Privacy policy
Last updated November 3, 2026
FirstKey is a home maintenance app for homeowners, landlords and tenants in Ontario. This policy explains what FirstKey keeps, why, where it's stored, who else handles it, and your choices. We wrote it in plain language. If anything is unclear, contact us.
FirstKey is run from Ontario, Canada, and follows Canada's private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA).
What FirstKey keeps
- Your account: your name and email. Your password is stored only in a scrambled form that can't be read back. If you turn on two-step sign-in, we keep that setting.
- Your homes: the address, home type, year built, possession date for a new build, and what the home has (for example a furnace or a sump pump). Also equipment details (brand, model, serial number, age), tasks and when you did them, costs, bills, warranties, notes, and the files and photos you add.
- Utility use: if you bring in a Green Button file from your utility, the bills and usage in it.
- Emergency info: where the shut-offs are, photos of them, and who has a key (names and how many keys, never codes).
- Rentals: which tenants are linked to which home, invite codes, repair requests and their photos, notices, messages between landlord and tenant, and tasks a landlord gives a tenant.
- Pros and stores: when a business signs up, its name, trade, phone, email, the area it serves, licence and insurance details, and description. For bookings, the job details, times, messages and invoice. For deals, the deal and the coupon codes people get, and when they're used.
- The AI helper: your questions, any photo you add, and the answers, so you can see your history. We also count questions to apply the daily limit.
- Your phone: the address used to send notifications to this phone, and app settings such as your look and maintenance day.
FirstKey doesn't read your contacts and doesn't track where you are. On some Android phones, checking a home's address needs location permission. FirstKey uses it only for that check.
Why we use it
- To run FirstKey: build your maintenance plan, send reminders, keep your records, connect landlords and tenants, and handle bookings with pros.
- To keep accounts safe and stop misuse.
- To reply when you contact us.
We don't use your information for advertising, and we never sell it.
Where it's kept
Your account, homes, records, files and photos are stored by Supabase on Amazon Web Services servers in Canada (Montréal). Information is encrypted when it's sent and when it's stored. Files and photos are private. They open only through short-lived links, for people allowed to see them.
Who can see what
- You see everything for the homes you own.
- Tenants linked to your home see notices sent after they joined, their own repair requests and photos, their messages with you, the emergency info and shut-off photos, and tasks you give them. They don't see your bills, files, equipment, or other tenants' requests.
- A pro you book sees the job details you give them, including the home's address and any entry notes, and the messages on that job. They don't see the rest of your home's records.
- Stores never see your name or address. When you use a coupon, the store sees only the code and the deal.
- Business listings: the details of approved pros and stores are shown to FirstKey users.
- FirstKey's administrator sees business sign-ups, to approve or pause them.
Companies that help run FirstKey
Each one gets only what it needs for its job, and must protect it under its own terms.
| Company | What it does | What it gets | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Everything listed above | Canada |
| Anthropic | Writes the AI helper's answers | Your question, any photo, and basic facts about the home (type, age, equipment). Not your name, email or address unless you type them in. Its business terms don't let it train its models on this. | United States |
| Expo, Apple and Google | Deliver notifications to your phone | The notification's text and your phone's notification address | United States |
| Resend | Sends email copies of notices, only if email is switched on | The recipient's email and the notice | United States |
| Environment Canada | Weather alerts and forecasts | Map coordinates for the home's area only | Canada |
| Your phone's maps service (Apple or Google) | Checks the home's address and finds its weather area | The address you type | Depends on your phone |
Information handled outside Canada is covered by the laws of that country, and its courts and authorities may be able to access it.
We may share information if the law requires it, for example a court order, or to protect someone from serious harm.
How long we keep it
- We keep your information while your account is open.
- When you delete something in the app, it's removed right away.
- When you delete your account, your account, homes, records, files, photos and AI history are deleted right away. Server backups, if any, are replaced within 30 days.
- Repair requests a tenant sent stay in the landlord's records, without the tenant's name.
- If a pro deletes their account, homeowners keep the record of past jobs and invoices, with the business name.
Your choices
- See and change your information in the app at any time.
- Take a copy: Records, then Share report or Save as PDF. Or ask us.
- Delete: Account, then Privacy & security, then Delete my account. See what gets deleted.
- Notifications: turn them off at any time in your phone's settings.
Under PIPEDA, you can ask to see the information we hold about you, how it's used and who it's been shared with, and ask us to correct it. We reply within 30 days. If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada.
Keeping it safe
- Turn on two-step sign-in and app lock in the app, under Account, then Privacy & security.
- Photos are re-saved on your phone before upload, so they carry no location data.
- Please don't store door, alarm or lockbox codes in FirstKey, including in photos.
- If a data breach could cause you real harm, we'll tell you and the Privacy Commissioner, as the law requires.
Children
FirstKey is made for adults who look after a home. It isn't meant for anyone under 18, and we don't knowingly collect children's information.
Changes
If we change this policy, we'll update this page and the date at the top. For big changes, we'll also tell you in the app.
Contact
Questions or requests about your information:
Email firstkeyhelp@gmail.com.