The rules of the house.
Written in plain words, kept in plain sight. The legal versions live below — these are the ones we actually live by.
One home per family
Your home is sealed to your household. No other family, feed, or algorithm ever sets foot in it.
No ads, no tracking, no selling
You pay for Caju; that’s the whole business. There is no analytics script anywhere — not even on this page; view the source. No pixels, no ad SDKs, no data partner waiting downstream. Nothing about your family is mined, profiled, or sold, because nobody is paying us for it. You are.
Who can actually see your home
Your household — and, honestly, us. Caju is not end-to-end encrypted; the people who run it could technically read the database, and anyone who tells you otherwise about an app like this is not being straight with you. So you should know exactly who that is: one family in London, the same one whose own calendar, money and health live in here. No employees, no analytics team, nobody paid to look.
Nothing moves without your yes
Anything that touches real money happens inside limits you set first — hard caps, switched on by you — and keeps a clear record of who said yes and when. An agent can never wave through anything big on its own; the server refuses it.
Every number is fresh — or says so
A figure is either up to date or it tells you it isn’t. Nothing quietly goes stale and pretends to be current.
If something goes wrong, you hear it from us first
If your data is ever exposed, you get told plainly and fast — what happened, what was touched, what we did about it. Not a lawyered paragraph months later. And if you find a hole before we do, security.txt on this site says exactly where to write; a human answers, and we fix it.
If the deal changes, we tell you first
Any change to these promises, the price, or the list of companies that touch your data is announced to every home before it takes effect — in plain words. Nothing is ever slipped into a policy page hoping you won’t look.
Your data leaves with you
One button, in Settings: everything your household has put in, as one plain JSON file — open, complete, machine-readable — any time, no questions. Leaving is a feature, not a fight.
If we ever close the doors
You get real notice, and everything handed over before anything is switched off — the same export, plus your original files by hand. No family’s home vanishes overnight.
How it’s kept — the plain facts
Adjectives are cheap. These are the mechanisms.
Google or a passkey — there is no Caju password to steal.
Invite-only, and it fails closed: an unknown email is simply turned away, whatever it signs in with.
Real database records, listed device by device — revoke any one of them, any time.
Encrypted, everywhere. Plain HTTP is redirected before it carries anything — and browsers are told never to try it again.
Stored with a host certified SOC 2 Type II; the most sensitive stored credentials are encrypted again by the app itself.
One database, in Amsterdam — the EU, the same region the app runs in. The handful of US processors are named below.
Functional only — a sign-in session and a couple of UI preferences. No banner, because there is nothing to consent to.
None. Zero scripts, zero pixels, including on this page — view the source.
One download in Settings — the whole home as plain JSON, whenever you like.
Email us and we delete it. Deletion is by hand today — which means a person actually does it, and confirms when it’s done.
Every company that touches your data
No hidden middlemen — here they are. Railway hosts the database. Google signs you in and, if you connect it, holds your calendar. Apple delivers the notifications. Cloudflare carries emailed bookings in and keeps the nightly backup copies. When you hand Caju a messy PDF — a payslip, a diet plan — Claude, by Anthropic, reads it once to pull out the figures; Anthropic’s commercial terms say what the API reads is never used to train their models. Your scale, the trains, the weather and the bakery each see only the little they need to answer you. The full list — every name, and exactly what each one sees — lives in the privacy policy. If it ever grows, this page changes before the code does.
If any of these promises ever looks broken to you — technically or otherwise — write to lucas@yac.tech. A human answers, usually the one who wrote the code. The only member of the household who has never worried about any of this is the cocker spaniel; for everyone else, there’s this page.
The legal versions: Privacy policy · Terms of service
Welcome home.
Caju is a private household app — a family’s calendar, tasks and trips, health, and money, gathered into one calm place. One home per family, invite-only; your data is never sold or shared.
Built by one family, for one household. · caju.casa