What we collect, and what we do not.

What the product stores

Everything below belongs to one household. There is no shared directory of families, helpers, or plans.

Organizer accounts

An email address, used to sign in and to reach you about your household. Sign-in is passwordless, so we never receive or store a password.

Household details

The household name, the name or nickname you use for your baby, your time zone and date format, an optional expected arrival date, and the homecoming date once you set it.

Your help plan

The activities you choose, anything you write to describe them, private instructions for helpers, and the days and times you open.

Helpers

A name and an email address for each person who uses your household link, plus what they raised a hand for and what they signed up for. A helper who offers to be on call may also give a phone number; it is shown only to your household’s organizers, on the on-call list, and never goes into an email. Helpers do not create accounts and have no profile outside your household.

Your private helper link

The address you share with helpers is stored encrypted, so you can copy it again from Share with helpers instead of making a new one. Turning a link off ends every session that came from it. A link that someone forwarded cannot be detected.

Helper verification codes

A helper proves the email address is theirs by typing a six-digit code we send to it. We never store the code itself, only a scrambled fingerprint of it that cannot be turned back into the digits, alongside the household, the helper, when it expires and how many tries have been used. A code works for ten minutes and once only. The code is in the subject line of that one email, so it is also held by our email provider for as long as they keep their own records, and it is readable on a locked phone screen. That is the same trade the organizer sign-in code makes.

A helper's own personal link

Helpers who joined before codes arrived were each given a private link of their own. Those links no longer open anything: opening one now takes the helper to your household's page, where they type their email and a six-digit code. The old links are still stored encrypted until a later cleanup removes them, and nothing reads them. A helper who was already signed in through one stays signed in until that session runs out.

Calendar files

Add to calendar makes a file on the spot from dates you already have here, and keeps no copy. A helper's file holds their own times and, where you wrote them, your private instructions for that helper; your whole-plan file holds only the times helpers have taken, with no name and no instructions. Each event is named for the activity and your household, so two emails to a helper, the one confirming a date and the reminder the day before, now carry that name to them as an attachment as well. A saved event lives in that person's calendar afterwards, where it may be shared or shown on a lock screen, and it does not update itself when you change a time. Choosing Google Calendar sends the event's words to Google; the other two choices send nothing anywhere.

People you record

If you note someone visiting or staying, the product stores the name you type and an optional relationship. That person is never contacted and receives no link.

Notes from helpers

If a helper suggests something you did not think of, their note is stored with your household and shown only to you and to them.

Update emails

Organizers get a short email about what changed in the app, at most every two weeks and only when something changed. Every one carries a link that stops them with one click. We keep a record of which update went to which account and when, and nothing else. Every other email an organizer gets can be turned on or off by kind, from Notifications in Household settings. Those choices are stored with your account, not with one household, so they cover every household you organize. The sign-in code and the one-time hello from us are not affected: you need the first to get in, and the second happens once.

The App Review account

Apple reviews the iPhone app, and the reviewer signs in with one address we reserve for them. It belongs to no family and never will. So the reviewer does not need a mailbox, the sign-in codes sent to that one address can be shown on a page only they hold the link to. Nothing else is read from it: no other address can be looked at this way, we keep no copy of the code, and we delete the note that a message arrived an hour after it does.

One optional photo

If you add a photo, it is stored privately, stripped of camera and location metadata, and shown only inside signed-in household sessions. It is never attached to an email. It becomes visible outside the app only if you separately publish an unlisted announcement and separately consent to including it in that link’s preview.

What never leaves your household

The product keeps operational records so we can tell whether it is working. Those records are deliberately content free. They carry a household identifier, an action name, an outcome, and a timestamp.

• Your household name, baby name, activity titles, written notes, private instructions, and helper names are never copied into analytics, operational logs, error reports, or our internal records.
• We do not sell your information, share it for advertising, or use it to train models.
• There is no public family page, no helper directory, and no way to search for a household.
• Emails the product sends use fixed copy and never quote what a helper wrote to you. The one deliberate exception is the reminder the day before someone helps: it includes the private instructions you wrote for that specific task, because that is the point of it. It goes only to the person who signed up for that time.

Analytics

The public pages of this site (this homepage, the beta application, the updates page, and the pages linked from the footer) use Vercel Web Analytics to count visits. It records no custom events and sets no advertising cookie. It is not loaded on organizer pages, helper pages, or announcement links, so your household activity does not reach it at all.

On organizer and helper pages the product also records which screens were reached and which buttons were pressed, by fixed internal name, so we can see where the product is not working for people. It never records what you typed, what the screen said, or anything about your household. These records are kept for 90 days and are visible only to the founder; they stop entirely if you ask us to turn off operational records for your household.

Who else touches your data

We use a small number of service providers to run the product. Each one handles data on our instructions.

Vercel

Hosts the application, stores the optional photo privately, and provides the homepage visit counts.

Neon

Hosts the database that holds your household.

Clerk

Handles organizer sign-in and holds the organizer email address used for it. Helpers never reach Clerk.

Resend

Delivers product email and reports whether a message arrived, bounced, or was marked as spam.

Apple Push Notification service

Delivers push notifications to the iPhone app, once you install it and allow them. Apple is told your device’s push token and the one short sentence the notification shows, and nothing else about your household.

Google Fonts

Serves the two typefaces our email is set in. Your mail app fetches them when you open a message, so Google sees your IP address and roughly when you opened it. Many mail apps block this and show a standard font instead. It is never told anything about your household.

How long things are kept

Your household

While active

Not deleted automatically at the end of your plan.

Operational records

90 days max

Content-free records, then removed.

Calendar files

Not kept

Built when asked for. A saved event is theirs.

Helper verification codes

30 days max

A code works for ten minutes. The scrambled fingerprint and its counters are removed by the daily cleanup a month after that.

A helper signed in on a device

6 months

A helper who typed a six-digit code stays signed in on that browser for six months, then types a new one. Every other way in stays signed in for 30 days of use. Turning a link off ends the sessions that came from it straight away.

Archived household

Kept, sealed

Data stays but nobody can reach it. Every organizer membership, helper link, helper session, and unused verification code stops working immediately.

Deleted household

Gone in 7 days

Access ends immediately; fully removed within seven calendar days, including any stored photo.

Push notifications

Until you stop

A push says one fixed sentence, like “A helper needs your okay.”, and which household it is about, so the app can open the right one. It never names a person, an activity, a date, or a photo. We store your device’s push token, an id for that app install, and when the app last confirmed them. All three go when you sign out, when you delete your account, or when Apple tells us the app is gone.

Display preferences on your device

Until cleared or replaced

Your browser or the privately tested iPhone app can remember your appearance choice and the public update you dismissed. These stay on that device after sign-out, contain no account or family details, and are not sent to us.

The iPhone app on your phone

Until you delete the app

The iPhone app keeps one value in the phone’s own Keychain that tells our sign-in provider which install of the app this is. It holds no household, no name and nothing about your family, and it is the same value whether anybody is signed in or not. Signing out ends the session and removes the family data the app held on that phone. The local display preferences listed above can stay; deleting the app removes the sign-in installation value too.

Deleted account

Gone at once

Your name and email are removed the moment you confirm, from your account and from every invitation that carried them, and your sign-in stops working. A blank record stays where you were, so the households you organized keep their own history; it holds no name and no address. The one thing we keep is a do-not-send entry, and only if an email to you ever bounced or was marked as spam, so we never email that address again.

What you control

• You decide who receives your household link, and you can retire a link at any time. Retiring it stops anyone new from getting in with it and finishes any verification code sent from it. Helpers who already verified their email keep their access until you remove them.Share with helpers
• You can remove a helper. That ends their access straight away, takes down their raised hands and their on-call offer, puts any time they had signed up for back to open, and cancels the emails waiting to go to them. Help they already gave stays on your calendar.Helpers
• You can remove the photo, and you can revoke a published announcement along with its link.Announcement
• You can turn each kind of email we send you on or off. Those choices are stored with your account, so they cover every household you organize. The sign-in code and our one-time hello are not affected.Household settings
• The household owner can archive or delete the household. Both actions ask for explicit confirmation.Household settings
• You can delete your own organizer account. Your name and email go straight away and your sign-in stops working. It is not the same as deleting a household: the households you organize stay with their other organizers.How it works
• You can ask us to stop collecting operational records for your household and to delete the ones we already have. During the private beta this is handled by email.Email us