Homestead — Privacy Policy

Publisher: think3d — a sole proprietorship based in Saskatchewan, Canada

Product: Homestead, self-hosted team chat software

Contact: [email protected]

Effective date: _not yet in force (draft of 2026-09-26)_

1. The fact that explains everything else in this policy

Homestead is software you install and run on your own infrastructure. It is

not a hosted service. think3d does not operate your Homestead server, does not

have access to it, and does not receive the things people send through it.

That means there are two separate privacy relationships, and they must not be

confused:

This policy covers only the second row. If you are a user of somebody's

Homestead server and you want to know what happens to your messages, that

question goes to the organisation running that server — not to think3d. We

cannot answer it, because we cannot see it.

2. What think3d never receives

We state this positively because it is the product's central claim and it needs

to be exact rather than expansive. think3d does not receive, store, host,

process or have any means of obtaining:

• message text, message history, threads, reactions, polls or search indexes
• uploaded files, images or attachments
• voice or video streams, or recordings or transcripts of them
• your user accounts, usernames, email addresses, display names, member lists,

roles or channel structures

• passwords, password hashes, session tokens, MFA secrets or API keys
• your server logs, audit log or database

Voice and video run peer-to-peer or through media and TURN servers that you

deploy. They do not pass through think3d.

The marketing site says *"your conversations never touch our servers."* That

claim is accurate and deliberately narrow. It does not mean nothing ever

leaves your network — three features do reach outside it, and §4 describes each

one and how to turn it off.

3. What think3d does collect

3.1 The homestead.chat website — nothing, by design

The website sets no cookies, runs no analytics, loads **no third-party

fonts, scripts, tag managers or CDN assets, and makes no third-party

requests**. There is no tracking pixel, no session identifier and no

fingerprinting.

**Because the site stores nothing on your device and shares nothing with anyone

else, there is no consent banner.** Consent under the EU ePrivacy Directive (and

the equivalent Canadian and US state expectations) is triggered by storing or

accessing information on a user's device for non-essential purposes. We do not

do that, so there is nothing to consent to. A banner that asked for consent we

do not need would be noise, not compliance.

This is a standing constraint, not a current state of affairs: **adding a single

analytics tag or hosted font reverses the whole paragraph above** and would

require a consent mechanism.

3.2 When you contact us

If you email [email protected], we receive and keep what you send: your

email address, your name and employer if you give them, and the content of the

correspondence. We use it to answer you, to keep a record of what was agreed,

and to provide support.

• GDPR lawful basis: Art. 6(1)(b) — performance of a contract or steps taken

at your request before entering one — for sales and support enquiries; Art.

6(1)(f) legitimate interests for keeping ordinary business records.

• PIPEDA: consent is implied by your choosing to contact us for that purpose.

3.3 If you ask to be told when Homestead ships

The website invites you to get in touch if you want to be notified at release.

3.4 Business and billing records

If you license Homestead, we keep the records a business has to keep: who the

customer is, the contact people, what was licensed, and what was invoiced and

paid.

• GDPR lawful basis: Art. 6(1)(b) contract, and Art. 6(1)(c) legal

obligation for tax and accounting records.

4. The three flows that leave your network

These are the only ways Homestead reaches outside the customer's infrastructure.

Each is listed with what it discloses, to whom, and the exact configuration key

that turns it off.

4.1 Desktop update check — the only flow that reaches think3d

What happens. The Homestead desktop application checks for a newer version

once each time it starts. By default it asks think3d's update server.

What think3d receives. The request discloses to us:

• the IP address the client connects from (an approximate geographic region

can be inferred from it)

• the application version and platform
• the time of the check, and whether an update was downloaded

Under GDPR an IP address is personal data, so this is processing carried out by

think3d for think3d's own purpose.

• Purpose: getting security and bug fixes to installed clients.
• GDPR lawful basis: Art. 6(1)(f) legitimate interests. Our interest is in

shipping security updates to software already in use; the data involved is

minimal and is not used to profile, target or identify individual users.

**Before the desktop app asks us anything, it first asks your own server whether

it is allowed to.** That policy request (GET /api/updates/policy) goes to your

Homestead server and never leaves your network.

How to turn it off. An administrator of your deployment can:

Two caveats we would rather state than have you discover.

1. The check fails open. If the desktop app cannot reach your server to read

the policy — server down, network partition, older server version — it falls

back to the default check against think3d rather than skipping updates

silently. This is deliberate: an unreachable server should not quietly stop

security updates. If your requirement is that a client must *never* contact

us, set updates_feed_url to an internal mirror rather than relying on

updates_enabled, because a mirror survives the fail-open path.

2. The default host name is still discordant.think3d.ca. Homestead was

developed under the working title *Discordant* and the update feed has not

yet moved. If you are building an egress allow-list or deny-list, that is the

host to write down today.

4.2 GIF search — sends the typed query to Giphy (United States)

What happens. If GIF search is enabled, what a user types into the GIF

picker is sent to Giphy's API at api.giphy.com.

Who receives what. Giphy receives the search text and the IP address of

your server — the request is made server-side, so individual users' IP

addresses are not exposed to Giphy. Giphy is a US company.

think3d receives nothing from this flow. From your point of view Giphy is a

sub-processor that you have chosen to enable; from ours it is not our processor

at all, because we are not in the path.

How to turn it off.

The switch gates the whole GIF route rather than individual endpoints, so

trending browsing is disabled along with search.

EU note. Enabling this feature creates a transfer of personal data to the

United States, which the customer — as controller — is responsible for

assessing. Leaving it off avoids the question entirely.

4.3 Link previews — your server fetches pasted URLs

What happens. When someone posts a message containing a link, your Homestead

server fetches that URL to build a preview card (title, description, image).

Who receives what.

• The operator of the linked site sees a request from your server's IP

address, and therefore learns that someone in your organisation posted that

link and roughly when.

• If the linked page offers a preview image, the image is loaded **directly by

each reader's browser** from wherever it is hosted. That host therefore also

sees the reader's own IP address and user-agent. This is the same behaviour as

any web page embedding a remote image, but it is worth stating because it is

the one part of this flow that exposes individual users rather than the server.

• think3d receives nothing from this flow.

Security. Because the URL comes from a user, the fetch is guarded: the

resolved IP address is validated (not just the host name), private and

link-local address ranges are refused, redirects are re-validated at every hop,

and the response size is capped. This was hardened deliberately — an unguarded

version of this feature is a server-side request forgery vulnerability.

How to turn it off.

5. Your rights

5.1 If you are in the European Union or the United Kingdom

Under GDPR you have the right to: access the personal data we hold about you;

have inaccurate data corrected; have data erased; restrict or object to

processing (including processing based on legitimate interests, such as the

update check); receive your data in a portable form; withdraw consent where

consent is the basis; and lodge a complaint with your national supervisory

authority.

5.2 If you are in Canada

Under PIPEDA you may ask what personal information we hold about you, how it

is used and to whom it has been disclosed; ask for corrections; and withdraw

consent, subject to legal and contractual limits. If you are not satisfied with

our response you may complain to the **Office of the Privacy Commissioner of

Canada**.

5.3 If you are in the United States

We do not sell personal information and we do not share it for cross-context

behavioural advertising. Depending on your state you may have rights to know,

delete, correct and opt out. Note that **California's CPRA reaches B2B contact

data**, which is exactly what a sales pipeline consists of.

5.4 How to exercise any of these rights

Email [email protected] and say what you want. We will confirm receipt and

respond within the applicable statutory period — one month under GDPR, thirty

days under PIPEDA.

Requests about a Homestead deployment. If your request concerns messages,

accounts or files inside an organisation's Homestead server, we cannot act on it

and we cannot forward it, because we have no access to that server and no

relationship with its users. Direct it to that organisation.

6. Disclosure to others

We do not sell, rent or trade personal data. We disclose it only:

• to service providers acting on our instructions, to the extent needed

payment processing. Procurement will ask for this list and GDPR Art. 13

expects the categories of recipient.]**

• where required by law, after checking that the demand is valid and applies to

us; and

• in connection with a sale or reorganisation of the business, subject to the

same protections.

On law-enforcement demands, the structural point is worth repeating: **we cannot

produce customer message content because we never hold it.** A demand served on

think3d for the contents of a customer's Homestead server cannot be complied

with. It would have to be served on the customer.

7. Retention

Vague retention language is one of the most commonly criticised parts of a

privacy policy. Each cell above should end up with a number.

8. Security of what we hold

The personal data think3d holds is small: an inbox, business records, and

whatever the update endpoint logs. We protect it with access controls and

encryption in transit, and we keep the amount deliberately low because data not

collected cannot be lost.

9. Children

Homestead is licensed to organisations for workplace use. It is not directed at

children and think3d does not knowingly collect personal data from children.

10. Automated decision-making and profiling

think3d does not carry out automated decision-making or profiling with personal

data.

11. Changes to this policy

If this policy changes materially we will update the effective date and, for

existing customers, say so in writing.

Material changes will be announced by email to customers and noted at the top of this page with a revision date.