Household data can be more personal than it sounds
A shopping list may reveal health or habits. A bill shows a provider and amount. A trip plan says when you may be away. Privacy therefore needs to be described through specific data movements, not a broad promise.
Readable content on an unlocked phone
The app needs to display and edit content, so it is readable on an unlocked device. Phone security — a screen lock, updates and care when sharing the device — remains part of protecting it.
Encryption before sending
Content is encrypted on the phone before it is sent. The server stores encrypted data and the technical metadata needed to update the shared state. This distinction matters: data leaves the phone, but shared content is encrypted first.
Search remains on the phone
When you look for a project name or list item, content search happens on the device. The query does not need to build an external index of your household entries.
A notification without content still has delivery data
Notifications contain no titles, amounts or content. Google handles delivery and related delivery metadata. The signal tells the app that the shared state needs updating; details appear after you open it.
A new device is a new point of access
Signing in alone should not be enough to read shared matters on a new phone. The other person approves the device before it receives access. This is not a step to rush past without understanding it.
Questions to ask before taking part
Before the pilot, read the full policy and check that it covers data types, purposes, providers, retention, your rights and account deletion. If an answer is missing, ask for it before adding real household content.
Read the privacy summary