Privacy is part of the family.
This policy describes the public FireFam2011.com site and the private Personal Command Center at app.firefam2011.com. Last updated November 10, 2026.
The public homepage is informational. It does not contain family photo galleries or collect information through accounts or forms. The private Command Center is separate and requires authorization.
What information the private app accesses
If an authorized account owner chooses to connect Gmail, the Command Center requests only the Google Gmail read-only scope. It may retrieve message identifiers, sender, subject, preview, received time, unread status, and, when the owner explicitly requests AI prioritization, the email text needed to produce a summary. Email attachments are not retrieved for AI classification. It does not send, delete, or modify Gmail messages.
Automatic Gmail refresh
When the authorized account owner opens or refreshes the private dashboard, the service checks read-only metadata for up to 20 recent Gmail inbox messages. Automatic refreshes are throttled to at most once every 15 minutes per connected account. The owner can also sync manually. Opening or refreshing the page never submits email bodies to OpenAI: AI analysis only occurs when the owner explicitly requests it using the prioritization button.
How Gmail information is used
Gmail information is used solely to display a personal priority inbox and generate an importance label, a brief summary, and a recommended next action. On an AI prioritization request, message body text (up to 32,000 characters per message), sender, and subject are transmitted to OpenAI's API for this purpose. The app requests that OpenAI not store the response (store: false), but the API provider's data handling and abuse-monitoring retention policies may still apply. Gmail information is not used for advertising, resale, or training a general-purpose AI model by the application owner.
Optional Google Calendar connections
The private Command Center may connect separate personal or departmental Google Calendar accounts with read-only authorization. When authorized, the app reads visible calendar names and upcoming event titles, times, and locations for the personal agenda and countdown. This information stays in the protected database and is not sent to OpenAI. The account owner can revoke access in their Google Account. Department calendars are accessible only if the account explicitly grants access.
Optional BFPD Microsoft 365 calendar
If explicitly connected and permitted by the Microsoft 365 organization, the private Command Center requests delegated Microsoft Graph User.Read and Calendars.Read access, plus offline access to renew authorization. The system reads available calendars and upcoming event subjects, dates, times, and locations, stores them in the private database, and displays them to the authorized owner. It does not read Outlook mail, change events, or send Microsoft calendar content to OpenAI. Shared calendar visibility depends on the organization's permissions, and an administrator may need to approve access. The user or organization may revoke access in Microsoft 365.
Storage and security
Gmail message metadata, previews, and resulting AI classification data are stored in a protected Supabase database. Full Gmail message bodies are not intentionally persisted to that database. Google and Microsoft refresh tokens are encrypted at rest. The private app is accessible only to specifically authorized accounts, and access is enforced using authentication and database access controls. No system can promise absolute security.
Other information and future features
The private Command Center may also use calendars, work schedules, and other sources if those integrations are added and authorized later. Family photo galleries and smart-home features shown on the homepage are future plans, not currently available services. Any future collection or sharing functionality should be accompanied by an updated policy before launch. The public site does not intentionally use advertising cookies or analytics trackers.
Sharing and service providers
Information is processed only to provide the authorized functionality. Technical providers used for this site or the private dashboard can include Cloudflare (domain and DNS), Vercel (hosting), Supabase (private authentication and storage), Google (account authorization and Gmail), Microsoft (Microsoft 365 account and calendar authorization), and OpenAI (owner-initiated AI classification only). Access and processing are limited to their respective functions. Personal Gmail data is not made available to public website visitors.
Google API Limited Use
Use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. No Google user data is sold. Access to private Gmail content is restricted to the owner's authorized use of the service.
Control, revocation, and deletion
Users can revoke the app's Google permission at any time in their Google Account third-party connections. Revoking access prevents further authorized Gmail retrieval but does not automatically delete information already imported into the Command Center. To request deletion of stored messages and derived summaries, contact the app owner using the support contact shown on the Google OAuth consent screen. For existing stored information, the administrator can remove connected-account records and related data in the protected Supabase project.
Policy updates
This policy may change as the service grows. Changes will be posted on this page with a revised date before material new data practices are introduced. The private app also maintains a Gmail-specific privacy explanation.