Norsk | English

Privacy Policy

This is the pilot version. The text describes services that are actually active in the pilot, and marks optional services that can be enabled later by setting an environment variable. The text has not been reviewed by legal counsel and should be revised before any broader rollout.

Data controller

FamilyAssistant is operated by a private owner as a self-service tool. The data controller is the family's owner-user for that family's data. The service stores data locally on a self-hosted Raspberry Pi 5 in Norway and does not share data with third parties without explicit consent.

What data we collect

Identity: your email address from magic-link login and an optional display name you enter during onboarding.
Family data: member roster, allergies, recipes, weekly meal plans, shopping lists, pantry inventory, receipts, calendar events, chores.
Technical: session ID (HttpOnly cookie), chosen language (cookie + localStorage), request IDs for debugging, user-agent. IP addresses are stored only as salted hashes for rate-limiting.
AI key (optional): if you choose your own LLM provider, the API key is stored AES-256-GCM encrypted. The key is never exposed back via the API.

Third-party processors

The table below lists services that are actually active in the pilot and optional services that can be enabled by setting an environment variable. Optional services process no data until they are enabled.

Service	Status	Purpose	Data
Resend	Active (pilot)	Magic-link email delivery	email address, one-time token (15-minute TTL)
Self-hosted Raspberry Pi 5 (SQLite)	Active (pilot)	Local storage of all application data	all data from "What data we collect". Volume encryption depends on the host setup the operator has chosen
Cloudflare Tunnel	Active (pilot)	Secure reverse proxy from the operator's app domain to the self-hosted RPi	HTTPS traffic transits Cloudflare's network (existing edge locations in the EU). No application data is permanently stored at Cloudflare; the tunnel configuration is private
Anthropic / OpenAI / xAI / Ollama	Optional opt-in (per family via own API key)	AI features	messages and context you submit to AI features
Kassal API (kassal.app)	Optional opt-in (KASSAL_API_KEY) — planned activation post-pilot	Price comparison and product lookup for shopping list	product names and barcodes from your shopping list; no user data
Sentry	Optional opt-in (SENTRY_DSN) — not enabled in pilot	Error monitoring for the operator	stack traces; personal data is scrubbed before sending (email, request body, cookies removed in `beforeSend` hook)

Cookies we use

Session cookie (fa_session): HttpOnly, Secure, SameSite=Lax. Required for the authenticated state. Cleared at logout or after 30 days of inactivity.
Language preference (fa:language): localStorage, not a cookie in the technical sense. Remembers the chosen UI language.

Your rights

Access and data portability: GET /api/me/export returns all your and your family's data as JSON. A UI button is available under Settings → Account.
Right to rectification: all your own data can be edited in the app. Contact the family owner if family-level fields are not directly available to you.
Right to erasure: DELETE /api/me soft-deletes the account. Hard deletion happens 30 days later. Family owners must transfer ownership first. DELETE /api/family deletes the entire family and cascades to all related rows.
Right to restrict processing: the Settings screen lets you disable optional AI functionality; optional services (Sentry, Kassal) are not enabled in the pilot.
Right to lodge a complaint: you can file a complaint with the Norwegian Data Protection Authority (Datatilsynet — datatilsynet.no).

Data breaches

In the event of a suspected data breach, the Norwegian Data Protection Authority is notified within 72 hours. See docs/INCIDENT_RESPONSE.md for the internal procedure.

Contact

Use the "Give feedback" button in the app, or contact the family owner directly.

Last updated: 2026-05-04. Pilot version.