Privacy Policy
· development
Privacy Policy
Last updated: 30 July 2026
This Privacy Policy explains how Håkon Yndestad (“I”, “me”, or “haakony.no”) collects, uses, and protects personal information when you use:
- haakony.no (personal website)
- HomeFolio (home documentation / virtual tour app)
- Orebound (mobile game)
- Kinetiq (fitness / workout app)
I am the data controller for these products. Contact: haakony@gmail.com · https://haakony.no
This notice is written for transparency under the GDPR and similar laws. It is not legal advice.
1. Products covered
| Product | What it is | Where data lives |
|---|---|---|
| haakony.no | Personal website and posts | Web hosting |
| HomeFolio | Document and explore a home with photos, plans, and tours | My servers (database + object storage) and your device |
| Orebound | Offline space-mining game | On your device; ads and purchases go through store/ad partners |
| Kinetiq | Fitness app with activity sync, GPS, and optional AI coach | My servers and your device; also Strava, Garmin, and AI providers when you connect or enable them |
Only the sections that apply to the product you use are relevant to you.
2. HomeFolio
What I collect
- Account: name, email address, password (stored hashed) or Sign in with Apple / Google identity
- Home content you upload or create: home name, optional address, floor plans, rooms, photos (including 360°), videos, documents, notes, links, contact details you attach to items, LiDAR / room measurements and 3D models (on supported iPhones)
- Sharing: membership (who you invite), invite links, and member display names / emails visible to other members of a home
- Technical: session token (cookie or on-device storage), basic server access logs (for example IP address, time, path) used for security and rate limiting
I do not use advertising SDKs, marketing analytics, or payment processors in HomeFolio today.
Why (purposes and legal bases)
| Purpose | Legal basis |
|---|---|
| Create and run your account and homes | Contract (providing the service you asked for) |
| Store and show your home content | Contract |
| Invite others and share a home | Contract / your instruction |
| Sign-in with Apple or Google | Contract; the provider authenticates you |
| Security, abuse prevention, rate limits | Legitimate interests (keeping the service safe) |
| Respond to privacy or support requests | Legal obligation and/or legitimate interests |
Sharing
- Other members of a home you own or join can see that home’s content and the member list (including email and display name).
- Apple or Google if you choose their sign-in.
- Hosting and infrastructure I use to run the app (database, object storage, server hosting).
- Authorities if required by law.
I do not sell your personal information.
Retention
- Account and home data: until you delete the account or home, or ask me to erase them.
- Session tokens: expire after about 7 days (you can sign out earlier).
- Invite links: expire after about 7 days if unused.
- Server logs: kept only as long as needed for security and operations (short period), then discarded.
- Copies cached on your device (for example panorama cache) are removed on sign-out or account deletion where the app controls them.
Your controls in the app
- Delete account in Settings (removes homes you own and their files; homes shared with you stay with their owner).
- Delete a home if you are the owner.
- For a copy of your data (access / portability), email haakony@gmail.com — I aim to respond within 30 days.
3. Orebound
What is collected
- On your device only: game progress, settings, and preferences (for example in local storage). There is no Orebound account on my servers.
- Advertising (Google AdMob) on mobile builds: advertising identifiers and related device/ad data, subject to platform consent (including Google’s UMP consent form and, on iOS, tracking permission where required).
- Purchases: Apple App Store or Google Play, and RevenueCat for entitlement checks. They process purchase receipts and an anonymous customer identifier.
I do not receive your full payment card details.
Why
| Purpose | Legal basis |
|---|---|
| Save your game on the device | Contract / your use of the game |
| Show ads (if not removed by purchase) | Consent where required (UMP / ATT); otherwise legitimate interests for non-personalized ads where allowed |
| Process in-app purchases | Contract |
Sharing
Google (AdMob), Apple, Google Play, RevenueCat, and advertising attribution partners as configured by the OS / ad SDKs. Resetting progress in the game clears local saves; it does not delete data held by Apple, Google, or RevenueCat — use their tools or contact me if you need help.
Retention
Local data until you reset progress, clear app data, or uninstall. Ad and purchase partners keep data under their own policies.
4. Kinetiq
What I collect
- Account: name/email, password (hashed) or Apple / Google sign-in; optional profile (age, weight, height, sex, photo, display name, preferences)
- Fitness and health-related data: activities, heart rate and other streams, strength workouts, achievements; when connected, data from Strava and/or Garmin (which may include heart rate, sleep, stress, HRV, steps, and similar metrics, plus raw sync payloads)
- Location: GPS tracks for outdoor activities and routes; routes you mark public may be visible to others
- Integrations: OAuth tokens for Strava/Garmin; if you choose “remember login” for Garmin, encrypted credentials may be stored to keep sync working
- Optional AI coach / voice: when enabled, limited workout context (for example exercise name, weight, reps) may be sent to the configured text and/or speech providers to generate coaching
- Media: activity photos/videos and generated voice clips stored in object storage
- Technical: session cookie or on-device token; security logs
This includes health-related and precise location data. I process it only to provide Kinetiq features you use.
Why
| Purpose | Legal basis |
|---|---|
| Account and core app features | Contract |
| Health and biometric-related metrics needed for fitness features | Explicit consent and/or contract for features you actively use (connecting Strava/Garmin, recording HR, etc.). You can disconnect integrations and delete your account |
| GPS recording and private routes | Contract / your use of outdoor features |
| Making a route or leaderboard profile public | Your choice (consent / contract for that feature) |
| AI coach / TTS when you turn it on | Consent / contract for that optional feature |
| Security and abuse prevention | Legitimate interests |
Sharing
- Strava / Garmin when you connect them (their policies also apply).
- Apple / Google for sign-in.
- AI / TTS providers you enable coaching with (for example OpenAI, OpenRouter, ElevenLabs, or a self-hosted model — depending on configuration).
- Map tile / geo helpers used to display maps (for example national map services, OpenStreetMap-related tiles, and coarse IP-based map centering).
- Hosting (database, object storage, server).
I do not sell your personal information.
Retention
Account and synced data until you delete your account or specific content, or ask me to erase them. Session length is configured on the server (on the order of weeks). Local offline / live-session copies on your device may remain until you clear app data.
Your controls
- Delete account in Settings.
- Disconnect Strava/Garmin; turn off AI coach.
- Set route visibility (private vs public) and leaderboard opt-in.
- For a full copy of your data, email haakony@gmail.com (target: 30 days).
5. haakony.no (website)
When you visit the site, the host may process standard web server logs (for example IP address, browser type, pages requested, time). If you email me, I process the content of that correspondence to reply.
I do not run advertising trackers on the site for these products. If that changes, this policy will be updated.
6. Cookies and similar technologies
| Product | What |
|---|---|
| HomeFolio | Essential session cookie (homefolio_token) or equivalent on-device token; local preferences and media cache |
| Kinetiq | Essential session cookie / on-device token; local preferences and offline data |
| Orebound | Local game storage; ad SDKs may use their own identifiers subject to consent |
| haakony.no | Hosting may set strictly necessary cookies if required by the host |
Essential login cookies do not require a marketing cookie banner. Orebound uses a consent form for personalized ads where required.
7. International transfers
Some providers (for example Apple, Google, AdMob, RevenueCat, Strava, Garmin, and certain AI providers) may process data in the United States or other countries outside your own. Where required, I rely on appropriate safeguards used by those providers (such as Standard Contractual Clauses or an adequacy decision). My own application databases and object storage are operated on infrastructure I control; I aim to keep them in the EEA where practical.
8. Security
I use reasonable technical and organizational measures (access control, HTTPS in production, hashed passwords, encrypted integration secrets where implemented). No method of storage or transmission is perfectly secure.
9. Children
These products are not directed at children. Do not use them if you are under 13, or under the digital consent age in your country if that age is higher. I do not knowingly collect personal data from children. If you believe a child has provided data, contact me and I will delete it.
10. Your rights (EEA / UK and similar)
Depending on where you live, you may have the right to:
- Access your personal data
- Correct inaccurate data
- Delete data (“erasure”)
- Restrict or object to certain processing
- Withdraw consent where processing is based on consent
- Receive a portable copy of data you provided
- Lodge a complaint with a supervisory authority (in Norway: Datatilsynet)
To exercise these rights, email haakony@gmail.com. For HomeFolio and Kinetiq you can also delete your account in the app. I aim to respond within 30 days.
11. Changes
I may update this policy from time to time. The “Last updated” date at the top will change. For significant changes I may provide additional notice in the relevant app or on the site where appropriate.
12. Contact
Håkon Yndestad
Email: haakony@gmail.com
Website: https://haakony.no
Privacy policy URL (canonical): https://haakony.no/posts/privacy-policy