Privacy Policy

PRIVACY POLICY Last Updated: 11 November 2026 (Version: v3.23-2026-11-11) WHAT CHANGED IN THIS VERSION: - Shopping: Sign in on Woolworths’ own page. GroupApp’s saved email and password feature is removed; identifiable old copies are deleted with retries, but older orphaned account keys may remain. If the shop gets stuck, Google's AI may read the retailer page's buttons and text, or a picture of it, to find the right button. The page can show your name, email, address and cart. A picture sent to Google may accidentally include sensitive details hidden on the page, such as passwords, codes or payment details. Your group can keep shopping notes, readable by its adults; while you shop they may go to Google’s AI or TypeSafe’s Jev in the United States. Meal-plan pantry-check ingredients are included for review before a shop. Ticked items can be put back for 14 days. Remove offers 15 seconds to undo for everyone, then arranges deletion; active shops can delay cleanup. - Tips: We keep which tips you've seen and when, so we don't show them again on another phone. - Shopping: If none fits, it may ask for up to two more Woolworths searches for that item, with words the app checks first, and look at one product's Woolworths page, from which the app reads only its size, unit price, price, whether it's in stock, any special and its earlier price, its Health Star Rating, the allergens it declares and, for an item that names a dietary need or an allergy, its ingredients line; those details go to Google's AI service too, never to TypeSafe. The AI services also get the amount on your list when an item's words don't say it: a number and a standard measure. - Screen time: your group can log time on screens for anyone in it, including a child without an account. Everyone aged 16 or over sees it; someone under 16 sees only their own. It's kept until someone deletes it, or you leave. - Shopping: when you fill a Woolworths cart, TypeSafe’s Jev in the United States now has the first try at choosing each product, unless you choose Premium products or the item names a dietary need or an allergy. It sees the item’s words, with names from your group replaced, and Woolworths’ product options. Its choice is used only when it rates it at least 0.9 likely and the app’s checks pass; otherwise Google’s AI chooses, as before. - Notifications can show the start of a chat message, and task and event titles, again. It’s on unless you turn it off in You → Notifications. Never for under-16s, encrypted groups, baby notes, Mail Sifter or the assistant. Group chat: you can add one emoji to a message, from a short list like 👍 Got it or ✅ Done; everyone in your group sees who added which, and whoever wrote the message gets a notification. You can delete a message you sent, and a parent or guardian can delete their child’s. - You can report a message or a member to us and block a member, and we now ask adults before their first use of AI features. The daily brief is now on for every adult in a Standard group, with no switch. If you’d said no, it starts only after you’ve seen this notice. Under-16s never get it, and 16- and 17-year-olds only if they say yes. Device-only has been retired: every group is now Standard, and no setting keeps a group's records away from AI. - We now count how often each feature is used, in totals that name nobody and never include what anyone wrote. Nothing done by people under 18 is counted. Mail Sifter can now read screenshots you share to it and, if your group turns it on, pictures in emails, using Google’s AI. Location and camera details are removed first. Help us improve the assistant: under the new words, an AI model in Australia sorts each record into fixed categories and suggests made-up test examples, which we keep longer than the records. Our team may also study records with AI tools from Anthropic, OpenAI and Google, which promise not to train on them. You can now attach a photo, a PDF or a new camera photo to a message to the assistant. Google’s AI reads a photo to answer you; we don’t keep the file. Anything it would add, you approve first. Sign-in and password emails come through our email provider, Resend. We are committed to protecting your privacy in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). IN SHORT: WHAT HAPPENS TO WHAT YOUR GROUP WRITES This summary describes the app from the app update released after 18 October 2026. Until your phone has that update, and until your group's phones have finished the work it describes, what was written before stays as the later sections say. Each group's own progress is on the app's Privacy screen. OUR COMMITMENT. We don't read your group's content. Our servers open it only to do something one of you asked for, and people at GroupApp see it only when you send it to us or the law requires us to. Reading your content for any other reason would break our privacy policy. Some of that is held by keys our servers never receive, some by the rules inside our database that decide who may read a group's records, some by rules our own code keeps and our tests check, and some only lets us find out afterwards; section 7 says which is which. Phones only (shown in the app as Device-only) was retired in November 2026. Every group is now Standard. STANDARD (every group): - Encrypted on your phones: each member's own conversation with the assistant, and the cards the assistant raises. Chat, photos, captions, album names and comments too, when your group has turned encryption on — from the app update released after 18 October 2026 that is your group's own choice, and a group made after it starts with them stored as ordinary text until an owner or admin sets a Group Password, which we never receive. Section 7 says what setting one does, who is shown it, and what happens if it is turned off or forgotten. Mail Sifter email is encrypted as it arrives. - Stored as ordinary text, from the app update released after 17 October 2026: your group's everyday records — tasks and their history, the calendar, shopping, trips and stays, the meal plans your group makes, the words in the baby tracker, ceremonies, games, the daily brief and each member's own plan. Only the active members of your group can read them, and a member's own plan only that member; the rules inside our database decide that, rather than a key your phones hold. They were encrypted on your phones between 30 September 2026 and that update, and a record from then stays encrypted until a phone that holds the key opens it. - What our servers can open, and when: your own conversation with the assistant, never — it is under your own key. The one exception is an answer that did not reach your phone, which our assistant server keeps in its memory so your phone can collect it within five minutes (section 5, "Your assistant conversation is encrypted on your device"). Chat and photos, never once your group's phones have moved them onto a key our servers never receive; until that has finished, a copy of the key that protects them is kept for our assistant server, and nothing on our side uses it to open them. From the app update released after 18 October 2026 chat and photos are encrypted only in a group that has turned encryption on, and in a group that has not our servers read them as they read your group's everyday records, with no key to unlock and nothing recorded. What our assistant server does still hold a key for — the cards the assistant raises, and email forwarded to your group — it opens only while running a feature your group uses — answering a question, writing the daily brief, sorting an email when someone opens the app or, if Mail Sifter’s arrival sorting is on, after it arrives with nobody present, writing a ceremony helper's line or running a task search you pressed. That limit is a rule our own code keeps; the key itself does not enforce it. Each time the server unlocks your group's key it records the attempt first; that record lets us find out afterwards, and does not prevent a misuse. Your group's everyday records need no key from the app update released after 17 October 2026, so none of those three limits reaches them: our servers can read them while running a feature your group uses, nothing unlocks and nothing is recorded, and our commitment above and the rules inside our database are what stand in the way of anything else. - What stays readable to our servers: your group's everyday records; names; times, dates, amounts and who does what; who added an emoji to which chat message, and when; anything written before a phone encrypted it; and, from the app update released after 18 October 2026, your group's chat and photos unless the group has turned encryption on. - Where AI runs: on Google's Vertex AI at its global location, which may process a request in any country where Google operates, including the United States. A request is sent as written, names included, and health and baby information goes the same way as everything else. Your group's information is still stored in Australia. WHAT THIS DOES NOT COVER, AT ANY LEVEL: - A forwarded email passes through our email provider, Resend, which keeps its own copy for up to 30 days, and through our mail server's memory as it arrives, as it was sent. - The names of people, groups and babies, and structured facts — times, dates, amounts, doses, measurements, who does what, and whether something is done — stay readable so reminders, counts and sharing out work. - Our own backups, encrypted to a key we hold outside our cloud providers, keep older copies for up to 90 days, including of writing that was encrypted after the backup was made. Our database host's own backups expire on its own schedule. - Content written before a member's phone began encrypting stays readable. The jobs that encrypted older everyday records are removed with the app update released after 17 October 2026, because those records are no longer encrypted; the jobs for older chat messages and photos stay. - A message a member chooses to report to us is sent to us as their phone shows it, even from an encrypted group (section 1). - When you ask the assistant something, the text of your request, and anything our server opened to answer it, and any picture or PDF it reads, goes to Google's AI model service at its global location (section 5). 1. INFORMATION WE COLLECT We collect the personal information necessary to run a group together: - Account Data: email address, display name, user ID, your Terms agreement consent timestamp, and which versions of this Privacy Policy you were shown the changes to, and when. That last record is yours alone to see and is not a consent; it determines whether a faster assistant route that uses TypeSafe may be used. The ordinary assistant remains available without acknowledging this change. If you create or sign in to your account with Sign in with Google or Sign in with Apple, that identity provider is the source of your email address and, at your first sign-in only, a display name — we ask for nothing beyond your identity, no group information of any kind ever reaches Google or Apple, and the provider itself learns only that you signed in to this app and when. If you use Apple's Hide My Email while sign-up is limited to authorised addresses, the Apple relay address must itself be authorised. Invitations, guardian matching and the group inbox use that relay address, and delivery depends on your Apple forwarding settings. Once sign-up opens, prior relay-address authorisation is no longer needed. Google's own sign-in component sends a device identifier and usage data to Google for Google's own analytics — that is Google's own declaration about its software, not a flow we add or control. Your email address is also given to our email provider, Resend, so that it can send you the emails that let you sign in and keep your account safe: sign-up confirmations, sign-in codes, password resets, and the codes that confirm a new email address or a security check (section 7). - Birth Month: the month and year you were born, which you give once, when you create your account or before you first start or join a group. We use it to check that you are 18 or over before you start or join a group on your own. It can't be changed in the app afterwards; write to us if it is wrong. If the month you give means you are under 13, we don't keep it, and the app offers to delete the account. If a parent or guardian invited you, the month they gave is used instead, and you are not asked. - Group Data: group names, members and roles, tasks, calendar events, meal plans, shopping and pantry lists, trips (where and when, the places you're staying, how you're travelling, any booking references you add, and who's going), and — while a member is filling a Woolworths cart from your lists — which member is doing it, the store they chose, how far it has got and when, so the rest of you can see it. - Group Chat: the messages you send, and the emoji you add to messages there — one on each message, from a short list: 👍 Got it, ✅ Done, ❌ Can’t do it, 🙋 Need a hand and ❤️ Thanks. Got it can also say when: in 15 min, later today or tomorrow. Everyone in your group can see which emoji you added to which message, and holding a message down shows who added each one. Adding one sends a notification to the person who wrote the message, and to nobody else: it shows which emoji and the start of the message only where a notification can show what was written, and otherwise says only that you responded. They get at most one for a message every 10 minutes, none for a message more than 7 days old, and none when you take an emoji off. Emoji change no unread count and are never counted, ranked or shown anywhere but under the message. The assistant, the daily brief, voice requests and Mail Sifter never read them. An emoji is kept until you take it off or choose another, or the message, your account or the group is deleted. In a group whose chat is encrypted, which emoji you chose is encrypted on your phone like the message: our servers can see that you reacted to a message and when, but not which emoji or the time on Got it. An emoji added while your group's chat wasn't encrypted stays readable to our servers until a member's phone encrypts it: "Encrypt older messages" does that, and so does the app on its own once every member's phone holds the key. - Deleting A Message: you can delete a message you sent, at any time, and a parent or guardian can delete their child's. Everyone then sees "Message deleted" with the time it was sent. We remove its words, the quote of them in any reply, its emoji, and its photo, unless someone saved it to Photos, where it stays. It can't be brought back. What we can't remove: a notification already on someone's phone; a copy someone made (a screenshot, or words copied into their own assistant conversation, deleted after 30 days); a report someone sent us, which deleting doesn't cancel; and our backups, which expire within 90 days. - Assistant Conversation: what you type or say to the in-app assistant, and its replies, with a short pointer to any view from your tools that a reply showed you (see section 5). This conversation is private to you — other members of your group cannot see it. If you choose “Send to group chat” on one reply, a separate copy of that reply is sent as a group-chat message from you, marked as shared from your assistant; other members can then see it and may be notified. Creating a task or event does not itself post your assistant's reply to group chat. - Infant Health & Care Records: if you use the Baby Tracker, we collect what you record about a child in your care — feeds (including times, durations and volumes), sleeps, nappies, medicine doses, temperatures, baths, growth measurements, immunisation records and any notes you add. See section 4. - Screen Time: if your group uses Screen time, how many minutes someone spent on screens and on which day, who logged it, whether an adult has checked a child's entry and who, a daily target an adult sets for a child, and for a child without their own account who is added there, their name and a colour. People in your group type these in; the app doesn't read any phone's screen time. Everyone in the group aged 16 or over sees every entry and can add, change or delete them (an entry an adult has checked, only adults 18 or over); someone under 16 sees only their own and their target. It isn't sent to the wall display or anyone outside your group. - User Photos: photographs you upload to your group's photo wall, and a child's or member's display photo. - Voice: if you use a voice assistant or a connected device, a record of each request — the kind of request, whether it worked, which task, event or card it made, which child a feed request was about, and when. From 30 September 2026 we do not keep the text of what you asked or of what was said back; before then we did, and we are deleting those words. See section 6. - Forwarded Email: if your group turns on Mail Sifter, what a member forwards to your group's own address — the sender's email address and display name, the subject, the message body, and any attachments. We also store the attachments themselves — calendar files, PDFs, images and plain-text files up to 10 MB each — on our server, readable by the adult members of your group, and delete them with the item; an attachment of another type, or over that size, is never fetched, and only its file name is kept. It is received by our email provider, Resend, which stores it in Japan (Tokyo region), before it reaches our servers. Once an owner or admin of your group has opened Mail Sifter on a version of the app released after 30 September 2026, our mail server encrypts an email as it arrives — its subject, body, sender, attachment names and attached files — with a key your group's phones hold, and keeps only the encrypted copy; something shared into Mail Sifter from another app is encrypted on the phone that shares it. Until then, and for mail that arrived earlier, it is kept as it was sent. Resend's own copy, and our mail server's memory while an email arrives, hold it as it was sent. From the app update released after 1 November 2026 a picture inside an email is stored too, alongside attached ones, and a picture an email only links to on the web is never fetched. Our AI provider reads pictures shared into Mail Sifter from a phone and, if an owner or admin of your group has turned on reading pictures in emails, attached and inline pictures in email, to find the words in them; what was read is kept, encrypted, only as long as the picture is (section 5). Our assistant server can open an email, inside a request a member's app makes, to sort it or turn it into cards. The next adult member who opens the app has their assistant sort it, which sends its content to our AI provider the same way anything else you ask the assistant does — see section 5. Unless an owner or admin of your group turns off "Sort emails as they arrive" (it is on by default), our server sorts each new email instead, within about a minute of it arriving and without anyone opening the app: it opens the email only for that, sends it to the same AI providers in the same way, records what it found, and is paid for from a weekly amount set aside for your group rather than from anyone's own allowance. It is never used for a Device-only group. A second AI provider, TypeSafe, hosted in the United States, also reads it — with your group's names replaced, and never an email that uses words about health — to judge only whether it needs action and which member it is for; TypeSafe does not train on what it is sent. See section 7 for how long we keep it. - Technical Data: a push notification token per device, and counters recording how much of your weekly AI allowance you have used. - Guidance tips: From the app update released after 8 November 2026, we keep which tips you've seen and when, so we don't show them again on another phone. This includes the Shopping notes and Pantry check tips. This record is visible only to you. It's deleted with your account. - First Uses: which features of the app you have opened, and the date you first opened each — kept so that the app does not explain a feature you already use. It records a first and nothing more: not how often, not when you last did, and nothing about anyone else. It is visible only to you — not to other members of your group, not to a parent or guardian, and never to our servers or an AI model — and it is deleted with your account. - Items You Send Us: from the app update released after 30 September 2026, "Send feedback to GroupApp" on an assistant reply to you sends that one item to our team, with an optional thumbs up or down and a comment, the kind of item, the app version, your group's privacy level and the date. Other people's names and contact details are replaced before it is sent, and nothing is sent until you tap a second time. It is stored on our server and emailed, through Resend, to our team's inbox at help@groupapp.ai. If the item is about a request recorded under "Help us improve the assistant" (section 5), it also carries that record's identifier, and the email links to the record; the sheet says so before you send. It is not offered in a Device-only group or on an account under 16. See section 7. - Prices Seen In A Woolworths Cart: when a member fills a Woolworths cart from your group's lists, we record what each product cost, for the items that came from one of our recipe plans or our pantry list — the ingredient as our own catalogue names it, the product as Woolworths names it (which usually includes its pack size, though we keep no separate size of its own), its price, the quantity that price covers, the budget, standard or premium setting the shop used, and the date. We use them to work out later what a meal plan costs. These records are kept apart from your group and hold nothing that points at anyone: no group, no member, no store, no shop, no task, no time of day, and nothing anyone typed. No member can read them. There is no setting that turns them off, because there is nothing in them that is about you; section 7 says how long we keep them. - Home Layout: if you save an arrangement of your Home, which of its widgets you have hidden, pinned and added in that group — names from a fixed list, with nothing you typed and no dates or times. See section 10, which also describes two records the app keeps only on your phone. - Reports And Blocks: You can report a member's message, or the member, to us. A report sends that one message as your phone shows it, even from an encrypted group, with who wrote it, when, your reason and any note. We never tell the person or the group's admins who reported them, never send photos, and review reports ourselves, never with AI. We delete the message 30 days after review and our record 12 months later. Blocking a member hides their messages and photos and notifications about them from you; they aren't told. 2. PHOTO METADATA IS REMOVED ON YOUR PHONE When you add a photo to your group's photo wall, chat or calendar, a baby book, or a display photo, or you take a photo in chat, or you attach a photo to a message to the assistant (not kept), our app makes a new copy of the image on your phone BEFORE it is sent, and that copy carries none of the original's embedded metadata (EXIF and the like): no location coordinates, and no camera or phone details. We do NOT collect or store location metadata from your photos. One thing is read first, on your phone: except for a display photo or a photo you attach to the assistant, the date and time the photo was taken, so it is filed under when it happened. That date and time is stored with the photo and, like the other times and dates in your group, is readable to our servers. If the photo has none, the time you added it is used. The exception is pictures that reach Mail Sifter. From the app update released after 1 November 2026, one shared into Mail Sifter from your phone has its metadata removed on your phone first, in the same way, and one attached to or inside an email has it removed on our mail server before it is stored, but only if it is a JPEG, PNG or WebP picture. A picture emailed in the HEIC format (the iPhone's) is stored as it was sent, with any location and camera details it carries, and the adult members of your group can see it; our AI provider can't read it. For a photo you attach to the assistant, nothing is read from it first, not even the time it was taken. 3. HOW WE USE YOUR DATA We use your information solely to: - Render your group's meal plans, calendar, tasks, chat, shopping lists, trips and baby records for the people in that group; - Answer what you ask the assistant, and carry out the actions you approve; - Show other groups a recipe's average star rating and how many ratings it has, without anyone's name or group; - Send you the notifications you have turned on; - Count how often each feature is used, as described below, so we can decide what to improve. COUNTING HOW FEATURES ARE USED. From the app update released after 1 November 2026, our database adds up, for each day or week, how many messages, tasks, events, photos, baby-tracker entries, assistant requests and other records were made, how many people and groups used each feature, and how many people have each optional setting on. It counts records that already exist. It never reads what anybody wrote, and never records what you look at, which screens you open, how often you open the app or how long you spend in it. The totals hold no name, account or group, and a total drawn from fewer than 10 records or 3 groups, or mostly from one group, is not kept. Nothing done from the account of someone under 18 is counted. Only we see the totals; they are never shown in the app, sold or used for advertising. We do not sell your personal information, and we do not use it for advertising. 4. CHILDREN'S AND INFANT HEALTH DATA The Baby Tracker records health information about an infant, entered by an adult caring for them. We treat it as sensitive information under the Australian Privacy Principles. - WHAT IS COLLECTED: what you choose to record — feed times, durations and volumes; sleeps; nappies; medicine name, dose and time; temperature; bath times; growth measurements; immunisation records; and free-text notes. - WHY: only for these reasons: to show it back to the adults in that group, so that two carers can hand over accurately, and to power reminders you have asked for; and, in totals that name no baby, person or group, to count how often each kind of entry is made (section 3). - WHO CAN SEE IT: the active, approved members of that group, and nobody else. It is not shared with other groups, is never part of any public gallery, and is not used to build a profile of a child. - UNTIL THE APP UPDATE RELEASED AFTER 30 SEPTEMBER 2026, BABY RECORDS ARE NOT ENCRYPTED ON YOUR PHONE. Until then, baby records, including their notes, are stored in our database where our servers can read them, at every privacy level, protected by the access rules described in section 7 rather than by encryption on your device. Earlier versions of this policy and of the app's Privacy screen said baby notes were encrypted on your phones; that was wrong. - WHAT CHANGES WITH THE APP UPDATE RELEASED AFTER 30 SEPTEMBER 2026. From that version, the words written in the Baby Tracker — a log's note, a medicine's name, a food, what an immunisation was, a baby's profile note, a handover note, a book's title, and a care note's medicine and where it came from — and the tracker's summary sentence are encrypted on your group's phones before they are saved, at every privacy level. Outside a Device-only group a copy of that key is kept for our assistant server, so the assistant can open these words while answering one of you and when it writes the summary sentence, and what it opens goes to Google's global location like any other request (section 5); in a Device-only group no such copy is made. Records written before that version, and any written while a phone did not yet have the key, stay readable by our servers until a member's phone runs "Encrypt older baby records" on the Devices and keys screen. A baby's name, and times, types, amounts, doses, temperatures and growth measurements, are not encrypted: the app counts, charts and reminds from them, and the assistant and your lock screen use a baby's name. A handover notification says who handed over which baby and never includes the note. "Download my data" gives these words as they are stored; "Export baby records" in the app's settings gives them as text, from your phone. - AND WHAT CHANGES WITH THE APP UPDATE RELEASED AFTER 17 OCTOBER 2026. From that version the words written in the Baby Tracker, and the tracker's summary sentence, are no longer encrypted on your group's phones: they are stored as ordinary text in our database in Australia, where the active members of that group can read them, and where our servers can read them while running a feature your group uses. The rules inside our database are what keep anybody else out, together with our commitment in section 7 not to read your group's content. A record encrypted between 30 September 2026 and that update stays encrypted until a phone that holds the key opens it, and is stored as ordinary text from then on; “Encrypt older baby records” is removed, because there is nothing left for it to do. Section 7 explains what this gives up, and the privacy impact assessment published on our register sets out why we decided it. A baby's name, times, types, amounts, doses, temperatures and growth measurements were never encrypted and are unchanged. - THE APP IS NOT A MEDICAL DEVICE. Nothing it records or shows is medical advice, and it does not diagnose. Consult a health professional for clinical concerns. - WHO CAN START OR JOIN A GROUP. While account creation is limited to authorised email addresses, your address must be authorised before you create an account. When sign-up opens more widely, prior authorisation of your address is no longer needed. Creating an account does not add you to a group. An account can do nothing in a group until it starts or joins one, and that needs a birth month on record showing you are 18 or over, or a parent or guardian in the group who invited you. A person aged 13 to 17 comes in only through a parent's or guardian's invitation, and a person under 13 cannot hold an account. If someone invites you as their child, you confirm on your own phone that they are your parent or guardian before they are linked to you; if you decline, their invitation and the month they gave are deleted. - CHILD ACCOUNTS. A person aged 13 to 17 may hold an account in a group, created by a parent or guardian who is an adult member of that group and who declares the child's age. A person younger than 13 is not an account holder at all; they are recorded the way a baby is, as the subject of an adult's own records. A child account has no assistant, no daily brief and no voice, and a child under 15 has their consents given by that parent or guardian; from 15 they may give some of their own, and from the month after their 16th birthday the account is an ordinary account, except that from the release after 30 September 2026 a young member aged 16 or 17 uses the assistant, the daily brief and voice only after saying yes themselves — until then our servers refuse those requests. The guardian link to a dependant's account continues until the young person turns 18. What a child account holds, who can see it and what a parent can do is set out in plain words inside the app, on the child's own "What your parent can see" page. That child is also entitled to their own privacy policy, written for them: the Children's Privacy Policy, available in the app from the same place and published at this policy's own web address. - WHAT A GUARDIAN CAN SEE AND DO FOR A DEPENDANT. As the parent or guardian who added a child to your group, you can see everything they do inside that group, the same as any other member — their tasks, their calendar, their chat messages, their photos and their game history. You cannot see the plan they keep for themselves; that is theirs alone, the same as anyone else's is theirs. You gave the consent that created their account, it lasts 12 months, we ask you again before it lapses, and you can withdraw it at any time; withdrawing does not remove their account by itself. Whether children may be members of your group at all is a decision you make together with any other owner or admin, and the whole group is told in the chat when it changes. The app does not tell you what your dependant looked at, or when. 5. ARTIFICIAL INTELLIGENCE Some features send text (and, when you attach one or Mail Sifter reads one, a picture) to a third-party AI provider to produce an answer. That provider is Google, on Vertex AI at its global location: a request may be processed in any country where Google operates, including the United States. It is sent as written — the names of people in your group are not replaced — and a baby's records or anything about health are sent the same way as everything else. We chose Google's global models because the ones it offers in Australia could no longer run the app well. We ask before your first use of AI features, and you can say no; the rest of the app works without them. Every group is Standard. No setting keeps a group's records away from AI: what the assistant, the daily brief and the other AI features read is processed as this section describes. - WHAT IS SENT: what you type or say to the assistant, plus a short, relevant excerpt of your group's context needed to answer it — for example the names of members it may assign a task to, or a recent summary of a child's day if you have turned that on. To answer a question about your group's plans — what is on, what needs doing, or what is for dinner — the assistant can look up your group's tasks, calendar and meal plans, and what it finds is sent with your question. For one question that look-up is capped: at most 6 look-ups, 50 items of one kind and 120 in all, a window of 31 days, and 32 KiB of text; the assistant is told when something was left out, so that it can say so. That look-up does not read an event's notes or place, a baby's records, your group chat or your photos. If your group uses Mail Sifter, a forwarded email's subject, sender and body — up to the whole message — are sent this way AT LEAST ONCE, automatically — by our server within about a minute of its arrival with nobody present or, if your group has turned off "Sort emails as they arrive", the first time an adult member opens the app after it arrives — so the assistant can judge whether it is worth acting on and suggest options; that attempt is repeated if an earlier one failed to complete, and again if an adult member later chooses "Turn into cards" to draft tasks and events from it directly. - WHAT IS NOT SENT: your group's chat messages, your photo wall, unless you attach one of its photos to a message to the assistant, and any part of your records the feature does not need. Nothing is sent unless you have taken an action that asks for an answer. - PICTURES IN MAIL SIFTER. From the app update released after 1 November 2026, our assistant server sends pictures shared into Mail Sifter from a phone and, if an owner or admin of your group has turned on reading pictures in emails, the pictures in a forwarded email, to Google's Gemini, on Vertex AI at its global location, to find the words they show. Each picture is made into a fresh copy first, so none of its metadata goes with it, and no names or faces in it are replaced. It never runs for anyone under 16, and for a 16- or 17-year-old it runs only after their own yes to AI features. TypeSafe never receives a picture. What was read is kept encrypted, only as long as the picture is (section 1). - ATTACHING A PHOTO OR A PDF. When you attach a photo (from your phone or taken there and then) or a PDF to a message to the assistant, on your own phone, our server reads it once to answer you. A photo is sent to Google's Gemini, on Vertex AI at its global location, for its words only: it is told never to describe, identify or guess anything about a person. A PDF's words are read on our server without AI, and only those words are sent. Card numbers, bank account numbers and codes are removed from what was read. We don't keep the file. What was read is saved with your message, encrypted under your own key, and deleted with your conversation after 30 days. If what was read looks like it's trying to give the assistant instructions, a separate check (also Gemini) tells you and the assistant doesn't use it. While a file is part of a conversation, the assistant can answer, including how your group is getting on, or suggest adding things to your calendar, tasks, shopping list or meal plan for you to approve; it cannot change members or settings, the baby tracker, games or routines, post to your group chat, or delete anything. You can tell it to forget the file and carry on. It is never available to members under 16, or to 16- or 17-year-olds who haven't turned on AI features. It is never sent to TypeSafe, and "Help us improve" records only the steps of these requests, never their words or the file. - FASTER TYPED COMMANDS: when an adult types one direct request to the assistant on their own phone, our server may propose one task, calendar, shopping, pantry or baby-log action, or a bounded answer or button opening an app view. When one request names several new tasks joined by “and” or commas, and nothing else about them, our server may propose them as those tasks together, all shown for your Approve before any is added; TypeSafe judges whether each “and” or comma separates two tasks, and then checks the list itself against your request. When one request asks for several different things, such as logging a feed and adding a task, joined by “and”, a comma, “then” or the end of a sentence, our server may propose dividing it into at most three parts, each of which must begin a request of its own, and TypeSafe judges, for each place it could divide, whether the words on either side ask for two separate things that each make sense on their own. TypeSafe sees only that request, with names from your group's member and baby lists replaced. The request is divided only when TypeSafe is sure about every place. Each part is then handled on its own: a part that is one of these commands gets its own check and always waits for your Approve, whatever its probability; any other part goes to the ordinary assistant with only that part's words, which answers it under its usual checks. A part never asks a guided question; if a part is missing a detail, the ordinary assistant asks for it instead. One reply shows what happened to each part, including a part that could not be done. Our server does not divide a request when a part does not begin a request of its own, when a later part refers back to an earlier one, for example with “it”, “that” or “there”, or when no part is one of these commands; then, or when TypeSafe is unsure, the whole request goes to the ordinary assistant as before. Dividing a request needs an app that can show the parts and your acknowledgement of this version of the policy. If a task create or assignment, one-off event create, or feed log is missing a required detail, the app may ask up to four fixed questions with choices or a place to type an answer. Your phone may also show unselected examples from the group clock, an explicitly logged bottle amount for that same baby in the past seven days, or the previous time of a matching past event. It reads those existing group records under your access, and does not send the history or unchosen options to TypeSafe, another model or a new suggestion service. The labels say “Recently logged” or “Previous event time”; an amount is not advice about what the baby needs and a past event time does not check availability. You can edit the original request or cancel; a guided question itself writes no group record, and TypeSafe sees nothing until the request is complete. If that guided route cannot continue, the ordinary assistant may handle the request and answers under its usual checks. If you type a new complete command instead, only those new words go to the ordinary assistant at the current group time; a plain Cancel ends the question without changing a record. An already-shown question can stay in app memory for up to 15 minutes if you briefly switch tabs to check something. It clears when you cancel, start a new request, lock or switch groups, change account or the group time zone, close the Assistant screen, or restart the app. A question or approval option arriving after you leave the tab is not kept; an ordinary saved reply or receipt may still arrive. When the command is complete, TypeSafe's Jev checks whether the proposed action and fields match your request and answers before any tool runs. TypeSafe, in the United States, receives only that current request or guided exchange of the original request and up to four answers, plus proposed fields, with names from your group's member and baby lists replaced; it does not receive your earlier conversation, and the only records it receives are the existing titles described next. When you say you have done something, or ask to reopen or add something, our server reads your group's open tasks and the routines that are due now — under your own access — narrows them to about eight by matching the words you used, and asks TypeSafe which one you mean, or none of them. Those titles are your group's own words, written by whichever member added each one, with names replaced; a title can name a child, an appointment or a care task, and nothing is sent for a request that did not ask to tick, reopen or create. They are sent for that one request and not stored for this purpose. TypeSafe's answer chooses only between titles our server found; it never picks a person. An answer can reveal who someone is, and can include health or baby information. A verification probability above 0.8 may run an action at once, with an Edit receipt on screen; Undo is offered only for a newly created task or event that can be safely reversed. A matched tick is the one loosely worded request that can act without waiting for your Approve, because it can be taken back. It acts only when the words you used for the job are that task's own title: then it ticks that row and names what it ticked. If our server reached the row by matching a word you shared with it rather than its title, it asks you first whatever the probability — a request that matches nothing of yours can otherwise read as a row that happens to share a word. A top choice that does not stand clear of the second also asks. A verification probability from 0.6 to 0.8 waits on your Approve, Edit or Cancel, without changing a record; a request our server read from looser everyday wording (for example a baby's name as the subject, or "X is done") always waits for your Approve, whatever its probability; that proposal stays only on the current screen and disappears on your next request, group switch or app restart. These probabilities are estimates, not guarantees of correctness. When you add something, the same titles answer a different question — whether your group already has that job — and if so you are asked "You already have …. Add another?" rather than a second copy appearing quietly; it can only ask, and a failed check never stops you adding. When you ask for a task and your words say how often it comes round ("add task bins every Tuesday"), one more yes/no question in the same check decides whether we offer "Make it a routine?"; our server, not TypeSafe, reads the schedule from your own words, you always confirm, and nothing is created from that answer. A request with several different actions that is not divided as described above, a lower probability or a failed check goes to the ordinary assistant before anything is changed; a guided fallback includes your answers so you do not need to repeat them. This faster route is only available after your app has shown this version's policy and recorded that you saw it — at sign-up, or when you tap OK on the change notice; the server checks that record and the app's capability. Older apps and members who have not seen this version continue with the ordinary assistant. It is not used by anyone under 18, at the shared display or for forwarded email. By voice, it is used only to tick off or reopen a task or routine: TypeSafe receives what you said and the titles described above, and the assistant always asks aloud, naming the task or routine, and changes nothing until you say yes. TypeSafe says it does not train on what it receives; we cannot promise it keeps nothing. Mail Sifter's separate rule still excludes emails using health words from TypeSafe. - CHOOSING WHICH PART OF THE ASSISTANT ANSWERS: when an adult types a request to the assistant that our server does not recognise as one of the faster commands above, TypeSafe’s Jev in the United States may first choose which part of the assistant answers it, and answer a few yes/no questions about it — for example whether it is one request, whether it asks to read or to change something, whether it asks to open a part of the app, and whether it refers back to earlier conversation — so the reply comes sooner. This widens what TypeSafe receives: until now it received only the assistant requests our server recognised as faster commands. It receives only that current request, with names from your group’s member and baby lists replaced; baby or health details can be included. It does not receive your earlier conversation, your group’s records or its member list. If it is unsure, the assistant sorts the request as before. Its choice decides only which part of the assistant answers, and that part then works under its usual checks. It is used only after your app has shown this version’s policy and recorded that you saw it. - TIDYING A TYPED SHOPPING ITEM: when an adult types an item onto a shopping list in Shopping, on their own phone, our server may ask TypeSafe’s Jev in the United States three narrow questions so the list stays tidy: whether the item is the same as one already on that list, whether one line is several items, and which aisle it belongs in. TypeSafe receives the words you typed, the handful of items already on that list that our own matching narrowed it to, and the app’s fixed list of aisles, with names from your group’s member and baby lists replaced. A shopping item can say what somebody needs — a pharmacy line, an infant formula, a food somebody has to avoid — and those words are sent as you wrote them. It does not receive the rest of the list, your group’s records or your conversation, and nothing is kept for this purpose. Our own code does every count, split and write: an item judged the same is added to the one already there, with Undo; a “related” item asks you whether it is new or the same; an uncertain split is put to you before anything is created; an aisle is set only when the answer is reasonably clear, and is “Other” otherwise. When TypeSafe is unavailable, and always for a Device-only group, the shared display or a child’s account, nothing is sent and the list behaves as it did before: an exact match or a new item, no split, “Other” for the aisle. This is used only after your app has shown this version’s policy and recorded that you saw it; older apps and members who have not seen this version keep the behaviour our code gives on its own. - ADD SEVERAL AND ROUTINE DESCRIPTIONS: when an eligible member taps “Sort these” on Add several, taps “Fill it in” after describing one routine, or dictates either one and pauses or presses Stop, our server sends the submitted words, with names from the group roster replaced, to TypeSafe’s Jev in the United States. Jev chooses whether the words are structured enough to read directly. For unstructured prose, the name-replaced words also go to Google’s Gemini at its global location to suggest item boundaries or a routine title and recurrence; Jev checks the resulting choices. The words may include health or child details despite name replacement. No existing group records or roster are sent for these steps. Nothing is saved until you review and accept the list or check the routine form and tap “Keep it”. Add several is unavailable for Device-only groups; neither model route is available for child accounts or the shared display, and a young member aged 16 or 17 uses them only after saying yes themselves. - WHILE YOU DICTATE: when an eligible member dictates into the assistant, Add several or a routine description on their own phone, our server may ask TypeSafe’s Jev in the United States, at most twice for each message, whether the words so far sound finished, so the microphone stops sooner or waits longer. TypeSafe receives only the words said so far and whether you are asking the assistant, listing things to add or describing a routine, with names from your group’s member and baby lists replaced. This happens while you are still speaking, so words from a message you then cancel may already have been sent. Nothing is kept for this purpose. It is not used in group chat, at the shared display, for a Device-only group or a child’s account, and a young member aged 16 or 17 is included only after saying yes themselves. It is used only after your app has shown this version’s policy and recorded that you saw it; otherwise, and whenever TypeSafe does not answer in time, the app decides from the words alone as before. - YOUR VOICE AUDIO IS NEVER SENT TO US. Speech is transcribed on your device where the platform supports it, and by the platform's own service where it does not. There is no setting to refuse the platform's service; if you don't want it used, type instead on that phone. Until 23 October 2026 you could choose on-device only; that choice has been removed, and anyone who had it on now uses the platform's service when their phone can't transcribe on its own, and is told so each time. We receive text, never a recording, and we do not store audio. - TRAINING: we do not use your data to train AI models. The AI providers we use say in their terms that they process a request to return an answer and do not use it to train their models; that is their promise, which we cannot check ourselves. We do not say they keep nothing: a provider may keep a request for a limited time under its own terms, for example to look for abuse. - YOUR ASSISTANT CONVERSATION IS ENCRYPTED ON YOUR DEVICE. This applies to messages written from September 2026, once your device has begun encrypting. A message you type to the assistant is encrypted on your phone before it is saved, under a key held only by your own devices. Conversations from before that remain ordinary text until you run "Encrypt your past conversations" in the app's settings. A voice assistant request is written into your conversation by our servers, which hold no such key, so from 30 September 2026 it carries no words at all: only the record of what happened described in section 6, from which your phone writes the line you see. Voice requests from before then were saved there as ordinary text, and are deleted with the rest of the conversation after 30 days. Encrypting the record does not change what is sent to answer you: the text of your question still goes to the AI provider, as described above. From the app update released after 20 October 2026, if your phone loses the connection while the assistant is answering — for example because you locked it or switched apps — our assistant server keeps that answer in its memory so your phone can collect it within five minutes when you come back, instead of the answer being lost. After five minutes it can no longer be collected, and it is erased the next time our server handles a request, or when the server stops. It is never saved to our database or our logs, only your account can collect it, it is handed over once, and it is not kept for the shared display. Nothing is kept for you until you have seen this version of this policy. - VIEWS IN THE ASSISTANT'S REPLIES. A reply can show you up to three views from your tools — your group's tasks, its agenda, a day of a meal plan, a baby's tracker or growth chart, or your games — or a button that opens photos, Mail Sifter, Shopping, your other calendars, the Ceremonies screen or Edit Home. The app chooses which, never the AI model, which does not see them. With the reply we save a short pointer to each, never a copy of what it showed: which kind of view it is, whether you asked for it, and at most the meal plan and day, or the baby, it is about. The buttons that open photos, Mail Sifter, Shopping, your other calendars, the Ceremonies screen or Edit Home save nothing that points at a photo, an email, a calendar entry, a ceremony or your Home. A view is drawn afresh from your group's records each time you look, only while that group is the one open in the app, and says it is unavailable if the record has gone or you can no longer see it. The pointers are kept with your assistant conversation, no other member can see them, and they are deleted with it after 30 days. Unlike the words of your conversation, they are not encrypted on your device. - HELPING US IMPROVE IT IS A SEPARATE, OPTIONAL CHOICE. A switch in the app's settings, off unless you turn it on, sends a record of how the assistant and our other AI features handled each request you make in the app to LangSmith, a tracing service run by LangChain, Inc. (a United States company), which stores it in its Australian region. We use it to find out why something went wrong, did not answer or took too long. EVERY RECORD HOLDS which feature you used, when, how long it took and how it ended — including an error, a request you gave up waiting for, or whether an answer was reused — and each AI model it asked, how long that took and how much text (tokens) it used; for the assistant, also the kinds of request it found in your message and each tool it used and whether a change was saved and, under the newer words below, whether you then undid, edited, approved or cancelled it, or sent feedback, and whether you are 18 or over; for the daily brief, how its edition was made, as codes and counts. A record carries a code made from your account, which we can link back to you and LangChain cannot. A TYPED ASSISTANT REQUEST'S RECORD ALSO HOLDS THE WORDS, whatever the request is about, the baby tracker, health and group management included: what you asked, each fixed question and answer in a guided request, the instructions the assistant was given, the recent conversation it was shown, what it looked up in your group (such as task titles, events, shopping lists, meal plans and baby records), what it wrote back and what it changed. Before a record leaves our server, the names of people in your group and of babies in the tracker are replaced, and identifiers, email addresses and anything that looks like a password or key are removed. Names that are not on your group's list, such as a teacher's or a nickname, are not replaced. WORDS YOU TYPE OR DICTATE INTO ADD SEVERAL TASKS, ADD SEVERAL EVENTS OR DESCRIBE A ROUTINE ARE KEPT TOO: what you typed or what your phone heard you say, what our AI services were sent and what they suggested, with the same names replaced. THESE KEEP ONLY THE STEPS, NOT THE WORDS: forwarded emails, and the daily brief and our other AI features outside the assistant, except a Shopping run shared using its separate choice below. Neither audio nor a spoken assistant request is recorded, and nothing is recorded from your group's shared wall screen. A child account has no assistant. IF YOU TURN THE SWITCH ON UNDER THESE WORDS, AN AI CODING ASSISTANT MAY READ A RECORD'S WORDS to help us find what went wrong: Claude Code, using Claude, an AI model made by Anthropic that Google runs for us on Vertex AI at its global location, which may process them in any country where Google operates, including the United States. Google says it does not train its models on them; that is its promise, which we cannot check ourselves. It reads only records from adults, never what the assistant looked up in your group and never a request about the baby tracker. We keep only what we found, in our own words, and delete the rest the same day. IF YOU TURN THE SWITCH ON UNDER THE NEWER WORDS, AN AI MODEL ALSO READS EACH RECORD AUTOMATICALLY: Gemini, which Google runs for us on Vertex AI in Sydney. It sorts the record into categories from a fixed list (what kind of thing you asked, which tools ran, how it ended, how long it took and whether you undid or changed the result) and, when something went wrong, writes a made-up example of the same problem with invented names, dates and details. A person on our team compares each example with the record before we keep it for our tests, and deletes any they cannot check within 14 days. It reads only records from adults, and never the words of a request about the baby tracker, what the assistant looked up in your group or a forwarded email; for those it keeps only categories made from the steps. We keep the categories for 24 months and the checked examples while we use them to test the assistant. Neither holds your words, your account, your group or the time of day, so once LangSmith has deleted the record we cannot find yours to delete them. IF YOU TURN THE SWITCH ON UNDER THE NEWER WORDS, PEOPLE ON OUR TEAM MAY ALSO STUDY A RECORD WITH AI TOOLS: Claude Code, made by Anthropic; Codex, made by OpenAI; and Antigravity, made by Google. All three are United States companies and may process what they receive outside Australia, including in the United States. We use them only under business accounts whose terms say they won't train their AI models on it and will delete it within 30 days; that is their promise, which we cannot check ourselves. They receive only the parts of records a question needs, with names and identifiers replaced, never a request about the baby tracker or what the assistant looked up in your group, and a request that mentions health only through Google. We keep only what we found, in our own words, and delete our copies the same day. LangSmith deletes the records after 14 days, and we can delete yours sooner if you ask. With this switch off, none of these requests is sent there; Shopping has its own separate choice below. It applies to your own requests only, from the moment you turn it on; we ask again every 12 months, and turning it off is one tap in the same place. We changed what it records on 2 October 2026, so if you turned the switch on before then it is off until you choose again. On 3 October 2026 we began keeping the words of requests about the baby tracker, health, group management and summaries too; a switch turned on from 2 October stays on, and you can turn it off in the same place. - SHOPPING FILLS A WOOLWORTHS CART ON YOUR PHONE, ONLY WHEN YOU START IT. You sign in to Woolworths inside the app, and you enter your sign-in on Woolworths' own page. The screenshot exception below applies. From the app update released after 9 November 2026, you sign in on Woolworths' own page. GroupApp doesn't collect or save your retailer email, password or code. The update deletes the app's old saved copies for accounts it can identify, without reading them, and retries failures. Older account keys that this phone can no longer identify may remain; we can't claim every old copy is gone. Woolworths can keep its own sign-in session until you disconnect; another GroupApp member taking the browser still clears the previous session. For each item you include, its words, the amount on your list if the words don't already say it (a number and a standard measure, such as 1 L or 3 each), and up to 24 product options from Woolworths' search go first to TypeSafe's Jev in the United States, with names from your group's member and baby lists replaced in the item's words, and its pick is used only when it gives that pick a probability of at least 0.9, which is an estimate and not a guarantee, and the app's own checks of availability, quantity and price pass; otherwise they go to Google's AI service described above, which picks a product. If none fits, it may ask for up to two more Woolworths searches for that item, with words the app checks first, and look at one product's Woolworths page, from which the app reads only its size, unit price, price, whether it's in stock, any special and its earlier price, its Health Star Rating, the allergens it declares and, for an item that names a dietary need or an allergy, its ingredients line; those details go to Google's AI service too, never to TypeSafe. A shop set to Premium products, and an item whose words name a dietary need or an allergy, go only to Google's AI service. Your group can keep shopping notes, a list of short sentences such as "Free range eggs only". They are stored on our server for the group and every adult in the group can read, add, cross out and change them. Children and managed accounts cannot. While anyone in the group runs a shop, notes that aren't crossed out may go with an item to Google's AI service described above, or to TypeSafe's Jev in the United States for eligible product checks. Names from your group's member and baby lists are replaced first; other names and identifying details may remain. Saved product choices aren't reused in a shop with notes. Crossed-out notes aren't sent and are deleted after 30 days. If you leave the group or delete your account, the notes you wrote are deleted. Deleting the group deletes its notes, and an export of your data includes the notes you wrote. A search the AI asks for can reflect what a note means, but not repeat its words. Notes are preferences, not a safety check: the app warns you about allergy or medical words and still saves them, and nothing checks a product against a note, so check labels yourself and write a need on the item so the app asks you. Notes are for adults, only after your app has shown this version's policy and recorded that you saw it. An item can say what somebody needs — a pharmacy line, an infant formula, a food somebody has to avoid — and those words are sent as you wrote them. Apart from active shopping notes described below, TypeSafe receives nothing else of your group's, and we keep nothing for this purpose; it is asked only after your app has shown this version's policy and recorded that you saw it. If the app cannot make sense of a Woolworths or Coles page, it may send that page's buttons and text, or on iPhone a picture of the retailer view, to Google's AI service to find the right button. These can include your name, email, address and cart. The picture may accidentally include sensitive details hidden on the page, including passwords, codes, payment details or things you typed. The app checks for sensitive and editable fields, but its checks can miss hidden fields. It does not intentionally capture sign-in, verification, payment, checkout or order pages, or pages you are controlling. We do not keep the picture or page content in logs, records or on the phone; Google's retention terms are described above. The items go into your own Woolworths cart, and “Open Woolworths cart” opens Woolworths' own app at the page where you check the cart and order. GroupApp does not pay or place the order, and it never makes a Woolworths list. We keep only the token and cost counts of these requests. While a shop is running, the other members of your group see that you are doing it, the store you chose and how far it has got — never the items, because they are already on your group's lists, and never your address if you chose delivery, only that you did. One member at a time can fill your group's Woolworths cart. You can also ask for a task for someone to arrange the pickup; it asks them to check the cart and order in Woolworths, because nothing has been ordered. Accounts under 16, shared displays and groups set to Device-only cannot fill a cart, a member aged 16 or 17 needs their AI choice turned on, and the task to arrange the pickup is never given to an account under 16. Shopping's lists are your group's tasks, shown in one place. - HELP US IMPROVE SHOPPING is a separate checkbox at the start of each Shopping run, off by default. It shares that run’s searches and product options, including the product details read from a product page, your group's shopping notes that aren't crossed out, how many there are and which ones the AI said changed a decision, AI instructions and answers, checked choices and quantities, cart changes and verification, pauses, cancellation and attempted handover to the retailer app. Login fields, passwords, codes, cookies, addresses, payment details and full browser pages are excluded. Names from your group are replaced before sending; other names and dietary or health details in item words and notes can remain. The same LangSmith Australian storage, 14-day retention and deletion-on-request process above apply. When shopping gets stuck, its record also includes the retailer, page type, failed rule, fallback level, outcome, app and bundle versions, and a text-free outline of the page's structure. Those details contain no page text, labels, model reply, screenshot or identifiers. The checkbox covers this run only and never turns on assistant tracing. “Stop sharing this run” stops new uploads from this phone; records already sent or in flight remain. Notes already in a saved record aren't removed when the note is deleted. Failed uploads or an interrupted phone can leave an incomplete record. What you do after opening the retailer app is not recorded by GroupApp. - HELP IMPROVE PRODUCT MATCHING is a separate switch in Shopping's settings, off unless you turn it on, kept on your phone and used only for shops you run. The prices seen in a cart, described in section 1, are recorded during a shop whether this is on or off. What the switch adds is a record of each product decision: the ingredient as our catalogue names it, the products that were offered with their prices, the one that was chosen, the ones that were not, the quantity, the setting, one reason from a short fixed list, and what the check of the cart found. It is kept twice. Once with the shopping record above, for 14 days, which also needs that run's own checkbox, because without it there is no record to add to. And once as rows we keep for longer that hold nothing pointing at anyone — no group, member, store, shop, task, time of day, or anything anyone typed. Only items that came from one of our recipe plans or our pantry list are described this way, so something you typed yourself is never in it. Your phone asks you again after 12 months. Turning the switch off stops new records; the 14-day ones can be deleted on request, and the longer-kept ones cannot, because nothing in them says they are yours. Saved product choices are separate, and “Clear saved product choices” in the same settings removes them. - YOUR GROUP'S PRIVACY LEVEL: every group is Standard. The summary at the top of this policy says what is encrypted on your phones, what our servers can open and when, and what stays readable. At Standard a copy of the group's key is kept for our assistant server so that it can open your group's encrypted writing — apart from chat, photos and each member's own private plan, though a goal a member has chosen to share with the group is opened the same as anything else — while answering one of you, writing the daily brief, sorting an email, running a search you asked for or helping with a ceremony. Before the app update released after 30 September 2026 that same key also protected chat and photos; after that update your group's phones will move chat and photos, group by group, onto a key our servers never receive, and the Privacy screen says when that has finished for your group. Anything saved before your phone began encrypting it, or by an older version of the app, stays readable until a member encrypts it from Devices and keys. Until October 2026 there were also an Australia level and two Global levels, and until November 2026 a Device-only level; a group at any of them is now at Standard. An event group — a temporary group made from another for one occasion — has no assistant, daily brief or voice at any level. Until 30 September 2026 an event group made by a Device-only group was set to the Australia level (now Standard) rather than Device-only; we are moving each of those to the level of the group that made it and saying so in its own chat. From the app update released after 17 October 2026 the level no longer decides whether your group's everyday records are encrypted, because they are not: they are stored as ordinary text. - SEARCHING YOUR TASKS BY MEANING. Typing in the search box on your Tasks tab matches words in the tasks already on your phone, and nothing leaves it. Pressing Search sends what you typed, compared against your group's own task titles and notes, to find tasks that mean the same thing even if the words differ. That comparison happens in Australia and is not stored: we compare it once, to answer that one search, and then forget it. Where your tasks are encrypted, our server opens their titles and notes for that one search with the copy of your group's key described under privacy levels, and keeps nothing it opened. A Device-only group's task text is never sent to be compared, because that would break what that level keeps off our servers: in a Device-only group, pressing Search instead finds tasks with a similar spelling among those already on your phone, worked out on your phone, and nothing leaves it. Search by meaning is not available on a child's account in other groups; typing still finds tasks on the phone either way. - SUGGESTED START TIMES AND MEAL SEARCH, WORKED OUT ON YOUR PHONE. When you type the title of a new event, your phone reads your group's 300 most recent past events (as your calendar already does) and compares the title with them there, by spelling — no model is involved, and the title is not sent to us. Searching meal plans works the same way: the plans you can see, and the names of their recipes, are read to your phone, and what you type is compared there. Each time you save an event after the app looked for a suggested time, we keep one count: which kind of match answered (the same title, a similar spelling, or none), whether you kept, changed or overrode the suggestion, and how long the look-up took. It holds no title, nothing you typed, and no member's name, and it is deleted with the group. A task's time of day is suggested the same way, and only as an offer: when you give a task a date, your phone compares its name with your group's own past tasks it is already holding, and shows one time beside the other choices — the most recent — where at least three similarly named past tasks agree within half an hour. What you typed is not sent to us, nothing is filled in, no time is saved unless you tap it, and we keep no count of that one at all. - THE DAILY BRIEF. From the app update released after 23 October 2026, the daily brief is written on our servers for every adult in a Standard group, paid from a separate A$0.50 a week set aside for the group's daily brief. There is no switch. A member who earlier said no gets it only after their app has shown this version of the policy. It is never written for anyone under 16, a member aged 16 or 17 gets it only after saying yes themselves, and a Device-only group has no daily brief. - A plain-language explanation of exactly what the assistant can and cannot see is available in the app, under the assistant and voice settings. - AUTOMATED DECISIONS: a model makes three kinds of decision on its own. It may choose WHO should do a task or calendar item, from a list the app has already worked out, and any of you can change that assignment at any time. When you fill a Woolworths cart from your group's lists, it chooses which product goes in — TypeSafe's Jev when it gives its pick a probability of at least 0.9, except for Premium products, otherwise Google's models — from the options Woolworths' own searches returned for that item, including up to two more searches it asked for: only from those, with the quantity checked by the app itself, and when the match is unclear the shop asks you and carries on with the rest. It takes your group's shopping notes into account and may tell you which note it says changed a choice. That is its own report and not a check that the product meets the note; it may not name a note even when one mattered. You check the cart and order in Woolworths, so nothing it chooses is bought until you do. For some single direct requests an adult types to the assistant, fixed questions may first collect up to four missing details; asking a question makes no change. If that guided route cannot continue, the ordinary assistant handles the exchange under its usual checks. TypeSafe then checks whether the action our server proposed matches the current request or completed guided exchange before the existing tool runs; this can include a baby-log request, but is not a judgment about the baby's health. When one request names several new tasks joined by “and” or commas, it also judges whether each join separates two tasks; a request it reads as several tasks always waits for your Approve, and nothing in it is added before then. When one request asks for several different things, it also judges where that request divides; each part is then handled on its own, a part that is one of these commands always waits for your Approve, and a wrong division could carry out one part without the rest. It may also choose WHICH of your group's existing tasks or due routines you meant when you say you have done one, from a short list our server found by matching your words — a wrong choice would tick the wrong record, so it acts on its own only when your words are that task's own title, and anything else asks you first whatever the probability. A strong match may act with an Edit receipt, and Undo for a safely reversible new task or event; a less certain match waits for Approve, Edit or Cancel, and the probability is an estimate rather than a guarantee. A wrong check could change the wrong record. The model never decides what needs doing, makes a clinical judgment about a person's health or a child's wellbeing, or decides who is in your group. Two other automated decisions are made without a model. The app may suggest a start time for a new event from your group's own past events, and a time of day for a task from your group's own past tasks, which you can change or leave alone before saving, worked out on your phone as described above. And, only if you switch it on, Arrange by use can change the order of the unpinned widgets on your Home, by a fixed rule worked out on your phone from your own use of a few tools there — section 10 says what it uses and how to turn it off. A plain-language explanation is available in the app, under the assistant settings. 6. VOICE ASSISTANTS AND CONNECTED DEVICES If you connect a phone, watch or speaker, that device holds a narrow credential rather than your login. You can see and revoke every connected device in the app at any time. A spoken answer is heard by whoever is in the room, so the assistant will not read out a child's name or their records to a shared device unless you have allowed it. WHAT WE KEEP FROM A VOICE REQUEST: the words are sent to answer you, as section 5 describes, and from 30 September 2026 we do not keep them, or what was said back. We keep a record of each request: the kind of request, the device it came from, whether it worked and why not, which task, event or card it made, which child a feed request was about, and when. No other member of your group can see that record. Anything the request made — a task, an event, a card waiting for your OK — holds its own words, like anything else in the app. If your weekly allowance has run out, the request is not sent and not kept, and the reply says so. Before 30 September 2026 we also kept the text of each request and reply; we are deleting it. 7. DATA STORAGE, SECURITY & RETENTION Data is stored in encrypted cloud database infrastructure, and access is enforced per group by Row Level Security policies rather than by application code alone. Photographs are stored in private buckets and are served through short-lived signed links. - YOUR GROUP'S EVERYDAY RECORDS ARE NOT ENCRYPTED ON YOUR PHONES, FROM THE APP UPDATE RELEASED AFTER 17 OCTOBER 2026. Tasks and their completion history, your calendar's names, notes and places, shopping lists and their items, the meal plans your group makes, the words in the baby tracker, ceremony posts and outcomes, your games, each edition of the daily brief and each member's own plan are stored as ordinary text in our database in Australia. Who may read them is decided inside the database, per group: the active members of that group, and for a member's own plan only that member. They are encrypted in transit, the disks and backups they sit on are encrypted, and our own backup key is held outside our cloud providers — but a copy of our database holds the words, so what keeps us out of them is who may run a query against it and our commitment in this section not to read your group's content, rather than a key your phones hold. Between 30 September 2026 and that update these records were encrypted on your group's phones, under a key a copy of which was also kept for our assistant server unless the group was Device-only; the bullets below describe that arrangement, and it still applies to a record written then, which stays encrypted until a phone that holds the key opens it and is stored as ordinary text from then on. Nothing encrypts more of them: the jobs that used to are removed with the same update, and the jobs for older chat messages and photos stay. Why we decided this was the right trade, and what it gives up, is set out in the privacy impact assessment published on our register. - WHETHER YOUR GROUP'S CHAT AND PHOTOS ARE ENCRYPTED IS YOUR GROUP'S OWN CHOICE, FROM THE APP UPDATE RELEASED AFTER 18 OCTOBER 2026. A group made after that update stores its chat messages, photos, captions, album names and comments as ordinary text in our database in Australia. Who may read them is decided inside the database, per group: the active members of that group and nobody else. Photographs sit in private storage reached through short-lived links, everything travels encrypted, and the disks and backups are encrypted — but a copy of our database holds the words and the pictures, so what keeps us out of them is who may run a query against it and our commitment in this section not to read your group's content, rather than a key your phones hold. An owner or admin turns encryption on, in Manage group or when the group is made, by setting a GROUP PASSWORD: at least 10 characters, made of at least five different ones, not one of the most common passwords, and not containing your group's name, with a button that offers a strong one if you would rather not think of your own. It is typed on their phone and used there to lock a copy of every version of your group's key: we never receive the password, we never receive the key, and nothing on our side can test a guess at either. From then on your group's phones encrypt what they send; every phone already in your group keeps reading without anybody typing anything; and a member's new phone opens the group's whole history — including messages and photos sent before that phone existed — with the password alone. Only members of your group aged 18 or over are shown the password, and only on a phone that already holds the key. Members under 18, and members whose age we do not hold, read your group's chat and photos on their own phones and are never shown it. An owner or admin can change the password, which stops the old one working as soon as the change finishes, or turn encryption off, after which chat and photos sent from then on are stored as ordinary text while everything already encrypted stays encrypted and stays readable only on the phones that hold the key. If your group forgets its password and no phone in it still holds the key, we cannot recover what was encrypted: we hold no copy of the password, no hint, and no way to reset it. Your group is told each time: when encryption is turned on, when the password is changed and when encryption is turned off, our database writes a line into your group's own chat naming who did it and which way it went, in the same step as the change itself, so it cannot be done quietly. That line carries no part of the password. Groups that were already encrypting chat and photos before this update keep doing so, read everything exactly as before, and are asked once to set a Group Password or turn encryption off. Why we made encryption a choice, and what it costs, is in the assessment we publish for this change. - GROUP CHAT MESSAGES ARE ENCRYPTED ON THE SENDER'S DEVICE. This applies to messages sent from September 2026, once a device in your group has begun encrypting. A message, and the quote a reply carries, are encrypted before they are sent, under your group's key, which your group's devices hold. At every level except Device-only a copy of that key is also kept for our assistant server, as section 5 describes, and nothing on our side uses it to open messages; after the app update released after 30 September 2026 your group's phones will move messages and photos, group by group, onto a key our servers never receive, and the app's Privacy screen says when that has finished for your group. Messages from before that remain ordinary text until someone in the group runs "Encrypt older messages" from the chat, and until it finishes both kinds are there at once. A notification about a message in a group whose chat is encrypted tells you who sent it and which group it was in, and does not carry the message, because it is encrypted before it reaches us. If your group loses every device and its Group Password, the encrypted messages cannot be recovered — by you or by us. From the app update released after 18 October 2026 this paragraph describes a group that has encryption on: a group made after that update starts with its chat stored as ordinary text, as the bullet above says, and a message encrypted before the group turned encryption off stays encrypted. - THE DAILY BRIEF IS STORED AS ORDINARY TEXT, FROM THE APP UPDATE RELEASED AFTER 17 OCTOBER 2026. Each edition is stored in our database in Australia, where the active adult members of your group read it and where our assistant server, which writes it, can read it too. Until that update this applied, and it still applies to an edition written before it, which stays encrypted until a phone that holds the key opens it. From the first release after 30 September 2026, the words of each edition of your group's daily brief are encrypted by our assistant server when it writes them, with the copy of your group's key described in section 5, and your phone opens them with its own copy. An older version of the app that cannot do this is sent the words by our assistant server, which opens them for that one request. Our assistant server writes the brief from your group's titles, so it reads them when it writes it; encrypting the stored edition protects a copy of our database, not the brief from our assistant server. If your group's phones have not shared a key with our servers, the brief is stored as ordinary text, as it was before. The older brief each member got on their own, which versions of the app from before the shared brief still ask for, is no longer stored by our assistant server; versions from before 9 September 2026 are answered by an older service that still stores it as ordinary text for up to three days after it expires, until it is retired. - YOUR PLAN IS STORED AS ORDINARY TEXT, AND NO OTHER MEMBER OF YOUR GROUP CAN READ IT UNLESS YOU SHOW THEM A GOAL, FROM THE APP UPDATE RELEASED AFTER 17 OCTOBER 2026. The words of your own plan are stored in our database in Australia, where the rules inside the database let you read them and no other member of your group, and where our servers can read them while running something you asked for. The one exception is the one you make yourself: if you show a goal to your group, from that same update the rules inside the database let the members of that group read that goal's line, and nothing else of the plan it sits in — not why you wrote it, not what might get in the way, not when, and not who it is for. Taking it back closes it again. Until that update this applied, and it still applies to a plan item written before it, which stays encrypted until your phone opens it. From the first app version released after 30 September 2026, the words of your own plan — what you plan to do, why, what might get in the way, when, and who it is for when that is a pet — are encrypted on your phone before they are saved, under your own key, which our servers are never given. A goal you choose to show the group is encrypted under your group's key instead, so the people you showed it to can read it, and your reasons for it stay under your own key. Items from before that are encrypted by your phone the next time it loads your plan. A phone that has not been given your key yet saves your plan as ordinary text, as before. Anything you choose to send from your plan — a plan you post in the group chat, or a goal you add to the group's list — becomes that message or task, and is protected the way that message or task is. When you ask what a goal would take, your phone sends that goal's line with the request, as section 5 describes. - MAIL SIFTER EMAILS ARE ENCRYPTED AS THEY ARRIVE, once an owner or admin of your group has opened Mail Sifter on a version of the app released after 30 September 2026. The subject, body, sender, attachment names and attached files are encrypted with a key your group's phones hold, and your group's note to the assistant is encrypted the same way as event notes. What the assistant made of an email is encrypted too, apart from the kind of each suggestion and any date or time, which stay readable so that our database can keep refusing a suggestion that is not a task or an event. Our assistant server can open an email inside a request a member's app makes. Mail that arrived before your group set this up is kept as it was sent until it is dealt with or reaches its 30 days. - CARDS ARE ENCRYPTED WHEN THEY ARE SAVED. The words inside a card the assistant or Mail Sifter raises — a draft's title, a spoken note, a medicine's name, an email's subject, summary and suggestions — are encrypted with your group's key by the phone that saves the card, or by our assistant server when a voice request or Mail Sifter’s arrival sorting raises it. What stays readable is what the card is about: its kind, the record it points to, and any date or time. A phone that has not yet been given your group's key saves a card as before, and every card is deleted 30 days after it was raised. Our assistant server can open a card inside a request a member's app makes. - THE KEY OUR SERVER HOLDS, AND HOW WE WOULD KNOW IT WAS USED. At every level except Device-only, the copy of your group's key kept for our assistant server is itself locked by a key in Google Cloud's key service, in Australia, kept apart from our database. From the app update released after 30 September 2026 that copy opens your group's encrypted writing but, once your group's phones have finished moving chat and photos, not chat, photos or anyone's own private plan — a goal someone has chosen to share with the group is different, and stays open to it like the rest of your group's writing. Each time our server unlocks it, it first writes a record of the attempt — which member's request it was for, or that it was Mail Sifter sorting an arrived email with nobody present, what for, and whether it went through — and no other member, admins included, can read the records of your requests. We are also switching on Google's own record of each use of that key, kept where we cannot delete it, and will compare the two every night; the app's Privacy screen says when that runs. These records let us find out afterwards that the key was used; they do not prevent a misuse, and one unlock can open many items within the request or arrival sort it was for. From the app update released after 17 October 2026 your group's everyday records are not encrypted at all, so that copy no longer opens anything in them: what it opens is the cards the assistant raises, email forwarded to your group, and a record your group encrypted before that update, until a phone that holds the key opens it. - A NEW PHONE AND YOUR GROUP'S KEY. A new phone gets your group's key from another of your phones or from an owner or admin of your group, after they compare safety words; for chat and photos, it can also use the Group Password if your group has one. Our server no longer gives a waiting phone a key; automatic delivery was retired on 23 October 2026, and earlier delivery notices stay in your group's chat. When someone joins, is approved, or a new phone is given your group's key, a notice is recorded in your group's chat, and any member can use a delivery notice to revoke that phone's key. A notice is recorded, not necessarily seen: it does not badge or notify, and one written by our database is not evidence against someone who controls our database. - YOUR GROUP'S EARLIER MESSAGES REACH EVERY MEMBER. From the app update released after 14 October 2026, once an owner or admin of your group turns it on, your group's phones send the group's earlier keys to the phones of everyone in it, so every member can read the group's earlier messages and photos, including people who joined after they were written. Your group is told in its chat when this is turned on, and a person joining is told before they join. A group that gets its key while its founder is its only member has it from the start. A child's phone receives these keys only after an adult in the group has acknowledged it for them, and a shared display never receives them. Each copy is locked so that only the phone it is sent to can open it. Sharing stops if a key change in your group could not be checked, until an owner or admin confirms the group's phones, and in one case until our support has checked them first. Until your group's chat and photos have moved onto a key our servers never receive (section 5), someone who broke into our assistant server, or its access to Google's key service, could use the copy of your group's key kept there to make a phone they control look like one that holds the key, and so receive your group's earlier keys. That is a limit of the current arrangement, and we do not claim protection against it. - WHO AT GROUPAPP READS YOUR CONTENT: nobody, as a matter of this policy. Our servers open your group's content only to run the features you use. People at GroupApp see it only when you send it to us — an improvement trace you switched on, or an item you send with "Send feedback to GroupApp" — when you show it to us while asking for help, or when the law requires us to hand over what we hold. Reading your content for any other reason would break our privacy policy. For what our servers can open, this commitment and the records above are what stand in the way, not encryption. From the app update released after 17 October 2026 that is also true of your group's everyday records, which are not encrypted at all: the rules inside our database decide who may read them, and this commitment is what keeps us from reading them ourselves. WHO HANDLES YOUR INFORMATION FOR US: besides our own servers, these services handle some of your information on our behalf. None may use it for its own purposes. - DATABASE AND FILES: Supabase, Inc. (a United States company) hosts our database, file storage and the small server functions around them, in its Sydney region. - OUR ASSISTANT SERVER, AI MODELS AND KEYS: Google Cloud (Google LLC, a United States company) runs our assistant server and the key service described above in Australia, and provides the AI models described in section 5 — Gemini 4 Argon, Gemini 3.8 Flash, Gemini 3.7 Flash and Gemini 3.5 Flash-Lite, on Vertex AI at its global location, which may process a request in any country where Google operates, including the United States. If you switch on "Help us improve", Google also runs Claude, an AI model made by Anthropic, on Vertex AI at its global location, which may read the words of some of those records to help us find what went wrong, as described in section 5. If you switch it on under the newer words, Gemini, on Vertex AI in Sydney, also reads those records automatically, as described in section 5. Its model service receives the text of a request, names included; pictures from Mail Sifter, with any names and faces in them; any photo you attach to a message to the assistant, with any names and faces in it; the words of any PDF you attach; and anything our server opened to answer it. The comparison behind task search runs in Australia. - OTHER AI PROVIDERS: OpenRouter, Inc. (a United States company) passes some requests to a model's own provider, for versions of the app from before 30 September 2026 that still use them: meal search, the older daily brief and task suggestions. TypeSafe, hosted in the United States, checks some single requests adults type to the assistant, and spoken requests to tick off or reopen something, before existing tools run, may choose which part of the assistant answers other typed requests, reads the words submitted to Add several or a routine description, and may choose a Woolworths product, as described in section 5, and separately judges forwarded email for every group using Mail Sifter, as described in section 1. If you switch on "Help us improve", LangSmith (LangChain, Inc., a United States company) stores the record described in section 5 in its Australian region. If you switch on "Help us improve" under the newer words, Anthropic and OpenAI (United States companies) may receive parts of those records when our team studies them with their tools, as described in section 5. - EMAIL: Resend, which receives email forwarded to Mail Sifter and keeps its own copy in Japan for up to 30 days (section 1), and which sends each item you send us with "Send feedback to GroupApp" to our team's inbox at help@groupapp.ai. Resend also sends the emails that let you sign in to your account and keep it safe: sign-up confirmations, sign-in codes, password resets, and the codes that confirm a new email address or a security check. - ERROR REPORTS: when the app crashes or hits an error, it sends a report to Sentry, run by Functional Software, Inc. (a United States company), which stores it in its European Union region (Germany). A report describes the error and the phone — the app version, the operating system, the screen that was open and the steps just before it. Before a report leaves the phone the app removes your email address, the details of any request, the query part of web addresses, and any field it recognises as content, such as a message, note, title or name; an error's own description can still include a short piece of what the app was handling when it failed. Any timing record (a performance trace) the app sends has the same details removed. We use these reports only to find and fix faults. - PUSH NOTIFICATIONS: to deliver a notification, our servers hand it to Expo, run by 650 Industries, Inc. (a United States company), which passes it to Apple's or Google's notification service (Apple Inc. and Google LLC, United States companies) for your phone. The notification's words travel through them, together with the push token that identifies your device to them. FROM THE APP UPDATE RELEASED WITH THIS VERSION, A NOTIFICATION CAN SHOW WHAT WAS WRITTEN: the start of a chat message (about 140 characters) or a photo's caption, and the title of a new task or of a task or event you are reminded about. Those words then pass through Expo, Apple and Google, outside Australia (Apple or Google keeps them for up to a day if your phone is offline), and show on your phone and any watch paired with it. It is on unless you turn off "Show message text in notifications" in You → Notifications. It is always off for members under 16 and a message from a member under 16 shows only that they sent one. It never applies to a group whose chat is encrypted or a shared display, and notes, the baby tracker, Mail Sifter and the assistant still send notifications that carry no words your group wrote. On Android the words show only once your phone is unlocked; on an iPhone your phone's own Show Previews setting decides. We send only what is in our database when the notification goes: a message deleted before then is not sent, but one deleted afterwards stays in a notification already on a phone. A muted group sends no notifications. Our record of each delivery holds no words. Between the first release after 30 September 2026 and this one, notifications carried no words your group wrote. Otherwise a notification names the group and the person: a reminder says which group it is in and, for an event, how soon it starts; a new task says who added it and in which group; a duty handoff says who handed over which baby. A notification your own phone sets for itself, such as a duty handoff alarm, is written on your phone from what it has already opened, and does not pass through these services. RETENTION: we keep your information for as long as your account exists, because it is the record your group is using. Screen time entries are kept until someone in your group deletes them; entries about you are deleted when you leave the group or delete your account, a child added in Screen time is deleted with everything logged for them when they're removed, and everything goes when the group is deleted. A daily target is kept until an adult changes or clears it, the child turns 16 or leaves, or the group is deleted; earlier targets and removed ticks aren't kept. Shopping items ticked off after this update can be put back for 14 days, then leave recovery and are deleted by scheduled cleanup. Existing ticked items receive 14 days from the database update because their completion dates may be wrong. Removing an item from the shared list offers 15 seconds to undo, then arranges deletion. Active shopping runs delay physical cleanup until they end. Empty meal-plan lists are archived after their plan ends; custom lists are archived only when a member finishes them. Archived lists can be restored, and standing lists remain available. Group deletion still removes these records. Eight things are kept to a fixed window instead: - Assistant conversations — what you typed or said to the assistant, its replies, the pointers to views its replies showed you, and the history of the action cards it raised — are deleted after 30 days. Anything you approved lives on in your group's tasks, calendar and records; only the conversation itself is discarded. - Mail Sifter items — a forwarded email you have not resolved (creating cards from it, or dismissing it) is deleted automatically after 30 days, whatever the assistant made of it in the meantime. Resolving it deletes its text at once, and any attachment we stored with it; only the fact that it happened is kept. - Items you send us with "Send feedback to GroupApp" are deleted after 90 days, or sooner when you delete them in You → Your choices, withdraw, delete your account, or your group is deleted. They are read only by the people on our team who review them, and they are included in "Download my data". Each is also emailed to our team's inbox at help@groupapp.ai, without your name, your account or your group — though a link to an improvement record leads to that record's code made from your account (section 5); that email is not deleted with the stored copy, so it stays until we delete it — ask help@groupapp.ai to remove it. - Booking references in Trips and stays: cleared 30 days after the trip ends. We tell your group in its chat a week before, naming the trip and the date, so you can keep a copy elsewhere; if a trip is added or its dates change too late for a week's notice, they're cleared a week after we tell you. The rest of a trip stays until someone in your group deletes it. - Reports you send us (section 1) are kept in two stages. The reported message, your note and any note we add are deleted 30 days after we close the report, and at the latest 180 days after you send it (a report still open then is closed with no action taken). What remains, the record of how it ended, is deleted 12 months after it closes. - Diagnostic delivery records for notifications are removed when your account is. - We delete accounts that remain unconfirmed after 7 days. - For accounts created after we first open sign-up more widely, we erase an account after 90 days without a sign-in if it has never belonged to a group and has no pending request to join or guardian invitation. Two shopping records go the other way. The prices seen in a Woolworths cart, and the product decisions kept under “Help improve product matching”, have no end date, because a row holds nothing that points at any person, group or store. Deleting your account does not remove them: there is nothing in them to find. We would rather say that than state a window we do not enforce. The status of a shop a member is running is kept while your group exists, like the list it came from, and goes when the group is deleted or when the member who ran it deletes their account. Our usage totals (section 3) are kept for 24 months. Like the two shopping records, they hold nothing that points at a person or group, so deleting your account does not remove them. The categories and checked made-up examples made from "Help us improve" records (section 5) go the same way: neither holds anything that points at a person or group, so deleting your account does not remove them. We keep the categories for 24 months. When you delete your account (section 8) your data is removed from our live systems immediately. CONSENT: we ask again every 12 months for anything you have switched on that shares information. When a year has passed we turn that setting off and tell you why on the screen it lives on, so nothing keeps running because nobody revisited it. We keep a record of each of these answers — what it was for, which wording you agreed to, when, and who gave it — and you can withdraw any of them at any time by turning the setting off. BACKUPS AND RESTORES: our database is backed up on a rolling schedule by our hosting provider, and we keep our own nightly copy, encrypted to a key we hold outside our cloud providers, for up to 90 days. A backup keeps what was stored when it was made, so it can hold an older, readable copy of writing that has been encrypted since. Backups are not edited individually: nobody can reach into one to remove a single account. Instead they expire on that schedule, and if we ever have to restore one we re-apply every deletion recorded since the point we restored to, before the service is returned to use. We keep a separate, append-only record of which accounts have been deleted and when — held with a different provider, precisely so that restoring the database cannot erase the evidence that an erasure happened. That record contains an account identifier and a timestamp, and nothing describing the person: no name, no email, no group, no content. 8. YOUR RIGHTS (ACCESS, EXPORT, CORRECTION & ERASURE) Under the APPs, you have the right to: - Access the personal information we hold about you, and download a copy of it. "Download my data" in the app's settings produces a machine-readable archive of your account, your group records and a list of your photographs. - Request correction of inaccurate data. - Delete your account and your data. "Delete my account & data" in the app's settings removes your account, your assistant conversation, your display photo, and permanently deletes any group where you are the last remaining member — including its tasks, calendar, chat, baby records and photographs, files included. A group you share with other people is not deleted, because it is not yours alone to erase. Your messages in it are deleted with your account, without a "Message deleted" line in their place, and so are the emoji you added; a quote of one of your messages in someone else's reply stays unless you delete that message first. This is immediate and cannot be undone by us. REQUESTS ABOUT A SPECIFIC ITEM, OR A COMPLAINT: you can also ask us to act on something more specific — a particular photo, message or record — or make a complaint about how we have handled your information. Write to privacy@groupapp.ai. Anyone may make a complaint, including anonymously. A parent or guardian may make either kind of request on behalf of a person under 15. We acknowledge every request within a few business days and give you a written decision, including our reasons if we are unable to do what you asked, within 30 days. If you are not satisfied with our response, you may take the complaint to the Office of the Australian Information Commissioner (OAIC). 9. YOUR DEVICE'S OWN CALENDAR GroupApp can add a group event to the calendar already on your phone, and can look at that same calendar to warn you about a clash or let you bring an entry into the group. This is not a connection to your Google or Apple account, and we do not hold any calendar permission or any copy of your calendar. - WHAT WE ASK FOR: your operating system's own calendar permission, requested only when you first use one of these features, and only after our own screen explains what it is for. On iOS, adding an event can use a write-only permission that lets us add without ever being able to read your calendar; checking for a clash or bringing an entry in needs full access. You can see and revoke this permission at any time in your phone's own Settings, without opening GroupApp. - WHAT STAYS ON YOUR PHONE: anything we read from your calendar — to check for a clash, or to show you entries you might bring in — is read on your phone, used on your phone, and never sent to us or to anyone else in your group. - WHAT LEAVES YOUR PHONE: only what you explicitly send. Tapping "Add to my calendar" copies that event's title, time and place to the calendar you choose; that copy then belongs to whichever account that calendar is part of, the same as anything else you put in your own calendar. Bringing an entry in from your calendar sends its title, time and place — never its notes or who else is invited — straight onto your group's own calendar, where every member can see it immediately; your group is not told about it in chat until you choose to announce it. - THE COPY IS A COPY: an event you add with "Add to my calendar", or an entry you bring in by picking it, does not update if the original changes, in either direction, and we do not keep a record of it so that we can reach back into your calendar later. - KEEPING THEM IN SYNC, IF YOU TURN IT ON: an adult member can choose, for one group on one phone, to keep the two in step automatically. "Show group events in my calendar" adds a calendar called "GroupApp" and the group's name to your phone and keeps it matching the group's calendar; turning it off, or signing out, removes that calendar and everything in it from your phone. On iOS that calendar may be saved in the account your phone's default calendar uses, such as iCloud, and we tell you which. "Bring in entries from my calendars" puts the title, time and — if you choose — place of every entry in the calendars you pick onto your group's calendar, including entries you add to them later, where every member can see them; we show you what will appear before you turn it on. To keep either up to date, your phone keeps its own record of which of your entries became which group event; that record stays on your phone, holds no titles, times or places, and is never sent to us. Keeping in sync happens only while GroupApp is open on that group, never in the background, and never on our servers. 10. YOUR HOME SCREEN, AND WHAT STAYS ON YOUR PHONE You can arrange the widgets on your Home in each group you belong to. We keep one record of that, so that your arrangement follows you to another phone. Two other records are kept on the phone you use, and are never sent to us. - YOUR HOME LAYOUT, KEPT BY US: when you save your Home in Edit Home, or confirm your choices at the end of setup, we store, for your account in that group, which widgets you have hidden, which you have pinned and in what order, and which optional ones you have added. Each is a name from a fixed list of eight widgets. The record also holds a version number, and a revision number that goes up by one with each save so that the app can tell when another of your phones has saved a change first. It holds nothing you typed, no dates or times, and nothing the widgets show. Only you can read or change it, and only while you are an active member of that group: no other member, owner or admin can, and our assistant and our AI providers never read it. It is deleted when you leave the group or are removed from it, when your membership stops being active, when the group is deleted, when you delete your account, and when you choose "Reset layout". It is included in "Download my data". Your phone keeps a copy of your last saved layout so that Home can be shown while you are offline; see below for when that copy is removed. - ARRANGE BY USE, KEPT ON THAT PHONE: off unless you switch it on in Edit Home, and then only for that group, on that phone, for your account. While it is on, the phone records, for each of seven tools — Meals, Babies, Games, Mail Sifter, Other calendars, and the Tasks list and Agenda widgets — whether you used it on each of the last 28 days: one yes or no per tool per day. Using a tool means opening it from your tool shortcuts (the grid button at the top left of the screen) or from the list of tools; opening or expanding its widget on Home, or completing an action in that widget; or doing the same with that tool's view in a reply from the assistant that shows it because you asked to see it; nothing else counts. Days older than 28 are removed whenever the app reads or updates the record. The record also holds the day you switched it on, the last day it was updated, the day it last worked out an order, that order, and the group's time zone. It does not record what you looked at, the time of day, how long you spent, how many times you opened anything, or anything about anyone else, and photos, chat, ceremonies, the brief and your plan never count — nor does anything you say to the assistant, or a view it shows you that you did not ask for. It is used for one thing: from seven full days after the day you switch it on, and then at most once a week when you open Home, it may move your unpinned widgets for those tools one place up or down, according to those days, with the last seven days counting twice. Pinned widgets stay where you put them, and using a tool during a visit to Home does not move anything until a later visit. The record is never sent to us, to an AI provider, to an analytics service or to another member, so it is not in "Download my data". Switching it off deletes it and puts your widgets back in the order you saved, or the standard order; "Reset usage" clears it and starts again; a change to the group's time zone also starts it again from that day. - SETUP PROGRESS, KEPT ON THAT PHONE: when you set up tools for a group, the phone keeps which tools you chose (or that you chose to explore first), which step you are on, whether each step is still to do, skipped or finished, whether you created or joined the group, whether you were shown the question about the group's AI setting and answered it (never what you chose — that is the group's own privacy level), whether your Home choices were saved, and whether you dismissed "Finish setting up". It holds nothing you typed and no dates or times. It lets you carry on where you left off, and stops the app suggesting a tool you have already set up, skipped, or chose not to set up. It is never sent to us or to anyone else. "Reset layout" and "Reset usage" do not remove it. - REMOVING WHAT STAYS ON A PHONE: Arrange by use, setup progress and the copy of your layout are removed from a phone when you sign out there or delete your account, and for one group when the app on that phone next learns that you are no longer in that group. The copy of your layout is also removed when you choose "Reset layout". A phone that is not running the app keeps them until it next opens. A phone keeps them for at most 20 groups, removing the least recently saved first. They sit in the app's own storage on the phone, protected by the phone's operating system, and are not encrypted by us. Like the rest of the app's storage, they can be included in the phone's own backup, to iCloud or to your Google account, if that backup is switched on; we do not receive that backup, and a phone restored from it keeps and removes them by these same rules. 11. CONTACT US For privacy inquiries or data requests, contact us at privacy@groupapp.ai.