This is a plain summary of how potluck.club handles data today. The full privacy policy, and an address for privacy and deletion requests, go here before launch.
Your household's own things
Home, lists, the family calendar, the family chat, the family inbox and login codes live in your household's own storage: a separate database for each household. No other household can read it.
What other households see is what you share with them: the gatherings you're part of, your RSVPs and dishes, and the facts about your household you chose to show. Each fact has its own audience, such as hosts only, your groups, or guests when you host.
Signing in
You sign in with your phone number and a six-digit code we text you. We keep the number to sign you in and to find your household. Besides sign-in codes, we text only to bring an adult into a household: a join link when someone in the household adds them by number, and a note when their request to join is approved.
The family inbox
Only if your household turns it on, by connecting the family Gmail or by forwarding mail to the household's address.
- We read new mail to sort it into tasks, decisions, calendar events, login codes and quiet mail on your Home.
- For each message we keep the sender, the subject and a short excerpt, at most 1,000 characters. We never store attachments.
- Login codes are masked, never shown to jia or to an AI model, and deleted 15 minutes after they arrive.
- We send an email only when an adult in your household taps Send on a reply they've read.
How long mail stays
- A message's text stays while the task or decision it became is open.
- It's deleted 30 days after that task or decision is done or dismissed.
- A message that didn't become one is deleted 30 days after it arrived.
- Replies drafted to it, and anything jia said about it, go with it.
- If your household disconnects Gmail, we revoke our access and delete every message's text at once. The tasks and decisions you already have keep their titles, without the email.
Calendars
If you connect your own calendar, we read its events to show them on the family calendar as busy, by title or in full (you choose), to find free times for gatherings, and to flag clashes. We never change your calendar. Disconnecting it removes its events.
jia, and the AI model behind it
Messages and events go to our AI provider (Anthropic) only when someone in your household asks jia something, and only to answer that request. Anthropic doesn't train on them.
What we don't do
- We don't sell your data, use it for advertising, or show it to anyone outside your household.
- We don't use it to train AI models.
- People at potluck.club don't read it, except with your household's permission, for security, or as the law requires.
Analytics and error reports
We count a few steps, such as signing in, creating a household or casting a vote, to see where people get stuck. These are counted on our servers: no tracking script in your browser and no cookies for it. You appear only as a scrambled id, never by name or number. Error reports are scrubbed before they leave: no phone numbers, emails, codes, links with tokens in them, or what you typed.
Cookies
One to keep you signed in, and one that remembers the invite link you opened, so the app can take you back to it after you sign in. Nothing else.
Deleting
- "Delete our household", at the bottom of the family profile, deletes your household's storage, its photos, its connections, and its part in shared groups and gatherings. Every adult is signed out.
- Disconnecting the family Gmail or a calendar revokes our access and deletes the mail text or events we kept from it.
- Turning off a link to your own assistant takes effect at once.
Google user data
potluck.club's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.