Privacy
Last updated October 2026 · Support & FAQ · Terms
The short version
What we store
- Your email address, and a one-way hash of a sign-in secret that your browser works out from your password. Your password itself never leaves your browser.
- Your family code (like SUNNY-FOX-OAK-4821).
- Your family's data as encrypted blobs that only your family's accounts can unlock.
- The member list without names: which accounts are in the family, who owns it, when each joined.
- Join requests: the email address and name of someone asking to join, until the request is answered or the family is deleted.
- Locked keys: each account's public key, and copies of the keys that only the right person's password (or recovery code) can open.
- Timestamps of when things last changed.
What we never see
- Your password.
- Your calendar and appointments.
- Cycle-planner dates.
- Lists, chores, meals and rewards.
- Your kids' details: names, birthdays, schools.
- Your home address, and where your events are.
- Anything you ask the assistant.
- Photos for the photo frame.
Everything in the right-hand column is either encrypted in your browser before it leaves, or never leaves it at all. A few outside services get what they need to do one job, such as an approximate location for the weather. The table below lists every one of them. No ads, no trackers, no analytics. You can download your data, and delete your account, yourself, at any time.
How the encryption works
- Your password is split in your browser. When you sign in, your browser works out two separate secrets from your password. One is used as the password for the sign-in service (Supabase Auth), so Supabase never receives your real password, nor the secret that unlocks your keys. The other never leaves your browser; it unlocks your keys. The sign-in secret Supabase does receive is still made from your password, so someone who stole it could try to guess your password offline: that is why a long password matters.
- Each account has its own key pair. The public half is stored with your account. The private half is stored only locked with the secret above that never leaves your browser (and, if you made one, with your recovery code).
- The family key. When you start a family, your browser makes a random family key. Every kind of shared data (events, lists, chores…) is encrypted with it in the browser (AES-256-GCM) before it syncs, so the cloud holds only ciphertext. A copy of the family key is locked for each account in the family, with that account's public key.
- Private things have their own key. The cycle planner and private appointments are encrypted with a personal key that only that person can open, and for the cycle planner also one partner they choose. When she chooses, she sees the partner's email address and a 12-digit code to compare with their screen, and that partner's account and key are recorded inside her encrypted planner, where nobody else can change them. If the partner's key ever changes, nothing new is shared with it until she confirms it is really them. Everyone else in the family sees only "Busy" blocks for private appointments: the date, time, repeat pattern and who, without titles, places or notes.
- Joining needs a safety code. When someone asks to join, the owner (or a member the owner allows) sees the requester's email address and types the 12-digit safety code shown on the new person's screen. The code belongs to that one request, in that one family. Only then is the family key locked for the new account. A request from someone you don't recognise, or one whose code doesn't match, gets nothing. The name a requester types cannot contain digits.
- Keys only go to approved keys. The family remembers which key it approved for each account. If an account's key changes (for example after a password reset without the recovery code), it gets no new family key, and no partner's planner, until someone who can approve people approves it again with the safety code.
- Leaving changes the key. When the owner removes someone, the owner's ChalkFam replaces the family key straight away. When someone leaves or deletes their account, the key is replaced the next time the owner, or a member who can approve people, opens ChalkFam with a fresh sign-in (if theirs is older than five minutes, Settings → Family asks them for their password). From then on, they cannot read anything that changes. The previous key is kept until the next change, so the owner can undo a key change that went wrong.
The people who run ChalkFam never hold a key that opens your data. Three honest limits: your locked keys are only as strong as your password, so choose a good one; ChalkFam is a website, so you are trusting the code we serve each time you open it; and whoever controls the server decides who is listed as a member, so someone in that position could add a fake member to your family, and the next key change would include it. The member list in Settings → Family shows everyone who is in.
Password reset and the recovery code
A reset email lets you choose a new password, but a new password cannot open keys that were locked with the old one. That is what keeps your data private, even from us. What happens next depends on whether you made a recovery code (optional, offered in Settings → Account):
- With your recovery code: type it after the reset. It unlocks your keys, including your personal key for private things, and ChalkFam locks them again with your new password. Nothing is lost.
- Without it: your account gets a new key, and gets nothing until someone in your family who can approve people approves you again, with the safety code. That brings back all the shared family data. Your own private items (cycle planner, private appointments) were locked with your personal key; without the recovery code nobody can open them again, including us, so they are deleted from the cloud, also for the partner you shared the planner with. You start them fresh and choose your partner again.
- If you are the only one who can approve people (an owner on their own, or the only approver): without your recovery code, nobody can approve you again and your family's data will be unreadable. ChalkFam warns you before a reset, and Settings shows a reminder until you have a recovery code. You can also let another adult approve people (Settings → Family → Can approve).
We cannot reset or recover any key for you. If every grown-up in a family loses their password and recovery code at the same time, the family's data cannot be recovered by anyone.
What is stored, and where
In your browser
- Browser storage (localStorage): your family's data, readable in your own browser so the app works offline, your settings, your sign-in session, and a counter per piece of data so your browser can refuse an older copy. No keys.
- IndexedDB: daily local snapshots of your data (the last 14, so you can undo a mistake), the keys unlocked in this browser (stored so that they cannot be copied out), and, if you use the photo frame, the photos you added. Photos never leave your browser.
- Small caches: the last weather forecast, the city we guessed and places you looked up, so the app opens quickly.
- Browser cache: the app's files so it opens offline; on computers and tablets the natural voice (downloaded by itself on Wi-Fi); and, only if you chose to use them, the assistant model and the PDF and photo readers.
Signing out, leaving the family, deleting your account and being removed all clear ChalkFam's saved copy from that browser: the family's data, snapshots, keys, photos, caches and session. Only your look and language preferences stay. Signing in again brings the family's data back from the cloud. Settings → Privacy & your data → Clear ChalkFam from this browser does the same clean-up whenever you choose; your look and language preferences stay there too (clearing the site's data in your browser removes those). It touches nothing else on your phone or computer, and it does not delete your account or your family's data. Nothing about your family lives in a cookie.
In the cloud (Supabase)
| What | Contents |
|---|---|
| Account | Your email address, a one-way hash of the sign-in secret (not your password), when the account was created and last signed in. Held by Supabase Auth. |
| Family | The family code, which account owns it, when it was made. |
| Members | Which accounts are in the family, their role, whether they may approve people, when they joined, who approved them, the fingerprint of the key that was approved, and each account's public key. No names. |
| Family data | One row per kind of data, holding only ciphertext, the random nonce used to encrypt it, a random row id, the key version, a write counter and when it changed. There is no readable copy and no column that could hold one. Other people's private appointments are in it only as "Busy" blocks (date, time, repeat pattern, who), inside the ciphertext. |
| Previous key version | After a key change, the family data as it was just before, still encrypted under the previous key, so the owner can undo a key change that went wrong. Replaced at the next key change. |
| Personal data | Each person's cycle planner and private appointments, as ciphertext under their personal key, with a random row id, which key it uses, a write counter and when it changed. Readable (and even returned) only to accounts holding that key. |
| Keys | The family key locked for each account; each account's private key, locked with its secret that never leaves the browser and, if made, its recovery code; personal keys locked for their owner (and a cycle partner), with the fingerprint of the key each was locked for. Useless without the matching password or recovery code. |
| Join requests | The requester's email address and the name they typed (both readable by your family, which needs them to decide), their public key, and whether the request was approved or denied. |
| Join attempts | The account id and the time of each request to join, to limit guessing of family codes (10 an hour). Older than a day: deleted at that account's next request. |
Live updates go through Supabase Realtime. When a row is deleted, its random row id may be visible to other signed-in users of the service; row ids reveal no content.
Every outside service: when, and exactly what it receives
Any web request also carries your internet (IP) address and browser type; that is how the internet works, and we list it where it is the only thing sent. "About 1 km" means the coordinates are rounded to 2 decimal places before they leave your browser; "about 100 m" means 3.
| Service | When | What it receives |
|---|---|---|
| Supabase (accounts and sync) | Whenever you sign in, and while you are signed in and online (sync and live updates). | Your account email; the derived sign-in secret, not your password; ciphertext and locked keys; family membership without names; the requester's email on join requests; timestamps; your IP address. |
| Vercel (hosts the app) | Whenever the app or these pages load. | Normal web request logs: IP address, browser (user agent), the page asked for. No family data. |
| MET Norway | When the weather is refreshed, at most every 30 minutes while the app is open. | Your family's place, rounded to about 1 km. |
| BigDataCloud | At start-up and every few hours, to find the town; once to find the country of a home address. | With no saved place: only your IP address, which it uses to guess the city. Otherwise: a point rounded to about 1 km. |
| Photon (komoot) | Only while you type in a place field (never for a private event, where only saved places are searched), or when you tap "Get travel time" for a place you typed but did not pick. | The text you typed, and a point rounded to about 1 km so nearby results come first. |
| OSRM (routing) | Leave-by times for events at a saved place, or where someone tapped "Get travel time"; never for a private event unless its owner taps "Get travel time" in their own editor. "Travel times for events" in Settings → Travel & maps turns this off for the family. | An approximate start point (about 100 m) and the destination's coordinates. |
| Google Places, Routes and Static Maps | Only if your family adds its own Google key in Settings, in place of Photon, OSRM and OpenFreeMap, at the same moments. | The same as Photon and OSRM above (typed text and a point rounded to about 1 km; an approximate start point and the destination), and the place's coordinates for a map picture. Requests carry your family's key. |
| OpenFreeMap | When a map preview of a picked place is shown (for a private event, only after its owner taps "Get travel time"). | Requests for the map tiles around that place, which show its neighbourhood. |
| Overpass (OpenStreetMap) | Only when you tap "Find grocery stores near me" on a grocery list. | A point rounded to about 1 km. |
| School calendar websites | Only if the browser allows the app to read a school subscription link you added: when you tap Fetch or Refresh, and then once a day while the app is open. The app's security policy blocks most school sites, and then nothing is sent; you download the file yourself instead. | A normal web request to the address you pasted: your IP address and browser. Nothing from ChalkFam is sent. |
| Your browser's speech service | Voice add: only after you tap the microphone and accept the notice. Reading aloud: only if you turn on "Allow online voices". | Voice add: your recorded voice (Chrome, for one, sends it to Google to turn it into text). Online voices: the text being read, such as the morning briefing and spoken alerts, which goes to Google (Chrome) or Microsoft (Edge). Without that switch, only voices built into your browser or computer read aloud (they don't send anything online). |
| jsDelivr | Only the first time you use an optional heavy feature. | Download requests for the PDF reader, the photo text reader (OCR) and its language data, the assistant that runs in your browser, the natural voice engine and the map library. No family data. The PDF and photo readers run in a separate worker that is handed only the file you picked; the natural voice runs in its own worker too. |
| Hugging Face and GitHub | The natural voice, once, on computers and tablets on Wi-Fi (turn it off by choosing “Browser voice” in Settings → Voice & briefing). The assistant model only after you choose to download it. | Download requests for the model and voice files. No family data. |
| Google Fonts | When the app loads, and when you switch to a language that needs its own typeface. | A font request: your IP address and browser. |
The sign-in library and the QR-code maker are part of the app itself, not loaded from another site. Tapping "Directions" or "Open in Google Maps" opens Google Maps in a new tab with that destination; nothing is sent until you tap. None of these services receive your calendar, your lists, names or any other family data beyond what the table says.
The assistant
"Ask ChalkFam" works in layers. A rules engine handles the common things with no model at all. If your browser has a built-in language model, the assistant can use it; otherwise you can choose to download a small model that runs in your browser. The download shows its size before it starts, is cached by the browser, and can be removed by clearing site data. In every layer, what you ask and your family's data stay in your browser. The assistant only sees what you are allowed to see on that screen: other people's private items reach it only as "Busy". One honest limit, for the downloadable model only (it is opt-in): its engine (WebLLM, from jsDelivr) runs inside the app's page, with the same access to your data in that browser as the app itself. If you would rather not, keep using the rules engine or your browser's own model.
Kids
Accounts are for grown-ups. Kids don't get accounts, passwords or email addresses: they are people inside your family's encrypted data, and use ChalkFam on a shared family screen or the wall display. Kid mode limits a screen to a child's own chores and day. Approving someone into the family needs the 12-digit safety code from the new person's screen, typed in by the person approving, and the name a requester types cannot contain digits, so a stray tap cannot let anyone in. We collect nothing about children: their names, birthdays and schools exist only inside your family's encrypted data.
How long we keep things
- Your account and your family's encrypted data: until you delete them, or until ChalkFam stops running (see the terms). There is no set expiry, and no hidden copy we keep for ourselves, but there is no promise that ChalkFam keeps your data stored on its servers.
- Join requests: until the family is deleted or the person who asked deletes their account. An answered request stays so the family can see who joined.
- Backups: Supabase keeps a daily backup of the database for 7 days (our plan; point-in-time recovery is not turned on). We don't guarantee that data can be recovered from them. Deleted rows leave those backups as they roll off. Everything in them is the same ciphertext and locked keys.
- Request logs: Supabase and Vercel keep request logs (IP address, time, browser) for a short period under their own policies.
Deleting, yourself, right away
Deleting is self-serve and immediate. Deleting your account or the family, removing someone, leaving, handing over the family, changing or restoring the family key and replacing your own key all need your password typed within the last five minutes (a link from an email does not count), so a borrowed or stolen session cannot do them. Like any signed-in member, such a session can still change or delete the family's everyday data; the daily snapshots kept in each browser you use let you put it back, and one damaged piece of data never stops the rest from syncing.
- Your account: Settings → Account → Delete my account. Your email, sign-in secret hash, membership and every copy of your keys are removed immediately, and ChalkFam's saved copy is cleared from that browser. Your private items can no longer be opened by anyone. If you are the only person in your family, the family and all its encrypted data go too. If you own a family that has other members, make someone else the owner (or delete the family) first.
- Your whole family: the owner uses Settings → Family → Delete this family. Every row of that family (data, keys, members, requests) is removed immediately. For the other members, ChalkFam clears the family's data the next time they open it.
- A person: the owner removes them under Settings → Family. Their access stops at once, the family key is replaced, and wherever they are signed in, ChalkFam clears the family's data the next time they open it. People in the calendar (kids, grandparents) are removed from the Family screen, with Undo.
- Leaving: Settings → Family → Leave this family (asks for your password). ChalkFam's saved copy is cleared from your browser, your planner and private appointments in this family are deleted, and the family key is replaced the next time the owner or someone who can approve people opens ChalkFam.
- Only this browser: sign out, or Settings → Privacy & your data → Clear ChalkFam from this browser. Only ChalkFam's saved copy there goes; your account and your family's data stay.
Before deleting anything, Settings → Privacy & your data → Download my data gives you a readable file of your family's shared data plus your own private data (your cycle planner and private appointments), with your account email and the date. It never contains another person's private data. It is not encrypted, so keep it somewhere private.
No ads, no trackers, no analytics
There are no advertising or analytics scripts, no third-party cookies and no usage tracking. We do not sell or share data with anyone; the services above only receive what the table says.
Changes
This page may change at any time; the date at the top shows the latest version. The current version is at /privacy; the same text is kept in the project as docs/PRIVACY.md, so every change is in the project's history.
Contact
Questions about privacy, requests about your data, or anything you can't do yourself in Settings: use the contact link on the support page.