Plain-Language Privacy & Shared-Device Architecture

Families deserve clear, honest answers about what is private on a shared phone in the living room versus what requires server-side cryptographic enforcement.

1. Zero PII Collected on Our Public Website, Interactive Demo & Printable Generator

Our public website, interactive demo (/demo/), and standalone Printable Checklist Generator run entirely in your browser. We do not require an account, email address, payment method, or real child name to explore the demo, read guides, copy templates, or print A4/US Letter checklists. Emergency phone numbers and pediatric contacts on printables are rendered as blank write-in boxes so you can hand-write them on paper at home.

2. Shared-Device UI Isolation vs. Production Server Security

In our interactive Sunroom V3.4.1 product prototype (commit 3506e58 deployed at /demo/), fictional household state is stored locally in browser localStorage so visitors can test role transitions offline. Within the prototype interface:

• PIN-Gated Kid Mode: Handing a phone to a child locks navigation to Kid Mode (#/kid) and requires the 4-digit household PIN (2580 in the sample family) to return to adult routes, even across browser back buttons, URL hash edits, or page reloads.
• Surprise-Safe Wishlists: Children never see adult gift reservation statuses (Considering / Reserved / Bought), claimers, budgets, or Secret Surprise Ideas in Kid Mode, on the Kitchen Wallboard, or in child exports.
• Scoped Caregiver & Co-Parent Views: Switching to Caregiver Rosa or Co-Parent Marcus hides private adult mood/energy reflections and non-shared household members in the interface.

Important Architecture Distinction: Browser localStorage isolation is a UI demonstration for a trusted shared family device—it is not cryptographic multi-tenant security against someone inspecting browser developer tools on the same profile. Our production architecture specification enforces authenticated per-user sessions, PostgreSQL Row-Level Security (RLS), and atomic server-side gift claim transactions.

3. No Child Surveillance, Dark Patterns, or Clinical Overclaims

• No spyware, keystroke logging, or covert location tracking.
• No competitive sibling leaderboards, kid-facing subscription upsells, or punitive streak resets when a child is sick or visiting another home.
• Adult mood and energy check-ins are independently optional, private to the author in the UI, and keep household Support Signals OFF by default.