Our security model
Simpli-FI Family is operated by Simpli-FI OS LLC. Version 1.0 is designed for private, adults-only households, not public profiles or open discovery. We treat household identity, task, timer, and reward information as confidential.
Security is a continuing process, not a guarantee. No method of storage or transmission is completely secure. This page describes safeguards the Service is designed to use; it does not promise immunity from every failure or attack and does not claim that household content is end-to-end encrypted.
Identity and household access
- Each household adult authenticates with a distinct Sign in with Apple identity and confirms they are 18 or older.
- An expressly authorized synthetic App Review account is fenced from creating, claiming, approving, or joining a real household and contains no real household data.
- One primary adult may invite exactly one second adult through a short-lived, single-use invitation. Version 1.0 does not offer accounts, profiles, or invitations for anyone under 18.
- Possessing a link never grants membership. The invited adult must authenticate and request to join; both adults compare the same short code; and the primary adult approves the exact pending request before activation.
- Authenticated role and household checks are designed to restrict records to the relevant household and permitted member.
- The primary adult can remove the second adult, the second adult can leave, and account deletion is available in the app.
- Public household creation requires an adult Sign in with Apple session, app-integrity validation, coarse age and legal attestations, replay controls, and server-authoritative membership creation.
- Release and development identifiers and backends are separate so test data is not intentionally mixed with release household data.
Server-authoritative commands and timers
Assignment transitions, timer changes, completion review, and reward posting are designed to go through authorized server commands rather than unrestricted client writes. Commands include unique request identifiers so safe retries can be recognized, and the service checks permitted role, household, revision, and state transitions.
Timer displays derive from stored authoritative timestamps rather than trusting a device to synchronize every second. This reduces device-clock dependence but does not make a timer safety-critical, payroll-grade, or guaranteed to update instantly. Offline actions may wait locally and reconcile when connectivity returns.
Data minimization
- Notification previews are designed not to include task titles, private notes, names, or reward details.
- Operational logs and diagnostics must not include task text, real names, rewards, or household details.
- The first release does not request location, bank credentials, payment-card data, net-worth data, connected-email content, contacts, photos, retained microphone recordings, HealthKit or fitness data, clinical records, biometrics, or medical measurements.
- Private cached household state and queued Watch commands use device-local protection and are cleared when account or household binding changes.
- Public Family pages contain no advertising, product analytics, or third-party font scripts.
Devices, Watch, and invitations
The 1.0 Apple Watch experience uses the paired iPhone for initial authentication and authoritative synchronization. Watch and phone commands are scoped to the signed-in account and current household binding. Signing out, deleting an account, or switching accounts is designed to clear private task state and end active app surfaces on that device.
Invitation links contain an expiring token that can start only a pending request. The invited adult receives no household member list, task, reward, note, or history before approval. When the installed app does not open directly, the fallback page removes the token from browser history before displaying invitation state and does not place it in browser storage, analytics, console output, or an onward link. Recipients should still treat every invitation as confidential.
Providers, encryption, and app integrity
We use established providers, including Apple, Firebase, Google Cloud, and Vercel, for operating-system services, authentication support, database and function hosting, notification routing, and public-page delivery. Production admission requires app-integrity checks to be configured and verified. Network connections to those services use encrypted transport where supported and required by the platform and provider.
Provider access is limited according to operational need and applicable service controls. We review production dependencies, privacy manifests, entitlements, and release configuration before submission. Provider safeguards reduce risk but do not eliminate it.
Your part in household security
- Use a protected Apple Account and device passcode, and keep supported operating-system updates installed.
- Share invitations only with the intended second adult and never post an invitation, comparison code, or access code publicly.
- Revoke a lost, sold, repaired, or shared device promptly.
- Do not put passwords, access codes, government identifiers, bank credentials, medical records, or unnecessary sensitive information in tasks or support messages.
- Contact us promptly if a household member, role, assignment, or device appears unfamiliar.
Report a suspected vulnerability
Email ready@simpli-fi-os.com with the subject “Simpli-FI Family security report.” Include the affected surface, a concise reproduction description, the potential impact, and a safe way to contact you. Do not include credentials, invitation tokens, private Household Content, or another person’s data.
To protect users while investigating:
- use only accounts and synthetic data you are authorized to test;
- do not access, change, retain, or disclose another person’s information;
- do not perform denial-of-service, spam, social engineering, physical intrusion, or destructive testing;
- stop testing when you encounter private data or could affect service availability; and
- allow a reasonable period for investigation and remediation before public disclosure.
We do not currently offer a bug bounty or promise payment. We will make a good-faith effort to acknowledge a credible report and keep the reporter informed when practical. These guidelines do not authorize access that would otherwise be unlawful or waive any rights or remedies.
Incident response and questions
We assess credible reports, limit exposure, preserve appropriate evidence, remediate the issue, and notify affected people or authorities when required by law. The timing and detail of communications depend on the nature of the incident, safety, legal obligations, and the need not to create additional risk.
For a privacy-rights or deletion request, use the process in the Privacy Policy. For account or product help, visit Support.
Simpli-FI OS LLC
Denton County, Texas, United States