Privacy Policy

Life OS holds a lot about your family: your calendar, your money, your sleep, your children. We keep it because the product does not work without it, we isolate each household from every other one, and we do not sell it, rent it, or use it to advertise to you. You can export it or delete all of it.

If you are here about Google Calendar specifically, the disclosures for it are in Google user data, immediately below: what we access, how we use it, who we share it with, how we protect it, and how long we keep it.

This section covers information Life OS receives from Google APIs specifically. Life OS's use of it adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What Google user data Life OS accesses

• Your email address and basic profile (name, profile picture), from sign-in, to identify your account.
• The list of calendars in your Google Account — their names, colours and IDs — so you can choose which ones Life OS should read.
• The events on the calendars you choose: title, description, location, start and end times, attendees and recurrence.

We request only the scopes needed for this. We do not request access to Gmail, Drive, Contacts, Photos, or any other Google service.

How Life OS uses Google user data

• To show your household's schedule in the app, the daily brief, and the wall display.
• To work out who needs to be where, and to send leave-time reminders before you have to go.
• To create, update or delete an event — but only when a member of your household explicitly asks us to, in the app.

Google user data is never sold, rented, or used for advertising or ad profiling, and is never used to develop, improve or train generalised AI or machine-learning models. When the assistant answers a question, or prepares a proactive suggestion for your household, the relevant events are sent to our AI gateway, OpenRouter, solely to produce that one response. Every such request is restricted to zero-data-retention endpoints that do not store or train on inputs (today, Anthropic's Claude models hosted on Amazon Bedrock and Google Cloud Vertex AI); a request is refused rather than sent anywhere else.

Who Life OS shares, transfers or discloses Google user data to

We do not sell, rent, or transfer Google user data to anyone for their own purposes. It is shared only with the service providers required to operate the feature, each acting on our instructions: Supabase (database and authentication, where the events are stored), Vercel (hosting, which processes the requests), Trigger.dev (the scheduled jobs that sync your calendar), and OpenRouter (the AI gateway, and through it the zero-data-retention model hosts named above, only for the events needed for a specific response), and ElevenLabs (text-to-speech for the children's board: when the assistant's spoken answer mentions a calendar event, that sentence of text is sent to ElevenLabs to be read aloud, and nothing else). We disclose it otherwise only if legally compelled, and will tell you unless we are prohibited from doing so.

How Life OS protects Google user data

Google Calendar data is treated as sensitive: the scopes Life OS requests are Google's sensitive-tier calendar scopes, and the protections below apply to it specifically, not only as part of a general security posture.

• Encrypted in transit with TLS, and encrypted at rest by our database provider.
• Google OAuth access and refresh tokens are encrypted at the application layer with a key held outside the database, so a copy of the database alone does not yield usable tokens.
• Every row carries a household ID and is protected by database row-level security, so one household's calendar data is unreachable from another household's session.
• Access to production systems is limited to the operator, over multi-factor authentication.

How long Life OS retains Google user data, and how it is deleted

• Calendar events are held only as a short cache so the app is fast. It covers roughly the past week and the next three weeks and is refreshed on each sync; anything outside that window is not retained. Looking further ahead in the app fetches from Google live rather than storing more.
• Disconnecting Google in Settings deletes the stored tokens and the cached events immediately, and stops all further syncing.
• Deleting your household deletes all of its Google data along with everything else, immediately and permanently.
• You can also revoke Life OS's access at your Google account permissions. We stop being able to sync at that moment, and you can delete what we already hold from Settings.
• Encrypted backups held by our database provider age out on that provider's retention schedule, after which no copy remains.
• To request deletion directly, write to privacy@familylifeos.app and we will action it within 30 days.

Life OS is an invite-only family organiser. For data protection purposes Life OS is the controller of the information described here. Contact: privacy@familylifeos.app.

Only what a household adds or explicitly connects.

• Account and identity — email address, password (hashed by our auth provider, never visible to us), and the name, role, colour, photo and date of birth each household records for its members.
• Household life — calendar events, tasks, chores, meal plans, groceries, recipes, school items, trips, packing lists, notes and reminders.
• Calendar — if you connect Google Calendar: the list of your calendars, and the events on the ones you choose. We can also create and change events, but only when you ask us to.
• Financial — if you connect a bank through Plaid: account names, types, balances and transactions. We never receive or store your bank username or password. Plaid handles that and gives us a token.
• Health and activity — if you connect WHOOP, Oura, Strava or Apple Health: sleep, recovery, readiness, steps and workouts.
• Home — if you connect Home Assistant, the state of devices you expose to it. Home Assistant runs on your own hardware; we hold a token to reach it.
• Location — addresses you enter for your home and other saved places, used to work out travel time to events. If a household member turns on location sharing — off by default, chosen per person in Settings — their phone also reports significant location changes, including while the app is closed, so the family board can show which named place they are at. See Location sharing below for exactly what that stores.
• Technical — sign-in sessions, push notification tokens, error reports, and a record of scheduled jobs.

Location sharing is off by default and is turned on per person, by that person, in Settings. It can be switched off there at any time, and revoked from iOS Settings independently of the app.

What the phone reports

When it is on, the phone reports significant changes in position — roughly every half kilometre — using iOS's significant-location-change service. This works while the app is closed or has been terminated, which is the point: a family board that only updated while someone had the app open would not tell you anyone had arrived anywhere. It is the lowest-power option that can report an arrival; we do not use continuous or high-precision tracking.

What is stored, and what is not

The coordinate is used to work out a name — a place you have saved, or a nearby business — and is then discarded. Coordinates are never written to our database. What we keep is:

• The place name and category, and the time the person arrived there.
• A history of named stops — “at practice, 5:40pm to 7:10pm” — so the app can answer how long someone was somewhere.

We do not keep a route, a trail, or any history of coordinates. There is no map of where anyone has been, because the underlying data to draw one is never retained.

Who can see it

Members of your own household, and no one else. To turn a coordinate into a place name we send it to Google Places at the moment of the fix; Google receives the position but not who it belongs to. Nothing about anyone's location is sold, shared with advertisers, or used to build a profile.

Tapping someone on the family board shows a map. The pin is on the place, not on the person — the school, the shop, the house — because the place's location is what we hold and a phone's reading is only accurate to about half a kilometre anyway. The map image is fetched by our server from Mapbox, so neither the coordinate nor who is there leaves our systems to draw it.

Turning it off, and deletion

Switching location sharing off in Settings stops all reporting immediately. Deleting a person removes their presence record and their stop history with them, as does deleting the household. To have it removed directly, write to privacy@familylifeos.app.

Life OS is designed for families and holds information about children — names, dates of birth, photos, school details, chores and rewards. That information is entered by a parent or guardian on the account, and children are given access only when a parent creates a login for them. A child's view is limited to their own board: their schedule, their chores, their stars. Children are never shown household finances, other people's health data, or adult check-ins.

We do not knowingly let a child create an account without a parent, we do not advertise to children, and we do not use children's information to train models. A parent can delete a child's profile and all associated data at any time from Settings, which removes it from our database.

• To show your household its own information — the whole point of the product.
• To generate your morning brief, reminders, and the check-ins that ask whether something slipped.
• To answer questions you ask the assistant, and to carry out actions you ask it to take.
• To keep the service running: error monitoring, and alerting us when a sync stops.

We do not sell personal information. We do not share it with advertisers. We do not use your household's data to train any AI model, and the AI providers we use are engaged under terms that prohibit training on it.

Running the product means sending some data to other companies. Each one receives only what its job requires.

• Vercel — hosting and delivery.
• Supabase — database, authentication and file storage (photos, trip documents).
• Trigger.dev — scheduled background jobs (calendar sync, the morning brief).
• Sentry — error monitoring.
• OpenRouter and the model providers it routes to — the text of an assistant request and the household snapshot needed to answer it.
• Google — Calendar (what you connect), and Maps/Places for travel times, address lookup, and turning a shared location into the name of a nearby place.
• Plaid — the bank connection.
• WHOOP, Oura, Strava — the wearable connections you choose.
• Kroger — only if you connect it, to build a cart from your grocery list.
• MealViewer — public school lunch menus. No personal data is sent.
• Mapbox — drawing the map of a place someone is at. Our server requests the image, so Mapbox receives the location of the place and never the identity of the person there.
• Open-Meteo — weather for your area. No personal data is sent.
• ElevenLabs — the voice that reads the assistant's answers aloud on the children's board. It receives only the text being spoken.
• ScrapingBee and Jina — fetching a recipe page you asked to import. Only the URL is sent.
• Apple (APNs) and web push services — delivering notifications to your devices.
• Cloudflare — receiving email you forward to your household's capture address.

• Household isolation is enforced in the database itself through row-level security, not only in application code. One household cannot read another's rows.
• Third-party access tokens — the keys to your bank, calendar and wearables — are encrypted with AES-256-GCM before they are written, using a key held only in the application environment. A database leak alone does not expose them.
• Secret columns are unreadable to normal application queries; only the server components that need them can decrypt them.
• Incoming webhooks are verified cryptographically, so nobody can impersonate Plaid or WHOOP to us.
• Children's accounts are excluded from household data access at the database level.

No system is perfectly secure, and we will not claim otherwise. If we discover a breach affecting your data we will tell you promptly and describe what happened.

Household content stays until you delete it or close the household. Disconnecting an integration deletes the stored token and stops future syncing. Deleting your household removes its data from our database; backups age out on our provider's retention schedule. Error reports are kept for a limited period by Sentry.

Presence is a single current record per person, overwritten as they move, plus the history of named stops described under Location sharing. Turning location sharing off stops new records; deleting the person or the household removes the existing ones.

• Access and correction — everything we hold about your household is visible and editable in the app.
• Export — you can request a copy of your household's data.
• Deletion — you can delete individual records, a person, an integration, or the entire household.
• Disconnect — every integration can be revoked from Settings, and from the provider's own account page.
• Notifications — push can be turned off per person, with quiet hours.
• Location sharing — off unless switched on, per person, and revocable in Settings or in iOS at any time.

Depending on where you live you may have additional rights — to object, to restrict processing, or to complain to a regulator. Write to privacy@familylifeos.app and we will honour them.

Our providers operate in the United States. If you use Life OS from elsewhere, your information will be processed in the United States.

We will update this page when the product changes what it collects or who it shares with, and move the date at the top. For a change that materially affects your data, we will tell you in the app before it takes effect.