PRIVATE HOUSEHOLD PILOT · INFORMATION ONLY

Belgrave Family Hub privacy policy

Effective date: 15 October 2026.

This policy describes the current private pilot. The household administrator controls access and authorizes its integrations. Changes in data use require an updated notice and any necessary consent before the change is enabled.

Information used

The Hub processes explicit messages from authorized senders, their permitted sender identifiers, tasks, appointment details, corrections and audit history. The WhatsApp adapter ignores groups, status, broadcasts, history sync, unknown senders and its own messages. The current pilot permits only the enrolled owner.

Google account email and a stable account identifier verify that the intended account authorized an integration. OAuth tokens let the separate private workers operate within their granted scopes. The Calendar worker creates and manages synthetic events only in the app-created scratch calendar. The Drive worker creates a private backup folder and uploads encrypted application backups.

The Hub does not request whole-Calendar or whole-Drive access in this pilot. It does not connect to Gmail or Google Tasks. This public information page does not collect household submissions, authentication details or Google data.

Use and sharing

Information is used for household coordination, source/correction history, authorized test-calendar synchronization and recovery. Google receives the account authorization information, synthetic calendar projections and encrypted backup files needed for those functions. WhatsApp handles messages through its own service. The Hub stores private operational data on its configured server.

The Hub does not sell information or use it for advertising. Model processing is disabled: the current pilot sends no household content or credentials to model providers. Use of Google data is limited to the authorized functions described here and the Google API Services User Data Policy, including Limited Use.

Protection and recovery

The private Hub uses authenticated access through its private connection. Google workers have separate credentials and limited permissions. Backups are encrypted before upload; the private recovery key remains under the owner's control, separate from the server and cloud backups. These measures do not eliminate all security risks. OAuth credentials and WhatsApp session state are sensitive and must not be shared through this website or support messages.

Retention and control

The pilot preserves source records and correction history. Backup retention keeps seven daily and four weekly recovery points, with overlap where a copy serves both periods. Older app-created backups may be moved to recoverable Drive Trash after a newer upload is verified. Encrypted backups are scheduled daily at 02:30 America/Bogota. The administrator controls backup removal and the separate offline recovery key.

The account owner can revoke Google access through Google Account permissions. Revocation stops future authorized access; it does not automatically delete existing Hub records, scratch events or encrypted backups. Contact the household administrator to review or remove pilot data and backup copies. A disconnected recovery-key copy remains under the owner's physical control.

Contact

For privacy questions or access/removal requests, contact your household administrator using your existing private communication channel.