Privacy policy

How HomeFrame handles your data. Last updated October 2026.

HomeFrame is a product of Home Grid LLC ("we"), which is responsible for the data described here.

HomeFrame is a family wall calendar. It shows your Google Calendar events, your household's chores and meal plan, and a slideshow of photos you choose, on a tablet in your home. This page describes exactly what it collects and what it does with it.

What HomeFrame stores about you

• Your account — your name, email address, and either a password (stored only as a bcrypt hash, never in readable form) or your Google account identifier if you sign in with Google.
• Your household's own content — the people, chores, rewards, meal plans, shopping list, notes and countdowns you type in.
• Your settings — time zone, theme, slideshow timings, and the place name or coordinates used for the weather strip.

Google Calendar data

HomeFrame asks for two calendar permissions, and uses each for one thing.

With calendar.readonly it reads your calendars so it can show them on the wall. It stores, for the calendars you switch on: the calendar's name, colour and identifier, and for each event its title, description, location, start and end times, all-day flag, status and Google link. HomeFrame only keeps a window around today — roughly two months back and thirteen months forward — and rewrites it on each sync.

With calendar.events it writes an event to Google only when you add one yourself, on the wall display or in the app, and only to the single calendar you have nominated in Settings. If you nominate no calendar, HomeFrame writes nothing at all. It edits or deletes only events it created this way, identified by a record it keeps of them; it never edits or deletes an event it did not create, and it never adds anything to your calendars on its own.

Google Drive data

HomeFrame requests no Google Drive permission at all. The slideshow reads a folder that you have chosen to share in Drive as "Anyone with the link", which HomeFrame fetches the same way any visitor holding that link would. It has no access to the rest of your Drive, and connecting a Google account to HomeFrame never asks for one.

Because such a folder is readable by anyone who has its link, use a folder created for this purpose rather than one holding anything private.

For the photos you choose, it stores the file identifier, name and pixel dimensions. Photo images themselves are fetched from Drive when the slideshow displays them and passed straight to your screen; they are not copied into HomeFrame's database.

Microsoft accounts and Outlook calendars

You may also sign in with a Microsoft account, or connect an Outlook / Microsoft 365 calendar (personal or work). HomeFrame then receives, through Microsoft Graph, the same categories of data it receives from Google: your email address, name and account identifier for sign-in, and for a connected calendar the list of your calendars and the events in them (title, preview text, location, start and end, all-day flag, cancellation status and link). It writes an event to Outlook only when you add one in HomeFrame, to the single calendar you nominate. Refresh tokens are encrypted at rest exactly as Google's are, and disconnecting the account in Settings deletes them. A work or school tenant may require its administrator to approve HomeFrame first; HomeFrame never sees anything the administrator has not allowed.

Google sign-in

If you sign in with Google, HomeFrame receives your email address, name, profile picture and a Google account identifier, and uses them only to create and recognise your account.

Payments

Purchases are handled by Stripe. Your card details go to Stripe and never reach HomeFrame. We keep only what we need to know what your household has bought: a Stripe customer reference, whether HomeFrame has been purchased and when, and the status of any AI companion subscription.

How HomeFrame protects your data

Google user data — your calendars, their events, and the profile information returned when you sign in — is protected by the following measures.

• Encrypted in transit. Every connection to HomeFrame is served over HTTPS using TLS 1.2 or higher. Plain HTTP requests are redirected to HTTPS, and HomeFrame's own calls to Google's APIs are made over TLS as well.
• Encrypted at rest. The PostgreSQL database that holds your calendars, events and household content is encrypted at rest by the hosting provider, on encrypted volumes with encrypted backups.
• Access tokens encrypted separately. The Google refresh token that lets HomeFrame keep your calendar current is additionally encrypted with AES-256-GCM before it is written to the database, using a key held only in the server's environment and never stored alongside the data. Access tokens are short-lived and are never written to logs.
• Access controls. Every request is checked against the household of the signed-in user, derived from a signed, HttpOnly, Secure session cookie — never from anything the request itself supplies. One household cannot read or change another household's data. Passwords are stored only as bcrypt hashes, and the wall display's settings are protected by a household PIN that is also stored hashed and rate-limited against guessing.
• Least privilege. HomeFrame requests access to your calendars and no access to Google Drive at all. Calendar access is used to display your events and, only when you add an event yourself, to write that event to the single calendar you nominate; HomeFrame never edits or deletes an event it did not create. Administrative access to the production database is limited to the developer operating the service, and is used only to keep the service running.
• No third-party processing. Google user data is not sent to any advertising network, analytics service, data broker, or AI or machine-learning training system.

How long HomeFrame keeps your data, and how to remove it

• Calendar events are held only for a window around today — roughly two months back and thirteen months forward — and that window is rewritten on each sync. Events outside it are deleted automatically.
• Disconnecting a Google account in Settings immediately deletes its refresh token, its calendars, and every event synced from it.
• Revoking access at myaccount.google.com/permissions stops all future syncing; HomeFrame's stored copy is then removed on its next sync attempt.
• Deleting your account — email support@home-frame.com and your account, your household and all of its data are permanently deleted within 30 days, including from backups on their normal rotation.

What HomeFrame does not do

• It does not sell or rent your data, to anyone, ever.
• It does not use your Google data for advertising, or to train any AI or machine-learning model.
• It does not share your Google data with third parties, except the hosting providers below that are required to run the service.
• It does not track you across other websites.

HomeFrame's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide and improve the user-facing features described on this page, and for no other purpose.

Who else is involved

• Render hosts the application and its PostgreSQL database, in the United States.
• Open-Meteo receives the coordinates or place name of your weather location in order to return a forecast. No account or personal information is sent with it.

Households are separate

Every piece of data in HomeFrame belongs to exactly one household, and every request is checked against the household of the person making it. Members of one household cannot read or change another household's calendars, photos or anything else.

Children

HomeFrame is meant for a household to run together, and a family's chore chart may well name children. Only an adult account holder can connect a Google account or change settings. HomeFrame does not knowingly collect data directly from children.

Changes

If this policy changes in a way that affects how your data is handled, the date at the top will change and the notice will appear in the app.

Contact

Home Grid LLC · support@home-frame.com