Security

• Every household gets its own database, separate from every other household's.
• The private details in it are encrypted with a key that belongs to that household alone.
• Each app's sharing rules are enforced on the server, on every read and write.
• We don't sell your data, show you ads, or use your household's content to train AI.
• You can export everything, and deleting means deleting.

This isn't end-to-end encryption. The service holds the keys, because it has to decrypt your data to show it to the people your household shares it with, to send reminders, and to run the apps. The rest of this page explains what that means.

A database per household. Each household's apps, calendar, messages and settings live in a database of its own. A request from one household never runs against another household's database.

A key per household. Before we store them, the private details in that database are encrypted with AES-256-GCM, using a key derived for that household alone. That covers member names, email addresses and birthdates, messages, locations, forwarded email, activity, and the text in your apps: notes, titles, descriptions and the like. The keys are never stored. They're derived when needed from a master key held as a secret in our hosting provider, and we can rotate that master key without downtime.

What isn't encrypted with your household's key. Numbers, dates, times, record ids and short status fields stay readable, so the database can sort, filter and total them. Amounts and quantities are numbers, so they're among them. Uploaded files (photos, documents and attachments) are stored with our hosting provider's encryption at rest, not with your household's key, and we strip location data from photos before we store them.

In transit. Every connection uses HTTPS, and browsers are told never to connect over plain HTTP.

People in your household. Each app decides what each person sees. A private journal entry is readable only by its author, and an adults-only app stays hidden from children. Those rules are checked by the server on every request, not just hidden in the screen, so an app can't read past them either. Guests see only what an admin shares with them, for as long as the admin allows.

People in a shared Space. A Space is its own separate place, with its own apps. Joining one doesn't open your household to the other households in it.

Our team. The service has no screen that shows a household's content to staff: no "sign in as this customer" and no support back door. Our maintenance tools run only on our own computers, and they show what support needs: the members of a household and their emails and roles, billing status, and which apps are installed. They don't open messages, files, locations or what's in your apps. Changes made with them are logged.

Because the service holds the keys, someone with operator access could technically decrypt a household's data. That access is limited to the few people who run the service.

• Passwords are stored as a salted hash; we never see yours.
• You can add two-factor sign-in with an authenticator app (with ten one-time backup codes), or sign in with a passkey.
• Repeated failed sign-ins are slowed down per account and per network, and sign-up and sign-in forms check for bots.
• Under Settings → Account & Security you can see every device signed in to your account and sign the others out.
• Resetting your password signs you out everywhere and disconnects any AI assistant connected to your account.
• We email you when your password, email address, two-factor setting, backup codes or passkeys change, so a change you didn't make doesn't go unnoticed.

More in account security.

We don't use your household's content to train AI models. AI reads your data only when someone in your household asks it to, in the ways the privacy policy lists: an assistant an adult connects to their own account, suggestions from text, email and photos, and building an app. Children and guests can't connect an assistant, and an admin can switch AI access off for any app.

Chat with Chickadee, the assistant on our website, answers from our public pages and never reads your household's data. See support chat for what it keeps.

Export. A household admin can download an archive of the household's apps, messages, inbox and files from Settings → Export Data at any time. It holds what that admin is allowed to see, and the download link lasts seven days.

Deleting your account. Deletion waits seven days, with a link to cancel, then removes your sign-in, private settings, location history, private files and memberships. Things you added to a shared household can stay for its other members.

If a subscription ends. The household becomes read-only for 90 days, so you can renew or export, and is then deleted.

Backups. Our database provider keeps 30 days of point-in-time backups for disaster recovery. They expire on their own, and we never use them to bring back an account someone deleted.

Chickadee Bandit runs on Cloudflare, which hosts the service and stores its databases and files. We don't currently pin your data to a particular country or region. The other companies we use, and what each one does, are listed under service providers.

If we ever discontinue the service, we'll give you reasonable notice and a chance to export your data first, as our terms promise. Your export is yours to keep, in plain formats (JSON files and your original uploads), readable without us.

If you think you've found a security problem, email support@chickadeebandit.com with "SECURITY" in the subject line, rather than posting it publicly. Tell us what you found, how to reproduce it, and what someone could do with it. We read every report and will reply.

While you look, please test only against your own account and household, don't access or change anyone else's data, don't degrade the service for others, and give us a reasonable time to fix the problem before you talk about it publicly.