Walt is run by Hey Walt, LLC (“we”, “us”), and it is a private tool for running one household. Households join by invitation: you either set yours up from a link an operator sent after you asked to join, or someone who runs your house added you — no stranger’s data lands here uninvited. This is a plain account of what Walt keeps about your household, where it lives, and what you can do about it.
What we keep
Only what your household puts in. The people in it (names, roles, email addresses, and a photo if you add one), the work you log (problems reported, comments, checklists, chat, and photos), the rooms and things in your home, and your maintenance schedules and their history. If — and only if — you connect an outside service yourself, Walt also holds what that service reports: calendar events, a vehicle’s odometer and charge, a thermostat or hot tub’s readings, a sensor’s battery and reachability, and the electric rate you enter. There are no third-party trackers, no advertising pixels, and no analytics SDKs anywhere in the app.
Where it lives
On Cloudflare, which hosts Walt: your records in a D1 database, your files and photos in R2 storage. Everything is scoped to your household — every record carries your household’s id, and a record outside it is not merely off-limits to you, it is invisible, as if it did not exist. Storage keys for your files are prefixed by your household, so your data is one contiguous set, not a scatter.
How it is protected
At rest, D1 and R2 encrypt everything stored (AES-256, with keys Cloudflare manages). Your sign-in tokens get a second layer: they are hashed (SHA-256) before they are stored, so even a copy of the database cannot be used to sign in as you. Credentials for any service you connect are sealed and never leave the server.
In transit, every hop is over TLS — your browser to the server, and the server to any service it calls on your behalf. Nothing travels in the clear.
How you sign in
Signing in is your email address — there is no password to choose, forget, or leak. When you ask to sign in, Walt emails you a one-time link and a short code, either of which signs you in; both are single-use and expire in minutes. Each device you use keeps its own key: you can see your signed-in devices on your profile and revoke any of them, and an organizer adds the rest of your household by sending an invite link. The sign-in and invite emails go out through a mail provider purely to deliver them.
If you asked to join from the front page, Walt keeps the email address — and the name, if you gave one — you put on the waitlist until an operator lets you in or declines the request. That is the one thing it holds before a household of yours exists, and nothing more.
What we deliberately do not do is end-to-end encryption. Walt’s assistant reads your household’s data on the server to be useful, and end-to-end encryption would make that impossible. That is an honest trade, named here rather than buried: your data is encrypted at rest and in transit, but the server can read it, because the features you use need it to.
The assistant, and Anthropic
When the “house brain” is turned on, the text of the work you log — a problem’s title and description, and the chat on it — is sent to an AI model so it can estimate effort, help plan your week, and answer questions in chat. Effort estimates run on Cloudflare’s own AI service; planning and chat run on Anthropic, the company that makes the Claude models. Either one processes that text to produce the answer; it is not sold, and it is not used to advertise to you. If the house brain is off, none of your text is sent anywhere. Apart from the messages you send us yourself (below), this is the only place your household’s content leaves Walt’s own storage, and it happens only for the household that turned the assistant on.
We do not sell your data
Full stop. Walt has no ads, no data brokers, and no sharing beyond the service providers named on this page: Cloudflare, which stores and serves the app and runs its effort estimates; Anthropic, which powers the assistant when you enable it; Stripe, which takes payment if your household subscribes (your card number goes to Stripe, never to us); Help Scout, the helpdesk that holds every message you send us so we can answer it; and whatever services you personally choose to connect. Nobody else sees your household.
Messages you send us, and Help Scout
When anyone in your household uses Contact support, opens a case from our help pages, or writes to support@heywalt.app, the message goes to Help Scout, the helpdesk we read and answer from. With it go the sender’s name and email address, and for somebody signed in their role, your household’s name, the page they were on, the app version and any screenshot they choose to attach, so we can reply and know what they were looking at. Send feedback is different: it stays in Walt’s own storage, screenshot included, for us to read, and is never sent to Help Scout. Help Scout sees only support requests, nothing else in your household.
Family, and children
Walt is a family tool. A household holds adults, teens, and kids — as roles, set by whoever runs the house. Children do not sign themselves up; the adults enter and control the household’s data, and an organizer in the household can see, export, or erase all of it. Walt is not a service marketed to children on their own. Kids and teens cannot use the assistant at all, and cannot connect outside apps: nothing they type is sent to an AI model as a question of their own. What they file on a work order is part of the household’s records, and can reach the assistant when a grown-up in the house uses it.
For a child’s seat we keep only what the household needs to run chores and money: a first name, a role, a face (a drawn character, never a photo), a birth year if a parent enters one (never the full date), the chores, jobs and work orders they are part of, and the money ledger that follows from them. When a child hands in a chore or a job they may add one photo of the finished work for a parent to check; it is deleted the moment a parent sends the work back, and 90 days after a parent approves it. We do not ask a child for an email address, and we never collect a child’s location. Nothing about a kid’s seat is sent to our analytics.
A parent can review everything a child’s seat holds from Family, export it with the household’s data, and delete the child’s seat at any time. Before a child’s seat is added, the parent reads a short notice of what we keep and agrees to it; we record who agreed and when. Deleting it removes the child’s name, email, birth year, face, payout handle and sign-in for good; the chores and money history they were part of stays, shown as “A former family member”, so the household’s balances still add up. Words the family typed, like a work order’s title, stay as written. How long we keep each kind of data, and why, is in our written retention policy, which we will send to anyone who asks at support@heywalt.app.
Your data, both directions
You own it, coming and going. From Settings → Data, an organizer can download the entire household as one JSON file, and can permanently delete the household — files first, then every row, then the household itself. Deletion is real erasure, not a hidden archive; the organizer’s own access ends with it.
Who to ask
Walt is run by Hey Walt, LLC. Your household’s organizers hold the controls described above — export, erasure, and who is in the house — so for those, an organizer is the quickest route; if you are one, they are yours in Settings. For anything else, including a question about how we handle your data, write to support@heywalt.app or use Contact support from any page’s menu.
By post: Hey Walt, LLC, 2501 Chatham Rd #6149, Springfield, IL 62704, USA.