Ohana Privacy Policy

Effective date: 27 October 2026
Last updated: 27 October 2026

1. Introduction

Ohana is a family organisation application that helps families coordinate everyday activities, including tasks, shopping lists, schedules, and other shared family information.

This Privacy Policy explains how Ohana collects, uses, stores, shares, and protects personal data when you use the application or its related services.

Ohana is currently an invitation-only service operated by an individual in Slovenia. It is free to use at present. If the service, its features, or its business model changes, this policy may be updated accordingly.

We aim to collect only the information needed to operate Ohana, provide its features, maintain security, and support its users.

2. Who is responsible for your data?

The data controller responsible for processing personal data through Ohana is:

Controller: [FULL LEGAL NAME]
Country: Slovenia
Email: [email protected]
Website: https://ohana.day

For questions about this policy, requests concerning your personal data, or other privacy matters, contact us at [email protected].

3. Personal data we collect

The information we process depends on how you use Ohana.

3.1 Account information

When you create an account, we may process:

• Email address.
• Name and other basic profile information.
• Authentication identifiers associated with your chosen sign-in method.
• Account preferences and settings.
• Profile pictures you upload.

Ohana supports Google sign-in, Microsoft sign-in, and email/password authentication. Signing in with Google does not, by itself, connect your Google Calendar.

3.2 Family information

To provide shared family-planning functionality, Ohana processes information you or other family members enter into the application, including:

• Tasks and their descriptions, status, and deadlines.
• Shopping lists and their items.
• Family preferences and settings.
• Family membership and role information.
• Other information associated with family organisation features.

Information shared within a family may be visible to its other authorised members, depending on their permissions.

3.3 Information about children

Parents or authorised family administrators may create and manage restricted child accounts.

These accounts have limited permissions. Child accounts are intended to provide access to appropriate family features without allowing children to modify protected family information.

We process information associated with these accounts only as needed to provide the relevant functionality, manage permissions, and maintain security.

Parents and guardians should ensure that information about children is entered and shared appropriately.

3.4 Google Calendar information

Ohana is developing an optional Google Calendar integration.

When this integration is made available and you choose to connect your Google account, Ohana will request the Google Calendar permissions presented during Google's authorisation process. The intended integration provides read-only access to calendar information; Ohana will not create, edit, or delete events in your Google Calendar.

Depending on the functionality you use, information processed may include:

• Calendar event titles and descriptions.
• Event dates, times, and time zones.
• Event locations and other event details made available through the granted permissions.
• Calendar identifiers and related metadata.

Some calendar information may be stored in Ohana's database, while other information may be retrieved from Google when needed to provide the feature.

Important family-sharing disclosure: Calendar information retrieved through Ohana may be visible to members of the family associated with the integration. It is not necessarily visible only to the person who connected Google Calendar.

Before enabling this integration, Ohana will provide an appropriate in-product disclosure explaining the data access and family-sharing implications.

Google sign-in and Google Calendar access are separate. You can use Google sign-in without choosing to connect Google Calendar.

3.5 Invitations and communications

Ohana is currently invitation-only. We process email addresses and related invitation information to send invitations and manage access to families.

Google/Gmail is used to send application emails.

Receiving an invitation does not, by itself, establish that the recipient has access to a family's information. Access depends on the account and family membership process.

3.6 Technical and security information

When you use Ohana, technical information may be processed to deliver the application, maintain security, troubleshoot problems, and prevent abuse.

This may include:

• IP addresses and connection metadata.
• Request and access metadata.
• Authentication and session information.
• Application errors and technical events.
• Information needed to investigate security incidents.

Cloudflare is used for DNS and proxied application traffic. As a result, Cloudflare may process IP addresses, request metadata, and other technical information needed to deliver and protect the service.

Ohana does not currently use third-party analytics or advertising-tracking services.

4. How we use personal data

We process personal data for the following purposes:

• Providing Ohana: Creating accounts, managing families, and delivering tasks, shopping lists, scheduling, and other available features.
• Authentication and access control: Authenticating users and enforcing family membership and permissions.
• Google Calendar integration: When enabled and authorised, retrieving calendar information to display it within Ohana.
• Communication: Sending invitations and necessary account-related messages.
• Security: Protecting accounts, preventing abuse, and maintaining the confidentiality and integrity of the service.
• Troubleshooting and maintenance: Diagnosing application problems and ensuring the service operates correctly.
• Legal compliance: Meeting legal obligations where applicable.

We do not sell personal data or use it for advertising.

5. AI-assisted features

Ohana includes an AI-assisted feature intended to help users create tasks and events.

The current implementation uses a locally hosted language model. At present, this feature does not read existing family information or Google Calendar data. It is used to assist with creating tasks and events based on the user's request.

We do not intend to use Google API data to train general-purpose AI models.

If AI functionality changes, including the introduction of a cloud-based AI provider, we will assess the privacy implications and update this policy and any required user disclosures before introducing processing that materially changes how personal data is handled.

6. How we share personal data

We share or make personal data available only as needed for the purposes described in this policy.

6.1 Within your family

Ohana is designed to support shared family organisation.

Depending on the feature and permissions involved, family members may see tasks, shopping lists, preferences, profile pictures, and other information made available to their family.

When the Google Calendar integration is enabled, calendar information retrieved through Ohana may also be visible to members of the associated family. This sharing will be disclosed before users enable the integration.

Users should consider this family visibility before entering sensitive information or connecting a calendar.

6.2 Service providers

Ohana currently relies on the following external providers:

• Google: Authentication, Google Calendar integration when authorised, and application email delivery.
• Cloudflare: DNS and proxied application traffic, including services supporting delivery and protection of the application.

The application, database, and backup infrastructure are self-hosted.

Service providers may process personal data as necessary to provide their services, subject to their applicable terms and privacy commitments.

6.3 Legal requirements and security

We may disclose information when required by law or when reasonably necessary to establish, exercise, or defend legal claims, investigate security incidents, or protect users and the service.

We do not sell family information or provide it to advertisers for advertising purposes.

7. Google API data and permissions

When the Google Calendar integration becomes available, its use of Google data will be governed by the permissions you grant and the disclosures presented by Ohana.

Our intended practices are as follows:

• Calendar access is read-only.
• Google Calendar data is used to provide the corresponding Ohana functionality.
• Calendar information may be stored in Ohana's database or retrieved from Google when needed.
• Calendar information retrieved through Ohana may be displayed to authorised members of the associated family, as disclosed before connection.
• Google Calendar data is not sold or used for advertising.
• Google Calendar data is not used to train general-purpose AI models.
• Google authorisation can be disconnected through the intended disconnect workflow, which will revoke the Google authorisation and remove the associated credentials and cached Google data from active Ohana storage.

The Google Calendar integration is still being finalised. The credential-storage, revocation, and deletion workflows must be implemented and tested before the integration is made available for general use.

Google's applicable API policies and user-data requirements also apply to this integration.

8. Where data is stored and international transfers

Ohana's primary application infrastructure, database, and backups are hosted on self-managed infrastructure within the European Economic Area (EEA).

Backups are stored separately in self-hosted, S3-compatible object storage. Uploaded profile pictures are also stored in a separate bucket on self-hosted object storage.

Google and Cloudflare may process certain personal data outside the EEA, depending on the services and configurations involved.

Where personal data is transferred outside the EEA, applicable data-protection requirements and transfer safeguards must be observed.

We will update this section if changes to hosting or service providers materially change where or how personal data is processed.

9. Data security

We take measures intended to protect personal data against unauthorised access, loss, alteration, and disclosure.

Current infrastructure protections include:

• HTTPS for application traffic.
• Encryption at rest at the storage and application layers.
• Network isolation and access restrictions for application workloads.
• Separation of application infrastructure and backup storage.
• Restricted family access based on membership and permissions.

Ohana is not currently end-to-end encrypted. The application backend may need to process or decrypt information to provide its features.

The Google Calendar integration requires additional safeguards for OAuth credentials, including secure token storage, appropriate access restrictions, and tested revocation and deletion workflows. These controls must be completed before the integration is released for general use.

No method of electronic storage or transmission can guarantee absolute security.

10. Data retention and deletion

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, unless a longer period is required by law.

10.1 Family content

Tasks, shopping-list items, preferences, and other family information are retained while needed to provide Ohana and support the family's use of the service.

Users can delete individual tasks and shopping-list items. Users can also remove or replace their uploaded profile pictures.

We do not currently have a finalised automatic-retention schedule for all types of family content.

10.2 Account deletion

You may request account deletion by contacting [email protected].

When an account is deleted, the intended process is to remove the account's personal information and access, together with its associated Google credentials and cached Google data, where applicable.

Shared family content may be retained when it is still needed by other family members. We will seek to avoid unnecessarily retaining identifiable information about a departing member.

If you need to delete an entire family, contact support. Family deletion is intended to remove its shared content, memberships, child profiles, and associated Google integration data. Adult user accounts are not automatically deleted solely because a family is deleted.

10.3 Google disconnection

When Google Calendar is disconnected, the intended workflow is to revoke the Google authorisation and delete the associated credentials and cached Google data from active Ohana storage.

Disconnecting Ohana does not delete events from your Google Calendar. Your source data remains under your control in Google.

10.4 Backups

Ohana uses a backup rotation consisting of:

• Daily backups retained for 30 days.
• Four weekly backups.
• Six monthly backups.

Deleted information may remain in backup copies until those copies expire under the backup rotation. Backups are maintained for recovery purposes and are not intended to provide normal access to deleted data.

10.5 Technical logs

Technical and security information is retained only for as long as reasonably necessary for operational, security, and troubleshooting purposes.

Specific log-retention periods and automated deletion controls will be finalised as the service's operational logging develops.

11. Cookies and similar technologies

Ohana uses strictly necessary cookies for authentication, session management, security, and core application functionality.

Ohana does not currently use analytics or advertising cookies.

If optional cookies or tracking technologies are introduced in the future, we will update this policy and implement any consent mechanisms required by applicable law before using them.

12. Your rights under data-protection law

If the GDPR applies to the processing of your personal data, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests, where applicable.
• Request data portability where the relevant legal conditions are met.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a competent data-protection supervisory authority.

These rights are subject to applicable legal conditions and exceptions.

To exercise your rights, contact [email protected]. We may need to verify your identity before responding.

If you are in Slovenia, you may contact the Information Commissioner of the Republic of Slovenia if you believe your personal data has been processed unlawfully.

13. Children's privacy

Child accounts are intended to be created and managed by a parent or authorised family administrator. They have restricted permissions and are not intended to provide children with unrestricted control over family information.

Parents and guardians should ensure that creating and managing a child's account is appropriate and lawful.

We will apply the data-protection requirements relevant to children and the services offered to them. Where parental authorisation or consent is legally required, the necessary process must be established and followed.

14. Changes to this policy

We may update this Privacy Policy when Ohana's functionality, infrastructure, service providers, or legal obligations change.

The revised policy will be published on the Ohana website with an updated revision date. Where required, we will provide additional notice of material changes, particularly changes to how Google data or other personal data is accessed, used, stored, or shared.

15. Contact

For questions about this Privacy Policy, personal-data requests, or privacy concerns, contact:

Email: [email protected]
Website: https://ohana.day

Please include enough information for us to understand and respond to your request, but do not send passwords, access tokens, or other authentication secrets by email.