Privacy policy

Updated 16 September 2026

The Village is a private family request board managed by the person who shared its address and passphrase with you. This policy describes how this installation handles information.

Information used by the app

The app stores requests, notes, chosen display names, request times, completion and deletion details, and notification delivery results. Older requests may contain the email address used under the previous sign-in system. Everyone with a valid family session can read and manage family requests.

Notification registration stores your browser's push endpoint and encryption keys. Sign-in creates a random session token. Only a hash of that token is kept in the database. The family passphrase is checked against a salted password hash; it is not stored in browser storage.

Cookies and device storage

A necessary, secure, HttpOnly cookie keeps you signed in for up to 30 days. It is not available to page scripts. Signing out revokes that session. Your appearance and display-name preferences are saved on this device. A pending request may remain in tab storage for safe retries. Request history is not saved permanently in browser storage.

The service worker caches the app interface, icons and these information pages so the interface can open offline. Private API responses are not cached. You can remove local preferences and cached files through your browser or device settings.

Hosting and notifications

Cloudflare hosts the app and its database and processes network information needed to operate and protect it. Short-lived, hashed identifiers are used for request limits. Cloudflare may process service logs under its privacy policy. Optional push notifications use your browser's notification provider, such as Apple, Google or Mozilla. Message payloads are encrypted in transit to the push service, but notification content may appear on your device's lock screen.

Retention and deletion

New requests trigger cleanup of request records older than 30 days from creation. Before cleanup, Delete moves a request to a restorable list. This is not an immediate permanent erase. Session records expire after 30 days and are cleaned up during subsequent sign-ins. Notification subscriptions stop receiving messages when their associated session expires or is revoked.

To request access, correction or permanent deletion of records, contact the family member who manages this installation. Provider logs and backups may follow Cloudflare's own retention practices.

Your choices

You can decline notifications, turn them off in the app or device settings, and sign out. The app contains no advertising, third-party analytics, tracking pixels or customer counters. Share only information you intend other members of this family board to see.