Privacy, identification and managing the family
Huusholli is built so that the family's data belongs to the family. This page explains what that means in practice: what the server sees, how family members are identified and how devices are managed.
What the server sees
The family's name, members' names and pictures, chores, plans, messages and voice messages are encrypted on the device with the Family Key before they are sent to the server. The server stores encrypted packages and their technical identifiers, such as which family a package belongs to and when it changed. The server cannot open the packages, because it does not have the key. That is why we cannot read your family's messages or chores, nor restore them if the key is lost.
Tilu's help and the picture catalogue contain no family data: they are the same for every family and are fetched from the server as they are.
The Family Key and the Public ID
The Family Key is created on the device when the family is created. Huusholli shows it once, and it must be saved somewhere safe. The Family Key and the family's public identifier (Public ID) together restore the family on a new device. The key is also needed if the parent admin's passcode is forgotten. We do not keep a copy of the key.
When a member's personal device joins the family with a join code, the code brings the Family Key to the device encrypted. The key is neither typed nor shown.
Roles
Every family member has a role, which shows as a colour, not as text.
- Parent admin
- The family's creator. Manages members, roles, join codes, passcodes and settings. There can be more than one parent admin.
- Parent and grandparent
- See the whole family's status, add and edit chores and plans and run the Flurry. Do not manage members or devices.
- Child
- Sees their own chores and messages according to their reading level: as pictures, as a list or as the adult view. Does not see the family's management.
- Guest
- For example a babysitter: sees the day's chores and messages, not the management.
Personal and shared devices
A device's mode is decided by the join code, not in the settings.
- Personal device. A member's own join code (Family › Members, the member's row) makes the device theirs. The device remembers the user and does not ask who is using it. A child's personal device is always locked to the child.
- Shared device. The Shared device row's code connects, say, the kitchen tablet or the browser on a shared computer. Everyone picks themselves from a picture, and the device returns to the choice after five minutes without use. The code is valid for an hour.
- Codes are single-use. A used, expired or wrong code is rejected, and too many attempts pause joining for a moment.
- Forget device. Removes the family's data and key from the device. The family is restored later with a join code or the Family Key.
Passcode and picture password
The purpose of identification is to protect family members from each other's mischief on the same device: so that a sibling does not mark another's chores done or read another's messages.
- The parent admin always has a passcode. The four-digit passcode is asked for when the parent admin's picture is chosen on a shared device and before managing the family.
- For others the passcode is optional. Without one, the profile can be opened by anyone on the device. The parent admin sets and removes passcodes on the Family › Members page.
- The youngest child's picture password. A child who cannot read yet chooses three pictures out of nine in the right order. The pictures are in different places every time, and Tilu encourages and advises if the password goes wrong.
- Remember me. In your own browser you can choose not to be asked every time.
- A forgotten passcode. The parent admin gives the member a new one. Changing the parent admin's own passcode needs the Family Key.
Passcodes are stored encrypted in the same way as the rest of the family's data. The server does not see them.
Children's messages
A child's conversations are the child's own, within the family too. An adult sees a message sent to the child only when the child presses Show a grown-up. Asking for help from a chore card is the exception: it is meant for an adult, and it shows in the adult's Messages as a link to the chore.
Message retention
On the Settings › Messages page the parent admin can choose that old messages are deleted automatically after a chosen time. The deletion applies to all of the family's devices.
What we do not do
- We do not show ads.
- We do not sell or pass on data.
- We do not read the family's content, because we cannot.
The company's general privacy notice: Privacy.
Updated