Reminders
A notification the server couldn’t write
Every other feature here is between your devices. These two are not — a reminder needs somebody else’s clock, and an emailed invite needs somebody else’s inbox. Both are built to give away as little as the job allows, and both are described here in full.
- 1
Your device decides what to be woken for
Only your device can read the calendar, so only your device can work out what's coming. It builds the whole plan — the next occurrence of everything in the next 30 days — and rewrites it after every change.
- 2
The server keeps the clock, and nothing else
A web app has no reliable background timer on any platform, so "remind me at 8am" has to be somebody else's alarm. The server holds a list of times and opaque ids. It has no idea what any of them are for.
- 3
The push that arrives is empty
A wake-up carries no payload, ever. The server holds no key, so anything it could write would be plaintext sitting in Google's or Mozilla's push queue — exactly the content the rest of the system exists to withhold. The push means one thing: something is due, wake up.
- 4
Your device writes the notification
Woken, Family Manager decrypts locally and composes the real notification — the title, the time, who it's for. The only party that can read it is the one that shows it.
A task keeps saying so. An event doesn’t.
“Leave now for swimming” is a moment — repeating it twenty minutes later is nagging about the past. “Bins out” is outstanding until somebody does it, so a task reminder comes back (every 20 minutes by default, or hourly, daily, or off) until it’s ticked off. It only returns if you dismissed the last one: leave it on the lock screen and nothing more happens.
Act from the notification
A task’s reminder carries Done and Reschedule. Both open the app to do the work, because the bit of the browser that draws the buttons can’t read your calendar — and the link is spent on arrival, so a reload can’t tick the same task off twice.
What this costs you, stated plainly. The server learns when a device wants waking, and for which space. Not what for — the id is opaque and minted on your device. Timing is a real piece of metadata and it is the minimum price of reminders that actually arrive. Reminders and push are both optional: a server that has no push keys configured doesn’t offer them at all, and Family Manager then simply never asks.
Email invites
Sending an event to someone who doesn’t use the app
This is the one thing that leaves the encryption
A calendar invite is an email. The recipient’s mail client holds no key, so the invite is plaintext — and briefly at rest in the server’s outbox on its way out. That is the whole point of the feature and it cannot be engineered away: you are deliberately handing one event to somebody who doesn’t use Family Manager. Everything else about your calendar stays end-to-end encrypted; this is the exception, and it is off until you turn it on.
What it’s for: the grandparent who wants Sunday’s dancing in their own calendar, the coach who needs training times. They get a real invite that lands in Apple Calendar, Google Calendar or Outlook like any other — no app, no account, no link to click.
Three switches, all off by default
- 1
Off until the whole family turns it on
The switch lives on the family's shared record, not on one phone — so every member sees that it's on and who turned it on. Turning it on means confirming a dialog that says, in those words, that email is not encrypted. A device-local switch would let one person start broadcasting the family calendar with nobody else able to notice.
- 2
Off for every person without an address
Nothing is stored until somebody types an email address against a person. Someone with no address is simply never emailed — there is no default, no import, and no address book to sync.
- 3
Off unless the server relays mail at all
Mail is a server capability that ships switched off. A server with no relay configured doesn't expose the route, and Family Manager doesn't offer the feature. Self-host and it's your call entirely.
And once it is on
-
Edits replace, they don’t duplicate
An invite carries the event’s stable id and a version number, so changing the time updates the entry already sitting in the recipient’s calendar instead of adding a second one.
-
Dropping someone withdraws their copy
Take a person off an event and a cancellation goes to them — from their side, being removed and the event being deleted are the same fact. Turning the whole feature off cancels everything outstanding rather than going quiet.
-
Every entry says who it will reach
Under the people picker, in plain words: “Emailed to Nina and Bob. Labelled as Ivan’s.” Silence is indistinguishable from a broken relay, which is why it’s written down.
-
A failed invite tells you
Projection is best-effort, but best-effort and silent are different things — the only other person who could notice is the recipient, who has no idea anything was meant to arrive.
-
Sending is signed and capped
Only a family’s owners can send, proved cryptographically to the server, and the signature commits to those exact recipients and that exact invite. There’s a per-family daily cap and a recipient limit, so the relay can’t be turned into somebody else’s spam problem.
-
Private events stay private
A private entry is encrypted to the people it’s for, and it emails exactly those people — the mail reaches no further than the encryption does.
Start using Family Manager
No sign-up, no email, no password. Open it and go — your data is encrypted before it leaves your device.