Privacy

What Banjo is

Banjo is a private family calendar for phones, laptops and an optional wall screen. Anyone can start a household; only people a household invites can join it, and each household sees only its own data. In this policy, “we” means the people who run Banjo, and “you” means anyone who uses it.

What we store

• Your sign-in. Your name, email address and profile picture from Google when you sign in, or your email address if you use an email link (teens and caregivers can).
• Your household. The household name, your town and its approximate location (for weather), time zone, the people in your family (names, colors, birthdays, and for kids, school and grade), roles, settings and the wall PIN (stored only as a one-way hash).
• Your calendar. Events from the Google calendars you choose, events you add in Banjo, the details of private events, rides and reminders, and calendars you add by link.
• What you add. Lists and to-dos, recipes and dinner plans, chores, stars and rewards, teen requests, photos and files you upload, and the alerts Banjo sends you.
• Google access tokens, encrypted with AES-256-GCM. They never leave our servers and are never sent to phones or screens.
• Phone alert subscriptions: the address your browser gives us to deliver alerts to that phone.
• A history of changes in your household (who changed what and when), so you can see history and undo.
• Error reports when something breaks, with emails, tokens and fields that may hold family content removed before they are sent.

Who can see it

• Everyone in your household, parents, teens, kids and caregivers like grandparents, nannies and sitters, sees only what their permissions allow. An owner of the household sets what each person can see and do.
• Private events show as busy to everyone else, unless an owner lets someone see private event details.
• A wall screen paired to your household shows the family view. It never shows private event details.
• The Banjo team doesn’t look at your family’s content. We access it only to give support you ask for, to keep Banjo secure and working, or when the law requires it. Our admin page shows only counts and basic facts about each household, such as its name, how many people it has, when it was last active and how much storage it uses. It never shows events, lists, recipes, photos, or anyone’s name or email.

We don’t share your data with anyone else, except the service providers below.

Google Calendar data

When you sign in, Banjo asks Google for these permissions:

• openid, email and profile: to sign you in and show your name.
• calendar.calendarlist.readonly: to list your calendars so you can pick which ones Banjo shows.
• calendar.events: to read events on the calendars you pick, and to add, change or delete the events you make or edit in Banjo, so Banjo and Google Calendar stay in step.
• calendar.app.created: to create a separate family calendar for Banjo in your Google account when you choose to, and to manage only calendars Banjo created.

Teens and caregivers who sign in with Google give only openid, email and profile. Banjo never asks for access to Gmail, contacts or Drive.

We use Google data only to show and sync your family’s calendars in Banjo. Google data is never sold, never used for advertising, never used to train AI models and never sent to AI providers. No person at Banjo reads it unless you ask us for help with a specific problem, it’s needed for security, or the law requires it.

Banjo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Banjo’s access at any time from your Google Account, under Security, then third-party connections. Deleting your household also ends it.

AI

Banjo uses Anthropic’s Claude for one thing today: reading a recipe you import from a photo, screenshot or PDF, or from a link whose page has no recipe data of its own. Only the content you’re importing is sent: the image or file, or the page’s text. No names, events or other family data go with it. The file is read in memory and isn’t stored by Banjo.

We keep a short record of each AI request (when, which task and what it cost) and may keep the result so the same file isn’t read twice. Under Anthropic’s commercial terms, content sent through its API isn’t used to train its models. Google Calendar data is never sent to any AI provider.

Services we use

These companies run parts of Banjo for us and handle data only to do that:

• Supabase: database, sign-in and file storage, in the United States.
• Vercel: hosting for the app and its servers, in the United States.
• Google: sign-in and Google Calendar sync.
• Resend: sends invites and alert emails.
• Sentry: error reports, with emails, tokens and family content removed.
• Anthropic: recipe import, as described above.
• GitHub: stores our encrypted backups in a private repository.
• Apple, Google and Mozilla push services: deliver phone alerts to your browser. The alert is encrypted on the way.

Banjo also looks things up from public services, sending only what the lookup needs and nothing about your family:

• Open-Meteo: weather for your town’s approximate location, and town search during setup.
• Zippopotam.us: the postal code you type for your home location, to find your town.
• SchoolCafé: school lunch menus, using your school’s and district’s identifiers.
• Open Food Facts: product names for barcodes you scan.
• TheSportsDB: schedules for sports teams you add.
• Calendar links and recipe pages you add are fetched from their own addresses.

Feedback

When you use Send feedback, Banjo sends your note to the Banjo team with the page you were on, the kind of device, its screen size, your browser and the Banjo version. A screenshot of the screen goes with it unless you switch it off before sending; it may show your family’s events. Feedback is kept privately for the Banjo team and is not shown to your household. It stays with the team after a household is deleted; email us to have it removed.

How long we keep it

We keep your household’s data while your household exists. Things you delete are removed, some after a short window so you can undo. A household export you request is kept for 7 days.

We make a daily encrypted backup of the database, kept for 30 days, and while they are small enough, a weekly encrypted backup of photos and files, kept for 15 days. Backups are only for recovering from a failure. After you delete your household, it is gone from backups within 30 days.

Deleting your household

A parent can delete the household in Settings, under Household data, then Delete household. On a wall screen it asks for the parent PIN, and everywhere it asks you to type the household’s name to confirm. It:

• stops Google sync and revokes Banjo’s access to Google,
• deletes every event, person, list, recipe, chore, photo, file and setting in Banjo,
• deletes everyone’s Banjo sign-in, which signs them out on every device.

Your Google calendars keep their events, including a family calendar Banjo made for you. You can delete that one in Google Calendar. Backups age out within 30 days. You can also email us at hello@banjoathome.com and we’ll delete it for you.

Settings also has Reset household, which deletes the household’s data the same way but keeps the sign-ins, so you can start over.

Children

• A parent can give a child of any age a Banjo sign-in. For a child under 13, a parent first reads what Banjo keeps and agrees on a consent screen. Banjo records which parent agreed, when, and which version of the words.
• What Banjo keeps about a child: the profile a parent enters (name, nickname, birthday, color and picture); the child’s email address only if a parent picks an email sign-in (a 6-digit sign-in code from a parent needs none); what the child does in Banjo, such as the events they ask for, list items, chores checked off and when they last signed in; photos they add, if a parent allows it; their phone’s alert address if they turn alerts on; and any feedback they send.
• Children under 13 never sign in with Google and never connect a calendar, email or contacts. A child’s information is never sold, never used for advertising and never used to train AI.
• Parents can review it in Settings › People, download it with Export, change what the child can do, and withdraw consent, which ends the child’s sign-in at once and deletes their sign-in, email and alert subscriptions. Removing the child takes them off Banjo; resetting the household deletes everything.

If you think a child’s information is in Banjo without a parent’s permission, email us and we’ll remove it.

Security

Data moves over HTTPS. Each household’s data is walled off from every other household in the database. Google tokens are encrypted, and the wall PIN is stored only as a hash. No system is perfect, so if we ever learn of a breach that affects you, we’ll tell you.

Changes

If this policy changes, we’ll update the date at the top, and tell you in Banjo when the change matters. See also the terms.

Contact

Questions or requests: hello@banjoathome.com.