Legal

Privacy Policy

Last updated: September 18, 2026 · Effective: September 18, 2026

Level Up Home is a family-organizer app. We try to keep this policy short and human, because we don't do many of the things that make most privacy policies long. We don't sell your data. We don't show ads. We don't train AI on your content. We don't track you across other apps or sites.

This policy explains exactly what we do collect, why, and who can see it. If anything here is unclear, email privacy@leveluphome.app and we'll fix the policy or fix the app.

1. What we collect

Information you give us

When you create a household account with an email address, we store that address and a hashed password (handled by our authentication provider; the plaintext never reaches our servers). If you sign in with Apple or Google instead, we receive the name and email address that provider shares with us and a provider account identifier; we never see your Apple or Google password. Apple lets you hide your email, in which case we store the private relay address Apple creates. We use the name only to pre-fill your household name, and the email only to sign you in and to match invites sent to that address.

Every household also gets a short invite code (for example K7P3-Q9WX). It identifies your household to another family who enters it, and nothing else; it is not derived from your email or any personal data, and you can see it under Settings → Friends.

Inside the app, you can create:

• Family-member profiles — a name, optional avatar emoji and color, optional birthday.
• Household data — tasks/chores, calendar events, shopping and to-do lists, meal plans, recipes, rewards, reward redemptions, and the dashboard layout you pick.
• Settings — household display name, theme choice, default weather location, your preferred clock format, and any other in-app preference.

Information your device gives us

When you use the app, the system reports:

• A per-device identifier we generate ourselves the first time you launch the app. This is a random UUID; it is not your phone's hardware ID, advertising ID, or anything we could use to recognize you outside the app. It resets when you reinstall.
• Platform + OS version (iOS / Android / web) for diagnostic purposes.
• A push notification token (Expo's "Expo Push Token") if you grant notification permission, so we can send the alerts you configure — e.g. when someone in your household redeems a reward.

Optional integrations you turn on

• A connected calendar account — if you choose to connect a Google or Microsoft account, we sync the calendars you select with your household calendar. This is the one integration where we hold a credential for an outside account, so it gets its own section: Connected calendars.
• Weather location — if you enter a city or ZIP code for the dashboard weather widget, our server looks it up with OpenStreetMap's Nominatim geocoder (once per distinct place, then cached) and fetches the forecast from Apple Weather (WeatherKit). Neither service receives your IP address, account, or any other identifier; the app only ever talks to our server.
• AI features — when you import a recipe from a web page that has no structured recipe data, ask the meal planner to suggest or schedule a week, or import a calendar from a photo, the app sends the relevant content to our server: the page's text for a recipe import; your recipe names, ratings, cook times, tags, the week's meal slots, that week's calendar events, and any preference you typed for a plan; or the photo or screenshot you chose for a calendar import, shrunk on your device first. Events that came from a connected calendar (Google, Microsoft, iCloud, or a subscribed feed) are sent as start and end times only, never their titles, locations, attendees, or notes. Our server passes the request to Anthropic's Claude API directly (no aggregator or model hub) to get the result and returns it to you. Anthropic does not use API inputs or outputs to train its models. We keep only a per-household count of AI actions for the month; the content itself is not stored by us after the request completes.
• Team schedules and calendar links — a public iCal link you subscribe to (a school or league calendar) is fetched by our server every 15 minutes and stored as events in your household calendar, renamed by any rule you set. GotSport is different: its schedule only answers to a signed-in parent, so you sign in to GotSport inside the app, in an embedded browser that talks to GotSport directly. Your GotSport password never passes through us and is never stored by us; the login stays on that device. The app then fetches your schedule and match list with that login and sends the games (titles, dates, times, venues) to our server, which stores them as events like any other calendar link. If you choose to push a schedule into a connected Google, Microsoft, or iCloud calendar, those events are written to that calendar the same way as events you create in the app. A calendar file (.ics) you upload on the web is read on our server and not kept.
• Smart home (Premium) — if you add a webhook, the app sends a small JSON message to the address you chose when the events you ticked happen (for example a chore being checked off): the event name, the time, your household name, the family member’s name and avatar, and the chore, reward, rank, badge or meal involved. Phones and tablets send it straight to your hub; the web app sends it through our server, which forwards it and keeps nothing but a rate-limit counter. Dashboard buttons work the same way. A read-only API token you create lets your hub fetch the same household snapshot the home-screen widgets use; only a hash of the token is stored, and you can revoke it in Settings. If you embed a Home Assistant dashboard, the address and the long-lived token you paste are stored with your household settings (encrypted at rest, readable only by your household) so every device can open the dashboard signed in; the page itself is loaded directly from your Home Assistant, not through us.
• Send to a store — when you send a shopping list to a store, the item names and quantities go to that store: to Instacart through our server (which asks Instacart for a link and keeps nothing but a rate-limit counter), to Kroger through our server using the Kroger account you connected (its sign-in token is kept in an encrypted vault and deleted when you disconnect), or to Walmart as search links opened on your device. We never see store passwords.

Connected calendars

You can connect a Google, Microsoft, or Apple iCloud account so its calendars sync two-way with your household calendar. This is opt-in: nothing is accessed until you tap Connect in Settings and approve on Google's or Microsoft's own sign-in page. We ask for the narrowest permission that allows two-way sync — on Google that is calendar.events (read and write events), on Microsoft Calendars.ReadWrite. We do not ask for, and cannot see, your contacts, email, files, calendar sharing settings, or anything else in that account.

iCloud is different because Apple offers no sign-in page for calendar access. Instead you create an app-specific password in your Apple ID settings and enter it, with your Apple ID email, in Level Up Home. That password only works for calendar (CalDAV) access; it is not your Apple password and cannot sign in to iCloud, the App Store, or your device. We verify it against iCloud once, store it the same way as a refresh token (below), and never show it again. Revoke it at any time from account.apple.com → Sign-In and Security → App-Specific Passwords.

What we receive from a connected account:

• The account's email address and its stable account identifier — so we can label the connection in Settings and avoid connecting the same account twice.
• The names and colors of that account's calendars — so you can pick which ones to sync.
• For the calendars you select: each event's title, start and end date and time, all-day flag, location, and description.
• A refresh token (Google, Microsoft) or the app-specific password (iCloud) that lets our server keep syncing without asking you to sign in again.

How we use it. Only to run the feature you turned on: showing those events in your household calendar and dashboard, pushing edits and deletions you make in Level Up Home back to that calendar, and tagging events to family members using rules you set per calendar. We do not use calendar data for advertising, profiling, or to train AI. No person reads it except as described under "Us" in Section 3.

How it's stored. Synced events live in the same household database as everything else (Section 4). The refresh token or app-specific password is stored in Supabase Vault, encrypted at rest with a key that is not present in our application code. It can be read only by the server-side sync job — never by the app on your phone, tablet, or browser, which is why no device ever needs calendar permission.

Who else sees it. Only your household, and any friended household you explicitly share a specific event or list with (Section 3). We never sell calendar data, transfer it to any third party, or send it to any AI model.

Stopping. Settings → Calendar accounts → Disconnect deletes the token immediately. You can also revoke our access from your Google account permissions or Microsoft account permissions page, or delete the app-specific password at account.apple.com; our next sync attempt then fails and the connection is marked as needing sign-in. Events already copied into your household calendar stay there until you delete them.

Google API Services — Limited Use

Level Up Home's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide the calendar-sync feature you enabled; we do not transfer it to others except as needed to provide that feature, for security purposes, or to comply with applicable law; no person reads it except with your explicit consent, for security, or to comply with law; and we never use it for advertising.

Google user data and AI. Google Calendar data is never used to develop, improve, or train any machine learning or artificial intelligence model, generalized or otherwise, by us or by anyone we work with. The only AI feature that can see any of it is the optional meal planner described above, which runs when you tap "Suggest": it receives the start and end times of that week's synced events so it can plan around busy evenings, and nothing else from those events. That request goes to Anthropic's Claude API under Anthropic's commercial terms, which prohibit training on customer data, and is not retained by us afterwards. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

2. What we don't collect

• We do not use any analytics or telemetry SDKs.
• We do not use advertising SDKs or fingerprinting.
• We do not collect precise location, contacts, microphone input, or camera input. The only photos we hold are ones a member of your household chooses to add on purpose: a profile picture, screen-saver photos, a photo attached to a calendar event, or the backdrop on a countdown. They are stored privately under your household, shown only inside your household, and deleted with the item they belong to and with your account.
• We do not use Apple's IDFA or Google's GAID. We do not need App Tracking Transparency consent because we don't track.
• We do not access your phone's calendar, contacts, or any other on-device account. If you connect a Google or Microsoft account, we access only the calendar permission you approve — see Connected calendars — and nothing else in that account.

3. Who can see your data

Your household

Anyone signed in to your household account on any device sees the same household data. That is the point of the app. The authentication credentials decide who is "in" the household.

Friended households

If you accept a "Family Friends" invitation, that household can see your display name (the one you set in Settings) so they can quickly share lists or calendar events with you. They do not see your email, your member profiles, your private tasks, or anything you have not explicitly shared.

Shared lists

When you share a specific list with another household, both households see that list's items, who added each one, and who checked it off. The other household does not gain access to your other lists, tasks, calendar, or settings.

Us

Our database is gated by row-level security policies that key off your household identifier. Engineering staff at Level Up Home can access the database only when investigating a bug you've reported or a security incident, and only with the minimum data needed. We don't read your household data for any other reason.

4. Where your data is stored

We use the following service providers to run the app. Each one sees only the data needed for the function we use them for:

• Supabase — primary database and authentication. Hosted in the United States. Stores everything described in Section 1 except items marked "stored only on your device." Connected-calendar tokens are additionally encrypted with Supabase Vault (see "Connected calendars").
• Google (Calendar API) and Microsoft (Graph API) — only if you connect that account, and only for the calendars you select. They receive our sync requests on your behalf; their own privacy policies govern what they do with your account.
• Cloudflare Turnstile — bot protection on the sign-in and password-reset forms. Receives your IP address and standard browser signals to decide whether an attempt is automated. Does not receive your email, password, or household data.
• Expo / Apple / Google — push notification delivery. Receives only the token issued by your device and the body of the notification (e.g. "Avery redeemed 'Movie Night.'").
• Apple Weather (WeatherKit) — forecast provider. Our server sends it the coordinates of the place you entered, rounded to about a kilometre, and nothing else. Apple Weather legal attribution.
• OpenStreetMap Nominatim — turns the city or ZIP you type into coordinates. Receives that string once; the result is cached on our server. Data © OpenStreetMap contributors.
• Vercel — marketing site + web app hosting. Sees standard request logs (IP + user-agent) that are retained briefly and not joined to your account.

We do not transfer your data to any other third party. We do not allow these providers to use your data for their own purposes.

5. How long we keep your data

• Live data — as long as your account is active.
• Deleted lists and calendar events — stay in a "Recently Deleted" trash for 30 days, then are hard deleted from every device automatically.
• Connected-calendar tokens — deleted the moment you disconnect that account, and when you delete your account. Events already synced into your household calendar stay until you delete them, then follow the 30-day trash rule above.
• Closed account — when you delete your account from the app, every database row keyed to your household, your cloud photos, and your push tokens are hard-deleted immediately. Requests made by email are completed within 30 days.
• Server logs — kept up to 90 days for security and debugging, then rotated out.

6. Children's privacy

Level Up Home is designed for families with kids, but kids don't sign in. The household account holder — an adult — is the only person who creates an account, agrees to these terms, and decides what information about their kids (a name, an emoji, optional birthday) to enter. We do not knowingly collect personal information directly from children under 13. If you believe a child has created an account without parental consent, contact privacy@leveluphome.app and we will delete it.

7. Your rights

You can:

• Access and export your data — visible in the app, and downloadable as one JSON file from Settings → Account → Export my data (members, chores, events, lists, meals, recipes, rewards, settings). Calendar credentials are never included. You can also request it by emailing privacy@leveluphome.app.
• Correct any information by editing it in the app.
• Delete individual items in the app, or delete your whole account from Settings → Account → Delete household account. Deletion is immediate. Full steps and what it covers: Delete your account.
• Disconnect a calendar account at any time from Settings → Calendar accounts, or revoke our access from your Google or Microsoft account's permissions page.
• Object or restrict processing, where applicable under your local privacy law (GDPR / UK GDPR / CCPA / etc.). Email us — see "Contact" below.

We do not sell or share personal information for behavioral advertising purposes, so there is no "Do Not Sell or Share" opt-out toggle required by CCPA — there's nothing to opt out of.

8. Security

Data in transit is encrypted with TLS. Data at rest in our database provider is encrypted at the disk level. Connected- calendar refresh tokens are additionally encrypted at the column level with Supabase Vault and are readable only by the server-side sync job, not by the mobile or web app. Row-level security policies enforce household scoping at the database layer, not just in the app. We follow standard practices for access control, dependency updates, and incident response. No system is perfectly secure, and we'll notify affected users if a security incident exposes household data.

9. Changes to this policy

If we change this policy in a way that materially affects what we collect or who sees it, we'll notify you in the app before the change takes effect. The "Last updated" date at the top reflects every revision.

The September 4, 2026 revision adds the connected-calendars feature and replaces the earlier on-device calendar access, which the app no longer uses. Nothing in that section applies to you unless you choose to connect an account, and connecting one always passes through Google's or Microsoft's consent screen — that screen is your notice and your choice.

10. Contact

Email privacy@leveluphome.app for any privacy question — including data access, deletion, or correction requests. We aim to respond within 5 business days.