FamCal

Privacy policy

Effective October 30, 2026

FamCal is a private family calendar display operated by Anderson Quach (“we”, “us”) at calendar.andersonquach.com. It shows a household’s Google calendars, a photo slideshow and the local weather on a wall-mounted tablet. It is not open to the public: only people a household member invites can sign in. This policy explains what the service collects, why, who it is shared with, and the choices you have.

Information we collect

Your sign-in account

Your email address and a password (stored only as a one-way hash by our authentication provider), plus a membership record noting who invited you and when.

Google account data

When a household member connects a Google account, FamCal receives, with their permission:

• The account’s email address, name and profile picture (Google scopes openid, email, profile).
• The list of calendars on that account, with their names and your access level (calendar.calendarlist.readonly), so you can choose which ones to show.
• Calendar events (calendar.events): titles, times, locations, notes, guests and reminders, read so they can be shown on the display. FamCal creates, changes or deletes an event, or answers an invitation, only when someone does that on the display.
• An OAuth refresh token, so the display keeps working without signing in again. It is encrypted (AES-256-GCM) before it is stored.

Calendar events are not stored on our servers; they are fetched from Google each time the display refreshes. The one exception is the email addresses of people invited to events, which are kept for up to 90 days so the display can suggest them when adding guests.

Household settings

The settings a household enters: family members’ names and email addresses, the ZIP code used for weather (and the town and coordinates it resolves to), photo gallery links, calendar colours and display preferences, and a PIN that guards the settings (stored only as a hash).

Stored on the display device

The tablet’s browser keeps a copy of recent events, the weather and the photo list so the display still works when the network drops, along with display preferences. This stays on that device.

Cookies and logs

FamCal uses only the cookies needed to keep you signed in. There are no advertising or analytics cookies and no third-party trackers. Like any web service, our hosting provider records requests (such as IP address, browser type and the page requested) in server logs used for security and troubleshooting.

How we use information

Only to provide FamCal to your household: to sign you in, show and edit your calendars, show photos and weather, and keep the service secure and working. We do not sell personal information, use it for advertising, or use it to build profiles.

Google user data

FamCal’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the calendar features you see on the display. It is not transferred to anyone except as needed to provide those features, to comply with the law, or for security; it is not used for advertising; and no person reads it unless you ask us to for support, it is needed for security, or the law requires it. Google user data is not used to develop, improve or train generalized artificial intelligence or machine-learning models.

Services we rely on

FamCal shares only what each one needs to do its job:

• Google: the Calendar API (your calendars and events) and Google Cloud, which hosts the app.
• Supabase: our database and sign-in provider; it stores the information described above and sends invitation and password-reset emails.
• SmugMug: the photo galleries a household links; the display loads those photos from SmugMug.
• Open-Meteo receives the household’s approximate coordinates to return a forecast, and Zippopotam.us receives the ZIP code to find those coordinates. Neither receives anything that identifies you.

We may also disclose information if the law requires it, or to protect the safety of people or the service.

How long we keep it

• Account and household settings: until they are removed in Settings or you ask us to delete them.
• A connected Google account: until it is disconnected in Settings, which revokes FamCal’s access at Google and deletes the stored token and calendar list.
• Event guests’ email addresses: up to 90 days. Weather readings: about 15 minutes.
• Server logs: kept by our hosting provider for a limited period, typically 30 days.

Your choices

• Disconnect a Google account in FamCal’s Settings, or remove FamCal’s access at any time from your Google Account’s third-party connections.
• Ask a household member to remove you, or email us to see, correct or delete your information.

We answer requests within 30 days. Depending on where you live, you may have further rights under local law; we honour them for everyone.

Security

Connections are encrypted with HTTPS, Google tokens are encrypted at rest, only invited members can sign in, and changing settings needs the household PIN. No system is perfectly secure, but we work to protect your information and will tell affected people promptly if a breach affects them.

Children

FamCal is meant for adults managing a household. Children may appear on the display because a parent added their name or an event, but we do not knowingly let children under 13 create accounts. If you believe a child has given us personal information, contact us and we will delete it.

Changes

If this policy changes, we will update it here and change the effective date. If a change matters, we will tell members before it takes effect.

Contact

Questions or requests: anderson@auratechlabs.co.