What we keep, and why.

Your account. An email address and a password. The password is stored hashed by our sign-in provider; we never see it.

The people in your household. A display name, a role (grown-up, child or family member), a duck and what it is wearing, and a birthday if you choose to add one. Birthdays are optional and the app works without them.

What you put in. Tasks and who did them, calendar events and who is going, shopping and to-do lists, meal plans, recipes, your pantry and food preferences, the books your family is reading, Duck Bucks earned and spent, arcade scores, messages in family chat, and the family message a grown-up sets.

What you file. Photos and files you add, such as a child’s artwork, a receipt or a permission slip, along with anything read out of a receipt or document, such as a merchant, a total and a date. Letters you forward to your flock’s Mailbox address are kept as suggestions until a grown-up deals with them. Passwords you save in the Vault are kept there too.

Your phone, if you allow it. If you turn on notifications, we keep the push address your phone gives us so a notification can reach it. The camera and your photo library are used only when you take or choose a picture.

We do not collect your location, your contacts, your device’s advertising identifier or your browsing history. There is no analytics or tracking code in the app of any kind, ours or anybody else’s.

Children in a household usually have a profile and no login: a grown-up adds them, and what is recorded about them is a name, a role, a duck, and optionally a birthday. A child with their own login can see and do the same things in the app that a child without one can, and no more.

Everything about a child is entered by a grown-up in that household, and any grown-up there can change or remove it at any time. We do not build profiles of children, show them advertising, or sell anything to them. There is nothing in the app that a child can buy.

Supabase hosts the database, the sign-in system and the files you upload, in a Canadian region (Montréal, ca-central-1).

Resend sends our email (sign-in messages, invitations, and the morning digest if you turn it on) and receives the letters you forward to your flock’s Mailbox address. An email address and the contents of those messages pass through Resend, in the United States.

Anthropic reads the things you ask the app to read: a receipt or a document you file, a photo or PDF of a calendar, a photo of a recipe, a photo of a book’s barcode, and a letter forwarded to your Mailbox. The file or letter is sent to Anthropic’s API, in the United States, and what comes back is a suggestion you can check and correct. Artwork and ordinary photos are never sent. Anthropic does not use what we send to train its models.

Spoonacular finds recipes. When you search, it receives the words you searched for and any diets or intolerances you chose, and nothing about who you are. It is in the United States.

Open Library and Google Books look up a book when you add one by its ISBN. They receive the ISBN and nothing else.

Expo and Apple deliver notifications to your phone. The notification’s words, such as “Sarah asked you: Pack the swim bag”, and your phone’s push address pass through Expo’s push service and Apple’s, in the United States.

Apple and RevenueCat handle subscriptions. You pay through the App Store, so Apple holds your payment details and we never see a card number. RevenueCat, in the United States, keeps the record of what your household has paid for, filed under your household’s identifier. It never receives your family’s names, tasks, calendar or files.

That is the complete list for the app. We do not sell your information, we do not share it with advertisers, and no other company receives it.

Google Analytics. This website, and only this website, uses Google Analytics to count visits: which pages are read, how people arrived, the kind of device and browser, and a rough location such as the city. It sets cookies to do that. We use it to see which pages help and which do not. It is not connected to your account in the app, and the app itself has no analytics. You can block it with your browser’s cookie settings or Google’s own opt-out add-on at tools.google.com/dlpage/gaoptout.

The support form. What you type into the support form on the help page (your name, your email address, the topic, your message and any screenshots you attach) is sent to our inbox through Resend. We keep it as an ordinary email for as long as it takes to help you.

Writing to us. If you email us, we keep the conversation in our inbox for the same reason.

Vercel hosts this website and the web version of the app, in the United States. Like any web host, it keeps short-lived request logs (an IP address, the browser and the page asked for) to keep the sites running and to stop abuse.

If you link with another household, they see only the events you choose to share, one event at a time, and nothing is shared until somebody says so. They cannot change what they can see.

Your documents, receipts and the notes on them are never shared through a link, and neither are your tasks, lists, Duck Bucks, chat, or the people in your household. Either side can end a link at any time, and it stops immediately.

Your information is encrypted on its way to us and while it sits with us. Saved passwords are encrypted again on top of that, with the key kept outside the database, so they are not readable even in a copy of it.

We hold those keys rather than you. That is what lets you sign in on a new phone without a recovery code, what lets a receipt be read and a document be searched, and what lets a grown-up share one password with a child and not another. It also means we could technically read what you store. We do not, and we would tell you if that ever changed.

Access is enforced in the database itself rather than in the app, so a household’s information is only reachable by people in that household, and files are served through short-lived links rather than public addresses.

We keep what you put in for as long as your household exists, because a family organizer that quietly forgot last term would not be much use. Deleting something in the app removes it.

You can delete your account from your profile in the app, and it happens straight away. If you are the only grown-up in your household you will be asked to close the whole household instead, because leaving children with nobody to look after their profiles is not something we will do quietly. Closing it removes their profiles and logins too. A child cannot delete their own account; a grown-up in their household does it for them.

Copies in our database host’s routine backups age out on their normal schedule. Apple and RevenueCat keep records of purchases as the law requires them to.

You can ask us what we hold about you, and we will send it. You can correct anything that is wrong, and most of it you can edit in the app yourself. You can ask us to delete your account and everything in it, or do it yourself in the app. You can turn notifications and the morning digest off, or never turn them on.

If you are in Canada and you are not happy with how we have handled a request, you can complain to the Office of the Privacy Commissioner of Canada.

If we change what we collect or who we send it to, we will change this page and the date at the top. If the change is a significant one, we will tell you in the app before it takes effect rather than hoping you re-read this.