Privacy and your data

Updated October 30, 2026. This describes the app's current data handling.

What we keep

We store your account and household profiles, calendar events, rides and helpers, recipes, meals, shopping and pantry lists, tasks, birthdays, board posts, uploaded files, feedback, Scout chats and proposals. Connected services can add calendar, email and school records. We also keep connection settings, encrypted access credentials, notification subscriptions, import evidence, saved AI answers and usage/error records needed to run the app.

Who can see household information

Owners, admins and adults see the household. Trusted adults have their own sign-in and see only their own events and rides unless an admin turns on more. Teens and kids see only what their role allows.

Access depends on household role and feature permissions. Adults, trusted adults, teens and children have different access; parents can read teens' Scout chats. The database checks household access. The operator has administrative access, including feedback and the private AI review page, which can show Scout questions. Outside ride helpers can see the ride details on a link an adult chooses to send. Anyone holding that link can use its one answer before it expires or is cancelled. Split-household sharing and recipe sharing are explicit choices.

Ride helpers

An adult can save a helper's name, their relationship to your family, and, if you add them, a phone number and email. Only owners, admins and adults in your household can see a ride helper's details. We store a one-way hash of the link. A helper link works for one answer, lasts at most 14 days, and stops working if the event changes. It shows only the time, place, ride leg (drop-off or pick-up) and the helper's first name. The app never sends the message itself; your family sends it.

AI and the privacy boundary

Rules and your household's saved data answer first where supported. When AI is needed, emails, email text and attachments, photos, images, scans, PDFs, vision requests, school or portal information and children's or teens' details use hosted Anthropic Claude. They never go to the own-model/Ollama route. Saved answers containing household information stay private to that household. Scout model turns use Claude because their prompts and tool results can contain this information.

The own-model route can use Ollama Cloud, which is an outside service even though the app calls it the "own model." Only two food-only tasks are currently eligible after a household-name check: grocery splitting sends the dictated text; meal ingredients sends the meal title, serving count and any already-have ingredient names. Unknown wording, names, extra context or files send the request to Claude instead. Grocery splitting sends no audio; meal ingredients sends no household profile, calendar, school data or account identifier. Both also send the task instructions and output format. If the own model fails or returns an empty answer, Claude is the fallback, subject to availability and the AI allowance.

Claude receives the text or files needed for the feature. Scout sends household names and roles, timezone and date, the current question, up to 12 earlier messages trimmed to 2,000 characters each, available tool descriptions, and results of tools it calls, such as schedules, rides, lists, meals and school details. A linked Claude key uses that account; otherwise the app uses its configured Claude account. Previously linked OpenAI and xAI keys are ignored for app AI requests and can be removed in Settings. AI can be wrong. Some small Scout changes save immediately with Undo; larger changes are proposals for review.

A separate shared cache reuses guarded generic food answers and independently fetched public recipe pages. Email, photos, Scout chats and family-written recipes are not shared through this cache. It checks household names and accepts only narrowly allowed generic inputs.

Recipes

Family-written recipes stay private to your household, along with their photos, notes and ratings. The one exception is the FCB Founders cookbook: when the operator deliberately publishes a recipe there, only its text (title, servings, times, ingredients and steps) is shared with other households, and never family details. AI recipe import sends only what you submit. See the recipe terms.

Outside services

• Anthropic: hosted Claude processing described above, including recipe search when its web-search feature is used.
• Ollama Cloud or a configured own-model host: the two checked food-only requests described above. A remote host is not the same as a model running privately on your computer.
• Supabase: account sign-in, household database records, encrypted connection credentials, private file storage and saved answers. Its hosted embedding function processes text for meaning matching; this is separate from Ollama.
• Vercel: hosts the website and server routes that process requests, uploads and connected-service responses. Requests include ordinary connection information such as IP addresses; server logs can include operational errors.
• Resend: receives email and attachments forwarded to your family address, and delivers configured app emails such as invitations and operator alerts. Those messages include recipient addresses and their message content. Messages sent to the support address are forwarded to the operator by email and are not stored by the app.
• Google and Microsoft: optional sign-ins exchange account identity and authentication tokens. Separately connected Gmail and Google/Microsoft calendars provide the data their approved permissions allow. Yahoo supplies mail through a read-only IMAP connection when configured.
• School and calendar providers: ParentVUE, Infinite Campus and connected school, team and public calendar/menu services exchange the requests and credentials needed for your selected connection. Calendar feeds are read-only; school records are mapped to the students you choose.
• TeamSnap and SportsEngine: optional sports connections exchange approved account tokens and schedule/team requests. Other linked sports calendars, such as GameChanger, receive requests for the calendar feed you connect. HealthePro / My School Menus receives school/menu requests.
• Open-Meteo: town searches, selected coordinates and timezone for weather. ESPN: selected public team/league schedule requests. Map links open the chosen map service with the event address when you tap them.
• Brave Search and recipe websites: when configured, Brave receives recipe search queries; selected recipe sites receive page requests. Recipe cards can load images from their source websites.
• Apple, Google or Mozilla push services: deliver encrypted Web Push payloads to subscribed devices. Notifications can show names, places and times on a lock screen. Turn them off in Settings or your browser.
• Your browser or device speech service: the Talk controls use browser speech recognition. Your browser/device provider may process microphone audio to return a transcript; the app does not send audio to Ollama.

Google user data

Family CorkBoard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar and Gmail data is used only to provide features the household asked for, is not sold, and is not used for advertising or to train generalized AI models by Family CorkBoard.

Optional connections and Scout

Connection details apply only to households that connect them. New households are not offered ParentVUE or Infinite Campus. Parents can read a teen's Scout chats, and the teen is told. Adults can receive a weekly reminder to review the week ahead; the review runs when someone opens it. When notifications are enabled, we store a device address to reach that browser or phone.

Email connections

Mail connections screen sender and subject first and retrieve relevant message content. Rules make review cards and proposals; explicit "Read it for me" can ask Claude. Scheduled and forwarded-mail processing uses no AI. Email metadata, excerpts, extracted facts and review evidence can be stored; forwarding stores received content needed for its review workflow. This is not a promise that no email text is ever stored. Attachment reading is configurable per supported connection. Email attachments are read by the app's own code only and are never sent to an AI model; pictures and scanned PDFs are not read and are flagged for you to open. Disconnecting Gmail removes retained Gmail connection data; previously approved calendar events or tasks may remain as household items. Disconnect other connections from Connections; revoke access at the provider too if needed.

In-app feedback

You may attach up to three screenshots (5 MB each). Screenshots are stored privately, re-encoded to strip image metadata, and visible only to Family CorkBoard operators through short-lived links. Crop out private information first. Operators may keep a private note on a report. Feedback text and screenshots are never sent to AI or email alerts. Screenshots have no automatic deletion deadline; contact support for removal.

When you choose to send feedback, we store your reaction, optional text, a page route template without record identifiers or query strings, your account and household identifiers, the submission time, and its status (new, planned or fixed). Feedback sent from a connection problem can also include only a broad source type and error category, shown before sending. We do not automatically send error reports, page contents, email bodies, connection links, credentials or children's records with feedback. Do not enter these in the optional text. Feedback text is not sent to AI models or outbound integrations. Your own reports are visible to you and the operator; other household members cannot read them. The operator can see the household name and update report statuses. Feedback stays until household deletion or operator-assisted removal. Getting-started prompts use your household joining date and store dismissals in your own account metadata.

How long information stays

Most household records, saved AI answers, files and usage records have no automatic deletion deadline in the app; they stay until removed through a supported action or household deletion. Some item removals are soft deletes. Inactive Scout conversations become eligible for scheduled deletion after 90 days since their last activity. Temporary photo uploads are removed when consumed; abandoned staging files become eligible for daily cleanup after 24 hours. Sign-in, sign-up, password-reset and invitation attempts are counted using hashed identifiers (never the email or IP address itself) to stop abuse, and those counts become eligible for deletion after about 2 days. These cleanup jobs can run late or fail. Public recipe search pages are reused for up to a week before refresh. Cache refresh is not a promise of permanent deletion.

The app does not control how long outside providers keep processing records, logs or backups, and this code does not establish their retention or AI-training terms. We cannot promise immediate deletion of their copies. Ask the operator for help with provider-specific deletion or an account-removal request.

Export and deletion

Household admins can export supported household records from Settings. Exports exclude secrets and some internal records, including ride-link hashes. The copy includes your ride helpers; it does not include the ask history, which holds the one-way hashes of the ride links. The owner can choose Delete household in Settings after disconnecting the connections the app identifies. That action removes private household files and deletes the household database row and cascading records. Other members' sign-in accounts remain. Temporary upload cleanup and provider copies follow the limits above. Contact the person who invited you for help with a sign-in account, feedback, records without a delete control, or a failed deletion.

Keep originals of important information. Do not enter passwords, Social Security or bank numbers, or detailed medical records into household content.

Terms of use · Back to sign up · Sign in

Questions or stuck? support@familycorkboard.com