Trust

Privacy & security

Your conversations and photos are personal. Here's how we handle them.

Data isolation

Every table storing user data has row-level security enabled. Policies scope reads and writes to your own auth.uid(), so another account cannot query your chats, messages, or profile — even with a valid session.

Avatar uploads

Avatars live in a user-scoped storage folder. Policies restrict every operation (list, read, upload, update, delete) to files inside a folder named after your user ID.

AI processing

Messages are sent to the Lovable AI gateway for inference. We do not use your conversations to train models, and the gateway is scoped to this project's key.

Sessions

Sign in issues a refresh-token session stored in your browser. Use “Sign out everywhere” from your profile to revoke every active session across devices.

Deletion

Deleting a chat removes its messages permanently. Account deletion on request removes your profile, chats, messages, and avatar.

Encryption

Traffic is TLS 1.2+ end-to-end. At rest, database volumes and object storage are encrypted with AES-256 by our infrastructure provider. Passwords are hashed with bcrypt and checked against the Have I Been Pwned corpus on sign-up and password reset.

Subprocessors

Lovable Cloud. Database, authentication, and object storage.
Lovable AI Gateway. Routes inference requests to model providers under a project-scoped key.
Google. Optional OAuth sign-in for accounts that choose it.

This list is maintained by Homunculus Health Labs. Ask us for the current DPA before onboarding a team.

Your rights

Export your chat history as a PDF from any chat.
Rename or delete individual chats from the sidebar.
Sign out of every device from the profile page.
Request full account deletion by contacting support.

Compliance

Homunculus Health Labs is a wellness and education tool. It is not a certified medical device, is not HIPAA-covered, and does not carry SOC 2 / ISO 27001 attestations today. We will publish updates here as our posture matures.

Contact

Privacy questions, deletion requests, and security reports go to privacy@homunculuslabs.fun. We aim to reply within two business days.

This page is maintained by Homunculus Health Labs to answer common security and privacy questions about the product. It is not an independent certification.