DRAFT — for lawyer review. Not yet the final policy. Version 2026-10-18-draft.

Privacy Policy

Nucleus Huddle ("Huddle") is a family organizer made by Nucleus Management Systems ("we"). This policy explains what we keep, why, who helps us run Huddle, and the choices you have. The short version: no ads, we never sell your family's data, and you can download or delete all of it from the app.

What we keep

• Your account: the email and password (stored only as a one-way scrypt hash) of each parent or teen who has a login.
• Your family's profiles: names, a color, a role (parent, teen, kid), ages if you add them, diet choices you pick, and optional PINs (stored as hashes).
• What you put in Huddle: calendar events, lists, prices, recipes, meal plans, chores and allowance, bills, budgets and spending, shared expenses, documents, Bible study progress, highlights and notes.
• Kids' rewards: what each kid earns from chores (cash, screen time, or rewards your family makes up), their balances, payouts and redeemed rewards, and the requests a kid sends to a parent (with an optional short note). These stay inside your family; parents set them up and answer requests.
• Photos and files: receipt photos, document photos or PDFs, recipe photos, schedule screenshots.
• Your library: which Bibles and faith texts your family adds, your family's faith setting if you choose one, reading progress, and books you upload (kept private to your family, encrypted). [Lawyer: a faith setting is religious information — a sensitive category in several state privacy laws; confirm the consent language.]
• Health, fitness and goals: challenges, what each person logs (minutes moved, glasses of water, hours of sleep…), goals and check-ins, cheers, and — only if an adult chooses — their sex, used only to suggest a strength target. Goals are private unless shared to the family board. We never ask for weight, and Huddle doesn't allow weight or calorie goals for kids.
• Challenges with other families: only your team name and your team's score are shared with the other families in that challenge — never names, ages, targets or logs.
• Accountability groups: if a parent joins a group of families, the other families in it see your family's display name for that group, your check-ins (what you did, minutes if you add them, and when), short notes and reactions your family posts there, your weekly streak and days with a check-in. People in your family are shown by a first name or nickname only if a parent turns that on for them; kids under 13 are off unless a parent turns them on and always use preset cheers instead of typing. Nothing else from your family's Huddle is shared. When your family leaves a group (or deletes its account), its posts, reactions and check-in days are deleted from the group. [Lawyer: confirm the parental-consent language for showing a child under 13 by first name to other families.]
• Reports and moderation in groups (Group HQ): when a parent reports something in a group — a post, a family's name in the group, a person's shown name, or a group challenge — we keep a copy of the reported words, which family it's about, the reason picked, an optional short note from the reporting parent, when, and how many families reported it. The families that reported it are kept only as coded keys: no one in the group, including the family that was reported, is told who reported it. The parents of the families in the group see the report, the reasons and the notes in Group HQ and can decide on it; the reported family's parents get a plain notice if something of theirs is hidden or removed. Kids never see Group HQ. Each group keeps an activity log of moderation and settings actions (the acting family's display name and the parent's first name, what was done, when), visible to the group's parents and kept 90 days; decided reports are deleted 90 days after the decision. Reports about a child's safety, and any report still open after 24 hours, are also sent to the Nucleus team (by email and a private review page) so we can act on them, including removing content, pausing or removing a family, or suspending a login. [Lawyer: confirm retention and the disclosure that reported content is reviewed by other parents and by Nucleus staff.]
• Challenges with other families — reports: a team name or a challenge's name or prize can be reported the same way; for a challenge started inside a group it goes to that group's parents, otherwise straight to Nucleus.
• Bank data, if a parent connects a bank: for each transaction, its date, amount, merchant or description, spending category, and an account label like "Checking ••0000". We never see or store your bank username or password, account or routing numbers, or balances, and Huddle can't move money. The connection's access key is encrypted and kept only on our server.
• Stores and prices: the stores your family picks (name, chain, address, the store's own map location and how far it was from where you searched), who in the family starred which store, and the prices you save from receipts, price checks and (if Huddle has it turned on) Kroger's public price feed — with the package size and date. This is your family's data like your lists: encrypted with your family's key, in your download, deleted with your account.
• Your location, only when you ask: when someone taps Use my location in Stores & prices, the phone asks permission and sends its location to our server, rounded to about 100 meters. Our server uses it once to find grocery stores nearby and measure how far they are, and never stores it. The map search itself goes out for the center of a roughly 1 km area, not your point. You can type a ZIP code or city instead. Kids under 13 don't use this. [Lawyer: confirm "precise geolocation" treatment under state laws given the rounding and no storage.]
• Community prices — only if a parent turns it on (off by default): when it's on, prices your family saves at stores you found on the map are also shared with other Huddle families as anonymous records — the store (or the chain and a roughly 11 km area around the store), the item's plain name ("milk"), the package size, the price and the date. Shared records hold no family name, account, person, list, receipt or location of yours. They carry only a one-way code that differs for every store and item, used to count different families and keep one price per family a week. Your family sees the middle price other families paid at the same store or chain nearby only when at least 3 families shared it in the last 30 days, and unusual prices are left out. Because shared prices can't be traced back to your family, they can't be removed when you turn sharing off or delete your account; they're dropped after 60 days. [Lawyer: confirm this meets the deidentified-data definitions (e.g. CCPA/CPRA, Colorado) and whether the public commitment not to re-identify needs to be stated here.]
• Calendar links you connect (they can be private links, so we keep them on the server and never send them to other family members' devices).
• Security records: IP addresses and device type, used briefly to stop abuse (rate limits, spam checks) and to keep your account safe.

We don't collect your contacts or anything from your phone that you don't add yourself, and we only use your location when you tap Use my location (above).

How we use it

Only to run Huddle for your family: showing your data on your family's devices, syncing changes, sending account emails (confirm your email, reset your password, invites you send), reading a receipt or schedule photo when you ask, and keeping the service secure. We don't use it for advertising and we don't sell or rent it to anyone.

Who helps us run Huddle

• Vercel hosts the app and its server, and (if enabled) stores encrypted files.
• Upstash hosts the database. Family data is encrypted with a key unique to each family before it's stored.
• Resend sends account emails, and the emails that tell the Nucleus team about a report that needs a look (the reported words and the group's name — never a family's email).
• Anthropic reads a receipt or schedule photo when you choose "Scan a receipt" or add a schedule screenshot. Only that photo is sent, and its answer comes back to you to check. [Lawyer: confirm the provider's data-use terms and retention for API inputs.]
• Calendar sites you connect are fetched by our server to show their events.
• Plaid connects your bank, if you choose to: you sign in to your bank in Plaid's window, and Plaid sends us your transactions (read-only). Plaid's handling of your data is described in the Plaid End User Privacy Policy. You can disconnect in Money at any time; we then ask Plaid to remove our access. [Lawyer: confirm Plaid's required disclosure language.]
• Anthropic also reads recipe photos when you choose "From a photo" — only those photos are sent.
• OpenStreetMap (the Overpass API and Nominatim, run by OpenStreetMap volunteers and the OpenStreetMap Foundation) answers "which grocery stores are near here". Our server sends them the center of a roughly 1 km area (never your exact location), or the ZIP code or city you typed — never your name, family or account. Store data © OpenStreetMap contributors.
• Kroger's public developer API, only if Huddle has it turned on and only for Kroger-family stores your family picked: our server sends the store's Kroger location number and the plain names of items on your list to get shelf prices, and a 1 km-area center to find Kroger stores nearby. Nothing that identifies your family. Nucleus Huddle is not affiliated with Kroger.
• Public-domain Bibles and faith texts are downloaded by our server from eBible.org and Project Gutenberg; no family data is sent to them.
• The Bible text is loaded from a public content network (jsDelivr) when you read it; no family data is sent with it.

Kids

Huddle is for families. A parent or guardian (18 or older) creates the family account. Profiles for children under 13 are created and managed by a parent; we don't ask a child under 13 for an email address and they can't create their own login. Teens 13 and up can be invited by a parent to their own login. Kids' profiles can't see Money or Documents. A parent can review, change, export or delete a child's information at any time in the app. [Lawyer: review COPPA verifiable-parental-consent requirements for the parent-created-profile model, and state laws on teens.]

Your choices

• Download everything: Family & settings → Account → Download everything.
• Delete: Family & settings → Account → Delete my account. You can delete just your login, or the whole family's data. Deletion removes the family's records, files and logins from our database right away; backups held by our providers expire on their normal schedule. [Lawyer: confirm provider backup windows.]
• Fix things: edit or remove anything in the app.

Security

Connections use HTTPS. Each family's data is encrypted at rest with its own key. Files open only through links that expire after 15 minutes. Sign-in is rate-limited, sessions can be ended by changing your password, and every change is checked against what that person is allowed to do.

Your rights

Depending on where you live (for example California, Colorado, Virginia or the EU/UK), you may have rights to know, access, correct, delete and port your data, and to opt out of sale or targeted advertising — we don't sell data or do targeted advertising. Use the app's tools above or email us. [Lawyer: complete state-by-state and GDPR sections if offered outside the US.]

Changes and contact

If this policy changes in a meaningful way we'll tell you in the app before it takes effect. Questions: support@getnucleusms.com.