Privacy, explained

Your household never leaves your device.

This page says what that means in practice. The formal policy is on the privacy page; this is the plain version.

What stays on your device

Everything you enter: names, ages, the time each person has, days off, your rooms, your pet, your own jobs, every choice of standard, rhythm and colour. The maker runs in your browser; nothing is posted to a server while you work.
The preview, the PDF and the calendar file. All three are built in your browser from your choices. The fonts for the PDF are two static files loaded from this site, like an image.
The plan file you save. It is a plain file on your computer or phone. We never see it.
The “remember on this device” copy, if you switch it on. It lives in your browser’s storage until you erase it.
The calendar entries you import. They go from the file on your device into your own calendar, not through this site.

What leaves your device

The payment. Stripe receives your email address, billing country and payment details, as it would in any online shop. It does not receive your schedule. Your email is used to send you the unlock link or the download link.
The unlock check. When you open an unlock link, your browser sends the unlock code (a signed reference to your purchase) to our server, which answers “valid” or “not valid”. Nothing else is in that request.
A visit count. A small script counts page views on all our sites: the page path, the time and a non-reversible daily identifier. It sets no cookie, builds no profile and never sees form contents.
Ordinary hosting logs. Our host keeps short-lived server logs (IP address, time, page) for security.

How we check this

Before each release an automated test fills the maker with unique made-up entries, previews, exports the PDF and opens an unlock link, while recording every network request the page makes. The test fails if any of those entries appears in any request. It also fails if the maker code contains any network call other than the unlock check and the font files.

What you can do

Use a private device, not a shared or public computer, and leave “remember on this device” off on anything shared.
On the last step of the maker, “Erase everything stored on this device” removes the settings, the remember setting and the unlock from that browser. Files you already downloaded are yours and stay where you put them.

What we cannot do

Recover a plan file you lost, read your schedule, or reset a password: there is none. Support can only help with the site, the payment and the download or unlock link, and will never ask you to send your schedule or anyone’s names.

Formal details: privacy policy · legal notice.

Why is the plan file not encrypted?

Because it holds nothing secret (first names, age bands, rooms and a few choices), and an encrypted file needs a password that can be lost. We chose no password on purpose. Keep it where you keep other household papers.

Does the unlock link contain my schedule?

No. It contains a signed reference to your purchase and an expiry date, nothing else. Anyone with the link could unlock the export on their device, so keep the email as you would a receipt.

Does the calendar file send anything anywhere?

No. It is a plain text file in the standard calendar format. Your calendar app reads it on your device; if your calendar syncs to a cloud, that is your calendar provider, not us.