Privacy Policy

Family Dashboard is a household organiser: shared to-do lists, a grocery list, a pantry, meal planning, recipes, chores and a family calendar. This policy explains what it stores, why, and who else ever sees it. It is written to be read, not to be survived.

Who we are

Family Dashboard is operated by Pnumen Digital LLC. Questions, requests, or complaints: support@pnumen.com.

What we collect

• Your account. When you sign in with Google we receive your email address, name, profile picture and Google account identifier. We use these to identify you and to place you in the right household. We never receive your Google password.
• Your household’s content. Everything you put into the app: to-do items, grocery and pantry lists, meal plans, saved recipes and ratings, chores and allowances, saved restaurants, calendar events you create, and photos of receipts you scan.
• Google Calendar data, only if you choose to connect a calendar. See the dedicated section below.
• Operational records.A log of AI requests made on your household’s behalf (which feature, how many tokens, what it cost) so we can meter usage and apply spending limits.

We do not use advertising trackers, we do not build advertising profiles, and we do not sell personal information.

Google user data, scope by scope

Family Dashboard requests the narrowest scopes that make each feature work, and it asks for them at different times so that signing in never grants calendar access.

• openid, email, profile — used solely to sign you in and to show your name and picture to the other members of your household. Requested when you sign in.
• calendar.calendarlist.readonly — used only to list the calendars on your Google account by name, so you can choose which ones appear in Family Dashboard and which one new events are written to. Requested only when you choose to connect a calendar, and never at sign-in.
• calendar.events — used to display the events on the calendars you chose inside the household calendar view, so a family can see school, work and personal schedules together; to let the assistant point out what the coming week needs in its daily brief; to recognise when email forwarded to your family inbox is about an event already on your calendar (the last two use an AI provider, as described below); to notice which evenings are busy when you plan your week, so those nights get a quick dinner (worked out on our server; nothing from your calendar is sent to the AI provider for this); and to create and edit events that you add inside Family Dashboard, on the single calendar you nominate as the write target. Every other connected calendar stays read-only regardless of this permission. Requested only when you choose to connect a calendar, and never at sign-in.
• calendar.events.readonly — requested only from someone outside the household who chooses to share their own calendar through a one-time link. It is used solely to display the events on that person’s primary calendar in the household’s calendar view. It cannot change their calendar, and their events are never sent to an AI provider.

Connecting a calendar is optional and the app is fully usable without it. You can disconnect at any time in Settings, which deletes the stored authorisation, and you can also revoke access from your Google account permissions page.

Limited Use

Family Dashboard’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the features described above, we do not transfer it to others except as necessary to provide those features or as required by law, we do not use it for advertising, and no human reads it except where you explicitly ask us to, where it is necessary for security, or where the law requires it. Google user data is never used to train generalised artificial-intelligence models.

How we share, transfer and disclose Google user data

We do not share, transfer or disclose Google user data to third parties for any purpose other than the ones described here. This is the complete list of parties that ever handle data we receive from your Google account, and why. Nobody else does.

• The other members of your household. Your name and profile picture, and the events on any calendar you connect, are shown to the people in your household inside the shared calendar view. That is what connecting a calendar is for. Guests you invite to connect a calendar without joining the household see nothing of yours.
• Supabase, our database provider, stores your email address, name, profile picture and Google account identifier, and the refresh token for each calendar you connect. It stores this on our behalf and under our instructions only.
• Vercel, our hosting provider, runs the servers that call Google’s APIs. Calendar events pass through those servers in memory on their way to your screen; they are never written to Vercel’s storage.
• Anthropic, our AI provider, receives the title, date and start time of events on your household’s own connected calendars, for two features: the assistant’s daily brief (the coming week’s events), and the family inbox, which compares forwarded email with events from the past week and the next three months (along with Google’s identifier for each event and whether it repeats). Nothing else about your events is sent: no descriptions, locations or guest lists. Calendars connected by guests are never sent. Anthropic processes this on our behalf only to answer that request, and under its commercial terms does not use it to train its models.
• Notion, where we keep our list of the people using the app during the beta and the problem reports people send us, receives your name and email address, your household’s name and the kind of device you signed up on. We use it only to keep in touch with testers and to follow up on reports. It never receives calendar events, your profile picture or any Google token.

Google user data is notshared with, transferred to, or disclosed to anyone else: not to Anthropic or Notion beyond what is described above, not to any other AI provider (the help chat’s provider, Fireworks AI, never receives any Google user data), not to advertisers or data brokers, not to the restaurant-search providers, and not to other households (the shared recipe library carries recipes and star ratings only, never anything from Google). We do not sell it. The only other circumstance in which it would leave our hands is a legal obligation such as a valid court order, and we would tell you unless the law forbids it. If we are ever acquired or merge with another company, this policy continues to apply to the data and you will be told before anything changes.

How we protect Google user data, including sensitive data

Security procedures are in place to protect the confidentiality of your data, and we use encryption to protect it. Specifically:

• Encrypted in transit. Every connection is over TLS (HTTPS): between your browser or phone and Family Dashboard, between Family Dashboardand Google’s APIs, and between Family Dashboard and its database.
• Encrypted at rest. The database that holds your account details and calendar refresh tokens is encrypted at rest by Supabase, with encrypted backups.
• Tokens never reach the browser. The refresh token Google issues when you connect a calendar is used only by our server. It is never sent to your device, never written to logs, and never included in error reports. Your session with Family Dashboard is a signed, expiring cookie marked HttpOnly and Secure, so it cannot be read by scripts in the page.
• Your calendar is not copied into our database. Events are fetched from Google each time the calendar view loads and held in server memory for at most two minutes so the page stays fast. Only events you create or edit inside Family Dashboardare written, and they are written to Google, not to us. Two narrow exceptions: the assistant’s daily brief, which may mention a few event titles, is stored for the day it is written and deleted the next day; and when a forwarded email turns out to be about an event already on your calendar, we keep Google’s identifier for that event so a suggested change can be applied to it.
• Isolated per household.Access control is enforced by the database itself: every row is tagged with the household it belongs to, and the database refuses to return another household’s rows, so a bug in the application cannot expose one family’s data to another.
• Least access on our side. Production credentials live only in the hosting environment, never in source code, and only Pnumen Digital LLC’s operator can reach them. No person at Pnumen Digital LLC reads your calendar data except in the narrow cases the Limited Use section describes.
• Revocation is real.Disconnecting a calendar, leaving a household, or deleting a household calls Google’s token-revocation endpoint and deletes the stored token, so our access ends at Google’s side as well as ours. You can also revoke it yourself at any time from your Google account permissions page.
• If something goes wrong. If we learn of a security incident affecting your Google user data, we will notify you at your account email address without undue delay and describe what happened and what we are doing about it.

Artificial intelligence features

Some features send content to Anthropicto be processed: scanning a receipt photo, suggesting dinner ideas, writing or importing a recipe, estimating shelf life and nutrition, reading email forwarded to your family inbox, and writing the assistant’s daily brief. Only the content needed for that request is sent — for example the receipt image, or the recipe text.

Google Calendar data.If you connect a calendar, two features send part of it to Anthropic. The assistant’s daily brief reads the title, date and start time of the coming week’s events so it can point out what needs planning around. The family inbox compares forwarded email with the title, date and start time of events already on your calendar, so it does not suggest an event you already have and can catch a changed time. Nothing else about your events is sent, and calendars connected by guests are never sent. The full detail is under “How we share, transfer and disclose Google user data” above.

Busy evenings.When you plan your week, the app checks the start and end times of events on your household’s own calendars to spot evenings that are busy around dinner time. That check happens on our server. The AI provider is told only that a night needs a dinner ready in 30 minutes or less, never what is on your calendar, and calendars connected by guests are not used for it.

The help chat.Questions you type into the assistant’s help chat are answered by Fireworks AI, on servers in the United States. Only your question and the conversation so far are sent, along with our written guide to the app — never your name, email address, calendar, lists, recipes, any Google user data or anything else in your account. Fireworks does not store the content of these requests and does not use it to train models.

Content sent for processing is not used to train models.

Where your data lives, and who can see it

Your household’s data is stored in a Postgres database hosted by Supabase, and the application is hosted by Vercel. Access is enforced at the database level: every row belongs to exactly one household, and the database itself refuses to return another household’s rows.

Everyone in your household sees the household’s shared content — that is the point of a shared list. Nobody outside it does.

One deliberate exception, so it is not a surprise:

• The shared recipe library. Recipes saved to the shared library, and the star ratings attached to them, are visible to other households using Family Dashboard, so everyone benefits from recipes others have found. Ratings are stored under an opaque key rather than your name or email. Your grocery list, pantry, calendar, chores, receipts and to-dos are never shared this way.

We also use service providers who process data on our behalf: Google (sign-in and calendar), Anthropic (AI features), Fireworks AI (the help chat), Supabase (database), Vercel (hosting), Notion (where we keep the problem reports you send us, and our list of the people using the app during the beta: name, email, household name and the kind of device), and a mapping or restaurant-search provider when you search for a restaurant. We do not sell your data.

How long we keep it

Household content is kept until you delete it, or until you delete your household.

Deleting a household takes 30 days. When you ask, the household stops working immediately and nothing in it is readable. For the next 30 days the person who set it up can cancel and everything comes back exactly as it was. After that the content is permanently deleted — meals, recipes, groceries, pantry, chores, calendar events, settings, receipts and anything forwarded to the family inbox — and accounts left with no household are deleted with it. Any Google connection is revoked at that point, so our access to your calendar ends.

Three things deliberately outlive a deleted household, and it is worth being precise about them:

• AI usage and billing records. We keep the itemised cost of each AI request — which feature, which model, how many tokens, what it cost and when. These records note when a household used a feature, and they are kept for accounting after the household is deleted. They stop pointing at any account and retain only a short household label that no longer maps to anyone.
• Recipe ratings in the shared cookbook.Stars and favourites on shared recipes stay, so other families’ libraries do not change when one household leaves. They are stored against that label rather than against you, and we permanently reserve it so it can never be reissued to a future household or member.
• Our beta tester list and the problem reports you sent us. The copies we keep in Notion (your name, email address, household name and device, and what you wrote in a report) are kept so we can follow up. Ask us at support@pnumen.com and we will delete them.

Email forwarded to a family inbox is handled separately and more strictly: the plain text is purged after about 30 days and attachments are processed and discarded within days.

Your choices

• Disconnect Google Calendar at any time in Settings.
• Delete individual items, or your household and its data, from within the app.
• Leave a household without deleting it — the rest of the family keeps theirs, and if it was the only one you were in, your account is deleted.
• Ask us for a copy of your data, or for it to be deleted, at support@pnumen.com.

Children

Family Dashboard is designed for families and a household may include children, but accounts are created and controlled by adults. We do not knowingly allow children to create their own accounts or to sign in independently.

Changes

If this policy changes materially we will update the date at the top and, where the change affects how Google user data is handled, tell you in the app before it takes effect.