How the demo handles your data

This is a plain-language summary for the early demo, not a final privacy policy. A lawyer will review the real policy before the paid beta.

Board settings stay in your browser

Your family name, panels, layouts, color themes, pets, pet check marks, added jokes and calendar links are saved in this browser's local storage. They are not sent to our database. Clearing your browser data or pressing Reset demo removes them.

Sending your setup to another screen

Other screens puts your whole setup, including calendar links, into a link and QR code. The setup sits after the #, so it goes straight from one of your screens to the other and never reaches our servers. The other screen asks before using it. Anyone who has that link can see your calendars, so treat it like a password.

Calendars and weather pass through

To read an iCal link, the board asks our server to fetch it once, because most calendar services block direct browser requests. The link is sent in the request body, the calendar is read and returned to your screen, and nothing is saved or cached. Weather comes from the US National Weather Service for a location rounded to about 1 km. If you set the location by ZIP code, your browser looks the ZIP up with the free zippopotam.us service.

Treat calendar links like passwords. Anyone who has one can read that calendar. Some services (iCloud public calendars, for example) make the link itself the only protection.

Connecting a calendar account (Google, Outlook / Microsoft 365, Apple iCloud or Yahoo) gives the board read-only use of your calendars. The service gives us a sign-in token (for iCloud and Yahoo, the app password you create), which we lock with a key only our server has and hand back to your board, where it's saved with your settings (encrypted with your family key on a family board). We don't keep a copy. Each time the board refreshes, it sends the locked token; our server unlocks it, asks Google for the next three weeks of events on the calendars you picked, and passes them straight to your screen. Disconnecting tells Google to cancel the access for Google. You can also cut off access at any time from the account itself: myaccount.google.com/permissions, account.live.com/consent/Manage, or by deleting the app password at Apple or Yahoo.

Votes are encrypted before they leave your device

When you start a vote, your browser creates a secret key. The question, the choices and every ballot are encrypted with it. The key is only ever placed in the part of the QR link after the #, which browsers never send to servers. Our database stores scrambled text plus an anonymous, random device ID used to allow one vote per device. Votes close after at most 7 days and are deleted after the period the board admin picks (1 day to 30 days).

Anyone who can see the QR code on the screen can vote, including visitors. The code only allows voting and gives no access to the rest of the board.

Invites

Invite QR codes in the demo show how joining will work: each link expires after about 10 minutes and carries the family's key after the #. In the demo, joining only shows you what would happen; it does not link devices yet.

Waitlist and suggestions

If you join the waitlist, we store your email and the answers you choose to give. If you use the suggestion button, we store only the text you type, with nothing about your family attached. We get an email copy of each signup and suggestion (sent through the email service Resend) so we can follow up. Email us to have any of it deleted.

Counting visits

We use Vercel Web Analytics, which counts page views without cookies and without following you across sites. We also keep daily totals of a few actions, such as “calendar added” or “vote started”, so we can tell which features families use. Those totals are just a number per day: no person, device, IP address or board details are attached.

Family boards (beta)

Admin sign-in. Admins sign in with a code texted to their phone. Our text service (Twilio) sees the number to send the code. We store only a scrambled, keyed version of it, which is enough to recognize the number next time but not to read it.

Settings are encrypted on your devices. Your board's settings (family name, calendar links, pets, colors, layouts) are encrypted in your browser with your family's key before they're saved. The key is passed between your family's devices inside invite links (after the #) or encrypted for each device, so our server never has it and can't read your settings. Device names are encrypted the same way.

Pet check marks are stored as anonymous item codes with a checked or unchecked flag, so phones and the wall screen stay in step. They're deleted after about 48 hours. Removing a device changes the family key so it can't read anything new.

Family photos

Photos added to a family board are shrunk on your device (which also removes location and camera details), then encrypted with a key kept inside your family's encrypted settings before upload. Our server stores only scrambled bytes it can't open. Removing a photo deletes it; closing your family board deletes them all.

Phone numbers and sitter info

Numbers in “Family & friends” and the babysitter info are part of your board's encrypted settings. Texts you send with the “Text” buttons go from your own phone's Messages app; we never see who you text or what the text says.

Automatic texts

When automatic texts are on, a person added to “Family & friends” gets one text from AGA Technology asking them to reply YES. Only people who reply YES get texts, and only when their family starts a vote (a few a week at most). Reply STOP at any time to stop all texts, or HELP for help. Message and data rates may apply. To send a text, the number and the message (the family name, the vote question and its link) pass through our server to our text service, Twilio. We don't store the number: we keep only a scrambled fingerprint of it and whether it replied YES or STOP. We never use these numbers for anything else, and we never sell or share them. Phone numbers and agreement to receive texts are not shared with third parties for their own marketing.

What we don't do