Privacy policy

Kitchenboard is a family organiser made and run from Adelaide, South Australia, by Corella Club. The whole point is that your household's calendar, chores, shopping and meals are private to your household. This page says plainly what we collect, why, who else handles it, how long we keep it, and what you can ask us for. We follow the Australian Privacy Principles as our standard, even where a small business is exempt from them, and we treat everyone who uses Kitchenboard the same way, wherever they live.

What we collect, and from whom

We collect information from you, from the other people in your household who use the app, and from services you choose to connect. You need an email address to hold an account, but the name you show can be a nickname. Birthdays, a weather location and outside calendars are entirely your choice.

• Account details: your email address, a display name, and a salted hash of your password (we store the hash, not the password). If you sign in with Google, the identifier Google gives us for your account and the email address Google confirms. When you last signed in, and which devices hold a session.
• Household data you enter: the names and colours of the people in your household, events, chores, shopping items, meals, recipes, pinned notes and privacy words. A birthday for a child if you add one, used to show an age on the wall.
• Outside calendars, if you add them (Plus): the feed address you paste and a cached copy of that calendar, refreshed about every 15 minutes while Plus is on, so the wall can show it.
• Location, if you choose: a latitude and longitude for the weather card, rounded to a quarter of a degree (about 25 km) before it is stored, so it names your area, not your house.
• Payment records: if you subscribe to Plus, Stripe collects and stores your card. We keep Stripe's customer and subscription identifiers, the state of your plan, and a log of the billing events Stripe sends us (their identifiers, types and times). We never see your card number.
• Technical records: sign-in attempts and rate-limit counters, paired screens (including ones you have disconnected), and server logs of requests and errors. There is no advertising, no tracking, and no analytics that identify you.

Why we use it

To run the service you signed up for: showing your household its wall and app, sending the emails the service needs (sign-up confirmation, password reset, invitations, and notice of changes to price or terms), taking payment for Plus, keeping accounts secure, and finding and fixing faults. We do not use household data to profile you, to advertise, or to train anything.

Cookies and storage on your device

• Sign-in cookie: keeps you signed in for 24 hours, or 30 days if you tick "keep me signed in". It also carries the short-lived state we need while you sign in with Google.
• Screen cookie: a paired screen holds its own key for up to 400 days so the wall can show your household without a password. You can disconnect any screen from Settings, which cancels its key.
• Theme: the phone app remembers your light or dark choice in your browser's local storage.

That is all. There are no third-party cookies.

Who else handles your information, and where

We use a small number of providers to run Kitchenboard, each only for the purpose named. We share information to provide the features you choose, as described here, and where the law requires it. We do not sell or rent household data, and nobody else gets it.

• GoDaddy hosts the service on a managed server in Singapore. Each household's data lives in its own database file, separate from every other household. We intend to move hosting to Sydney and will update this page when we do.
• Resend delivers our transactional email. Messages are sent from its Tokyo region, and Resend stores the content and delivery logs of those emails in the United States.
• Stripe processes payments for Plus and receives your email address and payment details. Stripe's own privacy policy applies to the card details it holds.
• Google, only if you choose to sign in with Google, tells us your verified email address and name. Separately, email you send to our support address is routed through Cloudflare to a Google mailbox, so Google handles that correspondence too.
• The Norwegian Meteorological Institute (MET Norway) provides the weather forecast. It receives the rounded location and nothing about who asked.
• Backups: an encrypted copy of Kitchenboard's data is taken nightly and kept in Australia for about 30 days. Full encrypted backups of our hosting account, which include Kitchenboard's data, are also kept in Google Drive; those are not on a fixed expiry today, so a deleted household can persist in an old backup until that backup is retired.

Some of these providers handle information overseas, in Singapore, Japan and the United States. We choose providers with strong security, use them only for the purposes above, and we stay responsible for your information where Australian privacy law says we must.

What we never do

• No advertising, no tracking cookies, no analytics that identify you, no selling or renting of data.
• We do not write into your Google, Apple or Microsoft calendars. Outside calendars you add are read-only and fetched by our server only to show them on your wall.
• The wall screen never sees your password. A paired screen has its own key, which you can cancel from Settings.

Calendar feeds you subscribe to (Plus)

Each person can subscribe their own calendar app to a private Kitchenboard feed. The feed is one-way, from Kitchenboard to that calendar, and carries only events made in Kitchenboard, not events from outside calendars you show on the wall. One-off events are included from 30 days back to 180 days ahead; repeating ones are included whole.

• A person's own feed carries their events in full: title, time, place and notes. Their dated chores are added only when they, or a household owner, tick the box for it.
• The whole-household feed carries every wall-visible event's title, time and place only. Notes stay home, anything matching your privacy words appears as "Busy", and events hidden from the wall are not in it.

Hiding an event from the wall does not hide it from household members in the app, or from its owner's personal feed. Each feed address is a private credential: anyone who has it can read that feed, so treat it like a password and rotate it from Settings if it leaks. On Free, feeds stay valid but empty.

Children

Kitchenboard is for adults; you must be 18 or over to hold an account, and we rely on you to tell us the truth about that. Adults can add children's names, birthdays, events and chores. Add only what is needed and what you have the authority to share, and avoid sensitive details such as diagnoses, in events and notes as well as in calendars you connect. Children do not have accounts and we do not collect information from them directly. If you are a parent or guardian and want something about a child removed or corrected, any member of the household can do it in the app, or you can write to us.

Security

Traffic is encrypted in transit. Passwords are stored as salted hashes. Each household's data is kept in its own file, and code that touches it must name the household first. Backups are encrypted. Changing your password signs out your other account sessions; paired screens keep working until you disconnect them from Settings. If we suspect a breach we look into it straight away. If it is likely to cause serious harm and we cannot remove that risk, we tell the people affected as soon as we can, explain what to do, and tell the Office of the Australian Information Commissioner where the law requires.

How long we keep it

• Household data stays as long as the household does. When an owner deletes a household from Settings, its database file is removed at once and any Plus subscription is cancelled.
• Your account: deleting it removes your sign-in and your sessions. A household that only you belong to is deleted with it. A household shared with other members carries on for them, with its subscription, and the person row that was you stays on their wall unless they remove it.
• Records we keep after deletion: a marker that the account or household existed (its identifier and dates), billing links and the billing-event log, and disconnected-screen records, so that payments can be reconciled and abuse traced. These hold no household content.
• Backups as described above. Server logs are kept for a short period for security and fault-finding. Stripe keeps payment records for as long as financial rules require.

Your rights and choices

• Export: from Settings you can download your household as a data file (JSON, which any spreadsheet or developer tool can open) plus a calendar file for each adult. The export covers the household's own content; it leaves out cached copies of outside calendars, notes that have already expired, and our account and billing records.
• Correction: you can change your display name and any household data yourself in the app. To change the email address on your account, or for anything else you cannot reach in Settings, write to us.
• Deletion: you can delete your account, or an owner can delete the whole household, from Settings.
• Marketing: we do not send any. The only emails are the ones the service needs.
• Complaints: write to us first. We will acknowledge it, look into it, and reply within 30 days with what we found and what we did. If we cannot resolve it, the Office of the Australian Information Commissioner (oaic.gov.au) can advise whether it can investigate, and you can also contact the regulator where you live.
• If you live in the UK or the EU, you can ask us for a copy of your information, to correct or delete it, to send it to you in a usable file, or to limit or object to how we use it, and you can complain to your own regulator. Write to us and we will explain the legal basis we rely on and how your information is protected overseas.

Changes to this policy

If we change this policy in a way that matters, we will tell account holders by email before the change takes effect and update the date at the top.

Contact

Questions about privacy, requests, and complaints: hello@kitchenboard.corella.club.