Privacy Policy

Google Calendar access

FamilyBoard accesses Google Calendar data only after a household member explicitly authorizes it through Google's consent screen. FamilyBoard requests these permissions:

• Calendar list (calendar.calendarlist.readonly): the names, colors, and access levels of the calendars on the account, so the household can choose which calendars to show.
• Calendar events (calendar.events.readonly): event details such as title, time, location, description, recurrence, attendees, and status, for the calendars selected for the dashboard.
• Owned-calendar events (calendar.events.owned): creating, updating, and deleting events on calendars the connected account owns, when a household member makes those changes through FamilyBoard.

With these permissions FamilyBoard can read, create, update, and delete Google Calendar events. It changes events only when a household member asks it to, and it does not send invitations or updates to event guests.

How the data is used

Google Calendar data is used only to display, synchronize, and manage household events through FamilyBoard. It is not used for advertising, profiling, or any purpose unrelated to showing the household its own calendar.

FamilyBoard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and security

• Event data is kept in FamilyBoard's database as a cache so the dashboard stays fast and current. Google Calendar remains the source of truth, and the cache is refreshed from Google.
• Google refresh tokens are encrypted (AES-256-GCM) and stored server-side only. The encryption key is kept separately from the database. Tokens are never sent to the browser or the wall display.
• Google access tokens are short-lived and are held in memory only; they are not persisted.
• Database access is restricted to the FamilyBoard server.

Sharing

FamilyBoard does not sell Google user data or any other personal data. Data is not shared with third parties, except with the infrastructure providers needed to operate the app (such as database and hosting providers), and only as required to run FamilyBoard.

To show the weather, FamilyBoard sends the household's approximate location (town-level latitude and longitude) and time zone to Open-Meteo, a weather service, to look up the forecast.

Revoking access and deleting data

A household member can revoke FamilyBoard's access at any time from their Google Account at myaccount.google.com/permissions. After access is revoked, FamilyBoard can no longer read or change that account's calendars and its stored refresh token stops working.

The household can also disconnect FamilyBoard by asking its administrator to remove the stored Google connection, its encrypted refresh token, and the cached calendar data. Contact justin.verh@gmail.com to request this.

Todoist tasks

FamilyBoard connects to the household's Todoist account to display and manage household tasks. It accesses Todoist task, project, and collaborator data through the Todoist API using a credential the household provides.

• Todoist data is used only to show and manage the household's own tasks. It is not used for advertising, profiling, or any unrelated purpose.
• The Todoist credential (API token) is encrypted (AES-256-GCM) and stored server-side only, with the encryption key kept separately from the database. The browser and the wall display never receive the Todoist token.
• FamilyBoard may keep a cache of task data from the Todoist projects the household has chosen to show, and the identifiers, names, and email addresses of those projects' collaborators, so tasks can be matched to household members. Todoist remains the source of truth, and the cache can be rebuilt from Todoist at any time.
• Todoist data is not sold, and it is not shared beyond the infrastructure providers needed to operate FamilyBoard.
• Access can be revoked at any time by regenerating or revoking the Todoist API token in Todoist's integration settings, after which the stored credential stops working. The household can also ask its administrator to remove the Todoist connection and the cached task data by contacting justin.verh@gmail.com.

FamilyBoard is not created by, affiliated with, or supported by Todoist.

Signing in

Household members sign in to FamilyBoard with Google. Sign-in uses a separate Google OAuth client from the calendar connection and requests only the standard identity permissions openid and email. Only Google accounts that the household administrator has added to FamilyBoard's access list can sign in; any other account is refused, and signing in never creates an account.

• From Google sign-in, FamilyBoard stores the account's email address, Google's account identifier, and the time of the last sign-in. It does not request or store Google profile information, and it does not keep the access token Google returns during sign-in.
• After signing in, FamilyBoard keeps a session in its own database: a random session identifier (stored only as a one-way hash), when it was created, last used, and when it expires, the browser's user-agent text, and, for a wall display, the display's name and who set it up. The browser holds the session identifier in a secure, HttpOnly cookie that page scripts cannot read.
• Sessions end after 30 days without use (and at most 90 days after sign-in); wall-display sessions last up to a year while in use. Signing out, or removing a wall display from the account page, ends that session immediately.
• Changes made while signed in are recorded as made by that household member (wall-display changes as FamilyBoard). This information is used only to run FamilyBoard, is not sold, and is not shared beyond the infrastructure providers needed to operate it. The household can ask its administrator to remove sign-in and session records by contacting justin.verh@gmail.com.

Shopping list and purchase history

FamilyBoard stores the household's shopping list in its own database: each item's name, store, quantity, and notes, when it was added, changed, or marked purchased, and which household member or household system (for example, the wall display) made the change.

• Items marked purchased are kept as the household's purchase history rather than deleted. The history is used for household functionality and may later be used for optional suggestions, such as items the household buys regularly. FamilyBoard does not make such suggestions today.
• Shopping data is not obtained from Google or Todoist, and it is not used for advertising or profiling. It is not sold, and it is not shared beyond the infrastructure providers needed to operate FamilyBoard.
• Items added by mistake can be deleted permanently. The household can ask its administrator to delete the purchase history by contacting justin.verh@gmail.com.

Trakt watch history

FamilyBoard connects to the household's Trakt account, which records the shows and movies the household watches. With the household's authorization, it reads that account's watch history, show progress, paused playback, personal calendar of upcoming episodes, movie recommendations, and watchlist, along with the account's username and time zone. FamilyBoard only reads this data; it does not change anything in Trakt.

• Trakt data is used only to show the household what it is watching, upcoming episodes, and recommendations. It is not used for advertising, profiling, or any unrelated purpose.
• The Trakt access and refresh tokens are encrypted (AES-256-GCM) and stored server-side only, with the encryption key kept separately from the database. The browser and the wall display never receive them.
• Watch data is kept only in the FamilyBoard server's memory to keep the dashboard fast. It is not stored in FamilyBoard's database; Trakt remains the source of truth.
• Trakt data is not sold, and it is not shared beyond the infrastructure providers needed to operate FamilyBoard.
• Access can be revoked at any time from the connected apps in the Trakt account's settings, after which the stored tokens stop working. The household can also ask its administrator to disconnect Trakt and delete the stored tokens by contacting justin.verh@gmail.com.

FamilyBoard is not created by, affiliated with, or supported by Trakt.

Meals and recipes

FamilyBoard stores the household's meal schedule in its own database: each planned meal's date, meal type, name, optional servings, notes, and cook, a link to a recipe if one was chosen, and which household member or household system made the change.

• Recipes come from the household's own recipe server (Mealie), which is hosted privately on the home network and is not reachable from the internet. FamilyBoard reads recipe content from it, such as names, ingredients, instructions, and the website a recipe came from, to show recipes and link them to meals.
• FamilyBoard keeps recipe content only briefly in the server's memory; it does not copy the recipe library into its database. A planned meal keeps the recipe's name so it still shows if the recipe is later removed.
• When someone in the household imports a recipe by its web address, the household's recipe server fetches that source website to read the recipe, and the recipe is saved in the household's recipe library. FamilyBoard records who imported it, when, and the web address, but not the recipe itself. Only public web addresses can be imported.
• FamilyBoard may parse a recipe's ingredient text (using the recipe server's ingredient parser, which runs on the home network) to help turn ingredients into shopping items. The parsed result is used only for that and is not saved to the recipe.
• Ingredients that someone chooses to add to shopping are stored in FamilyBoard Shopping like any other shopping item (name, quantity, store, a note naming the recipe, and who added them).
• FamilyBoard does not use the recipe server's own meal planner or shopping list.
• The credential FamilyBoard uses to read and import recipes is kept server-side only; the browser and the wall display never receive it.
• Meal and recipe data is not sold, and it is not shared beyond the infrastructure providers needed to operate FamilyBoard. The household can ask its administrator to delete its meal plans by contacting justin.verh@gmail.com.

Changes and contact

If this policy changes, the updated version will be posted on this page with a new date. Questions about this policy can be sent to justin.verh@gmail.com.