We’re letting households in a few at a time, by hand, so we can actually talk to the people using it. Everyone who lives there gets their own sign-in, and you decide what each of them sees.
Every household’s data is separated by the database itself, not by application code remembering to filter it — and that holds for us too. Nothing sold, no advertising, no analytics following you around.