Last updated 19 October 2026 · Terms of Service

NJN Dev (njndev.xyz and its subdomains - finance, calendar, time, wordle, herdle, connections, lift, invites, poker) is a personal, invite-only web app built and operated by Noah Nelson for a small group of family and friends. It is not a commercial product, it has no advertising and no third-party analytics or tracking service, and accounts are created individually by the operator - nobody signs up without already knowing them personally.

What data is collected

What's collected depends entirely on which parts of the app an account actually uses:

• Account: name, email address, and a securely hashed password (never stored in plain text).
• Finance: bank transaction data, either uploaded as a CSV statement or fetched automatically from a linked bank account the user has explicitly connected, plus whatever budgets, assets, liabilities, bills, and investment records that user enters.
• Calendar: events, to-dos, and attached files entered into the shared household calendar.
• Lift: workout, exercise, and body-measurement data entered by that user, and - only if the user connects it - activity data synced from their own Garmin account.
• Timesheet, Wordle, Herdle, Connections, Invites, Poker: whatever that feature is for (logged hours, game guesses and chat messages, guest RSVPs, poker chip counts and betting actions) and nothing beyond it.

Google Calendar data

If an account chooses to connect Google Calendar (Account → Calendar Sync), the app requests permission to read and write events on that person's own Google Calendar, solely to keep it in sync with their events on this app's shared calendar. Specifically:

• Event data (title, description, time, location, attendees) is copied in both directions between this app and that person's Google Calendar - nothing else on the Google account is accessed.
• This data is never sold, shared with third parties, or used for advertising, profiling, or any purpose other than the calendar sync feature itself.
• Access and refresh tokens are stored encrypted at rest and are only ever used by this app's own server to talk to the Google Calendar API on that user's behalf.
• Disconnecting Google Calendar (Account → Calendar Sync → Disconnect) immediately deletes the stored tokens; Google Calendar events already synced are not retroactively removed from either calendar.

This app's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How data is stored and protected

• All traffic is served over HTTPS.
• Sensitive fields - bank account credentials, Garmin credentials, Google/TimeTree OAuth tokens - are encrypted at rest, not stored in plain text.
• Every account's data is scoped to that account; other users (aside from explicitly shared features like the household calendar, bills split between named people, or friend-visible game results) cannot see it.
• Data is never sold or shared with advertisers, data brokers, or any other third party beyond the services listed below, and only for the features that need them. It is used solely to run the app for the people using it.

Third-party services this app talks to

Only when the relevant feature is actually used, and only for that feature's own purpose:

• Google Calendar API and TimeTree - calendar sync, described above.
• Garmin Connect - workout sync, only if a Lift account explicitly connects it.
• Each connected bank's own website - automatic transaction fetching, only for accounts that set up a bank connection, using credentials the user themself provides.
• The New York Times' public Wordle/Connections puzzle data - read-only, no personal data sent.
• Google Gemini API - only for an account that uses the Morning Briefing on the Wealth Manager, each time one is written (when the user asks for one, or each morning if they turn on the daily briefing). It receives that account's aggregated spending figures (category totals, budgets, largest purchases and recurring billers, with merchant names) to write the summary. No account numbers, balances or login details are sent, and the API is used on a paid plan, under which Google does not use the data to improve its products. Stored briefings are kept for 60 days; turning the daily briefing off stops new ones being written.

The app keeps a simple internal log of the pages each signed-in account opens: the page, the time, and whether the device was a phone, tablet or computer. It does not store IP addresses, browser strings or referrers, and it is deleted with the account. It is only visible to the operator, to see what is used. No third-party analytics, advertising, or tracking service is used anywhere in this app.

Data retention and deletion

Data is kept for as long as an account exists. To delete your account and all associated data, or to disconnect any third-party service, contact the operator using the details below.

Children's privacy

This app is not directed at children and is not intended for use by anyone under 13.

Changes to this policy

If what this app collects or how it's used changes meaningfully, this page will be updated and the "Last updated" date above will change.