Privacy

The short version

We store what the calendar needs and nothing we do not. Separated households see what they share about their children and nothing else. We do not sell anything to anyone, we do not run advertising, and there are no third-party trackers on this site.

What we store

• Your account. An email address, and a display name if you set one. Passwords are handled by our authentication provider and are never stored in a form we can read.
• Your calendar. Households, children, events, custody schedules, routines and token balances — the things you enter.
• Connected calendars. If you connect Google Calendar, we store the access tokens needed to read it, server-side, where the browser cannot reach them.
• Wall displays. A paired screen gets an identity of its own with deliberately narrow access. It never holds your password.
• An audit trail. A record of changes to shared schedules, so two households can see what was changed and when.
• The early-access list. If you asked for early access, your email address and which part of the product brought you here.

Who can see it

Access is enforced in the database itself, not only in the interface — every request is filtered by row-level security before the application sees a row. This matters because it means a bug in a screen cannot expose the other household’s data.

Where a child lives across two households, both parents see that child’s schedule. Neither sees the other’s private calendar, their events, their other children, or who else belongs to their household. We maintain an automated test suite whose sole job is to prove that boundary holds, and it runs before anything ships.

Children’s information

Children’s names, schedules and routines are entered by the adults in their households, and are visible only to those households and to any screen they have paired. A child with their own sign-in sees their own schedule and their own tokens. We do not use any of it for anything beyond showing it back to the family.

How long we keep it

Your calendar data is kept until you delete it or close your account. Closing your account removes your profile, your memberships, your personal calendars and their events, and any household where you were the last member.

Two things deliberately survive. A household with another adult still in it is not deleted — their calendar is not yours to remove. And entries in the audit trail and the token ledger are kept, with your identity removed from them, because a child’s earned balance should not change because an adult left.

Getting your data removed

• Close your account in Settings → Account. It takes effect immediately and cannot be undone.
• Leave the early-access list with the unsubscribe link in any email we send you.
• If you would rather ask a person, write to us and we will do it.

Where it lives

The application is hosted on Vercel and the database on Supabase, who process this data on our behalf. Connections are encrypted in transit. We use no analytics or advertising services.

Changes

If this policy changes in a way that affects what we store or who can see it, we will say so rather than quietly changing the date at the top.