HOMER / PRIVACY

Last updated 11 September 2026.

Homer is a private household organiser used by invitation. It has no advertising, no analytics, no trackers and no third-party scripts. It does not sell anything and has nothing to sell.

This policy covers Homer and its two siblings, Luncher and Mealer. They are one application on three addresses, sharing one database and one set of accounts, so there is one policy rather than three that would have to agree. It describes every kind of data they hold between them.

Google user data

What Homer asks for

One scope, and the narrowest one Google offers for this: https://www.googleapis.com/auth/calendar.readonly. It permits reading calendars and events and cannot write. Homer never creates, changes, moves or deletes anything in Google Calendar.

Homer does not request an identity scope. It learns which account you connected from the address of that account's primary calendar, which is already part of the calendar list it receives.

What it reads and stores

Your list of calendars — each one's name and colour — so you can choose which of them appear.
Events from the calendars you tick, and no others. For each event: its title, location, start and end times, whether it is all-day, and Google's id for it.
A window of about six months — 30 days behind today and 180 ahead. Anything outside that window is not copied.
The email address of the connected Google account, so the settings screen can show you which account is connected.
A refresh token, so Homer can re-read the calendar without asking you to sign in again.

Homer re-reads the selected calendars about every fifteen minutes and replaces its copy. Nothing else about your Google account is requested, received or stored.

How it is protected

Data is held in a Cloudflare D1 database in Cloudflare's network, reachable only over HTTPS and only by signed-in members of the household it belongs to. The refresh token is encrypted with AES-GCM under a key kept in Cloudflare's secret store rather than in the database, so a copy of the database on its own yields ciphertext.

Who it is shared with

Nobody. Google user data is not sold, not transferred to anyone, and not used for advertising. It is not used to develop, improve or train any generalised or non-personalised model, including any AI or machine-learning model. The only party who processes it besides you is Cloudflare, which provides the hosting and the database.

Within Homer, mirrored events are visible to the members of the household that connected the account — the people whose kitchen screen it is.

Deleting it

Disconnect on Homer's Google Calendar screen removes the stored credential, deletes every mirrored event, and asks Google to forget the grant. You can also revoke Homer's access from your Google account at myaccount.google.com/permissions at any time, with or without touching Homer; the mirrored events stop being refreshed and can be deleted from the same screen.

Limited Use

Homer's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Everything else these hold

Your account — a name, an email address, and a password stored one-way as a hash. The hash cannot be turned back into your password.
A session — one cookie so you stay signed in. It is stored as a digest, so the database does not hold anything that could be replayed as your session. There are no third-party cookies.
What the household puts in — chores, who does them, meals, recipes and shopping lists.
Who takes a packed lunch, and what each of them is having. An administrator marks which members of the household have a lunch packed for them, and the week then records what that person is having on each school day. It is a record about named individuals, most of them children, and it is listed separately here rather than folded into "meals" above because that is the honest way to describe it. It is visible to the household, like everything else, and it is deleted with the account it belongs to.
Failed sign-in attempts, briefly, to slow down guessing.

Ask the household's administrator to delete your account and it is removed, along with what belongs to it alone.

Changes, and how to reach us

If this policy changes, the date at the top changes with it. Questions about it, or a request to delete data, go to garycordick@gmail.com.