Security

Last updated: July 5, 2026

Protecting your household's data is foundational to HoneyDone. This page describes the concrete measures in place today — see our Privacy Policy for what data we collect and why.

Authentication

Sign-in, sessions, and multi-factor authentication are handled entirely by Clerk, a dedicated identity platform. HoneyDone never sees or stores your password.

Encryption

All traffic to and from HoneyDone is transmitted over HTTPS, including the connection to our database (Neon, managed PostgreSQL). OAuth access and refresh tokens for connected integrations — Google Calendar, Microsoft Calendar, Gmail, and your own Home Assistant server — are encrypted at rest using AES-256-GCM. These credentials are never exposed to the browser.

Household data isolation

Every record in HoneyDone is scoped to a household, and every query is required to check that the requesting user belongs to that household. Your household's tasks, shopping lists, home information, and integration data are not visible to any other household.

Third-party integrations

Calendar and Gmail integrations request read-onlyOAuth scopes (Google's calendar.readonly and gmail.readonly) — HoneyDone cannot create, modify, or delete events on your calendar, and does not fetch or store full email bodies or attachments, only message metadata used to detect actionable household signals. Home Assistant connections use a long-lived access token you generate and can revoke at any time from your own Home Assistant server.

Reporting a vulnerability

If you discover a security issue, please report it responsibly to hello@honeydone.io. Please give us a reasonable amount of time to investigate and address any issue before public disclosure.