PIA: An event can say who it's for

An event already says who's doing it ("4:15 – 5:00 pm · Alex"). It can now also say who it's for: "Alex · for Mia". A parent recording a child's swimming lesson can name the child, so the calendar says both who takes Mia and that it's Mia's. The full assessment (HQ PIA-017) was approved with conditions by the founder on 31 October 2026. This entry records what is built and what is still to come.

What it holds

For one event, up to 8 members of that event's group: people with their own sign-in (adults, 16–17s and child accounts) and profiles (people without a phone, often a younger child). It is picked from the group's list on the event form. It is never typed, never the wall, never someone outside the group and never a baby from the tracker. Nothing is chosen by default.

It is stored as the members' ids and shown by their current names. Like the event's title, time and place, it is plain text in our database. It is not encrypted, in any group, and the app doesn't say otherwise.

Who sees it, and who can set it

Everyone in the group, the same people who already see the event. A child account sees and sets it like the rest of the calendar. The database refuses a name that isn't an active member of the event's group, and refuses any change to the field from the group's wall or from a profile. A copy of another group's event never carries it.

The form says so where it's chosen: "Optional. Everyone in the group can see this." When the group has a wall it adds ", and so can anyone looking at the wall."

Where it goes

The calendar row: "Alex · for Mia", "For Mia" when nobody's doing it, and the doers alone when it's for nobody. Screen readers hear "Swimming, 4:15 to 5 pm, Alex, for Mia".
The member filter on the calendar keeps an event when a chosen member is doing it or it's for them. It's a filter over what the phone already holds: there is no per-person page, count, history, summary or export.
Download my data includes it with each event the member can see.
Never in "Add to my calendar" or "Keep in sync" (the phone calendar gets title, time, place and whether it's all day), chat event links or share sheets. A source scan keeps the list of files that read the field short and reviewed.

Who is told

When an event that names who it's for is added, moved, changes who it's for or who's doing it, or is deleted, these people get a notification:

the people it's for who have their own sign-in, and whoever's doing it;
the parents or guardians in this group of each named child under 16, of a child whose age we don't know, and of a profile. A parent or guardian who isn't in the group is never told. The parents or guardians of a 16 or 17-year-old aren't told: the child policy treats 16–17s like adults;
anyone just taken off it (it was for Mia and is now for Leo, or nobody's doing it any more), and the parents or guardians in this group of a child taken off it, under the same rule. They get the short version only ("Sam changed an event"): they already knew of the event.

Never told: whoever made the change, the wall, profiles, anyone who has muted the group, and anyone who blocked the person who made the change. Events that name nobody send nothing, as before. So do changes to the title, notes or place, events waiting for approval, events that ended more than a day ago, and changes the app makes itself (a copy of another group's event, a time zone change, a member leaving).

The form says, once someone's chosen: "When you save, we'll tell the people it's for, whoever's doing it, and a child's parents or guardians in this group." It names roles, never people, because members can't see who is whose guardian.

What it says. By default the notification names the group and who made the change, never who it's for or what the event is: "Sam added an event", "Sam changed an event", "Sam cancelled an event". In a Device-only group it says "Something changed in" the group. Only when message previews are on and every preview condition holds for that person and phone does it say more: "Sam added Swimming for Mia: Tue 4:15 pm". A person under 16 always gets the short version, and so does anyone told about a deleted, repeating or encrypted event. Tapping it opens the event: the notification carries only the group's id, the event's id and a fixed code saying it's an event notification.

Not too many. Changes made within two minutes of each other become one notification. After a notification, the next one about the same event waits at least ten minutes and then says what is true by then; nothing is dropped. One person can start at most 30 in each clock hour in a group (so up to 60 across the turn of an hour); past that they're dropped and only counted.

What we keep to send it. A waiting notification is stored as the event's id, a fixed code for what changed, who made the change and when, and nothing else, readable only by our server. For a deleted event it also keeps the ids of who it was for and who was doing it, because the event is gone and those ids are how we know who to tell (an extension of the assessment's condition C7, decided by HQ on 1 November 2026 for the founder's later review). In the same way, it keeps the ids of anyone taken off the event while it waits, so they can be told (a second HQ decision of the same day). It's deleted once sent, or after 24 hours. The delivery record keeps what it keeps for every notification: who it went to, which phone, and when, with no words.

The wall

The wall shows who an event is for wherever it shows events, the resting screen included, in the same words as a phone: "Alex · for Mia", or "For Mia" when nobody's doing it. Where a line can't hold every name it says "for Mia and 2 others" rather than cutting one. At rest it gives the time, never the place. Clock only and Guest mode show no events, so they show none of it. The touched Home's Tonight card names only the cook.

The people an event is for are never shown as doing it: they get no face, no credit for a tick and no place on "Who did it?", and an event only for Mia isn't her next thing on her tile. The wall has no filter, count or page by who an event is for, and it can't set or change it. It reads the field only as part of the event, so a stopped wall loses it with the events.

The assistant and Add several

Once the form asks who an event is for, the assistant can too. The lines it reads say "Swimming — Alex, for Mia", with names from the group's list, never ids. When it adds or changes an event it can say who it's for by name, and only someone in the group: a name it can't match, or two people it can't tell apart, means nothing is saved and it says so, rather than guessing. It's never told anyone's age or who is whose parent. The people it names are told exactly as when you save on a phone. At the wall, Ask can't set it at all, though it may say who an event is for, aloud too, as the wall's screen does.

Add several, and adding by talking, reads "swimming Tuesday at 4 for Mia" as an event for Mia, with you doing it. Both show as people you can take off before you add the events, and only what you leave is saved.

Mail Sifter, the daily brief, the insight cards and the household's task sharing don't read or set it. When the assistant is sorting a forwarded email, it can't say who an event is for at all.

Still to come (each in its own change, under the same conditions)

The privacy policy and child policy lines, in the edition that ships the feature. Until that edition is in the app, the form doesn't ask who an event is for at all.

Leaving, deletion and erasure

What happens	The field
A member leaves, is removed or deletes their account	Their id comes off every event in that group, past and future. The event stays
A profile is erased	Its id comes off too
A profile becomes an account	Kept: it's the same person, including while their membership waits for a birth month or a guardian
The group is deleted	Goes with its events
The event is deleted	Goes with it. A notification waiting to say so keeps the ids for up to 24 hours

Structural versus conventional

Property	How it holds
Only active members of the event's group, never the wall	Structural: a database trigger refuses any added name that isn't, re-checks everyone named when an event moves to another group, and locks those members' rows so a name can't be saved while that person is leaving
The wall and profiles can't set or change it	Structural: the same trigger
At most 8, no repeats	Structural: a CHECK
Never on another group's copy of an event	Structural: a CHECK
Leaving or account deletion removes the id	Structural: a trigger on the group's membership
Who is told, and only people in the group	Structural: the server works it out from the stored event and the guardian links when it sends, never from what a phone sends; each person must be an active member of the event's group
Only a person's own change sends one	Structural: the database writes the notification only for a change a signed-in person made, never for the app's own background changes
Short words unless every preview condition holds	Structural for under-16s (the database answers it); conventional, held by tests, for the sentence itself
Not in the phone calendar copy, chat links or share sheets	Conventional, held by tests: the copy is a fixed list of fields, and a source scan lists every file that reads the field
No per-person view or count	Conventional, held by the same source scan

Risks we accept

A member can still type a child's name, or anyone's, into a title or note; only the structured field is checked and erased. A notification already delivered can't be taken back, and every parent or guardian in the group is told, including one the other parent might prefer weren't: the app takes no side between them. A child's named schedule builds up for as long as the group keeps its events, as titles already do, and members who join later see it. Backups (up to 90 days) and screenshots outlive a change.

Best interests of the child

The purpose is the founder's: when one parent records a child's lesson, the other parent in the group knows about it. A child account can see and change what's recorded about them, and the field never leaves the group's own calendar.