Ūna end-to-end encrypts sensitive household content before it syncs. We cannot read your event titles, notes, locations, birthdays, list items, or household text from our backend.
Sensitive household content is encrypted on your device before it syncs. Our backend stores encrypted payloads and the minimum metadata needed to make the app work.
We do not sell your data, show ads, use third-party analytics SDKs in the iOS or Android app, or train AI models on your household content.
When you create a household, Ūna generates a 256-bit household key on your device. It's kept in Apple Keychain on iOS or Keystore-backed secure storage on Android. Ūna uses AES-GCM on your device to encrypt content before it's sent to Convex, our sync backend. The backend only ever sees ciphertext and nonces.
The household key is created on your device and kept in protected operating-system storage: Apple Keychain on iOS and Keystore-backed secure storage on Android. iCloud Keychain may restore it across your own Apple devices; a new Android or cross-platform device regains access through approval from a trusted device or a fresh household invite. Our backend never stores the plaintext household key.
Invite links should only be sent to people you trust. Joining a household gives that device access to the household's encrypted content. Invites have status and expiration metadata, and can be revoked at any time.
Profile photos are optional. They're encrypted on your device before upload and stored as encrypted files — our backend holds the ciphertext and a storage id, never the photo bytes. Profile photos are not used for ads, tracking, analytics, or AI training.
When you attach a file, image, or document to a household item, the file bytes are encrypted on your device before upload and stored as encrypted files. The filename and display metadata are also encrypted. Our backend stores a storage id, byte size, content-type group (image, document), the household item the file is attached to, upload status, and quota usage. We never store the plaintext filename.
Widgets read decrypted household content from a small on-device snapshot managed by Ūna. They may display household names, events, list items, and people you choose to show on the device. Widgets do not connect directly to Ūna's sync backend. Widgets trade some of the in-app strict "decrypt-then-display" model for being readable at a glance — anyone with physical access to your unlocked device can read what a widget shows.
Ūna uses normal local notifications on iOS and Android. Reminder, birthday, and list-item notification text is composed on your device after local decryption. Ūna does not need to send plaintext reminder text through our backend to notify you.
Event locations are encrypted before they reach our backend — we can't read them. When you use address suggestions while typing, or open a location in a maps app, the query may be sent to Apple Maps, Google Maps, or another map provider you choose. Those third-party requests are subject to the map provider's own privacy policies.
Google Calendar import is optional. Ūna lets you connect Google Calendar so you can choose events to copy into your Ūna household calendar. In this section, "Google Calendar data" means Google user data obtained from Google Calendar APIs.
When you use Google Calendar import, Ūna requests read-only access to:
Ūna uses Google Calendar data only to show calendars and events for import, let you select which events to copy, detect possible duplicates, and create the selected events in your Ūna household calendar.
Ūna does not create, edit, delete, invite guests to, or otherwise change events in your Google Calendar. Imported events become independent Ūna events. They are not continuously synced with Google Calendar. Changes made later in Google Calendar do not automatically update Ūna, and changes made in Ūna do not update Google Calendar.
Ūna uses read-only Google Calendar OAuth access for the import flow. Ūna does not store a Google refresh token or keep long-term Google Calendar access.
Events you do not import are not saved by Ūna. For events you choose to import, event details such as title, notes, location, link, and import identifiers are encrypted on your device before syncing to Ūna's backend. Ūna's backend stores encrypted event content and limited operational metadata needed to run the calendar, such as event time, all-day status, household membership, assignments, visibility, recurrence, and reminder timing.
Ūna protects Google Calendar data using encrypted transport and on-device encryption. Connections to Google APIs and Ūna's backend use HTTPS/TLS. Imported event content is encrypted on your device before it is synced to Ūna's backend.
Ūna uses read-only OAuth access for the import flow, does not request permission to change your Google Calendar, and does not store a Google refresh token. Access to backend systems is limited to authorized operations needed to host, sync, secure, debug, and support Ūna. Ūna does not allow employees, contractors, or service providers to read Google Calendar event content except with your affirmative permission, when necessary for security or abuse investigation, or when required by law.
Ūna shares, transfers, or discloses Google Calendar data only in the limited cases described here.
Ūna does not sell Google Calendar data or disclose it to advertisers, data brokers, information resellers, analytics providers, or AI model providers. Ūna does not use Google Calendar data for advertising, tracking, analytics, AI model training, credit-worthiness, or lending purposes.
Ūna's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Ūna keeps imported Google Calendar events until they are deleted in Ūna or removed through account or household deletion.
You can delete imported events directly in Ūna. You can also delete your Ūna account from the app. If other adults remain in the household, shared household events may remain available to them until deleted by someone with access. If you are the last adult in the household, deleting your account also deletes the household and its content.
You can revoke Ūna's Google access at any time from your Google Account permissions page.
Ūna collects a small amount of first-party diagnostic metadata to help us find and fix bugs: feature name, error category, retry count, result counts, app version, build number, and platform. We do not include household text, member names, event names, or household ids in diagnostics. Rows are retained around 30 days.
The iOS and Android apps ship with no Sentry, Crashlytics, or similar diagnostics SDK. On our backend, if a routine ops task — such as data cleanup — fails, we may send the operational incident to Sentry so the team can fix it. Those alerts carry hashed ids and incident metadata. They never carry household content.
Ūna subscriptions are purchased through the App Store on iOS or Google Play on Android. Apple or Google processes your payment; Ūna does not receive your full payment details. We receive the subscription metadata needed to verify access, such as product id, transaction or order id, purchase token, dates, subscription status, store or environment, and opaque account identifiers where supplied. Manage or cancel your subscription in the store where you purchased it.
Cleanup runs asynchronously. Some operational rows are retained briefly so we can recover from cleanup failures without losing audit-trail integrity. Approximate windows:
Ūna supports authentication with Apple, Google, and Microsoft. When you sign in, your chosen provider gives Ūna a stable account identifier and may provide your name and email, depending on your provider settings and consent. Ūna uses the provider identifier to create or restore your account and connect you to your household. Your sign-in session is cached in protected storage on your device. Your provider name and email are not stored on our backend beyond what is required for transient authentication. Apple, Google, or Microsoft processes the sign-in request under its own privacy policy.
Ūna lets adults create assistant connections with selected, revocable access they control. An assistant connection is not a household member. Adults choose capabilities, then grant access to specific people, calendars, and lists. Availability checks can stay limited to whether someone is busy or free unless event details are explicitly allowed.
Ūna’s hosted endpoint stores and returns encrypted household payloads and does not decrypt them. Ūna never gives an assistant the household key. Approved assistant content is protected with a separate agent-readable key wrapped to the connection’s public setup key.
The chosen trusted runtime uses its private key to decrypt approved records. That moment—not merely creating the connection—is where readable household information enters the assistant’s processing environment.
If the connector, model, logs, and storage all run on infrastructure you control, and readable content is not forwarded to another service, the selected plaintext can remain within the boundary you operate. Your own hosting, logging, backup, and access practices still determine who can see it.
Running only the connector yourself does not make the complete assistant local. If that connector calls a hosted model API, the readable details included in that request leave your infrastructure.
If decrypted details are sent to ChatGPT, Claude, or another hosted assistant or model API—or if a provider-hosted runtime holds the connection secret and performs decryption—the selected plaintext is processed in that provider’s environment.
The provider’s privacy, storage, retention, and model-training policies apply to the plaintext it receives. Ūna does not use household content to train AI models, but that promise cannot govern an external provider chosen by the user.
Assistants only receive content intentionally made agent-readable and granted. Adults can review access, rotate tokens, revoke a connection, or remove a revoked entry from the visible list.
Revoking a connection blocks future calls. It cannot recall or delete readable information that an external assistant or provider already received; deletion requests for that copy must follow the provider’s controls and policies.
Ūna is made for adults and caregivers managing a household. Children can be represented as household profiles, with a name, colour, and birthday — but they do not need Ūna accounts, and we do not collect personal information from them directly.
When you request Android beta access, Ūna stores the Google Play email address you provide together with consent, request-status, and operational timestamps. We use it only to review the request, add approved testers, send testing-related messages, and prevent duplicate requests. Cloudflare hosts the request service and uses Turnstile to protect the form from automated abuse; Cloudflare processes the limited browser and network information needed to perform that verification under its own privacy terms. We do not store the Turnstile token, your IP address, or its verification response in the beta-request database, and we do not use the submitted address for unrelated marketing. Pending requests are deleted after no more than 180 days; completed requests are deleted after around 90 days. You can ask us to remove a request sooner by contacting support@unafamily.app.
You can delete your account in Ūna at any time. If other adults remain in the household, Ūna removes your account link, your device keys, and your private content while keeping shared household content for them. If you are the last adult, deleting your account also deletes the household and its content. Cleanup runs asynchronously — see Retention windows above for typical timing.
Delete your account online →Support is available inside the app, under Settings. For privacy and data questions, email us directly.