Ūna end-to-end encrypts sensitive household content before it syncs. We cannot read your event titles, notes, locations, birthdays, list items, or household text from our backend.
Sensitive household content is encrypted on your device before it syncs. Our backend stores encrypted payloads and the minimum metadata needed to make the app work.
We do not sell your data, show ads, use tracking SDKs, or train AI models on your household content.
When you create a household, Ūna generates a 256-bit household key on your device. It's stored in Apple Keychain. Ūna uses Apple CryptoKit AES-GCM to encrypt content before it's sent to Convex, our sync backend. The backend only ever sees ciphertext and nonces.
The household key is created on your device and stored in Apple Keychain. It is saved as synchronizable, so iCloud Keychain helps restore it across your own Apple devices. Our backend never stores the plaintext household key.
Invite links should only be sent to people you trust. Joining a household gives that device access to the household's encrypted content. Invites have status and expiration metadata, and can be revoked at any time.
Profile photos are optional. They are stored separately so they can be displayed in the app. They are not part of the same end-to-end encryption model as text content, and they are not used for ads, tracking, analytics, or AI training.
Ūna uses normal iOS local notifications. Reminder, birthday, and list-item notification text is composed on your device after local decryption. Ūna does not need to send plaintext reminder text through our backend to notify you.
Ūna uses Sign in with Apple for authentication. We use your Apple account identifier to create and restore your Ūna account and connect you to your household. Email addresses are not stored beyond what is required for transient authentication.
Ūna does not currently let external assistants access your household planner. If assistant integrations are introduced later, they will require explicit permission, and this policy will be updated to describe scopes, content visibility (private, busy-only, or agent-readable), and how to revoke access.
Ūna is made for adults and caregivers managing a household. Children can be represented as household profiles, with a name, colour, and birthday — but they do not need Ūna accounts, and we do not collect personal information from them directly.
You can delete your account in Ūna at any time. If other adults remain in the household, Ūna removes your account link, your device keys, and your private content while keeping shared household content for them. If you are the last adult, deleting your account also deletes the household and its content.
We aim to reply to data requests within 30 days — usually faster. Everyday support lives inside the app, under Settings.