Our planner. Your privacy.

Oaks On Board is a private, self-hosted cruise planner for the Oaks family group. Approved members use it to organize their families, plans, checklists, packing and trip details.

Signing in with Google

When Google sign-in is enabled, the app requests only basic identity information: your Google account's email address and stable account identifier. It verifies your identity and matches your email to an enabled account that a trip administrator or family head has already added. Google sign-in does not create an account or change your family or role.

The app stores the Google account identifier and email linked to your planner account. Basic sign-in requests no Gmail, Calendar or Drive access. Its Google access and identity tokens are used during sign-in and are not retained afterward.

Optional shared Google calendar

A trip administrator can separately connect Google Calendar to create and maintain one shared Oaks trip calendar in their Google account. This connection requests permission to create and edit an app-created calendar and manage calendar sharing. Oaks uses those permissions for the shared trip calendar. Other members do not grant Calendar permissions.

When connected, the app sends whole-trip activity titles, dates, times, locations and planning details to Google. It shares the calendar for reading with enabled planner-account email addresses. Private family records, personal notes and traveler details are not exported. Calendar-sharing notification emails and event invitations are not sent automatically.

The server stores an encrypted refresh token for the connecting administrator so it can update the calendar and its sharing in the background. It also stores the calendar identifier, event/share mappings and synchronization status. Disconnecting removes the active stored credential and stops updates; the existing Google calendar, events and sharing remain in Google. Server backups may retain earlier stored records.

Emails from Oaks On Board

Trip administrators can send invitations, trip updates, account information and account recovery emails through Resend. Resend receives the selected recipient's email address and the message content. Each recipient receives a separate email. Account links work once and expire after 48 hours.

The app keeps administrator-only drafts and delivery history, including recipients, delivery failures and reported opens or link clicks when enabled. Open and click reports may be incomplete or caused by email privacy tools. Bounced or complained-about addresses are suppressed from future sends. No email is sent simply by creating an account or saving a draft.

Automatic planning reminders require both the organizer’s enablement and your daily or weekly opt-in in Your account. They contain a generic reminder and a link back to Oaks, without private plan titles or details. You can turn them off at any time. Manually reviewed planning check-ins have a separate opt-in. Your personal update inbox checks what you can currently access; moving families or losing access can remove earlier updates from view.

Notifications on your device

After you sign in on a phone, Oaks can show a guide to adding the app and enabling notifications. Your browser remembers whether each part of the guide has been shown for this account on this device. These local preferences contain no planner records, passwords or notification subscriptions; clearing browser data can show the guide again.

When you open the Home Screen app while signed in, Oaks records a last-seen time for your account, updated at most once a day. Trip administrators can see that the app has been opened, how many devices have active notification registrations, and when the setup prompt was reset. They can offer the guide again for one person or everyone. Notification permission remains your choice on each device.

Push notifications are optional and enabled separately on each device in Account. The app stores your browser's push delivery and encryption information, encrypted and linked to your current sign-in. Your browser's notification service (such as Apple's, Google's or Mozilla's) delivers an encrypted, generic alert. Private plan titles, locations and family details stay inside the signed-in planner.

Turn notifications off in Account or your device settings. Signing out, expiry of your sign-in, or removal of account access stops new alerts for that sign-in. After signing in again, return to Account to enable notifications again. Alerts already delivered may remain in your device's notification history; server backups may retain earlier subscription records.

Your family's information

Pre-trip status checks, including passport/document preparation, room confirmation, assigned adults, dates and short updates, are visible to the relevant family and trip administrators. Other families cannot see these checks. They are reported planning statuses, not verified travel documents or reservations. Private family to-dos and packing lists keep their existing family-only access.

Account information, planner records and backups are hosted on the server owner's equipment. The optional shared calendar also stores exported whole-trip plans and sharing information with Google. Signed-in members see whole-trip plans and the group roster. Private family records are limited in the app to that family's assigned accounts; personal notes are limited to their author.

Travel plans, decisions, wishes and memories show their audience when you create them. Basic care arrangements are visible to the signed-in trip group; extra child selections, handoff instructions and pickup records are limited to the family and the named caregiver. Saved album links open the external service, where its own access settings apply. The app does not upload your photos.

An administrator can save a shared trip archive containing whole-trip records only. That snapshot remains separate from later edits or removals of the original records. Downloaded family itineraries can include your private plans and care details; keep those files private. Downloads are snapshots and do not receive later corrections or access changes.

Trip administrators manage account access and family assignments. The server owner can access the underlying database and backups. The app uses session cookies to keep you signed in and security cookies to protect forms and sign-in requests.

Activity history

Trip administrators can see account sign-in times, recent activity times, page names visited, and a history of saved changes. Recent activity uses page visits and interaction times; idle background refreshes do not count. This history does not collect the text you type, private note contents, passwords, or private account-link tokens.

Changes and questions

Contact the trip administrator through your existing family group to correct account information, discuss removal of data, or ask about access. Changing an account's email removes its linked Google sign-in. Accounts can be disabled to prevent future sign-ins; planner history and backups are managed by the administrator and server owner.