Security

HouseChores, a product of MASONBYTE LLC · Accokeek, Maryland
Last reviewed 25 August 2026.

The short version

HouseChores holds one kind of thing worth protecting: a household's board — who lives there, what needs doing, and the notes and photos a family attaches. We protect it with the database itself, not with promises: every row is guarded by Row-Level Security rules that decide, inside the database, who can see it. A bug in the app cannot widen access, because the app was never the thing deciding.

What we do, concretely

• Isolation is measured, not assumed. Before any change ships, an automated harness rebuilds the entire database from scratch and probes hundreds of table-by-table, person-by-person combinations to prove no household can reach another's data. A change that widens access fails the build.
• No passwords to steal. Sign-in is a one-time email link or Sign in with Google. There is no password database, so there is no password database to breach.
• Everything is encrypted — in transit (HTTPS everywhere, enforced) and at rest in the database and file storage.
• Photos lose their location before they leave your device. Any GPS coordinates hidden inside a photo are stripped during upload — a picture of the dishes should not say where your house is.
• Deletion means deletion. Deleting your account, a message, or a board removes it — nothing is archived where your household cannot see it. Messages clear themselves after 90 days. See deleting your data.
• No analytics, no trackers, no advertising in the family experience — the same commitment as our Privacy Policy, kept by the app's own Content-Security-Policy, which blocks the browser from talking to anyone we did not name.
• Our own servers are watched. Server errors are reported to an error-monitoring service that learns when something of ours broke — never what your household is doing.

Payments

When HouseChores Plus is purchased, checkout happens on Stripe's own hosted payment page. Your card number goes to Stripe and only Stripe — it never touches our servers and we never store it. This is the architecture the card industry's PCI DSS standard calls SAQ A: the merchant's systems stay out of the card path entirely, and ours do.

Privacy practices, everywhere

The practices Europe's GDPR is known for — collecting the minimum, deleting for real, saying plainly how long things are kept — are simply how HouseChores works for everyone, not a switch that flips for one region. We are a US product and do not claim GDPR certification (no such certificate exists for anyone); what we claim is the behavior, and the Privacy Policy states it in full.

How we check ourselves

We assess HouseChores annually against the Minimum Viable Secure Product checklist (MVSP v3.0), the open baseline written by security teams at Google, Salesforce, Okta and others. Latest assessment: 25 August 2026 — 18 of 25 controls met or not applicable, 5 partially met, 2 planned, the largest being an independent penetration test. We publish the honest number rather than a badge: every partial is owned and on the roadmap.

Reporting a vulnerability

If you find a security problem in housechores.app, we want to hear about it: support@masonbyte.com (also listed in our security.txt). We will acknowledge your report within three business days and keep you informed as we fix it.

• Scope: housechores.app and its API — using an account and household of your own. Please never access, or attempt to access, another household's data; if a bug shows you something that is not yours, stop and report it.
• Safe harbor: good-faith research within this scope will not be met with legal action by MASONBYTE LLC. No denial-of-service, no spam, no social engineering of households.
• No bounty program at this time — we say so rather than imply one. We will credit you, with your permission, when a report leads to a fix.

If something goes wrong

If we discover a breach that affects your information, we will notify affected households within 72 hours of discovering it, tell you plainly what happened and what we are doing, and follow the notification laws that apply. An incident-response plan exists before it is needed — that is the point of one.

Who helps us run this

A few trusted companies help run HouseChores — database and sign-in, website hosting, email delivery, and server error monitoring. They hold only what their job requires, none of them get your data for advertising, and the Privacy Policy describes each role.