Privacy policy

Good Place is published by Meristem, an EURL registered in France, whose registered office is at 15 passage du Monténégro, 75019 Paris, France, registered under SIRET 83372619300034.

Publication director and contact for anything on this page: Thomas Landrain — thomas@meristem.ooo. Write to that address for any question about your data, and for the requests described under « Your rights » below.

The app is served from www.goodplace.house. Its email is sent from notify.goodplace.house. The older address galileo.fyi still works and redirects here.

Good Place serves two kinds of house, and who answers for your data depends on which one you live in. In GDPR terms, the roles split as follows.

Meristem, for the service itself

Your account and the way you sign in, the app and its security, the email it sends you, and anything you send us through the contact form. For these, Meristem is the data controller.

The organisation, when one manages your house

A coliving operator, landlord or association running your house decides who is invited, who lives in which room, what equipment and rules it publishes, and how the reports addressed to it are handled. For that, the organisation is the controller and Meristem acts as its processor — we process it to run the service, on its instructions, and for nothing else.

A flat-share standing on its own

With no organisation above it, there is no second controller: Meristem is the only one, and it is the house's own admin — one of your housemates — who invites people and manages rooms.

If an organisation manages your house, a request about the house's own management data reaches them faster than us. Write to us anyway if you are not sure who to ask: we will tell you, and pass it on.

Nothing here is bought, inferred or collected in the background. Every item below is something you typed, something you were invited into, or something the app needs to work at all.

Your account and how you sign in

Your email address, the method you signed in with, and when. There is no password: you receive a one-time code by email, or you use Google — and if you use Google, it tells us your address, your name and your profile picture. Nothing else.

Your profile

Your first name and a profile photo: the app requires both, and asks for them before it lets you in. A last name, a phone number, dietary notes and a short bio are optional — add, change or empty any of them yourself, at any time. The language you read the app in is kept here too.

Your place in the house

Which house or houses you belong to, your room, your move-in date, whether you are one of its admins, and whether you still live there.

If you work for an organisation, or repair for one

Staff of a managing organisation have a seat recorded against it and a rank — owner or admin. A maintenance agent has an authorisation instead, naming the organisation, whether they may only read the reports or also work them, and, once it is withdrawn, when. Neither is a house membership: somebody can hold one without living anywhere.

What you write in the house

Chores and who they fall to, calendar entries and who is coming, proposals, votes, poll answers and comments, purchases, shared expenses, who owes whom, the kitty, neighbourhood tips and their photos, equipment and fault reports, house rules, and which shelf of the fridge is yours.

What you write to whoever manages the house

Issue reports, the message threads on them and the photos attached. These are correspondence rather than house content, and they are the one thing a managing organisation reads — see « Who sees what » below for the limits on that.

Notifications

What the in-app bell has to tell you, and whether you have read it. If you turn push notifications on, we also hold what your browser gives us so it can reach your device: an address at your browser vendor's push service, two encryption keys, and the browser's own description of itself.

The email we send

For every message: the address, which template, whether it was delivered, and any error the provider returned. Addresses that bounce or report our mail as spam are recorded so we stop writing to them, and the unsubscribe link in a message carries a token tied to your address.

Invitations

The address invited, the house or organisation it is for, the role and the room it names, and whether it has been accepted, revoked or has expired.

If you write to us from the public pages

Your name, your email address, what you wrote, and whether you said you run several houses or live in one. It arrives as ordinary email in our inbox, and we reply to it there.

If you are a contractor an organisation calls out

Your name, your trade, your email address and phone number, and the notes the organisation keeps about working with you, so a repair can be sent to you.

Four bases in all, and most of the app sits on the first one. Article numbers are from the GDPR.

To run the app you were invited into — contract, art. 6(1)(b)

Your account, your profile, your membership of a house and everything you and your housemates write in it, plus the mail that carries a sign-in code, an invitation or a notification you asked for.

To keep the service working and safe — legitimate interest, art. 6(1)(f)

Server logs, the brakes that stop someone flooding the sign-in form or the contact form, handling addresses that bounce, and diagnosing a fault when something breaks. Our interest is a service that stays up and is not abused; it is weighed against your privacy by keeping these to the minimum and by not using any of them for anything else.

To send push notifications — consent, art. 6(1)(a)

Only after you turn them on. The switch in your profile turns them off again and deletes the subscription outright. Revoking the permission in your browser instead stops the notifications, but does not by itself remove what we hold: that record goes when the next attempt to reach your device comes back gone, or when you ask us to delete it.

To let you sign in with Google — consent, art. 6(1)(a)

Only if you press that button. The email-code route reaches the same account without involving Google at all.

To answer you — legitimate interest, art. 6(1)(f)

When you write to us about opening a house or about this policy, we keep the message long enough to answer it and to follow up.

There is no advertising, no profiling, no automated decision-making and no scoring of any kind in this app. Nothing about you is sold or rented. Beyond the services listed below, the one thing that leaves this app is a report sent out for repair — see « Who sees what ».

This is the part the app is built around, and it is enforced by row-level security in the database itself rather than by the screens in front of it — so a bug in a page cannot hand somebody rows they are not entitled to.

• Your current housemates see what the house shares: chores, the calendar, votes, the budget, tips, the directory, and your profile — including the email address you sign in with, your phone number, dietary notes and bio.
• An organisation managing your house sees how the house is set up — who lives there, in which room, what invitations are pending, what it publishes and what it pays for — and the reports addressed to it. It cannot read your chores, your calendar, your votes, your comments, your kitty, your tips, or who is coming to dinner. It never reads your phone number, your dietary notes or your bio.
• A report about something the housemates own themselves never reaches the organisation, its staff or a maintenance agent at all: the household settles it between itself.
• A maintenance agent authorised by an organisation reads the board of every house that organisation manages — every report addressed to the office, not only the ones assigned to them. Being an agent grants nothing else: no house content, no configuration, and never a report that stayed between housemates.
• When something has to be repaired, whoever manages the house can send the report on to an outside tradesperson by email. That message carries the report's title, the first 2,000 characters of what was written in it, how urgent it is, and the house's name and address — so a report about the building can reach somebody who does not use this app at all. Nothing else travels with it, and a report the organisation cannot see cannot be sent this way.
• A very small number of platform administrators at Meristem can reach the management side of every house, standalone ones included: its configuration, and the reports addressed to an office. That is how a house is opened, repaired or archived. It does not open house content — the database refuses them your chores, your votes and your budget exactly as it refuses an organisation.
• A report can be marked private to whoever filed it. When it is, the rest of the house sees neither the thread nor its photos.
• When you move out, your access to the house ends immediately. Your name stays on what you wrote, owed or organised, so the history the others rely on still makes sense — a debt with no name on it is not a debt anybody can settle.

The app is hosted in the European Union and so is its database. These are all of the services it runs on, and everything each of them does:

Supabase — database, sign-in and files

Holds everything described above. The database is hosted in Paris (AWS eu-west-3). Uploaded photos and files sit in private buckets there and are served through short-lived signed links.

Vercel — running and serving the app

Serves the pages and runs the server-side code. Like any web host, its logs record request metadata, including IP addresses, which it keeps for a limited period under its own retention policy.

Nuntly — sending the app's email

Sign-in codes, invitations and notification mail. EU-hosted, and it receives the recipient's address and the contents of the message it sends.

Google — sign-in if you choose it, and opening a tip on a map

Two separate things. Signing in with Google happens only if you press that button, and it tells us your address, your name and your picture; never press it and that half never happens. Separately, tapping a neighbourhood tip opens Google Maps in a new tab at its address or its coordinates. That is an ordinary web request, so Google sees the place, your IP address and your browser — though not the page you came from, which the link withholds on purpose. What does not travel with it is anything from your Good Place account or from the house.

Your browser's push service — only if you turn push on

Apple, Google or Mozilla, depending on your browser, carries the notification to your device. The contents are encrypted before they leave our server, so the service delivers them without being able to read them — but it does see that a message was sent to your device, and when.

OpenStreetMap — the map on the tips page

When you open a page with a map on it, your browser fetches the map tiles from tile.openstreetmap.org, which means your IP address reaches them. Searching for an address goes through our server instead, to Nominatim, OpenStreetMap's own geocoder — so your IP stays with us, but what we send is the words you typed, and the address itself does reach them.

unpkg — the pins drawn on that map

The marker itself is Leaflet's own image, and the app still loads it from the unpkg CDN rather than serving it from us — so a page with a map on it reaches them too, with the same request metadata as the tiles and nothing more.

There is no analytics, no advertising script, no social plug-in and no third-party tracker anywhere in this app. Apart from the map tiles and pins above, opening a page contacts nobody but us.

The house's history is the point of most of it, so the rule is to keep what the house still needs and to drop what it does not.

• Your account and profile stay for as long as you have access to at least one house. Once you have moved out of all of them, they stay until you or the house asks us to delete them.
• What you wrote in a house stays with that house for as long as the house uses the app: a vote, a chore or a debt only makes sense with its history around it.
• Notifications are deleted 30 days after you read them, and only the 200 most recent are kept in any case.
• An invitation stops working once it is accepted, revoked, or past its expiry — but the record of it stays: we mark it rather than delete it, so the address invited, the house and the room it named remain on file. Ask us and we will remove one.
• Delivery records for the mail we send are kept so a failed sign-in code can be traced. An address that bounced or complained is kept for as long as we send email at all — forgetting it would mean writing to it again. And a message that could not be delivered is set aside whole — recipient, subject and body — in a failed-mail queue we read when something has gone wrong; nothing prunes that queue today, so ask us if you want one removed.
• Sign-in codes are short-lived and single-use; once used or expired they open nothing.
• Server logs are kept by the hosting platform for the limited period its own policy sets. The IP addresses used to slow down abuse of the contact form are never written to the database at all: they live in the memory of whichever server answered, counted over a one-hour window and cleared by a sweep that runs as that server handles later requests — so a quiet one can hold a key somewhat longer than the hour it counts over.
• A message you send us through the contact form stays in our mailbox like any other email, and we delete it once it is no longer useful to the conversation.

There is no cookie banner on this site because there is nothing to ask you about: not one cookie here tracks you, profiles you or belongs to anyone but us. All of them are either strictly necessary or a preference you set yourself.

mg_lang — one year

The language you picked, so the first page the server sends is already in it.

mg_house — one year

Which of your houses you are currently looking at. It only selects; it grants nothing — the server re-checks which houses you actually belong to on every single request.

sidebar_state — one week

Whether you left the console's sidebar open or closed.

Local storage

Your sign-in session, so you are not asked to sign in again on every page, and whether you have dismissed or snoozed the prompts offering to install the app and to turn on notifications.

Session storage

Carries an invitation token and the page you were heading for across a sign-in, so neither is lost on the way. Once you have asked for a sign-in code, it also holds that address and the moment you may ask for another, so reloading the page does not restart the wait. It is cleared when you close the tab.

Under the GDPR you can ask us for any of the following, free of charge, and we will answer within one month.

• See what we hold about you, and get a copy of it.
• Have anything wrong corrected. Most of it you can fix yourself: your profile is yours to edit, and so is most of what you write. The exception is a message in a report thread, which nobody can edit or delete once it is sent — a letter the other side has already read is not rewritten — so a correction there is a message to us.
• Have your account and your personal details deleted. There is no self-serve delete button in the app today, so this one is a message to us and we do it by hand. Some of it cannot vanish entirely without falsifying somebody else's record — a debt between two housemates names both of them — so where that happens we remove or anonymise everything we can and tell you exactly what remains and why.
• Object to anything we do on the basis of a legitimate interest, ask us to restrict a processing while a dispute is settled, and withdraw a consent — push notifications, Google sign-in — at any time, without it affecting what was done before.
• Receive the data you gave us in a structured, machine-readable form, or have it sent straight to another service.

Write to thomas@meristem.ooo. We may ask you to confirm who you are, but only when a request is not obviously coming from the account it concerns. If an organisation manages your house, part of a request may be theirs to answer rather than ours — we will say so and forward it.

If our answer does not satisfy you, you can complain to the CNIL, the French data protection authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

• There is no password to be guessed, reused or stolen: signing in is a one-time code sent to your address, or Google.
• Nobody joins a house without an invitation from it, and the app refuses to send a sign-in code to an address that has neither an account nor a valid invitation.
• Who may read and write what is enforced inside PostgreSQL, on every row, rather than by the screens — and every request additionally filters on the house it is about, so two houses cannot be confused for one another.
• Photos, manuals and avatars sit in private storage and are reachable only through links that expire. The one exception is a house or organisation logo, which has to be public because a sign-in page shows it before anybody has signed in.
• Everything travels over HTTPS, between you and us and onward.

If a breach ever affects your data, we will notify the CNIL within 72 hours as the GDPR requires, and tell you directly when the breach is likely to put your rights at risk.

Good Place is meant for adults sharing a home. Accounts exist only where somebody was invited into a house, and we do not knowingly open one for anyone under 15. If you believe a child under 15 has an account here, write to us and we will remove it.

We update this page whenever the app changes what it holds, who can read it or where it goes. The date at the top says when it last changed. If a change materially affects you, we will tell you by email or in the app rather than leaving you to notice it here.