Privacy Policy

The short version

• Your family's things are kept so your family's devices can show them. That's what they're used for.
• No ads, no tracking, and we never sell anything about you or your kids.
• A parent creates the family and decides who's in it. In a new family, kids can't use the AI assistant unless a parent turns it on.
• You can download a copy at any time, and delete your whole family yourself.
• Questions: vunderusaf@gmail.com

What we keep

• Your family: names, roles (parent, kid), birthdays, colours, and parents' PINs (only as a scrambled fingerprint, never the PIN itself).
• What you add: chores and to-dos, events, lists, notes, messages in the family mailbox, photos you upload, kids' routines and which steps were ticked (kept a month), and the family's stars, rewards and allowance amounts (written down by you; no bank details).
• The activity log: who added, changed, completed or deleted what, and on which device.
• The AI assistant, if your family uses it: what was said or typed (as text), what the AI suggested and what was saved, and what it cost. Recordings are only kept if a parent turns on "Keep recordings as test cases" and someone ticks "Keep as a test case".
• Sign-ins and devices: the parent emails and passwords (only as a scrambled fingerprint), the names you give your devices, whose device each one is, when each device was last used, and on which days it was used (for counting how much the app is used: how many devices, ticks and new things per family each week, never what anyone wrote). For a device that gets notifications: whose they are, what about, what kind of device it is (like "Chrome on Android"), and when the last one arrived.
• Consent: when a parent agreed to this policy, which version, and the email they used.
• Feedback and app errors: what you send with "Send feedback", and error reports from the app (the app version, the kind of device, the screen; no names).
• Server logs: the server's own logs of requests and errors, kept a short while to keep it running.
• Invite requests from our website (invenn.app): the name, email and note someone sends with "Request an invite", and when. We use them only to send that person an invite. Answered requests are deleted after 90 days, unanswered ones after a year. The website itself sets no cookies and has no analytics or trackers.

Where it's kept

On InVenn's own server: a virtual server rented from GreenCloud (greencloudvps.com), in the United States. If you live outside the United States, your family's things are stored there. The nightly backups are kept on the same server, and a copy of each one with Backblaze (backblaze.com, a storage company, in the United States), so a broken server can't lose your family's things. That copy is encrypted on our server before it leaves, with a password only we have: Backblaze can't read it. GreenCloud only provides the computer and its connection to the internet.

Each family has its own database file, so one family's things are never mixed with another's. Everything travels encrypted (HTTPS). The sign-ins of connected Google and Microsoft accounts are kept encrypted too, with a key that isn't in the backups. Your devices keep a copy too, so the app works without the internet: each device gets only what it may show, so someone's private things, and a grown-up's work, go only to that person's own devices (a kid's private chore that's waiting for an OK also goes to the parents' own devices, until it's OK'd).

Who else sees it

Only the services that do a job for your family, and only for that job:

• AI assistant: when someone uses the mic or types a request, what they said and the family's first names go to OpenRouter, which passes them to the model's maker (Google for Gemini, OpenAI for Whisper and GPT). They turn it into the cards you check before anything is saved.
• Google and Microsoft: only for an account a parent connects in Settings → Calendars, to bring that account's calendars and to-dos into the app. For a Google account, the appointments made in InVenn for that account's person also go into their own Google Calendar, and changes go both ways (a parent can turn this off for each account).
• Apple, Google and Mozilla push services: to deliver notifications to phones that turned them on. What's in a notification is encrypted so the push service can't read it.
• ntfy.sh: what you write with "Send feedback" (with the app version, the screen, and which family it's from, as a code) reaches us on our phone through ntfy.sh, a notification service. It's also how the server tells us when it has a problem (no family's things in those).
• Backblaze: keeps the encrypted copy of the nightly backup (see "Where it's kept"). It can't read it.

We don't share anything with anyone else, unless the law requires it.

How long we keep it

Kids

• A parent or guardian creates the family, adds the kids and manages their profiles. We don't ask kids for anything.
• For a new family, kids' use of the AI assistant is off until a parent turns it on (Settings → AI assistant), and a parent can turn it off again any time.
• There are no ads, no tracking and no selling, for kids or anyone.
• A parent can see, change or delete anything about their kids in the app, or ask us.

Your choices

• Get a copy: Settings → Server & data → Download a backup.
• Change or delete things: in the app, any time.
• Delete your family: Settings → Family → Household → Delete our family (the administrator, on a device signed in with the family email). Everything is deleted from the server straight away, and from the backups within 14 days. Feedback you sent us stays, without who sent it. Or write to us and we'll do it.
• Stop sending appointments to Google: Settings → Calendars → the account's options → Send to Google. Turning it off takes them out of that Google Calendar again.
• Disconnect Google or Outlook: Settings → Calendars → Remove.

Contact

Write to vunderusaf@gmail.com. If this policy changes, we'll say so in the app and ask you to agree again when it matters.