Privacy Posture

Network metadata (every connection your family makes)

To detect when an app breaks (the core product), we observe each connection's:

• Source device IP (on your own LAN — never your public IP outside the household)
• Destination domain (SNI hostname, e.g. roblox.com)
• Destination IP
• Timestamp + connection outcome (success, server disconnect, timeout)
• Approximate latency (for anomaly detection)

Retention: 30 days, then automatically deleted from your isolated pod's database. You can configure to 7 days minimum if preferred.

Decrypted application traffic (HTTPS payload) — IF and ONLY IF mitm is enabled

This is the most powerful and most sensitive capability. By default, Family Edition runs in cert-pinning-aware passthrough mode: we see only metadata above + the SNI domain. To enable full payload inspection (required for in-app content monitoring of, e.g., chat messages), you must:

• Explicitly toggle "payload inspection" per-device in your dashboard
• Install our root CA on the specific device — we never silently install certificates
• Acknowledge a per-device consent screen that documents what gets inspected

When enabled, payload data is processed in-memory in your isolated pod for anomaly detection, then discarded unless you've opted in to longer retention (max 7 days for payload by policy).

Account information

Email, family name, family size, plan tier, billing info (via Stripe — we never store card numbers). That's it.

The product moat is a shared technical fingerprint library of broken apps. When your family's Roblox breaks because Akamai changed their TCP fingerprinting, our AI diagnoses it and writes a pattern like:

{
  "name": "akamai-tcp-fingerprint-roblox",
  "trigger_signal": "server disconnect within 50ms of upstream open",
  "trigger_dest_range": "128.116.0.0/16,136.22.0.0/16",
  "fix_action": "verify nft accept rules BEFORE MITM-VLAN4-CATCHALL-443"
}

That pattern ships to every other Family Edition customer so their Roblox keeps working. What is NOT in the pattern: your family's IP, your kids' Roblox usernames, your chat messages, your photos, who you are. The shared library is pure technical fingerprint — IPv4 prefix + protocol behavior + fix instruction. No PII.

You can read the full library at :8810/api/bypass-library (homelab-local for now; pip package hart-bypass in planning).

Every time our AI auto-diagnoses or auto-fixes something for your household, we write an audit entry to kb:family-cu-decision:<timestamp> containing:

• What was observed (anomaly trigger + raw signal)
• Which pattern matched in the bypass library
• Confidence score
• What action was taken (no-op / domain added to bypass / nft rule verified)
• Phantom verification result
• LLM model used (default: claude-opus-4-7)

You can read this log via your dashboard, export it as JSON, or receive a weekly email digest. We retain audit logs for 30 days by default; you can extend to 1 year or shorten to 7 days. This is the same LangSmith-style observability that enterprise customers demand of their AI vendors — applied to your household.

We commit to:

• Notify all affected customers within 72 hours of confirmed unauthorized access
• Notify state AGs within applicable statutory windows
• Publish a public post-mortem within 14 days (anonymized customer impact)
• Pay for credit monitoring if any payment info was compromised (we don't store cards, but if Stripe is breached we'd contribute)

Per-customer K3s isolation means a breach of one customer's pod does NOT cascade to other customers. This is the architectural defense the SaaS industry doesn't usually offer at consumer price points.