Signing in
Every HomeHerald account signs in through Firebase Authentication, Google’s sign-in service. You can sign in with an email address and password, with Google, or, on iPhone, with Apple.
When a board disconnects an outside management company, the security rules themselves end that company’s access to the community’s records - not just the screen it used to see.
Who can read a community’s records
HomeHerald stores each community’s records in Cloud Firestore, behind security rules that Google’s servers check on every read and write the app makes from your browser or phone. The rules check that the person is signed in and holds a seat in the community the record belongs to. Board-only actions also check that the seat is an admin or board member of that same community. A request that does not pass the rules is refused by the database, whatever the app on the other end asks for.
HomeHerald’s own platform administrator can read across communities to provide support and keep the service running.
Payments: Stripe holds residents’ card and bank details
When a resident pays, the card or bank details are typed into Stripe’s own secure payment fields, so they go to Stripe, not into HomeHerald’s database. Online charges, saved payment methods and AutoPay run through Stripe.
If someone gives Herald a card number in digits, on the phone or in a chat, the conversation record keeps only the last four.
Keys and passwords to other services
The keys HomeHerald uses to charge through Stripe, to send email through Resend, to send Herald’s texts and to reach the voice service are kept in Google Cloud Secret Manager, and each is released only to the server functions that declare it.
HTTPS everywhere
The website and the web app are served only over HTTPS. Browsers are told to keep using HTTPS for a year on homeherald.ai and its subdomains (HTTP Strict Transport Security), pages cannot be framed by other sites, and a content security policy limits which outside services a page may load or talk to.
Backups
- Every night at 2 a.m. Central, HomeHerald backs up the records of every community on a plan or a free trial.
- On the last day of every month, a monthly backup is taken as well.
- Uploaded files (documents, photos, receipts) are copied to a backup store every night right after the records.
- Every morning, an automatic check confirms the night’s backups actually ran.
- What is kept: of the record backups, on a paid plan, the last 7 nightly and the last 3 monthly, alongside any the board takes by hand. Backup copies of uploaded files are kept.
Herald conversation records are deliberately left out of backups, so no copy outlives their 12 months.
Deleting your account
Any member can delete their own account in the app under Profile > Delete Account. It removes the person from every community they belong to, clears their link to a property, ends their AutoPay if they were paying, and deletes their sign-in account. The community’s own records, such as its payment history, stay with the community, and backups age out on the schedule above.
Herald conversations are handled differently, and we say so plainly. HomeHerald keeps a record of conversations with Herald for 12 months, then deletes them automatically. When you delete your account, your name, account and phone number are removed from that record. The words themselves stay until their 12 months end. Only HomeHerald’s platform administrator can read that record.
The AI behind Herald
- Herald’s voice - the community phone line and talking to Herald in the app - runs on xAI’s Grok voice. Zero Data Retention is turned on for HomeHerald’s xAI account, so xAI does not keep the conversation; HomeHerald’s own database holds the only record.
- Herald’s written answers - chat in the app and texts, and reading the receipts and invoices you upload - use Google’s Gemini models, called from HomeHerald’s servers.
Questions or a security concern
Email hello@homeherald.ai or call (601) 706-7573. What HomeHerald collects, and why, is in the Privacy Policy. Who makes HomeHerald is on the about page.