HomeOS privacy notice

1. Who operates HomeOS

CFB Picks LLC, operating as Family Situation Room, provides this household service to approved adult household members in the United States. The dashboard also refers to the service as HomeOS. Contact support@familysituationroom.com about privacy, access, deletion or security concerns.

This notice covers the private dashboard and its enabled supporting services, including authorization and weather services. It is not a notice for a public store, payment service or every possible future feature. Optional connections described below work only when configured and separately authorized. HomeOS is independent of Apple, Google, Microsoft, Yahoo, Oura and the National Weather Service.

2. Information we use, and why

Information comes from you, other authorized household adults, the accounts you connect, and selected public sources. We use it to authenticate members, organize household information, create reviewed plans and reminders, operate chosen connections, and secure the service.

Neon stores household records. Shared school-mail review processes message text transiently and saves only private receipts and review choices for up to 24 hours; it does not save the raw message body. Provider authorization credentials are encrypted on the server so chosen connections can continue after you close the browser.

We do not sell household information or use it for targeted advertising. We do not use connected email, calendar, form-answer or wearable content to train general-purpose AI models. HomeOS uses and discloses Google data in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Public forwarded-email intake is currently disabled. If it is offered later, the owner will choose an exact source sender and consent to a stated HomeOS plan-review purpose before activation. Resend would receive the forwarded message; its public terms state that email and log data are retained for 30 days on active Free, Pro and Scale plans. That is provider-side retention and does not describe HomeOS retention. The exact handling of each inbound message component under that provider statement remains subject to review before activation.

3. What another household member can see

Connecting a source is separate from choosing to share it. In shared households, Google Calendar events remain unavailable to household calendar views until the mailbox owner enables the separate sharing control, which explains that authorized household adults will see primary calendar events. The owner can withdraw sharing; HomeOS removes that generation's local source cache and identifiable calendar history. School-mail text, receipts and review choices remain private to the connected mailbox owner and do not create shared tasks. Matching school-lunch balance, financial and budgeting notice results are visible only to the connected Google account owner. Tasks and locally created calendar events marked private are restricted to their creator in normal application views; shared items are household-visible. Planning, reusable answers, form drafts, family profiles and family tools are shared household records.

Email-to-calendar source settings and attachment previews are visible only to the mailbox owner. Choosing shared imports makes the resulting local event logistics visible to household adults; it does not share the original mail, attachment or private processing references. Pausing a source stops future processing. Previously saved or shared events remain until removed.

Morning Reads source settings, edition titles, summaries, reading copies and opened state are visible only to the connected mailbox owner. They are excluded from shared dashboard snapshots, household search, debrief email, AI requests, product analytics and household-facing exports. Encrypted service-recovery archives can contain these records until archive expiry; access is restricted and archives are retained for no more than 30 days under the current recovery procedure.

When daily debrief delivery is enabled, Resend sends tomorrow's event summary, shared preparations and due tasks, overlaps and relevant calendar changes to configured approved household recipients. App-private tasks and local calendar events are excluded. Oura scores and raw school-message bodies are not included. Recipients can retain or forward an email, and HomeOS cannot retract it.

A private label controls application access. It is not end-to-end encryption or a guarantee against access by authorized hosting, database or service administrators. Operational access must be limited to running, protecting or lawfully administering the service. Human review of connected Google content for support requires your specific permission, except where access is permitted for necessary security or legal purposes.

Someone near an unlocked display or signed-in shared device can see what that session displays. Protect your device and provider account. Removing a connection cannot erase information another authorized viewer has already seen or copied.

4. Imports and the weather AI

In the manual photo, PDF, text and calendar-file import tools, extraction runs in your browser. The selected raw file is not uploaded by that flow. Recognized text and proposals remain in the page until you choose what to save. Confirmed event details, reusable answers and form drafts are then stored as household records; they are not private merely because the original file stayed on your device. The separate email-to-calendar pilot processes supported calendar attachments on the server as described above; it does not use AI to interpret private email.

The optional morning weather synopsis uses Google Gemini through Netlify AI Gateway. Inputs are public NWS forecast-discussion text and public city-area, date, time-zone and forecast-office context. It does not receive household names, precise home addresses, email, calendars, form answers or wearable data. The generated synopsis can be reused for households registered to that public area; private household information is not pooled with it. Public discussions and generated forecasts may be retained by the shared weather service.

HomeOS currently has no product-analytics or session-replay integration enabled. A future household-content AI feature, new sensitive-data use or analytics integration would need an updated disclosure and any required separate consent before activation. The weather summary is fallible and does not replace official forecasts or warnings.

Optional travel estimates

The Apple Maps drive planner asks you to confirm addresses and consent before contacting Apple. The starting address stays in the open page; it is not saved as a household record or substituted from your weather city. Drive results are temporary, clear when you leave the travel view, and are not included in the AI weather summary or debrief email. Apple processes requests and technical connection data under its Maps privacy notice. Traffic predictions and matched locations can be wrong; review the map and refresh before leaving.

5. Optional Oura sleep-score trial

Oura access is currently restricted to a separately approved household trial for two adults and is not included in the general paid offering. Each wearer authorizes their own account. Oura's Daily permission includes sleep, activity and readiness summaries; HomeOS requests only the daily sleep endpoint for the score and Oura's date. Provider permission is broader than the information HomeOS uses.

Connecting does not share a score with another household member. Sharing starts off; only the wearer can enable it, hide it again or disconnect. HomeOS stores encrypted authorization credentials and consent/sharing metadata in a private database schema. It reads recent scores when the module opens or refreshes, without storing score history. Scores are excluded from AI prompts, product analytics, household debrief email and general household caches.

Disconnecting deletes the local Oura authorization. You can also revoke access in Oura. Oura grants are excluded from household exports, so restoration requires each wearer to reconnect and choose sharing again. General household-retention exceptions do not authorize keeping Oura-derived data after a required deletion. A morning check-in labeled “this visit only” stays in page memory and resets when the page is left or reloaded. Scores do not establish someone's mood, health or ability to take on responsibilities.

6. Children's information

HomeOS accounts and provider connections are for approved adults. We do not offer independent child sign-up. Adults may add child-related schedules, profiles or school information; adult-only access does not mean those records contain no children's information.

Only provide information about a child when authorized. Use the minimum needed, such as a first name or nickname, and avoid unnecessary birth dates, medical records or identifiers. Contact us to request review, correction or removal of a child's information or report an unauthorized child account. No child wearable connection is included.

7. Service providers and other disclosures

• Netlify provides hosting, functions, private caches and the weather AI gateway.
• Neon stores the household database and the separate public-weather and Microsoft-service databases where configured.
• Supabase manages dashboard login identities and sessions.
• Apple, Google, Microsoft and Yahoo provide the sign-in or account services you choose. Apple and Yahoo support is sign-in only. Google also supplies Gemini for public weather text.
• Oura provides separately authorized sleep scores when enabled.
• Resend processes recipient addresses and debrief content when delivery is enabled.

Providers receive information needed for their role. Their own policies govern information collected through your direct use of their products, which HomeOS does not control. Selected feed operators receive requests needed to retrieve their information. Support email passes through configured email/forwarding providers. Provider infrastructure can affect storage, availability and processing locations; we do not promise every provider processes information only in one US state or country.

We may disclose information when legally required or reasonably necessary to address fraud, unauthorized access or safety threats, limited to the relevant purpose. A business transfer requires notice and any consent required by law or provider policy; this notice does not authorize unrestricted sale or reuse of Google or wearable information.

8. Retention, disconnecting and deletion

Saved household records remain until removed through a supported tool or operator-assisted deletion. Some records, such as local calendar events, have in-app deletion. Tasks and broader removal of planning/history records currently require operator assistance. Completing a task, marking an answer expired or hiding an old item does not necessarily delete it. An answer's review/expiry date prevents reuse; it is not a deletion date. A recent-history view is not a retention limit. Undo state, snapshots and backups may retain earlier versions.

Shared school-mail bodies are processed transiently rather than saved. Private receipts and review choices expire after 24 hours, while minimized email-calendar records and Morning Reads copies use the feature-specific limits below. Completed, denied and closed DSR records are anonymized no later than 24 months after their last update through a restricted operator maintenance action; the opaque request code and minimal audit status remain. Open requests are retained while being handled. The service does not yet have a comprehensive automated account-deletion process or a verified fixed purge deadline for every cache, backup and provider log. We do not promise immediate or complete erasure from all systems when you click Disconnect.

• Google disconnect: deletes the local refresh token, private email-source settings and state, and that grant generation’s cached Google Calendar source and identifiable scan history. It stops new reads; saved household tasks, imported local events, shared plans and delivered emails remain.
• Delete my Google data: in shared households, this removes local Google authorization and source data for the selected household; it does not revoke the Google grant. Use Google account permissions to revoke provider access. In legacy installations, the authenticated mailbox owner can request confirmed deletion of their saved connection and source records; the operation attempts Google grant revocation and reports whether it was confirmed. Saved household tasks, imported local events, shared plans and delivered emails remain; imported events stop receiving source updates. Existing exports, backups, provider logs and other people's copies may need separate handling. See the Google deletion instructions.
• Morning Reads: cleaned reading copies are kept online for no more than 30 days and are limited to 20 recent editions per mailbox owner. Turning off Morning Reads, disabling all of its sources, or disconnecting or reconnecting Google deletes its source settings, copies and opened state. Copies are omitted from household-facing exports. Encrypted service-recovery archives can retain an earlier copy until their maximum 30-day expiry; deletion requests must be reconciled before a restore is reopened.
• Unstructured email shadow: raw message bodies receive a 24-hour expiry marker. Minimized results, deduplication records and failure rows receive 30-day expiry markers. Scheduled cleanup removes expired rows when the service is running; deletion may be delayed while it is stopped.
• Microsoft disconnect: stops new reads and reuse of connection results and removes authorization through the configured connection service. Previously shared records and delivered emails remain.
• Oura disconnect: deletes local authorization and stops future HomeOS reads. HomeOS stores no score history. Information already seen by another viewer cannot be recalled.
• Sign-out: ends the local dashboard session. It does not disconnect sources, delete records or necessarily end sessions on other devices.

For broader deletion, access or copy requests, submit an authenticated privacy request or contact us. We will identify affected systems, verify the request, and explain completion and lawful retention exceptions. We cannot delete copies in someone else's inbox, an independent export or a provider's own account through a HomeOS disconnect. Provider backups and logs follow their applicable processes; we will not represent those copies as erased without verification.

9. Your controls and privacy requests

Use connection controls to stop an optional source, the Oura control for your own sharing, and supported editing/deletion controls for saved records. You can also revoke HomeOS in your provider's account-permissions settings. An authenticated household adult can submit and review an individual privacy request in the privacy request page; only the owner can submit a household-wide request. Our operational response target is 30 days and is not a statement of a statutory deadline. We explain a denial and available appeal route. Removing information essential to a selected feature may make it unavailable.

For email fallback or requests from a former/nonmember adult, guardian or agent, contact support@familysituationroom.com with a short description. Do not send passwords, verification codes, access tokens, provider message content or complete sensitive documents. We verify identity and the authority for the requested scope, and protect other household members' information when responding.

10. Browser storage, security and updates

This installation uses Secure, HTTP-only login cookies that browser JavaScript cannot read. Login cookies can persist for up to seven days between renewals. Temporary authorization cookies support connection security. Browser local storage remembers saved demo-item identifiers. Clearing site data removes local preferences and sessions, not server records. Blocking necessary cookies may prevent sign-in.

HomeOS uses HTTPS, authenticated access checks and server-side encryption of provider credentials. Ordinary household content is not end-to-end encrypted. No service guarantees perfect security. Report suspected unauthorized access to the contact above; we will address incidents and provide notifications as required by applicable law.

We will date updated notices and prominently explain material changes. New uses of connected or sensitive data require any applicable additional permission before they begin; posting revised wording alone does not replace that consent.