Privacy policy

Last updated October 17, 2026

Who we are

jlcg.llc is run by JLCG LLC. It holds a shared file vault for the family and, for the Mather Fund (a family foundation), a planning page called Mather Labs. You can only use the site if an administrator has invited you, or has sent you a link for sending files in. In this policy, "we" means JLCG LLC and the administrators who run the site for it.

What we collect

• Your account: your email address, the name you choose to show others, the folders you can open, and whether you are an administrator. Your password is kept by our sign-in provider as a one-way hash; we never see it. If you use two-step sign-in, the provider also keeps the secret your authenticator app shares with it. If you add a passkey, it keeps the passkey's public key and identifier, the kind of device or app it lives in (such as iCloud Keychain), and when it was added and last used; your fingerprint or face never leaves your device. It keeps these until you remove them.
• Invitations: the email address and name an administrator enters to invite you, and when the invitation was used.
• Sign-in activity: each time you sign in (with your password, with a passkey, or from a link we email you, such as the one that confirms your address) or reset your password, the time, your IP address, the approximate country the connection came from, your browser's language setting, and a description of your browser and device. Administrators use this to keep the vault secure. They can also see when each account was last active (its latest sign-in, file action, or vault or Mather Labs page open while signed in) and how many browsers are signed in to it. An administrator can ask a location service (ipapi.co) for the approximate place of a sign-in's IP address, but only by clicking to look it up.
• File activity: who uploaded, opened, downloaded, moved, renamed or deleted a file or folder, and when.
• Folders you've opened: when you last opened each vault folder, so the vault can mark what has been added since. Only the vault uses it, to show you your own dots; administrators don't see it.
• Files sent with an upload link: if an administrator sends you an upload link, you need no account. We keep the files you send, and each file's name, size and the time it arrived, with the link's name and dates. You may add your name so the administrators know who sent what; it is optional and kept with each file. If you are also signed in to the vault in that browser, the file is recorded under your vault account instead. The site doesn't record your IP address (our providers' own logs may note it, under their policies). Only administrators can see what was sent while it waits in their Inbox. If they file something into a shared folder, everyone who can open that folder sees your name next to it (marked "upload link") if you gave one, or otherwise the name the administrators gave the link. When you click "I'm done", the administrators get a short email with the link's name, your name if you gave it, and how many files arrived.
• The family wiki: pages the administrators write about the family's properties, plans and decisions, sometimes drawn from meeting notes. You see the pages that belong to the folders you can open. Earlier versions of each page are kept for the administrators.
• Replies to wiki questions: the reply you save, your account identity, and when you saved it are kept in the vault. Readers of the same page can see your reply and name. Only you can edit your wording. Unsaved reply drafts stay in the open browser tab’s memory.
• What DougFirbot reads from files: the text of documents in the vault (PDFs, Word, Excel, PowerPoint and text files) and a short description of each photo, written by Anthropic's Claude. It is kept with the vault and used only to answer people who can open that file. Nothing in the Inbox or Trash is read.
• Meeting notes you email to notes@jlcg.llc: if you are a vault member, the note's text, your address, the subject and when it arrived are kept for the administrators, and the text is sent to Anthropic's Claude to draft wiki pages. Attachments (PDFs, photos, Word, PowerPoint and Excel files, and text files) are sent to Claude too; the site keeps their names and the text read from them, not the files themselves (see "Service providers"). An administrator reviews every draft before anything is published. Notes from anyone who isn't a vault member are not used.
• What you add: files you upload, folder names, your posts, comments, votes and requests in the vault's What's New section, and scenarios saved in Mather Labs, including any decision rationale, cash schedule, Trust assumptions or reconciliation you choose to save. Saved scenarios are shared with everyone who has access to the whole Mather Fund folder, as is the Fund's record of what the Mather Trust paid it each year, with who last saved it and when (only its record keeper can change it).
• The Mather Fund's custodian data, described in the next section.
• Questions to the Mather Labs assistant, described in the section after that.

The Mather Fund's custodian data (Plaid)

The Mather Labs administrator can connect the Mather Fund's accounts at J.P. Morgan through Plaid Inc. ("Plaid"): its investment accounts and, if the administrator adds it, its checking account. The administrator signs in to J.P. Morgan inside Plaid's own window and chooses the accounts there; we never see or store bank sign-in details. With that consent, Plaid gives us read-only access to the accounts chosen:

• account names, the last digits of account numbers, account types and balances;
• holdings: security names, ticker symbols, security types, quantities, prices, values and cost basis.

We don't keep security identifiers such as CUSIP, ISIN or SEDOL. The connection can't move money or place trades. We use this information only for the Fund's figures in Mather Labs: the newest fetch, sorted into the Lab's seven classes (a bank account counts as cash, at its balance), becomes the Lab's current mix. Everyone with Mather Labs sees that mix and, in the Lab's Snapshot, each class's sub-classes and holdings (name, ticker and value, with the fetch date) and each bank account's name and balance; the Lab's assistant can pass the mix to Anthropic along with the Lab's other figures, but not the holdings or the bank accounts. Account numbers, quantities, prices and cost basis are seen only by the administrator. The administrator can file an account under one of J.P. Morgan's equity categories so the Lab sorts it the way J.P. Morgan does; that filing (the account's last digits, its name as fetched, and the category) is kept until the administrator clears it, so it survives a reconnection, and only the category name reaches the Lab. The access key Plaid issues for the connection is stored encrypted with a separate key held only by our server function, and it is erased when the connection is closed.

The administrator can also connect the Mather Trust's main account at Bank of America through Plaid, the same way (signing in inside Plaid's own window and choosing the account there). We keep only that account's name, the last digits of its number, its type and its balances, the total, and its investment holdings (security names, ticker symbols, security types, quantities, prices, values and cost basis; no CUSIP, ISIN or SEDOL). Everyone with Mather Labs sees the total and its date, as the Trust's opening balance in the Lab's family planning and in its header, and the holdings (name, ticker and value) grouped into the Lab's classes, without account names or numbers; the account's name and number digits are seen only by the administrator. The balances and holdings are kept only while that connection is open, never longer than 13 months, and disconnecting deletes them. Its access key is protected in the same way, with its own separate binding.

This covers the Mather Fund's and the Mather Trust's own accounts. The site doesn't connect anyone's personal bank accounts. Plaid's handling of data is described in Plaid's End User Privacy Policy, and you can ask Plaid about data it holds at my.plaid.com.

The Mather Labs assistant (Claude)

Mather Labs has an optional assistant that suggests scenarios to try. It is powered by Claude, from Anthropic, PBC ("Anthropic"). When you ask it something, our server function sends Anthropic:

• your question and the earlier messages in that conversation;
• a summary of the Lab as you have it set up: the mixes being compared, the planning assumptions and results the Lab has computed. For the Mather Fund these include the Fund's own figures from its workbook.

It doesn't attach your name, email address or IP address. Claude only suggests; the Lab itself computes every number it shows.

On Mather Labs this assistant appears as DougFirbot, the tree from the vault. If you ask him about something in the vault there, he looks it up the same way as in the vault (next section), with your own sign-in, so he only finds what you can open. His answer and the names of the pages and files it came from are then also part of the Mather Labs conversation sent to Anthropic.

We don't keep the conversation with the assistant. It lasts only until you reload or leave the page. The exception (from v1.49) is what you type in Mather Labs, in the question box on the Start here page or in DougFirbot's panel. Those words are kept privately, to improve the answers. Nobody who uses the site sees them: they are not shown to other members, and the page never asks the database for them. Only the Mather Labs administrator can read them. For a what-if typed in the box (for example, "what if inflation is 5%?"), the Lab itself reads it in your browser. The record keeps the words as you first typed them (300 characters at most), the case they were read as (inflation, mix, giving, market; no account figures), a one-line answer and how many times it was asked. For a question put to DougFirbot, the record keeps your words and, unless his answer drew on a vault file, his answer. The database also records who asked first; it never sends that to a page. Every 30 minutes, new entries are written as a Markdown file in an administrator-only vault folder ("Mather Labs Questions"). DougFirbot reads that file like any other, and he only ever answers you from what you can open, so what others asked never reaches your answers; the administrator's DougFirbot can use it. Don't type anything private into the box or the panel. An administrator can remove an entry; a file already written stays in the vault until someone deletes it. The record is capped at 5,000 entries. To apply the assistant's daily limits, and the limit of 30 kept questions an hour, the database records who asked and when. These records are deleted automatically once they are 30 days old, the next time anyone uses the site (for the records behind the 30-an-hour limit, the next time anyone saves a question). Anthropic deletes what it receives within 30 days, unless something is flagged as a possible breach of its usage policies or the law requires it to keep it longer, and it doesn't use it to train its models. See how long Anthropic keeps this data.

DougFirbot, the vault's assistant (Claude)

DougFirbot, the tree in the corner of the vault, answers questions about what is in the vault. It is powered by Claude, from Anthropic. It works in two parts:

• Reading. Every few minutes new files are read once: text, Word, Excel and PowerPoint files by our own server function; PDFs and photos are sent to Anthropic, which returns the text of the PDF or a short description of the photo. That text is kept with the vault by file, removed when the file is deleted for good, and never shown to anyone who can't open the file. Nothing in the Inbox, Trash or unfinished uploads is read.
• Answering. When you ask something, our server function sends Anthropic your question, the earlier questions and answers in that conversation, your display name, the names of the folders you can open, the time of day on your device (morning, afternoon, evening or night), and the pages and file text it looks up to answer. It looks things up with your own sign-in, so it only ever finds what you can open.

We don't keep your questions or DougFirbot's answers. A conversation lasts only until you reload or leave the vault. To apply DougFirbot's daily limits, the database records who asked and when. These records are deleted automatically once they are 30 days old, the next time anyone uses the site. Anthropic deletes what it receives within 30 days, unless something is flagged as a possible breach of its usage policies or the law requires it to keep it longer, and it doesn't use it to train its models. DougFirbot can be wrong; it lists the pages and files each answer came from.

DougFirbot also keeps a library of its own one-liners (greetings and the like). Claude writes a few new ones each day from the existing lines alone, and administrators can add some; they contain nothing from the vault or about you. Some are for one time of day, so the vault asks for them by the time of day on your device (morning, afternoon, evening or night); that isn't kept.

How we use it

Only to run the site: to sign you in, show you the folders you may open, keep a record of who did what for security and to recover mistakes, show the Mather Fund's figures in Mather Labs, and answer questions you put to its assistant. We don't sell or rent information, use it for advertising, or share it with anyone except the service providers below, or when the law requires it.

Service providers

• Supabase provides sign-in, the database and file storage. It encrypts data at rest (AES-256) and in transit (TLS).
• Vercel hosts the site and counts page views with Vercel Web Analytics. The count uses no cookies. It records the page address (for vault pages this includes folder names), the referring page, approximate location, and browser and device type. It identifies a visit by a hash of the request that it discards after 24 hours.
• Plaid provides the Mather Fund's and the Mather Trust's custodian connections; the administrator is the only person who uses it.
• Anthropic provides Claude, the Mather Labs assistant, as described above. Claude also drafts wiki pages from the meeting notes vault members email to notes@jlcg.llc; for that it receives the note's text and attachments and the current text of the wiki pages, under the same 30-day terms, and it doesn't train on them. It also powers DougFirbot, as described above.
• Google Fonts and jsDelivr deliver the site's typefaces and its sign-in software. Your browser requests these files from them, so they see your IP address and browser details.
• ipapi.co receives a sign-in's IP address only when an administrator looks up its approximate location.
• Resend sends the site's emails, such as sign-in and password emails and the notices administrators get, and receives the meeting notes sent to notes@jlcg.llc. ImprovMX passes those notes on to Resend.
• ImprovMX forwards email sent to privacy@jlcg.llc to the administrator's mailbox and keeps a log of forwarded messages for a limited period under its own policy.

Cookies and browser storage

Your browser keeps your sign-in session, and a few small settings (such as when you last read What's New), in its own storage on your device. While you are signed in, the site also sets one cookie, jlcg_gate, holding a copy of your current sign-in token, so that the vault and Mather Labs pages are only sent to a signed-in browser. It lasts no longer than the token (about an hour, renewed while you use the site), is only sent to jlcg.llc, and is removed when you sign out. The site sets no other cookies. Signing out removes the session.

How long we keep it

• Sign-in and file activity: 12 months, then deleted automatically.
• Invitations that were never used: deleted 12 months after they expire or are withdrawn. A used invitation is deleted once its account no longer exists.
• The Mather Trust's balances and holdings from Plaid: kept only while the connection is open, and never longer than 13 months. Disconnecting deletes them all.
• The Mather Fund's holdings from Plaid: kept only while the connection is open, and never longer than 13 months. Disconnecting deletes them all. The administrator's filing of an account under a category (last digits, name and category; no balances or holdings) stays until the administrator clears it.
• The Mather Labs assistant: questions and replies aren't kept. Who asked and when: 30 days, then deleted automatically the next time anyone uses the site.
• DougFirbot: questions and answers aren't kept. Who asked and when: 30 days, then deleted automatically the next time anyone uses the site. Text read from a file: kept while the file is in the vault, and removed after the file is deleted for good.
• Meeting notes sent to notes@jlcg.llc: kept for the administrators until one of them removes them; ask privacy@jlcg.llc to have a note removed.
• Wiki pages: kept, with every earlier version, until an administrator removes them. To have something about you taken out of a page and its history, write to privacy@jlcg.llc.
• Replies to wiki questions: kept with the page; editing replaces your saved reply. Archiving a page hides its replies. A deleted account’s replies remain as “Former member”. For removal, write to privacy@jlcg.llc.
• Upload links: the list of files that arrived with a link is kept until an administrator removes the link from the list. The files themselves are kept like any other vault file.
• Your account, files, folders, posts and saved scenarios: until you or an administrator deletes them. The Mather Fund's Trust distribution record: until its record keeper changes it; each version saved, with who saved it and when, is kept so a mistake can be undone. Deleted files go to the vault's Trash and stay there until an administrator empties it.
• When you last opened each folder: while your account exists; it goes with the account.
• A deleted account: its sign-in, profile and folder access are removed. Its posts stay, shown as "Former member". Activity records keep its email address until they reach the 12-month limit.
• Backups: JLCG keeps occasional backup copies of vault files, and a weekly encrypted copy of the site's database (accounts, activity records and what members add), on private storage it controls. Something deleted from the site can remain in an earlier copy until that copy is removed; database copies are kept for up to 12 months. Our providers also keep short-term backups and logs under their own policies.

How we protect it

• Administrators must confirm each sign-in with a code from an authenticator app. Without it, the database refuses every administrator tool and the Mather Fund's custodian data.
• Every request carries your own sign-in, and the database decides what you may see or change. Folder access, administrator tools and the Mather Fund's custodian data are each checked there, not just hidden in the page. An upload link works the same way with the link's secret code in place of a sign-in: it can only add files to one folder that only administrators can open, and we store the code only in scrambled (hashed) form.
• Information is encrypted in transit (HTTPS) and at rest. The Plaid access key is encrypted a second time with a key that never enters the database.
• Uploaded documents open from separate storage or in an isolated viewer, so a file can't act as you on the site.
• Only administrators can see who signed in, when each person was last active, and the full record of who did what with files. Anyone who can open a file sees who uploaded it: the name that person chose in the vault or, if they haven't chosen one, their email address. Apart from that, other members see only daily counts of uploads and folder changes in the folders they can open (in What's New), not who made them.

Your choices

• To see, correct or delete information about you, or to close your account, write to privacy@jlcg.llc. We aim to reply within 30 days.
• You can change the name others see at the top of the vault at any time. Until you choose one, others see your email address next to your files and your posts in What's New.
• The Mather Fund's administrator can end the custodian connection at any time with Disconnect, which also deletes the fetched holdings.
• The Mather Labs assistant is optional. The rest of Mather Labs works the same without it.

Children

The site is for invited adults. It isn't meant for children under 13, and we don't knowingly collect their information.

Changes

When our practices change, we update this page and the date at the top. Significant changes are also announced in the vault's What's New.

Contact

JLCG LLC · privacy@jlcg.llc