This policy covers a single, privately operated installation of the open-source Waffled family organiser, run on hardware owned by one household and used only by members of that household. There is no public sign-up and no commercial service.
Who operates it
This installation is operated privately by Adam Such, who can be reached at support@adamsuch.io.
What is stored
- Household content entered by members — calendar events, chores, meal plans, shopping and to-do lists, and any photos attached to them.
- Account details for each member: name, email address, and a password stored as a one-way hash.
- Google Calendar data, only for members who choose to connect an account: calendar names, event details from the calendars they select, and an OAuth refresh token.
How Google data is used
When a member connects their Google account, this installation requests access to their Google Calendar. That access is used for exactly two things:
- Reading events from the calendars that member selects, so they appear in the household calendar.
- Writing events that were created in Waffled to the one calendar that member nominates as the write target.
Google data is not used for advertising, profiling, analytics, training machine learning models, or any purpose beyond displaying and syncing that member's calendar. It is never sold, and never shared with any third party.
Where it is stored, and for how long
All data is held in a database on hardware operated by this household. It is not hosted with a cloud provider. Backups are taken nightly and kept on the same hardware.
OAuth refresh tokens are encrypted at rest. Google data is retained until the member disconnects their account in the app or revokes access through their Google account, after which the stored connection and its tokens are removed.
Who can see it
Only members of this household, who each sign in with their own account. There are no analytics services, advertising networks, or third-party trackers. Where AI-assisted features are enabled, they run against a language model hosted on this household's own hardware; the text involved does not leave the household network.
Withdrawing access
Any member may disconnect their Google account at any time from within Waffled, or revoke it directly at myaccount.google.com/permissions. To request deletion of any other data held about you, contact the address above.
Changes
Any change to this policy will be published on this page with a revised date below.