Privacy policy

Effective October 6, 2026

Homebase is a self-hosted browser home page. It runs as a small server on the user's own Windows PC, listening only on that computer (localhost). There is no Homebase cloud service: its developer, davideAurum, does not operate any server that receives, stores or processes your data.

Data Homebase accesses from Google

When you connect a Google account and approve access on Google's consent screen, Homebase can access:

Account identity (openid, userinfo.email, userinfo.profile): your email address and name, used to label the connected account in Homebase.
Calendar list (calendar.calendarlist.readonly): the names and colors of your calendars, so you can choose which ones to show.
Calendar events (calendar.events): event titles, times, locations and descriptions, to display your calendar and to create, edit and delete events when you ask it to.
Gmail (gmail.modify): the unread count and, for recent inbox messages, the sender, subject, date and Google's short preview snippet. Homebase does not download message bodies or attachments. It uses this permission only to mark messages read or unread, archive them, or move them to the trash when you ask it to. It never sends mail and never permanently deletes mail.

How the data is stored

OAuth tokens are stored only on your PC, encrypted (AES-256-GCM under a key protected by Windows DPAPI), and are never returned to the browser.
Calendar events are cached in a local database on your PC so the page loads quickly.
Mail is never written to disk; message lists are held in memory for about a minute.

Sharing

Homebase does not sell, share or transfer Google user data to anyone. The only network traffic carrying your Google data is between your PC and Google's own APIs. Homebase has no analytics, advertising or tracking, and does not use Google user data to develop, improve or train AI or machine-learning models.

Limited Use

Homebase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Other services

If you connect them, Homebase talks directly from your PC to Microsoft (Outlook.com), Yahoo, CalDAV/IMAP servers and Todoist under the same rules: data stays on your PC and is used only to show and act on your own calendar, mail and tasks. Weather requests send the coordinates of the location you choose to Open-Meteo. Bookmark icons are fetched from the bookmarked websites.

Removing access and deleting data

Removing an account in Homebase (Settings → Accounts) deletes its tokens and cached events from your PC and revokes Homebase's access at Google.
You can also revoke access at any time at myaccount.google.com/connections.
Uninstalling Homebase and deleting its data folder removes everything it stored.

Changes and contact

If this policy changes, the new version will be posted on this page with a new effective date. Questions: github.com/davideAurum.