Privacy

Your family's plans aren't readable by us.

Ūna end-to-end encrypts sensitive household content before it syncs. We cannot read your event titles, notes, locations, birthdays, list items, or household text from our backend.

Last updated · 18 May 2026 v1
The short version

If you only read one paragraph.

Sensitive household content is encrypted on your device before it syncs. Our backend stores encrypted payloads and the minimum metadata needed to make the app work.

We do not sell your data, show ads, use tracking SDKs, or train AI models on your household content.

No. 02 · What we cannot see

We can't open the database and read your plans.

  • × What your events are called
  • × Event notes, locations, and links
  • × Birthdays and birthday names
  • × Household and family member names
  • × Shopping, to-do, chore and custom list names
  • × List item names and links
  • × Saved home address text
No. 03 · What we can see

The minimum metadata to sync correctly.

Account
Your Sign in with Apple account identifier and a hashed Apple subject. Used to sign you in and link you to your household.
Household membership
Household and member ids, member roles (owner, adult, caregiver), and the profile each adult is linked to.
Invites
Invite token hash, status, expiration, acceptance and revocation timestamps.
Event metadata
Start/end times, all-day flag, recurrence rule, reminder timing, visibility (household / personal), assignment ids, and whether an event is private, busy-only, or agent-readable.
List metadata
List type (shopping, to-do, chores), item sort order, checked/completed state, due date, reminder timing, and assignee id.
Reminders
Reminder status — active, snoozed, completed, skipped, canceled.
Audit metadata
Action type, actor id, target id, timestamp, and result status. Used to debug sync issues and protect your household.
Profile photo storage
An optional photo storage id and generated URL if you upload a profile photo.
No. 01 · The household key

The key never leaves your devices.

When you create a household, Ūna generates a 256-bit household key on your device. It's stored in Apple Keychain. Ūna uses Apple CryptoKit AES-GCM to encrypt content before it's sent to Convex, our sync backend. The backend only ever sees ciphertext and nonces.

  • Restores via iCloud Keychain. Across your own Apple devices, the key follows you.
  • Shared via invite. When another adult joins your household, the invite flow transfers the key to their device.
  • We can't recover it. That's the trade-off — see the runbooks on support.
Flow
Plaintext → Ciphertext
On device
"🍝 Spaghetti"
CryptoKit
AES-GCM
In Convex
a8::3f1b…c4
Household key
Apple Keychain · synchronizable
No. 04

No ads. No tracking. No selling.

More detail

The other questions people ask.

No. 04

Household keys & device access

The household key is created on your device and stored in Apple Keychain. It is saved as synchronizable, so iCloud Keychain helps restore it across your own Apple devices. Our backend never stores the plaintext household key.

No. 05

Invites

Invite links should only be sent to people you trust. Joining a household gives that device access to the household's encrypted content. Invites have status and expiration metadata, and can be revoked at any time.

No. 06

Photos

Profile photos are optional. They are stored separately so they can be displayed in the app. They are not part of the same end-to-end encryption model as text content, and they are not used for ads, tracking, analytics, or AI training.

No. 07

Notifications

Ūna uses normal iOS local notifications. Reminder, birthday, and list-item notification text is composed on your device after local decryption. Ūna does not need to send plaintext reminder text through our backend to notify you.

No. 08

Sign in with Apple

Ūna uses Sign in with Apple for authentication. We use your Apple account identifier to create and restore your Ūna account and connect you to your household. Email addresses are not stored beyond what is required for transient authentication.

No. 09

Agents & assistants

Ūna does not currently let external assistants access your household planner. If assistant integrations are introduced later, they will require explicit permission, and this policy will be updated to describe scopes, content visibility (private, busy-only, or agent-readable), and how to revoke access.

No. 10

Children & household profiles

Ūna is made for adults and caregivers managing a household. Children can be represented as household profiles, with a name, colour, and birthday — but they do not need Ūna accounts, and we do not collect personal information from them directly.

No. 11

Account deletion

You can delete your account in Ūna at any time. If other adults remain in the household, Ūna removes your account link, your device keys, and your private content while keeping shared household content for them. If you are the last adult, deleting your account also deletes the household and its content.

Reach us

Privacy questions, always.

We aim to reply to data requests within 30 days — usually faster. Everyday support lives inside the app, under Settings.