HomeroomCal

Draft

Privacy policy

This is a draft for the owner to review with a lawyer before launch. It is not legal advice. It describes how this version of HomeroomCal is built.

Who this is for

HomeroomCal is a service for parents and guardians 18 or older. It is not directed to children, and children should not create accounts or use it. Kid profiles store a first name and an optional nickname only.

What we collect

  • Your email address, used for magic-link sign-in and the morning digest.
  • A family name, used to build your private forwarding address.
  • First names and nicknames you add for the children in the household.
  • Messages you forward, including PDF and image attachments, plus the events, forms, payments, and closures we extract from them.
  • Billing identifiers from Stripe: customer id, subscription id, plan, and status. We do not store full card numbers.

What we don’t do

  • We do not connect to your inbox. There is no OAuth access to Gmail, Outlook, or iCloud.
  • We do not sell personal information and we do not show ads.
  • We do not use your mail to train HomeroomCal’s own models.
  • We do not ask for a child’s last name, student id, address, or photo.

Forwarding

You send mail to an unguessable address on in.homeroomcal.com. By default we only accept messages from email addresses you have verified. If you turn on “Accept forwarded school mail,” messages to that secret address are accepted even when the visible sender is the school. That is what Gmail’s automatic forwarding requires, because those messages arrive from the school, not from you. The secret address is what keeps strangers out. You can turn it off.

Gmail sends a forwarding-confirmation message. We store the confirmation link so you can open it. We do not store the rest of that message.

AI

Extraction uses Google’s Gemini API on the paid tier, default model gemini-3.1-flash-lite, with a stronger flash model for images, long PDFs, and replies that don’t match the schema. When no API key is configured, a local heuristic reader is used instead and nothing is sent to Google.

The owner must keep Gemini on Google’s paid tier and confirm Google’s current data-use setting so prompts are not used to improve Google’s models. HomeroomCal does not permit your mail to be used as training data for our product.

How long we keep it

The raw email and attachments are deleted automatically 30 days after they arrive. After that, the source view says the original was deleted. Calendar items you confirmed, including a short title and the fields you saved, remain until you delete the item or the whole account. Logs are scrubbed of email addresses, phone numbers, and similar identifiers.

Sharing

The family iCal address is a secret URL. Rotating it turns the old one off. Read-only share links can be limited to selected kids. Anyone with a link can view that slice of the calendar until you revoke it. Share pages send a noindex header. They do not include the original email.

Subprocessors

  • Cloudflare, for the app, database, file storage, and inbound email routing.
  • Resend, for sign-in, sender verification, and digest email.
  • Stripe, for checkout, the trial, subscriptions, and the customer portal.
  • Google, for Gemini extraction when an API key is configured.

Delete

Settings includes a control that deletes the family, users, kids, mail, files, calendar items, share links, and sessions. If a Stripe subscription is active, we ask Stripe to cancel it. That request can fail if Stripe is unreachable; cancel in the portal too if you still see a charge.

Contact

Privacy questions: privacy@homeroomcal.com. Set that mailbox up before launch.