Household boundary
Every tenant-owned record carries a household identifier, and cross-household relationships must fail at the database boundary.
Under safety testing
PRIVACY AND SAFETY
The family plan is personal. We treat it that way.
Planofam is being built around household separation, private-to-me boundaries, content-minimised analytics, and staged safeguards for children and sensitive modules.
Non-negotiable product rules.
Server-side membership
Protected requests check current membership instead of trusting a visible role or stale client state.
Private means private
Private-to-me content is designed to remain inaccessible to other adults, including household administrators.
Minimal analytics
Event titles, task text, list contents, child names, documents, finances, and precise location stay out of analytics.
A child PIN must create a restricted session.
It must never merely hide adult controls. Child participation remains gated until authorization, revocation, and accessibility checks pass.
Read child participation →From invitation to deletion.
Invite
Single-purpose, expiring, and revocable.
Participate
Access reflects current household membership.
Remove
API, sync, push, and cached access are revoked.
Delete
Export and deletion must be rehearsed before wider beta.
This website does not hold household accounts.
Website forms store only low-sensitivity beta and contact submissions. Do not submit child names, exact ages, schedules, medical, financial, or password information.
Questions about Planofam data?
Contact us without sharing sensitive household information.