Last updated: September 2026
Family Planner is a self-hosted family organizer. We store the data you enter: your name, email, family member names, the chores/events/lists/ messages/rewards you create, and your progress (points, streaks, completed chores). That's it. No analytics sold to third parties, no advertising, no tracking pixels.
We don't record which pages or screens you open. Older builds of the app kept a log of page visits; those records are deleted 90 days after they were made.
Your data is stored in a PostgreSQL database hosted on our infrastructure. Passwords are hashed with bcrypt (cost factor 12). Session cookies are httpOnly, signed JWTs with 7-day expiry. Email verification is required before login. Rate limiting and CSRF protection are in place on all state-changing endpoints.
If your family turns on the food inventory, we store the items you add (name, amount, where it is kept, category, best-before or use-by date, and when it was bought or opened) and a short history of what was used up or thrown away, with who did it and when, so it can be undone. Every member of the household can see it, and it is part of every member's data export. It is deleted with the household; removing an item also removes its history.
If the fridge photo scan is turned on, a parent can photograph the fridge, freezer or pantry to get suggested food items. That photo is sent to our AI provider, Anthropic, only to read it, and is not saved by Family Planner. You review the suggestions and choose what to add. The feature is off unless it has been set up, and you can always add items by hand instead.
Weather is off unless a parent turns it on in Family settings. When it is on, our server sends the place the parent chose, as an approximate location rounded to about 1 km, to Open-Meteo (open-meteo.com) to get the forecast, and sends the place name a parent types when searching for a town. No names, accounts or other household information are sent. Turning weather off or removing the place stops these requests and deletes the cached forecast.
A parent can choose photos your household has already uploaded to show on the calm screen of the fridge board when it is left alone. They are shown only to signed-in members of your household, never on a paired shared tablet, and never sent to anyone else. No photos are chosen unless a parent picks them, and the calm screen never shows ads.
When someone changes household settings (turns a feature on or off, sends or cancels an invite, joins the household or deletes their account, changes the Today board, turns beta usage counts on or off, or pairs, renames or removes a family tablet), we record a short line saying what changed, who did it and when. It holds names (of a feature, a member or a tablet) but never email addresses, codes, places or messages. Only parents can see it, under Settings, Recent changes. It is kept for 12 months and then deleted, and it is deleted with the household. It is part of a parent's data export; a teen's or child's export has only the lines about their own changes.
While Family Planner is in a small beta, a parent can choose to share usage counts so we can check the app is working for families. They are off unless a parent turns them on under Settings, Privacy & data, "Share beta usage counts". When they are on, we keep one number per day for your household for each of these: events added, meals planned, chores assigned, chores completed, chores checked by a parent, rewards claimed, members who joined, and whether the household's first chore was assigned within 10 minutes of signing up. That is all: no names, no user accounts, no roles, no chore, event, meal or reward titles, no messages or photos, and nothing about which member did what.
The counts are kept for 13 months: older days are never used, and are deleted the next time your household's counts change. Turning the setting off deletes all of your household's counts straight away, and they are deleted with the household. They are part of every member's data export. They are never sold or shared with anyone, and they are separate from any other analytics.
/api/users returns your profile./api/users/export) downloads one file with all your data, which you can open or keep (JSON format)./api/users to update your name/age.Family Planner is designed for use by families with children. Child accounts (under 13) must be created by a parent. We do not knowingly collect data from children directly. If you believe a child account was created without parental consent, contact us to remove it.
If event import is turned on, a parent can paste the text of a school email or flyer, or choose a photo or PDF of it, to get suggested calendar events. That text or file is sent to our AI provider, Anthropic, only to read it, and is not saved by Family Planner. Nothing is added to your calendar until you review the suggestions and choose what to add, and you can undo an import for a few minutes afterwards. The feature is off unless it has been set up, and you can always add events by hand instead.
A parent can connect their own Google Calendar or Outlook calendar in Settings. Only then, and only for the one calendar they choose, Family Planner reads and writes events with Google or Microsoft: it brings that calendar's events into the family calendar and, if the parent turns it on, adds family events to it. Each event shares its title, time, place and notes. We keep the access Google or Microsoft gives us encrypted and use it only for this sync; we do not read your other calendars, email or contacts. Disconnecting in Settings stops the sync, removes the events it brought in, and asks Google to cancel the access. Use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
We send transactional emails only: email verification, password reset, household invites and the notifications you have left on. No marketing email, ever. You can turn notification emails off in Settings.
If you turn on the optional morning summary (Settings → Notifications; it is off unless you turn it on), we also send you one short email a day, to a verified address only, with your own chores for the day, today's family events and tonight's dinner. Every summary email tells you how to turn it off.
These emails are sent through Mailgun, our email provider. To deliver a message, Mailgun receives the recipient's address and name and the message itself. We have turned off Mailgun's open and click tracking, so it does not track whether you open an email or rewrite the links in it.
Database is backed up daily. Backups are retained for 14 days (rolling) plus 4 weekly snapshots. Backups are integrity-tested on every run.
For privacy questions or to exercise your rights: privacy@ashbi.ca