This notice says what stays on this computer and what HouseShepherd sends somewhere else. It is part of the template in legal/. Have a lawyer review it before you distribute HouseShepherd.
HouseShepherd is a program that runs on your computer. It is not an account you sign up for with the owner. The owner does not operate a server that receives your scans, your device list, or your passwords.
What stays on this computer
- The database of scans, alerts, incidents, settings, and the "not a threat" marks (data/netaudit.db).
- Logs, reports, and backups under the data folder.
- Phone dumps (data/phone-dumps). Once a day, a raw folder older than 30 days is deleted. The newest 3 folders are always kept. A folder is kept when a phone check is running, or when that folder was changed in the last hour. Phone check results (data/phone-results) are kept. None of this is uploaded.
- Router and connector passwords and API keys you type. On Windows, a UniFi password can be encrypted for your Windows user. These secrets are sent only to the address you typed on your own network, not to the owner.
- Threat lists after they have been downloaded, so HouseShepherd can keep working offline.
- Whether you accepted the license (data/eula-accepted.json stores the time and a fingerprint of the license text, not your name).
- Which pages you open, if you leave that recording on. That count stays in the local database. It is not sent to the owner. You can turn it off under Your features.
- A leaked-password check never stores the password. The page hashes it in the browser.
What is sent, and to whom
HouseShepherd does not send your home IP address, host names, or scan results to the owner. It does contact other people's services when you use the feature that needs them:
- Update checks: HouseShepherd checks for updates by connecting to GitHub (api.github.com). The request does not include your program version, a device ID, or any other information about your computer. GitHub receives your IP address and the time of the request. We do not operate that server or receive that record. GitHub's privacy statement governs how long GitHub keeps it: https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement
- Threat feeds. When you refresh lists, HouseShepherd downloads public lists from abuse.ch (Feodo Tracker and URLhaus). The download is the list itself. Your private addresses are not uploaded with it.
- CISA Known Exploited Vulnerabilities. HouseShepherd may download CISA's public catalogue.
- NIST National Vulnerability Database. If you turn on CVE lookup, HouseShepherd sends product names and version strings to services.nvd.nist.gov. It does not send IP addresses or host names. An optional API key you set is sent only to NIST.
- Have I Been Pwned k-anonymity (passwords). The browser sends HouseShepherd only the first 5 characters of the SHA-1 hash of a password. HouseShepherd sends those 5 characters to api.pwnedpasswords.com and receives a list of matching hashes. The password and the rest of the hash do not leave the browser. Nothing is stored.
- Have I Been Pwned breaches (optional). If you save an API key and check an email address, HouseShepherd sends that address and the key to haveibeenpwned.com.
- XposedOrNot. If you check an email address for a public breach, HouseShepherd sends that address to api.xposedornot.com.
- Shodan InternetDB and ipify. The optional "what the internet can see" check asks api.ipify.org for this network's public address and then asks internetdb.shodan.io about that address.
- Notifications you set up. If you connect ntfy, Discord, Telegram, Pushover, or a webhook, the message you send (a test, an alert, or a weekly summary) goes to that service. A public ntfy topic can be read by anyone who knows the topic name.
- Problem reports. A report is sent only when you press the button that sends it, to the ntfy topic configured for that.
- Phone self-check. The phone page loads test addresses (advertising and connectivity hosts) from the phone itself so it can see whether those hosts are blocked. Those requests come from the phone, not from a HouseShepherd account.
- Connectors. A connector you add talks only to the private address you typed (your router, Pi-hole, firewall, or similar). HouseShepherd refuses a connector pointed at a public address.
- License check. About once a week, and when you press Check plan, Activate, or Move this seat, HouseShepherd contacts the license server address in license-server.url (or the HOMESOC_LICENSE_SERVER setting). It sends the license key, a random id created on this computer (data/machine-id), the name of this computer, the home name you typed, and which plan the key is for. It does not send your scan database, device list, packet capture, or passwords. The server answers with a signed license file that is saved in data/license.json. Between those checks HouseShepherd uses that file and does not need the network. If this PC shares status with a Family Helper, HouseShepherd sends a home name you typed, a security score, urgent alert kinds and titles (addresses removed), whether the monitor is running, when it last checked in, a patch count, and a drill score. It does not send IP addresses, MAC addresses, host names, device names, or browsing. The helper can send a note back. The helper cannot run a fix.
- Integrity report. A released copy that finds its files, license, or clock have been changed, or that license and update checks have been failing for several weeks, sends a short report to the license server. The report is the license key, the seat id (the random id in data/machine-id), the program version, the names of files that did not match (not the contents), a reason code, and the time. It does not include a scan, a device list, an email address, the computer's name, or your home IP address. The license server may also record, when a key is activated, a hash of the network address and a country code so the owner can see a key used from more places than the plan allows. The address itself is not stored. A source checkout (the folder you edit) and a test license do not send this report. The owner can turn on a phone or email alert for those reports. That alert goes to the owner, not to a buyer.
- Business-use report. HouseShepherd is licensed for homes. This build does not look for a business network, does not show a business-use notice, and does not send a business-use report. If a later version adds this check, this notice will be updated before that version sends any report. The license server can store a report if one arrives. A stored report is a score, reason codes, the plan name, the program version, and a random install id. That id is not your license key and not the seat id in data/machine-id. The report does not include a computer name, domain name, user name, IP address, or device list. The license server receives your network address when the report arrives but does not store it. The owner uses a stored report only to check that the license matches how the program is used, may be alerted to it by phone, email, or webhook, and may list the install id in the weekly summary. Reports are kept for 12 months.
- Usage counts (optional, off unless you turn it on). After you accept this notice, HouseShepherd asks you once whether to send usage counts. Yes and No are shown the same way, and you can change your answer at any time in Settings under Privacy. If you say yes, HouseShepherd sends one batch to the license server about once a week. A batch contains a random install id created for this purpose (not your license key and not the seat id), the plan name, the program version, the major version of the operating system, and counts of pages opened and of a few actions, such as how many times Patch status was opened or a fix was applied. If you mark a help article Yes or No, the batch can also include that count, named only by the article id, such as help.yes.getting-started. It does not include the question you type into Help. It never includes device or computer names, your user name, an email address, IP or MAC addresses, scan findings, file paths, web addresses, threat matches, or anything from an integration. The license server receives your network address when a batch arrives but does not store it. Settings shows the exact next batch before it is sent, and the batches already sent. The owner uses the counts only to understand which features are used and to improve HouseShepherd. The batches are kept for 24 months. Running totals and the weekly snapshot are not removed by that purge. They are combined counts across all installs and are not linked to any install id. Delete my data asks the license server to delete the batches and any feedback stored under your install id, and to subtract those batches from the running totals. Reset install id starts a new id. Counts sent under an old id stay until you delete them or the 24 months pass.
- Feedback you choose to send. Send feedback, in the sidebar and in Settings, sends the text you type, and a category if you pick one, to the license server so the owner can read it. It works on every plan, including Free. Your email address is included only if you type it because you want a reply, and it is used only to reply. Diagnostics are attached only if you tick Attach diagnostics, and the page shows the exact attachment first. The attachment is the same limited batch described under Usage counts. If usage counts are on, that batch includes its install id. If they are not, the install id in the batch can be blank, and the feedback is stored under a separate id. Nothing else is added. Please don't include passwords or other sensitive details in feedback. Feedback is kept for 24 months after your last message from that install id. The email address you typed is stored with the message and deleted with it. A reply the owner sends you is not stored on the license server. You can ask for the stored message to be deleted sooner with Delete my data or by writing to the owner.
- Payment. If you buy a plan, you pay on the store's page (Lemon Squeezy, unless the owner has switched the license server to another store). The card number goes to that store, not to HouseShepherd and not to the owner. The store then tells the license server the email and order number on the receipt so a license key can be created. The receipt page (the license server's /thanks page) asks for that email and order number so it can show the key.
What houseshepherd does not do
- It does not ask you to create an account with the owner. A license key is not an account.
- It does not upload your scan database, packet capture, or passwords to the owner.
- It does not send usage counts unless you turn that on. The choice is off until you say yes.
- It does not sell your data. There is no advertising network in the program.
Children
Family safety stores names and account identifiers you type, on this computer, so it can warn you if a marked child is an administrator. It does not send that list to the owner.
Changes
If this notice changes, the copy shipped with a new version is the one that applies to that version. The license agreement is shown again when its own text changes.