Privacy
Last updated 29 July 2026
Plain-language draft. SupaBizzy is an early product in private beta, and this policy is written to be read rather than to be legally exhaustive. It has not yet been reviewed by a lawyer. It describes what the software actually does today, and it will be reviewed and revised before payments are taken or the product opens to the public.
SupaBizzy helps a family keep its schedule, paperwork, and important details in one place. This page covers both the supabizzy.com website and the SupaBizzy app.
Who we are, and where your data lives
SupaBizzy is operated by its founder in the United States — when this page says “we,” that is who it means. Your data is stored and processed in the United States with the services listed below. If you use SupaBizzy from outside the US, your information travels to and is kept in the US.
In plain terms, our basis for handling your information is simple: we process what you put into SupaBizzy because that is the service you asked for; we process your waitlist email because you gave it to us for that purpose; and optional connections — like Google Calendar — happen only with your explicit go-ahead and can be switched off by you at any time.
The waitlist
If you join the waitlist — from this website or from the app's sign-in screen — we store the email address you submit, the optional "I'm a parent" checkbox, the page you signed up from, the referring page, and your browser's user-agent string. We use it to send product updates, invite early testers, and ask for feedback. We do not sell it.
The site has no analytics, no advertising, and no third-party tracking scripts. It does load its typefaces from Google Fonts, which means your browser makes a request to Google when the page opens.
Signing in
SupaBizzy has no passwords. You sign in with a link emailed to you, which also confirms the address is really yours. We store your email address and, while you are signed in, a session token in your browser. Sign-in is handled by Supabase (our database host) and the emails are delivered by Resend.
The app
When you use SupaBizzy, we store what you put into it: your family and its members, events and who is carrying each one, the notes and handoffs you write, anything you save in the Family File, and your notification preferences.
Everyone in your family can see the family's information. Items you mark sensitive are shown only to the family organizer, and are excluded from any sheet you share.
Google Calendar
Connecting Google Calendar is optional, and SupaBizzy works without it.
What we ask for
When you connect, Google asks you to approve two things: reading the calendars you connect, and creating a calendar that belongs to this app — the shared family calendar where SupaBizzy manages your family’s confirmed events. SupaBizzy holds no permission to change any other calendar.
What we do with it
| We do | We do not |
|---|---|
| Read events from the calendars you connect — title, time, and location — so they appear on your day. | Read your Gmail, contacts, files, or anything outside the calendars you connect. |
| Create one calendar, named SupaBizzy Family, and write your family's confirmed events to it. | Write to your personal calendar, or to any calendar we did not create. |
| Store the access tokens Google issues — encrypted at rest with AES-256-GCM, with the key held outside the database — so syncing can continue without asking you again. | Use your calendar data for advertising, for profiling, or to train machine-learning models. |
What never leaves for Google
Your Family File — insurance details, documents, contacts, registration answers — along with leads, handoffs, and the notes you write for each other, are never copied into Google Calendar. Only the schedule itself is: title, time, and place. This is enforced in the software, not merely by policy.
Limited Use
SupaBizzy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting
You can remove a calendar connection at any time in Settings, which deletes the stored tokens. You can also revoke SupaBizzy's access from your Google account permissions page. Events already pulled into SupaBizzy stay until you delete them — and all of it, tokens and events alike, is removed when you delete your account or family, on the schedule described under Keeping and deleting below.
Other calendars
You can also follow a public calendar by its iCal/ICS link — a school or sports team, for example. SupaBizzy fetches that address on a schedule and reads the events it publishes. Nothing is sent back.
Sharing
SupaBizzy can mint a link to a printable sheet — the details a sitter or a coach needs. That link is public to anyone holding it, expires after seven days, can be revoked at any time, and never includes items marked sensitive. Nothing is shared outside your family unless you create one of these links.
How we protect your data
The specific mechanisms, in plain terms:
- Encryption in transit. Every connection uses HTTPS/TLS — between your browser and SupaBizzy, and between our servers and the services we rely on, including Google. Our sites send HTTP Strict-Transport-Security headers, so browsers refuse to connect insecurely.
- Encryption at rest. The database and your uploaded documents live with hosting providers that encrypt their underlying storage. Nightly backups are additionally encrypted by us before they leave the server, and are discarded after 21 days.
- An extra lock on Google credentials. The tokens Google issues when you connect a calendar are encrypted a second time at the application level — AES-256-GCM, with the key held outside the database — so even a copy of the database would contain no usable Google credentials.
- Access checks on every request. You must be signed in, and the server confirms on every request that you belong to the family whose data you are asking for. During the private beta, sign-in itself is limited to invited accounts.
- Tighter rules for sensitive items. Anything you mark sensitive is shown only to the family organizer, and is excluded from every shared sheet — enforced when a sharing link is created and again each time it is read.
- Payment details never touch us. Card details go from your browser to Stripe directly; we keep only your subscription status.
- Guard rails on the service itself. Request rate limiting, strict browser security headers, and error reports scrubbed before they leave the server, so no emails, tokens, or Family File content ride along with them.
Who can reach your data
Everyone in your family can see the family's information, except sensitive items as described above; nothing leaves your family unless you create a sharing link. Beyond the protections listed above, what you enter is not encrypted in a way that would prevent us from reading it, so SupaBizzy's operator can in principle access it — for example while fixing a fault. We keep that access limited to what running the service requires. We do not sell your data, and we do not share it with advertisers.
Services we rely on
- Vercel — hosts this website and the app
- Render — runs the application server
- Supabase — hosts the database and handles sign-in
- Resend — sends sign-in and waitlist emails
- Stripe — processes payment if you subscribe. Your card details go to Stripe directly and never touch our servers; we keep only your subscription status
- Google — only if you connect a Google Calendar
- Sentry — collects error reports when something breaks; they are scrubbed before sending, so no emails, tokens, or Family File content leave with them
- GitHub — stores our nightly database backups, encrypted before upload
Children
Children do not get SupaBizzy accounts, and SupaBizzy is not directed at children. A parent adds a child as a family member and enters whatever details are useful — a school, an allergy, a shoe size — so a child's information is here only because an adult in the family chose to put it here, and it is visible only inside that family. Any of it can be edited or deleted by the family at any time, and deleting the family removes all of it, on the schedule described below.
Keeping and deleting
We keep your information for as long as your family uses SupaBizzy. You can delete individual items, members, or calendar connections yourself in the app at any time.
You can also erase everything yourself, without asking us:
- Delete my account & data (in Settings) removes your account and any family only you can sign into — every event, note, Family File item, and uploaded document, including the stored files themselves.
- Delete this family (organizers, in Family & members) erases the whole family for everyone in it, the same way.
Deletion takes effect immediately in the live service, and if your family has a subscription, deleting the family also cancels it with Stripe — deleted never means still-being-charged. Encrypted nightly backups are kept for 21 days for disaster recovery and then discarded, so deleted data is fully gone from backups within three weeks. Emailing hello@supabizzy.com works too — for deletion requests, waitlist removal, or anything the buttons don't cover.
Want a copy of what your family has in SupaBizzy? Email us and we’ll put an export together for you.
Changes
If this policy changes in a way that matters, we will update the date at the top and tell beta families by email.
Contact
Questions, corrections, or a deletion request: hello@supabizzy.com.