what we keep, and why

Your email address, and a name and timezone if you give us one. The name of your household and of the children in it — first names are plenty, and you can leave them out entirely.

The schools you follow, the calendars you upload, and the dates we read out of them. That is the actual product: without it there is nothing to put on your phone.

If you turn on reminders, we keep the settings and a record of which mail we sent you, so we don't send the same reminder twice.

If you forward school email to your household's address, we keep the raw message for thirty days so a failed read can be retried, then schedule it for deletion. Cleanup can be delayed by an outage or retries. The dates and titles read out of it stay, like any other calendar; the message itself is never shown on a public page.

Your calendar link works like a house key. Anyone holding it can see your family's dates without signing in — that is the only way phone calendar apps can subscribe to anything.

So we keep it hidden behind a tap rather than printed on the screen, and you can replace it with a new one at any time. Replacing it stops the old link working immediately; you re-subscribe once on each phone.

Be careful with screenshots and QR codes of it, for the same reason you would be careful photographing a key.

The companies that run this thing on our behalf include the site host, database, uploaded-file storage and email delivery service. Stripe processes subscription payments. Google handles Google sign-in when you choose it. These services receive the information needed for the feature you use.

xAI (Grok) is the only AI extraction provider currently configured in production. It receives extracted document text or image bytes when needed to read school dates. Gemini, OpenAI and Anthropic are supported by the code but are not enabled production processors; there is currently no alternative AI provider for a failed Grok read. ICS and CSV calendars are parsed without sending their contents to an AI provider. Upload only schedule information: remove unnecessary child names, contact details, medical information and other private details first.

If you sign in with Google, Google tells us your email address and name, and knows that you signed in here.

If you publish a community page for a school, the school-wide dates on it — titles, days, categories — are public at that page's address. Nothing about a child can be on a community calendar: the database refuses the row. The documents you uploaded are never republished, and the page shows how many people maintain it, not who. A community school page may carry one labelled sponsor line. The sponsor receives a count of how many times its link was followed and nothing else; we keep no record of who read the page or who clicked.

Public community school pages may carry one labelled sponsor line. Sponsorship uses aggregate link counts, without behavioural targeting or individual click profiles. There are no third-party advertising tracking pixels. We don't sell or rent anything about you or your children, and we don't build profiles for other companies.

We don't email you about anything except the reminders you asked for and the occasional message about your own account.

Deleting your account removes your personal access and calendar link. A household with another full member passes to that member, keeping its shared records. Otherwise we close the household and delete its private school records, dates and upload references, and request removal of the stored files. A failed file deletion needs operational cleanup. Public, community or externally followed schools are soft-deleted rather than erased, so their documents and dates can remain. Contact us about removal of information retained in shared records.

The questions you asked go too, and we ask Stripe to delete your billing customer. One thing stays: if you agreed to texts, or replied STOP, we keep that record and its date, because carriers expect proof of consent, with the phone number cut down to its last two digits.

Our production Neon database currently has a six-hour point-in-time restore window. Deleted database records can remain in that restore history until it expires. This is not a universal deadline for every provider: email logs, AI request retention, security records and legally required billing records follow the provider policies described below. Some operational audit records remain after account deletion; contact us about a specific record.

If you stop visiting, enabled source monitoring, reminders and calendar subscriptions can continue. Disable them or delete your account to stop that activity. Raw forwarded email is eligible for deletion after thirty days; the scheduled cleanup can be delayed by an outage or retries.