Privacy and Secrets

Weekaroo is local-first, but it can display sensitive information from calendars, notes, weather stations, and AI providers. Treat configuration files as private data.

Never commit or publish

• Calendar feed URLs
• WeatherFlow Tempest station tokens
• OpenRouter/OpenAI-compatible API keys
• Personal notes or private family messages
• Generated weather history from a private location
• Screenshots containing real calendar events, notes, private locations, or family data

Git-ignored private files

Do not publish these files:

• calendars.json
• family-messages.json
• countdowns.json
• timers.json
• weather-config.json
• ai-config.json
• weather-history.json
• day-notes.json

Pre-publish check

Before publishing screenshots, configs, or generated artifacts, run:

grep -RInE "apiKey|token|secret|BEGIN|sk-|Bearer|calendar.*ics|@|address|street" . --exclude-dir=.git

Review every hit manually.

Network exposure

Weekaroo is designed for local/LAN use. Do not expose it directly to the internet without adding authentication, TLS, and a deployment-specific threat model.

API keys are never returned to the browser by the built-in settings endpoints.