SRI Home Privacy Policy

This Privacy Statement (“Privacy Statement”) describes how Skin Research Institute LLC, doing business as SRI Home (“SRI Home”, “we”, “us” and “our”) collects, uses, stores, shares and discloses your personal data when you use our family calendar device and companion mobile application (the “Orca Calendar” app), Websites, and other products and services that link to this Privacy Statement (collectively referred to here as the “Services”). Our primary product is a wall-mounted Android touchscreen family calendar and companion mobile app, Orca Calendar (iOS/Android). Users create family accounts through which family members share a calendar, chores and rewards tracking, and meal planning features.

This statement also provides required disclosures under applicable law (see Additional Legal Disclosures section below) and serves as our Notice at Collection under the California Privacy Rights Act. This single policy governs all platforms through which our Services are accessed, including our website, Google Play Store listing, and Apple App Store listing.

Google API Services – Limited Use Disclosure

SRI Home’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

We access Google Calendar data solely to display your calendar events on your SRI Home device and in the Orca Calendar app.
We request only the minimum necessary scopes: openid and email (to identify the Google account you connect) and calendar.readonly (to read your events). We never modify or write back to your Google Calendar.
We do not use Google user data to serve advertisements, for unauthorized data transfers, or for any purpose other than providing the SRI Home Services you have requested.
We do not sell, share, or transfer Google user data to third parties except as necessary to provide the Services and as described in this Privacy Statement.

Microsoft Graph – Calendar Access Disclosure

When you connect a Microsoft Outlook calendar, we access it through the Microsoft Graph API.

Specifically:

We access Outlook calendar data solely to display your calendar events on your SRI Home device and in the Orca Calendar app.
We request only the User.Read, Calendars.Read, MailboxSettings.Read and offline_access permissions. Our access is read-only; we never write to your Outlook calendar.
We store your Microsoft account ID and email address, and the title, date and time, all-day status and colour of events from the calendars you choose. We read Outlook category names and colours on each sync but do not store them.
We do not use Microsoft user data to serve advertisements or for any purpose other than providing the SRI Home Services you have requested, and we do not sell it.
You can remove our access at any time at account.microsoft.com/privacy/app-access (personal accounts) or myapps.microsoft.com (work or school accounts). Disconnecting in the app deletes what we stored but does not revoke the permission at Microsoft.

Data We Collect and How We Use It

SRI Home collects personal data from you and about you depending on how you interact with our Services. The categories of data we collect are described below.

I. Account Data

When you register for a family account, you provide us with your name, email address, password (authenticated via Supabase), billing information, and contact information for family members you invite. Family membership links individual user profiles to a shared family group.

We use this data to:

Provide you with the Services and monitor what Services you have purchased.
Contact you for administrative purposes such as customer support.
Reply to inquiries via customer support requests.
Send communications, including updates on promotions and events relating to products and services offered by us, if you have provided your consent and not withdrawn it.

II. Connected Calendar Data

You may connect external calendars to Orca Calendar to display events on your SRI Home device and in the app. We support Google Calendar, Microsoft Outlook, calendars stored on your iPhone, and calendar subscription links (ICS/webcal, such as an iCloud link).

When you connect a calendar:

Google Calendar. We request the openid, email and calendar.readonly scopes. We store your Google account ID and email address, and the title, date and time, and colour of events from your calendars. Google sends us additional event details (such as location, attendees and description) during a sync; we do not keep them.
Microsoft Outlook. We request the User.Read, Calendars.Read, MailboxSettings.Read and offline_access permissions through Microsoft Graph. We store your Microsoft account ID and email address, and, for the calendars you choose, each event’s title, start and end date and time, whether it is an all-day event, and a colour. Repeating events are stored as individual occurrences. At each sync we read your Outlook category names and colours to work out an event’s colour, but we do not store them; only the resulting colour is saved. We do not request or store event location, attendees, notes or description, organizer, online-meeting links, privacy flag, or free/busy status.
iPhone calendars. The calendars you select are read on your phone. Only the title, date and time, and calendar colour are uploaded; location, notes and attendees stay on your phone.
Calendar subscription links. We store the link and the title and date and time of the events it contains. The link’s host (for example, Apple iCloud) receives our requests to fetch it.

How we handle imported calendar data:

We sync approximately every 5 minutes (calendar subscription links every 15 minutes) and when you use the app.
Imported events are added to your family’s shared calendar and are visible to every member of your family group and on your SRI Home wall display. They are not visible to other families. Database-level row isolation prevents other users from accessing your calendar data.
Our access to Google and Microsoft calendars is strictly read-only. We never modify, create, or write back to your external calendar.
Imported events are kept until you disconnect the calendar or delete your account. Events that fall outside the current sync window are not automatically removed.
Google and Microsoft refresh tokens, which keep your calendar connected, are stored securely on our servers and are not accessible to the app.
You may disconnect a calendar at any time in the app. Disconnecting deletes the stored sign-in and every event we imported from that account.
Disconnecting does not revoke the access you granted at Microsoft or Google. To remove it, visit account.microsoft.com/privacy/app-access (Microsoft personal accounts), myapps.microsoft.com (Microsoft work or school accounts), or myaccount.google.com/permissions (Google).

(Note: the in-app disconnect flow will be available prior to public launch.)

III. Family Content

User-created content within the Services includes: family calendar events, family member profiles (first names, avatar colors, points), chore and reward assignments, and meal plans. Family profiles may include profiles representing children, which are created and managed entirely by parents or guardians – see the Children’s Privacy section below. All family content is visible only within your own family group. If a family member turns on the voice assistant, some family content is sent to our voice vendors, as described under “VI. Voice Assistant (Beta)” below.

IV. Meal Planning Data

When you use the meal planning feature, the dietary preferences, allergens and ingredient lists you provide are transmitted to Google Gemini, a third-party AI service, to generate meal plan suggestions. This data is not used for advertising. Our Gemini access is on a paid tier, under which Google does not use the content to train its models; Google may keep it for a limited period (about 55 days) for abuse monitoring. Please refer to Google’s privacy documentation for information on how Gemini processes data.

V. Device and Usage Data

Whenever you use our Services, we collect data and information made available on your device, such as your device Internet Protocol (“IP”) address, device name, operating system version, the configuration of our mobile app when utilizing our Services, the time and date of your use of the Service, and other statistics.

We use this data to:

Understand and analyze usage trends and preferences of our users.
Improve the Service, and to develop new products, services, features, and functionality.
Investigate and take action with respect to any illegal activity such as unauthorized access or fraud.

VI. Voice Assistant (Beta)

The voice assistant is an optional beta feature available in the Orca Calendar phone app only. It is off by default. Each person turns it on for themselves, on each device, after accepting a consent screen that names the vendors below. A family administrator cannot turn it off for other members, and there is no age check; children do not have a login of their own, so a child using a phone on which voice is turned on could speak to the assistant.

When you hold the talk button:

Speech to text (Deepgram). Your speech is sent from your phone directly to Deepgram, together with the first names or nicknames of up to 50 family members (including children) to help it recognize them.
Understanding your request (Google Gemini). The text is sent through our server to Google Gemini, along with your family’s time zone, your last few exchanges, and family context: first names of all family members (including children), points, upcoming events (title, time and who), tasks, and meals. If you ask about a date range, event notes are included; private events are excluded. If you ask for meal planning, your family’s allergens and dietary needs are included.
Spoken reply (Cartesia). The text of the answer is sent from your phone directly to Cartesia, which turns it into speech. This text may include names and event details.

We do not store your audio, and it does not pass through our servers. We do not create voiceprints or ask our vendors to identify who is speaking. We do not use voice data for advertising. You cannot exclude a child’s name from the information sent to these vendors while voice is on.

How our vendors handle this data:

Deepgram: Every request tells Deepgram not to retain or train on the audio. Deepgram keeps it only as long as needed to process it.
Google Gemini: We send each voice request with storage turned off. Our access is on a paid tier under which Google does not use the content to train its models, and Google may keep it for about 55 days for abuse monitoring.
Cartesia: We have turned off the use of our content for training in Cartesia’s privacy settings. Cartesia’s own retention practices apply; see Cartesia’s privacy policy.

Voice data we keep:

Your last 5 questions and answers, for diagnostics. These stay on your device only and are cleared when you turn voice off, tap Clear, or sign out.
Usage counts (such as sessions, seconds of audio and number of requests) for each user and family. We remove your counts when you delete your account.
If you tap “Report a response,” the report: your reason, what the assistant heard (up to 1,000 characters), what it said (up to 2,000 characters), the app version, and your family. These can include names. Reports are visible to other members of your family, stay with the family if you leave it, and are deleted when the family is deleted.

VII. Photos and Profile Pictures

Photos your family picks for the wall screensaver, and profile pictures, are stored in private cloud storage with Supabase, along with an optional caption, who uploaded the photo, and its album. Photos are viewed through links that expire after 7 days and are readable only by members of your family.

Photos may contain embedded metadata, including the location where they were taken. Photos you upload, especially small JPEG files from an iPhone, may keep their location data. We do not currently promise that location data is removed.
You can delete a photo from the phone app or the wall display. When you delete your account, photos you uploaded are removed; if you are the last member of your family, the whole family’s photo folder is removed.
If a child profile is deleted, that profile’s picture stays in storage until the whole family is deleted.

VIII. Crash Reports and Device Diagnostics

We do not use third-party crash-reporting or analytics tools in the Orca Calendar app or on the wall display. Diagnostic data goes only to our own database, with no automatic expiry:

App crash reports: error name and message, code stack trace, app and Android version, time, your family, and the wall display’s device ID (wall display only). These do not include a user ID. They are deleted when the family is deleted, but not when one member leaves it.
Wall display process reports: when the wall display’s background process exits or crashes, we record the exit reason, memory figures, stack trace and device build. These are tied to the device, not your family, and are not removed when a family is deleted.
Wall display health check: software versions, time last seen, time zone, permissions granted, and time of last interaction. Each check replaces the previous one. The device record may remain after a family is deleted, with its link to the family removed.

What We Do Not Do

To be clear about our data practices:

We do not sell your personal data to any third party.
We do not use your data for advertising, and we do not serve ads within the Services.
We do not store voice recordings, and we do not create voiceprints or identify who is speaking.
We do not share your calendar data or family content with any party other than the named service processors listed below.
Calendar and family data are visible only within your own family group, enforced at the database level.

Protection of Your Photographs, Videos, and Content

We protect your photo, video, and personal content with industry-standard security measures, including:

Photo and video content you provide is stored on servers with our secure cloud hosting provider.
Photos and videos are sent to your SRI Home device using an encrypted protocol and are not accessible to any other party.
We will never share your content unless you give us clear instructions through the Services to do so, such as when you select family members or others to receive content on their frames.

Service Processors

To provide the Services, we engage the following third-party processors who may receive or handle your personal data on our behalf. Each is bound by contractual obligations to use your data only to fulfill our service requirements:

Supabase – infrastructure, database hosting, file storage, and authentication. Account data, calendar sign-in tokens, imported events, photos and diagnostic records are stored within Supabase’s infrastructure.
Google – Calendar API (for calendar sync, using the openid, email and calendar.readonly scopes) and Gemini AI (for meal plan generation and the voice assistant).
Microsoft – Entra ID and the Microsoft Graph API for Outlook calendar sync.
Deepgram – speech-to-text for the voice assistant (audio and family first names).
Cartesia – text-to-speech for the voice assistant (the text of the spoken reply).
Apple – calendars on your iPhone are read on your device and are not sent to Apple by us. If you add an iCloud calendar link, we fetch it from Apple’s servers.

We do not share your data with any other third parties except as described in the “When We Disclose Data” section below.

Third-Party Services

If you choose to use or link our Services with third-party services — such as syncing your Google, Microsoft Outlook or Apple calendars or a calendar subscription link, turning on the voice assistant, or using an Amazon Fire device with our SRI Home Digital app — we will use information we collect to authenticate you, provide the Services you request, and transmit data to and from the third-party service based on your selections.

Third parties whose services you use in connection with ours, or third parties whose websites we link to from our Websites, will have data practices that differ from ours. This SRI Home Privacy Statement does not apply to the activities of third parties when they are collecting or using data from you for their own purposes. We encourage you to review their privacy policies to understand how they use your information.

Cookies and Analytics Information

We may use various technical mechanisms such as cookies, web beacons, and similar tracking technologies to monitor how users use our Website and mobile apps in order to better understand customer behavior and improve our Services. Cookies are files with a small amount of data commonly used as anonymous unique identifiers. These are sent to your browser from the websites that you visit and are stored on your device’s internal memory.

You can delete and disable all cookies through settings in your Internet browser; however, if you choose to do so, some components of our Services may not work properly if cookies necessary for operation are blocked.

When We Disclose Data

Except as described in this Privacy Statement, we will not disclose Personal Data that we collect on the Services to third parties without your consent. We never sell your Personal Data to any third party and we do not use your data for digital advertising. We may disclose information to third parties in the following circumstances:

I. Third-Party Vendors

We use vendor companies (as listed in the Service Processors section above) to help us provide our Services. We enter into written agreements with these vendors requiring them to retain, share, store, or use Personal Data solely to fulfill your order and otherwise help us provide the Services to you.

II. Third-Party Services

As noted above, if you choose to link our Services with a third party service such as your online calendar, we will provide information to that third party based on your settings in our Services in order to interoperate with the third-party service.

III. Legal Reasons

When required by law or necessary to avoid harm. We may share your information if we are required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, to protect our property, to prevent fraud, or in response to a court order, judicial or other government subpoena, or to otherwise cooperate with law enforcement or other governmental agencies. We may also share your information if we believe it is necessary to protect you or others from harm, such as fraud or abuse, or as needed to establish our legal rights.

IV. Corporate Events

If SRI Home (or our assets related to our business) is acquired by another company, whether by merger, acquisition, or otherwise, that company will receive all information gathered by SRI Home on the Websites and Service. In this event, you will be notified via email and/or a prominent notice on our Website of any change in ownership, uses of your Personal Data, and choices you may have regarding your Personal Data.

Security

We value your trust in providing us your Personal Data. We implement appropriate physical, technical, and organizational security measures to protect Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of use, in accordance with industry standards. Despite our efforts, no method of transmission over the internet or method of electronic storage is 100% secure and reliable, and we cannot guarantee absolute security. It is important that you also take steps to protect your information, such as keeping your passwords secure. We do our very best to ensure that our personnel and trusted hosting and other service providers who need the information to perform a specific job are granted access to Personal Data only on a need-to-know basis and are subject to stringent confidentiality requirements.

Children’s Privacy

Our Services are designed for use by adults and families, and our target audience does not include children as independent users. Children do not create accounts and do not log in. Family profiles representing children are created and managed entirely by a parent or guardian within the parent’s account. We do not collect personal data directly from children through account registration.

Child profiles within a family account may include a first name and avatar, entered by the parent or guardian. This information is visible only within that family’s private group. If any family member turns on the voice assistant, the first names of all family members, including children, are sent to our voice vendors (Deepgram and Google Gemini) as described in “VI. Voice Assistant (Beta),” and there is currently no way to leave a child’s name out. The voice assistant has no age check, so if a child speaks to it on a phone where voice is turned on, their speech is processed in the same way as anyone else’s.

We do not knowingly collect personal information directly from children under the age of 13. If we introduce a parent-authorized teen account tier in the future, this policy will be updated to reflect the applicable data practices and consent requirements at that time. If you are a parent or guardian and believe your child has independently provided us with personal information, please contact us at support@srihome.com so we can take the necessary action.

Account Management and Deletion

You may update, correct, or delete your Personal Data and preferences at any time by contacting us at support@srihome.com. In-app account deletion is available within the Settings section of the app and deletes your account and the personal data linked to it, including your calendar connections and imported events, your voice usage counts, and photos you uploaded.

You may disconnect any connected calendar integration at any time through the app’s calendar settings. Upon disconnection, the stored sign-in and the events we imported from that account will be deleted. Disconnecting does not revoke the access you granted at Microsoft or Google; you can remove it in your Microsoft or Google account (see “II. Connected Calendar Data”).

Some information is shared with, or tied to, your family rather than to you alone, and is not removed when you delete your account or leave a family that still has other members. This includes voice response reports, crash reports, calendar subscription links, and a deleted child profile’s picture. These are deleted when the family itself is deleted, except for wall display process reports and device records, which are not linked to your family and may remain after the family is deleted. Please note that while changes are reflected in active databases promptly, we may retain certain information as required to satisfy legal obligations, keep it in routine backups for a limited time, or where we otherwise have a legitimate reason to do so.

Additional Information for California Residents

I. Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (“CCPA”) allows you to make certain requests about your personal information. Specifically, the CCPA allows you to request us to:

Inform you about the categories of personal information we collect or disclose about you; the categories of sources of such information; the business or commercial purpose for collecting your personal information; and the categories of third parties with whom we share/disclose personal information.
Provide access to and/or a copy of certain personal information we hold about you.
Delete certain personal information we have about you.
Provide you with information about the financial incentives that we offer to you, if any.

The CCPA further provides you with the right not to be discriminated against (as provided for in applicable law) for exercising your rights under the statute. Certain information may be exempt from such requests under California law. We will take reasonable steps to verify your identity before responding to a request for security purposes. If you would like to exercise any of these rights, or if you are an authorized agent making a request on a California consumer’s behalf, please contact us at support@srihome.com.

The CCPA provides certain rights if a company “sells” personal information as that term is defined under the CCPA. We do not engage in activities that would be considered “sales” of your personal information under the CCPA.

II. Shine the Light Disclosure

The California “Shine the Light” law gives residents of California the right under certain circumstances to request information regarding the manner in which we share certain categories of personal information with third parties for their direct marketing purposes. We do not share your personal information with third parties for their own direct marketing purposes without your affirmative consent.

III. Browser “Do Not Track” Signals

Some web browsers may transmit “do-not-track” signals to a website. Because there currently is no industry standard concerning what a service should do when they receive such signals, we currently do not take action in response to these signals.

Changes to This Privacy Statement

We may update this Privacy Statement from time to time. If we do, we will post any changes on this page. These changes are effective immediately upon posting. If you continue to use our Websites and Services after those changes are in effect, you agree to the new statement. If the changes are significant, we may provide more prominent notice or seek your consent, as required by law.

App Store and Play Store Compliance

This Privacy Statement is the single authoritative source governing data practices for all versions of the SRI Home Services, including the Orca Calendar iOS app (Apple App Store), the Orca Calendar Android app (Google Play Store), and our website. Apple App Privacy labels and Google Play Data Safety form disclosures are derived from this policy and reflect the same data types, processors (including Google Gemini, Microsoft, Deepgram and Cartesia), and purposes described herein. On Google Play, our target audience is general audiences; our app is not directed at children as independent users, as all child-related profiles are parent managed.

Contact Us

If you have any questions or suggestions about our Privacy Statement, do not hesitate to contact us at support@srihome.com or write to us at:

Skin Research Institute LLC
122 Sheldon Street
El Segundo, California 90245, USA