Security
Your family’s information belongs in your family’s plan. Here is how access is limited and where to report a concern.
Who can see your information?
Active adults in your household share the family plan. Private work details stay private; your partner sees the times you are busy. A helper’s private request link shows that specific task, not your whole family week.
Worried that someone has access they should not have? Check the reporting options below. Describe what happened, without passwords or private request links.
Read the Privacy NoticeImplemented controls
Private operations verify an active account and household authority on the server. Database row-level security and explicit grants restrict direct access. Recent authentication protects sensitive actions; enrolled multi-factor authentication is checked. Calendar credentials use authenticated encryption with server-managed keys. Provider webhooks are signature-checked and duplicate events are handled idempotently.
These controls are supported by automated checks. No independent security audit, certification, penetration-test result or guarantee of freedom from vulnerabilities is claimed.
Report a vulnerability
The receiving security contact is awaiting verification and is not available yet. This is a release blocker. Signed-in adults can submit and track a privacy request.
Scope: WeekBuffer-owned application endpoints on weekbuffer.com. Test only accounts and data you control. Do not access another household, interrupt service, send bulk traffic, exploit third-party providers or publish sensitive records. Stop if personal data is exposed.
Provide the affected URL, minimal reproduction steps and impact without passwords, tokens, family schedules or identity documents. Contact availability is shown above. We will review received reports and coordinate remediation; no guaranteed response time, bounty or legal safe-harbor promise is made here.