response status and whether the app left the foreground during the request. It does not contain the photo, label text, response body or a network address.