Privacy Policy

Product: SimpleHaven Provider: Jazz Systems LLC ("we", "us", "our") Effective Date: 2026-05-27 Version: 1.0 (Full legal version. A consumer-facing marketing version is published separately.)

TL;DR (Plain English)

We built SimpleHaven to be the most private home-visualization app on the market. Concretely:

• Your scans live in Your iCloud, not with us. We use Your private CloudKit container. We can't read it.
• Processing happens on Your device. Scanning, color matching, furniture detection, hero-image rendering — all on-device by default.
• No tracking, no ads, no sale of data. We do not run advertising, do not sell personal information, do not share it for cross-context behavioral advertising.
• Apple ID is the only login. We don't have a password database to lose.
• HomeKit data stays on Your device. We read it via Apple's frameworks to show device state. We never get a copy.
• Rendered hero images are produced by an on-device model. No cloud upload required.
• If we ever offer cloud rendering, it's opt-in and anonymized. When used, the frame is retained only transiently on our side (no more than 60 seconds) and the third-party rendering vendor (Replicate) auto-deletes the input and output within approximately 1 hour per its API policy.

The rest of this document is the long, legally-precise version. In a conflict between the TL;DR and the formal sections below, the formal sections control.

1. Scope

This Privacy Policy describes how Jazz Systems LLC ("we", "us") collects, uses, discloses, and protects personal information in connection with:

• the SimpleHaven applications for iPhone, iPad, Mac, Apple TV, and any future Apple-platform clients;
• the getsimplehaven.com website;
• our customer-support and billing-support interactions.

We address several major privacy frameworks here:

• U.S. — California Consumer Privacy Act / California Privacy Rights Act (CCPA / CPRA), as amended and in effect January 1, 2026.
• EU/UK — General Data Protection Regulation (GDPR) and UK GDPR.
• U.S. — Children's Online Privacy Protection Act (COPPA) as amended (compliance deadline April 22, 2026).
• Apple — App Store Privacy "Nutrition Label" requirements and HomeKit / Health Records developer privacy requirements.

Other jurisdictions (Virginia, Colorado, Connecticut, Texas, Utah, Quebec, Brazil, etc.) have analogous statutes; we treat all users consistently with the highest-bar framework that applies to them.

2. Who We Are; How to Contact Us

Data Controller (GDPR Article 4(7)): Jazz Systems LLC Texas, USA

Privacy contact: [email protected] General legal: [email protected] EU Representative (Article 27 GDPR): Not applicable — US distribution only. UK Representative: Not applicable — US distribution only.

We do not currently meet the EU GDPR threshold requiring a Data Protection Officer (Article 37). When we do, we will appoint one and update this Policy.

3. Architecture in One Paragraph (So You Understand the Data Flows)

SimpleHaven uses Apple's CloudKit with a private container (iCloud.com.getsimplehaven.com). Within that container, Your data goes to the private database, which is part of Your iCloud storage, not ours. The technical effect is that we — Jazz Systems LLC — cannot read, copy, modify, or back up Your scans, room layouts, device assignments, or any other content You create. Apple operates the container under Apple's own privacy commitments (see https://www.apple.com/legal/privacy/data/en/icloud/). We see only StoreKit purchase metadata (product ID, transaction ID, purchase date, family-shared flag) and crash/diagnostic data that You opt to share through Apple's standard "Share with App Developers" toggle. We do not operate a separate backend that holds Your scans.

4. Categories of Information We Process

4.1 What stays on Your device and in Your iCloud (we do NOT see):

4.2 What we DO receive (limited set):

4.3 What we explicitly do NOT collect:

• Government-issued IDs, social security numbers, driver's licenses
• Precise GPS location (we use Apple's coarse "approximate location" only if a feature requires it; default is none)
• Biometric data for identification purposes (see Section 6.2)
• Health, medical, or wellness data
• Financial or payment card information (Apple handles payments end-to-end)
• Browsing history outside SimpleHaven
• Contact lists, calendars, or messages
• Microphone audio (we do not record audio; we may use audio briefly for a future TTS feature for appliance alarms, but never recorded/transmitted)
• Children's personal information (the Service is not directed to children under 13; see Section 9)

5. Purposes of Processing

We process information for the following purposes only:

5.1 Service delivery

• Provide the core scanning, rendering, visualization, and sync functionality
• Authenticate You via Your Apple ID
• Sync Your home data across Your own Apple devices via Your iCloud
• Enforce paid-tier entitlements based on StoreKit transactions

5.2 Billing and entitlement management

• Receive purchase metadata from Apple to grant/revoke paid features
• Handle Family Sharing entitlement (where Apple has indicated a shared purchase)
• Process refunds (Apple-administered; we receive notification of refund and revoke the entitlement)

5.3 Customer support

• Respond to emails You send to [email protected]
• Diagnose issues You report (using only information You voluntarily share)

5.4 Security and abuse prevention

• Detect and prevent reverse-engineering, license fraud, and abuse of the Service
• Maintain audit logs for security incidents

5.5 Service improvement (only where lawful)

• Aggregate crash/diagnostic data (only if You opted in via iOS) to fix bugs
• Aggregate anonymized usage statistics about which features are used (if and when we add such telemetry — currently we do not)

5.6 Legal compliance

• Comply with subpoenas, court orders, law-enforcement requests where legally required
• Preserve records as required by tax, employment, or other law

We do not process information for:

• Targeted advertising
• Profiling for credit, employment, insurance, housing, or eligibility decisions
• Sale or rental to data brokers
• Training third-party models on Your data

6. GDPR-Specific Disclosures

6.1 Lawful Bases (GDPR Article 6)

See the "Legal basis" column in Section 4.2. In summary: we rely on contract performance for service delivery and billing, legal obligation for tax/record-keeping, legitimate interests for crash diagnostics and security (subject to Your objection right under Article 21), and consent for opt-in features such as TestFlight enrollment and any future cloud-rendering pipeline.

6.2 Special Categories of Personal Data (GDPR Article 9)

We are conservative about Article 9 risk. Article 9 covers biometric data processed for the purpose of uniquely identifying a natural person, plus health, racial origin, religious belief, political opinion, sexual orientation, and similar categories. SimpleHaven's default operation does not process Article 9 data:

• No biometric identification. Our furniture-detection and color-clustering models are object/color classifiers, not face-recognition or person-identification models. The room-scanning framework operates on geometry, not on people; persons present during a scan appear (if at all) as transient depth blobs and are not identified.
• No facial recognition or face matching. We do not create face templates and we do not match faces.
• No inference of Article-9-protected attributes from interior images. We do not infer religion from religious objects in a room, political views from posters, sexual orientation from interior context, or health status from medical equipment visible in a scan. We strongly recommend users avoid scanning sensitive items they would not want to appear in their iCloud private database.

If a future feature would process Article 9 data, we will (a) re-disclose, (b) seek explicit consent under Article 9(2)(a), and (c) update this Policy with a clear "what changed" notice.

6.3 International Transfers (GDPR Chapter V)

Because User Content lives in Your private CloudKit database, the geographic location of Your data is determined by Apple's iCloud regional architecture. EU users' iCloud data is typically stored in Apple's European data centers per Apple's published policies; see https://www.apple.com/legal/privacy/. For the limited data we receive (StoreKit metadata, support emails, server-side web analytics), processing occurs via Apple CloudKit and Replicate (cloud render) and is currently located in the United States. We rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where applicable, and on Standard Contractual Clauses as a backup. If You are in the EU/UK, contact [email protected] for a copy of our SCCs.

6.4 Data Subject Rights (Articles 12–22)

EU/UK residents have the following rights, subject to lawful exceptions:

• Right of access (Art. 15) — request a copy of the personal data we hold about You.
• Right to rectification (Art. 16) — request correction of inaccurate data.
• Right to erasure / "right to be forgotten" (Art. 17) — request deletion. Note: most of Your content is in Your iCloud, which You control directly; for the limited metadata we hold (e.g., support tickets, purchase records), we will erase except where retention is required by law (e.g., tax records).
• Right to restriction (Art. 18) — request we stop processing in defined circumstances.
• Right to data portability (Art. 20) — request Your data in a machine-readable format. (For scans, You already have export via Settings → Export Scan.)
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Rights re automated decision-making (Art. 22) — we do not make decisions with legal or similarly significant effects based solely on automated processing.
• Right to withdraw consent (Art. 7(3)) — withdraw consent at any time without affecting prior lawful processing.
• Right to lodge a complaint with a supervisory authority (Art. 77) — typically Your country's data-protection authority.

To exercise any right, contact [email protected]. We will respond within 30 days of a verified request, with a possible 60-day extension where complex. We will verify Your identity via Your Apple ID email and an in-app confirmation where feasible.

6.5 Retention (Article 5(1)(e))

We retain personal data only as long as necessary for the purpose. Specific retention windows are in Section 4.2.

6.6 No "Significant Decisions" Automated Processing

We do not use automated profiling to make decisions that produce legal or similarly significant effects.

7. CCPA / CPRA-Specific Disclosures (California residents)

7.1 Categories Collected (in the 12 months prior to the Effective Date)

The categories enumerated in Cal. Civ. Code § 1798.140 that we collect are:

We do not collect, in the past 12 months:

• (B) Customer records (no separate account system)
• (C) Characteristics of protected classifications under CA or federal law
• (D) Commercial information
• (E) Biometric information
• (H) Sensory data (audio, visual, thermal, olfactory)
• (I) Professional or employment-related information
• (J) Education information

7.2 Sale and Sharing

We do not sell personal information and we do not share personal information for cross-context behavioral advertising, as those terms are defined in Cal. Civ. Code § 1798.140(ad) and (ah). Because we do not sell or share, the "Do Not Sell or Share My Personal Information" link required by § 1798.135 is not strictly required, but we will still honor any signal a California resident sends (including the Global Privacy Control signal on our web property).

7.3 Rights of California Residents

California residents have the following rights:

• Right to know (§ 1798.110, .115)
• Right to delete (§ 1798.105)
• Right to correct (§ 1798.106)
• Right to opt out of sale/sharing (§ 1798.120) — not applicable to us as we do not sell/share, but we will honor opt-outs we receive
• Right to limit use of sensitive personal information (§ 1798.121) — not applicable as we do not collect sensitive PI
• Right to non-discrimination (§ 1798.125) — we do not discriminate against You for exercising privacy rights
• Right to portability (subset of right to know)

To exercise, contact [email protected]. We will verify identity via Apple ID email + an in-app confirmation where feasible. We will respond within 45 days, with a 45-day extension where complex.

Authorized agents acting on a California resident's behalf must provide signed permission and proof of identity.

7.4 Retention (CPRA § 1798.100(a)(3))

See Section 4.2 above; we do not retain personal information for longer than reasonably necessary for the disclosed purposes.

7.5 No Financial Incentives

We do not offer financial incentives in exchange for personal information.

8. Other U.S. State Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Tennessee (TIPA), Montana (MCDPA), Indiana (INCDPA), Iowa (ICDPA), Delaware (DPDPA), New Hampshire (NHPA), New Jersey (NJDPA), Maryland (MODPA), Minnesota (MNCDPA), Nebraska (NDPA), Rhode Island (RIDPA), and other states with comprehensive consumer-privacy laws have rights analogous to CCPA/CPRA (access, deletion, correction, portability, opt-out of targeted advertising / sale, opt-out of profiling for legally significant decisions). We honor these rights through the same contact channel: [email protected].

9. Children's Privacy (COPPA / Apple Kids Category)

SimpleHaven is not directed to children under 13. We do not knowingly collect personal information from children under 13. The App Store rating is 4+ (suitable for ages 4 and up) but the app's primary use case (scanning and customizing a home) presumes an adult user.

If we learn we have collected personal information from a child under 13 without verifiable parental consent in compliance with COPPA (16 C.F.R. Part 312, as amended with the April 22, 2026 compliance deadline), we will delete that information promptly.

If You are a parent or guardian and believe Your child under 13 has provided personal information through SimpleHaven, contact [email protected].

COPPA 2.0 and teen protection: Should the pending Children and Teens' Online Privacy and Protection Act ("COPPA 2.0") be enacted into law, we will extend equivalent protections to users under 17 as required.

10. Apple Frameworks — Specific Disclosures

10.1 HomeKit

Per Apple's developer requirements, our use of HomeKit data is governed by the following:

• No use for advertising. We do not use HomeKit data for advertising or marketing.
• No use for data mining. We do not data-mine HomeKit data.
• No off-device transmission by SimpleHaven. We read HomeKit accessory state on-device via Apple's HomeKit framework and display it spatially in the app. We do not transmit HomeKit data to our servers.
• No third-party sharing. We do not share HomeKit data with third parties.
• No service-improvement use of HomeKit data without separate, explicit consent.
• HomeKit configuration changes from within SimpleHaven are limited. v1 is read-only; future write features (e.g., toggling a light from the spatial dashboard) will use Apple's HomeKit framework with the user's existing HomeKit grant.

10.2 Matter

Same restrictions as HomeKit. Matter accessories are accessed via Apple's Home framework on-device only.

10.3 Room Scanning

Scans are produced on-device by Apple's room-scanning framework using the depth sensor (where available) and camera input. The resulting scan file is written exclusively to Your private CloudKit database; raw camera frames are processed transiently and discarded. We do not transmit raw frames, depth data, or geometry to our servers in the default configuration.

10.4 CloudKit Private Container

Apple operates the iCloud service under Apple's iCloud Privacy commitments. SimpleHaven's CloudKit private container has the following structure:

• iCloud.com.getsimplehaven.com — the SimpleHaven CloudKit container, owned by Jazz Systems LLC at the developer-account level.
• Private Database — Your data, stored in Your iCloud. We do not have administrative read access. Inaccessible to other users.
• Shared Database — used only when You explicitly create a CKShare (e.g., for a future household-sharing feature). We do not have read access here either.
• Public Database — not currently used by SimpleHaven. If we add a Public Database use (e.g., for a community catalog of templates), only data You explicitly publish would go there, and that would be subject to a separate consent flow.

10.5 Privacy Manifest (PrivacyInfo.xcprivacy)

Per Apple's privacy-manifest requirements (effective spring 2024), SimpleHaven includes a PrivacyInfo.xcprivacy file declaring all data types we access and the Required Reason API uses. We update this file as the codebase evolves.

11. Automated and Generative Features

11.1 On-Device by Default

The Application performs all automated inference on-device unless and until We explicitly offer a cloud-rendering opt-in. The on-device stack includes:

• Object/furniture detection — on-device image classification
• Color clustering — on-device color clustering
• Hero-image rendering — performed on the user's device
• Room/zone naming suggestions — a small on-device language model (where available) or a heuristic fallback

None of these models train on Your data. The models are frozen at the version we ship; running inference on Your scans does not improve them.

11.2 Generative Model License Compliance

The generative models used for on-device rendering are licensed under the CreativeML Open RAIL++-M License (and openrail++ variant), which contains use-based restrictions prohibiting use to generate or propagate content that, among other things, (a) defames, harasses, abuses, threatens, or is harmful to others; (b) discriminates against individuals or groups; (c) violates applicable law; (d) generates personal data without consent or for unlawful purposes; (e) creates non-consensual deepfakes or sexual content involving real persons; or (f) is used in the administration of justice or law enforcement without human oversight.

By using SimpleHaven's rendering features, You agree to comply with these use-based restrictions. See OPEN_SOURCE_ATTRIBUTIONS.md for the full text and pointers to the upstream license.

11.3 Future Cloud Rendering (Not Currently Active)

If we ever offer a cloud-rendering option (for example, to render a higher-quality hero image than the on-device model can produce on older hardware), it will:

• Be opt-in, with a clear consent flow describing what is sent and what is returned;
• Send only the minimum data necessary — typically a thumbnail of a single room view + a prompt — and not Your full scan;
• Strip identifiers before the upload (no Apple ID, no precise device model unless required, no IP-address-derived identity);
• Retain the frame only transiently — no more than 60 seconds on our (proxy) side — and rely on the third-party rendering vendor (Replicate) to auto-delete the input and output within approximately 1 hour per its API policy;
• Run in a U.S. data center (or, for EU users, an EU data center) per the same regional posture Apple uses;
• Not be used to train any model.

We will update this Policy with full specifics before launching any such feature.

12. Cookies and Web Analytics (getsimplehaven.com)

The getsimplehaven.com marketing website may use:

• Strictly necessary cookies for site security and basic navigation (no consent required).
• Aggregate, anonymized analytics via a privacy-respecting tool (e.g., self-hosted Plausible/Umami). We do not use Google Analytics, Facebook Pixel, or other invasive tracking.
• No advertising cookies, no cross-site trackers.

A cookie banner conformant with the EU ePrivacy Directive will be presented to EU/UK visitors. The Global Privacy Control browser signal will be honored as an opt-out request.

13. Affiliate Links

When You click an affiliate link in SimpleHaven or on getsimplehaven.com, the third-party retailer (e.g., a paint or furniture brand) may set its own cookies and may collect data about Your visit per its own privacy policy. We share with affiliate networks only aggregate click data (e.g., "user clicked from SimpleHaven" plus the product SKU). We do not share Your name, Apple ID, email, precise location, or Your home/scan data. See TERMS_OF_SERVICE.md Section 9 for our FTC affiliate-disclosure practices.

14. Security

We follow industry-standard practices to protect personal information:

• Apple-managed encryption at rest and in transit for CloudKit data (per Apple's published practices, which include end-to-end encryption for many iCloud categories under Advanced Data Protection where the user has opted in).
• TLS for all transmissions between Your device and any service we use (currently limited to billing receipts via Apple and inbound support emails).
• Principle of least privilege for our limited internal access to support tickets and revenue records.
• No long-lived secrets in client code. Apple StoreKit signing keys are server-side.
• Bug bounty / responsible disclosure: report security issues to [email protected].

No system is 100% secure. If a breach occurs that affects Your personal information, we will notify You and the relevant regulator(s) in accordance with applicable law (e.g., GDPR Article 33 — within 72 hours where required; state-level breach-notification laws).

15. Children's Family Sharing Considerations

Apple Family Sharing entitles a family organizer to share an in-app purchase with up to five additional family members. If a family member is under 13:

• The under-13 child uses the family organizer's payment method per Apple's rules.
• The under-13 child's experience of SimpleHaven is identical to an adult's experience — but the Service is not directed to children under 13, and we recommend parents supervise use and disable the share for children under 13 if they prefer.

Apple, not we, controls who can be added to a Family group and what content is shared.

16. Government and Law-Enforcement Requests

We respond to legally valid requests from government and law-enforcement authorities. Because Your content lives in Your iCloud private database, in most cases authorities would need to direct their request to Apple, not to us. When we do receive a request:

• We require a valid legal process (subpoena, court order, warrant) appropriate to the data sought.
• We narrow the response to the specific data legally compelled.
• We notify You where legally permitted (some orders prohibit notice).
• We log the request and, where lawful, publish aggregate statistics in a future Transparency Report.

17. Changes to This Policy

We may update this Policy from time to time. Material changes (e.g., a new category of data we collect, a new processing purpose) will be:

• Announced via in-app notice and at getsimplehaven.com with reasonable notice (at least 14 days for material changes);
• Logged in the "Revision History" section below;
• Where consent is the lawful basis, accompanied by a fresh consent flow.

The "Effective Date" at the top of this document indicates when the current version took effect.

18. Specific Statutory Rights — Summary

19. Contact

Jazz Systems LLC (operator of SimpleHaven) Attn: Privacy Team Texas, USA

Privacy: [email protected] Security: [email protected] General Legal: [email protected]

SimpleHaven v1 is distributed in the United States only; an EU/UK Article 27 representative is therefore not applicable. The GDPR/UK GDPR disclosures in this Policy are provided for transparency and will govern if and when EU/UK distribution begins, at which point a representative will be appointed.

20. Revision History

End of Privacy Policy.