Automated decision-making disclosure

The Children's Online Privacy Code (exposure draft s 28) gives a child, or a person with parental responsibility, the right to request information about how their personal information is handled, and s 28(2)(g) lists "whether there is any automated decision-making, including profiling … and, if so, clear and meaningful information about the context of such decisions, including the logic involved and the consequences", answered within 30 days. This page pre-answers that request for everyone rather than waiting to be asked. Read precisely, the Code requires the answer on request; it requires a plain-language explanation of any automated decision-making the app does. This document is that explanation, in full. The shorter version inside the app, under the assistant settings, says the same thing in plainer words.

There are five automated decisions in this app

The first two and the fifth involve a model. The third and fourth use fixed rules on a member's own phone. (Until 21 October 2026 there was another: a model checked the words and photos members added to a review. Reviews are now a star rating only, and that check is gone.)

  1. Who does a task or event. When a group adopts a meal plan or auto-allocates a batch of tasks, the AI task allocator decides who should do each item, from a list the app already built. Most of this document is about that one, because it is the one with the most rules to explain.
  2. Which product goes into a Woolworths cart. When a member fills a Woolworths cart from the group's lists, a model is shown that item's words and up to 24 products from Woolworths' own search — their names, pack sizes, prices and whether they are in stock — and chooses one. For Basic and Standard products, TypeSafe's Jev in the United States is asked first, with names from the group replaced in the item's words, and its pick is used only when it gives it a probability of 0.9 or more (an estimate, not a guarantee) and the app's own checks pass; otherwise Google's models choose. Premium products, and an item whose words name a dietary need or an allergy, go only to Google's models. A model can choose only from those products, and the app checks the quantity itself. Where the match is uncertain, or no model answers in time, the item is left out of the cart and the shop carries on. The member sees each of those items with up to three of the same products to pick from, and a pick made while the shop runs goes into the same cart. Nothing more is added for that item until they pick one, choose another on Woolworths' page once the shop ends, or leave the item on their list. Nothing is ordered: the member checks the cart in Woolworths' app and orders there. A product can still be wrong for a dietary need or an allergy, which is why the app asks the member to check the cart and never treats a filled cart as a finished shop.
  3. A suggested start time for a new event, and a suggested time of day for a task. When you create an event, your phone looks its title up against your group's own recent events — an exact match on the title first, then the closest spelling, with checks that refuse another person's activity and a title saying the event is not happening — and pre-fills the start and end times. When you give a task a date, your phone looks its name up against your group's own past tasks, which it is already holding, under those same checks; it offers a time of day only where at least three similarly named past tasks agree within half an hour, and the time it offers is the most recent of them. No model is involved in either, and what you typed is not sent to us: both comparisons happen on your phone. The event's suggestion never overrides a time you have touched and can be changed before you save; the task's is never filled in at all — it is one chip beside the other choices, and no time is saved unless you tap it. Every failure is silent. These are suggestions about timing, not decisions that write anything.
  4. The order of a member's Home widgets, if they switch on Arrange by use. No model is involved. A fixed rule on the member's phone moves their unpinned tool widgets, one place at a time, according to the days on which they recently used each of a few tools on that phone. It is off unless the member switches it on, and it has its own section below.
  5. Whether one direct typed assistant request can use a faster route. For an adult on their own phone, our server may propose a complete task, calendar, shopping, pantry or baby-log action from the words they typed. TypeSafe's Jev, in the United States, checks whether that proposal matches the request. For a task create or assignment, one-off event create or baby log missing a detail, fixed questions may collect up to four answers first; the adult can edit or cancel, and a guided question itself changes no group record. The phone may show an unselected example from that baby's recent explicit bottle record, the group's clock or a matching past event time. These describe history, not what a baby needs or whether someone is free; only a chosen or typed answer joins the request. TypeSafe sees nothing until the request is complete; if this route cannot continue, the ordinary assistant handles the exchange under its usual checks. On completion it sees only the current request or guided exchange (original request and up to four answers) and proposed fields, plus up to about eight of the group's open task and routine titles when the adult ticks, reopens or adds something, with names from the group's roster replaced; an answer or a title can still contain health or baby details. Above 0.8, an action may run at once, with an Edit receipt; Undo appears only for a newly created task or event that can be safely reversed. From 0.6 to 0.8, the app shows Approve, Edit and Cancel and changes no group record until the adult approves. A request read by the looser conversational pass (for example a baby's name as the subject, “X is done”, or an event without the word event) always waits for Approve, whatever its probability. When one request names several new tasks joined by “and” or commas, Jev also judges whether each join separates two tasks; a request read as several tasks is always shown as a list for Approve, after a second check of that list, and nothing in it is added before then. When one request asks for several different things, such as a baby log and a new task, Jev also judges, for each “and”, comma, “then” or end of a sentence where it could divide, whether the words on either side ask for two separate things; the request is divided only when Jev is sure about every place, and each part is then handled on its own. A part that is one of these commands always waits for Approve, whatever its probability, and no part asks a guided question; a wrong division could still show one part without the rest. One reply shows every part. These probabilities are estimates, not guarantees. The proposal stays only on the current screen and clears on the next request, group switch or app restart. An already-presented guided question may survive a brief tab switch in app memory, but expires 15 minutes after the first question and clears on Cancel, a new request, lock, group or member or timezone change, closing the Assistant screen or restart. A question or staged control arriving after the tab is left is not kept; ordinary saved replies and receipts may still arrive. A request with several actions that is not divided, a lower probability, a failed check or a timeout goes to the ordinary assistant, with guided answers where present, before any fast-route tool runs. The tool's own permissions and checks still apply, and the reply reports what it actually changed. The route is used only after the adult has seen the updated policy at sign-up or acknowledged its change notice on a capable app; without that the ordinary assistant remains available. It is not used by anyone under 18, at a shared display or for forwarded email. By voice, it is used only to tick off or reopen a task or routine, and the assistant always asks aloud first, naming it; nothing changes until the adult says yes. A wrong judgment could still change the wrong record, and not every action has a one-tap undo; a member can correct it in the relevant tool or ask us to help.

The deterministic result is the floor, always

Our rule is that a model may choose who does an item, and may never choose what the item is. It answers with a position in a list the app computed and sent, and the name of a member to give it to. It cannot invent an item, drop one, retime one or rename one.

Concretely, in order:

  1. The app computes a complete allocation for every task and event first, using rules with no model in them — who already has the most on this week, and what each person has said they can take on. That allocation is applied immediately; nothing waits on the model.
  2. The model is then asked, once, to refine it: it may reassign some items to a different group member. It is never given the ability to add an item, remove one, change a date or time, or change a title — the request it receives does not include a way to do any of those things, so there is nothing to validate against because there is nothing to misuse.
  3. Every answer is checked before it is used. An answer naming someone outside the group, or a position outside the range of items sent, is discarded, and that item keeps its original assignment. So is an answer naming a member the group has asked to leave out this week, or one who has said on their own settings that they do not take that kind of work — those members are not even shown to the model, and the same check is applied to the schedule from step 1 and again when the plan is saved, so no path can hand work to somebody it was told not to. If nobody eligible is left for an item, it is saved with no one assigned and the reason shown on screen, rather than given to somebody anyway. A model call that is unavailable, over the group's weekly AI allowance, slow, or simply wrong costs the group nothing — the schedule from step 1 is what ships either way, and a cancelled or timed-out call is labelled as such on screen rather than presented as the model's work.
  4. A person can change any of it. An assignment you make by hand on the review screen is kept if you run the model again. Both the original assignment and any refinement the model made are ordinary entries in your task list and calendar. Reassigning, retiming or deleting one is the same action a group member would take on anything else there, with no special "AI-assigned" state that resists being edited.

What it does not decide

Why this is easy to state honestly

Because the floor computation already exists and is already applied first, this disclosure does not have to describe a system that "usually" behaves a certain way, or hedge about edge cases. Computing the floor, and checking the model's answer, happen the same way whether the model is called at all, is slow, or returns nonsense — so "the result computed without a model is always the floor" is true in every one of those cases, not just the common one.

Arrange by use

Arrange by use is the one automated decision in this app that no model makes. It changes the order of the widgets on a member's Home by a fixed rule, using that member's own use of a few tools on one phone. It orders what the member sees by the member's own recorded use, and we describe it as exactly that.

It is off unless the member switches it on. The switch is in Edit Home, and it applies to one group, on one phone, for one account. Setting up the app never switches it on. Nobody else — another member, a parent or guardian, a group owner or admin, or us — can switch it on, or see whether it is on.

What it records. For each of seven tools — Meals, Babies, Games, Mail Sifter, Other calendars, and the optional Tasks list and Agenda widgets — one yes-or-no for each of the group's last 28 calendar days: whether the member used that tool that day. A use is one of four things:

Nothing else counts: not a widget appearing on screen, not time spent, scrolling or looking, not a notification or a link from somewhere else, not anything the member says to the assistant or a view it shows them without being asked, and never photos, chat, ceremonies, the daily brief, the member's own plan, or anything another member did. What the member asked the assistant, and what a view showed, are never part of the record: the fourth kind of use adds the same yes for that tool on that day as the other three. The record also holds the day it was switched on, the last day it was updated, the day it last worked out an order, that order, and the group's time zone.

The logic.

  1. Each tool's total is two for every day in the last seven on which it was used, plus one for every day in the 21 days before that.
  2. Nothing moves until seven full days after the day it was switched on.
  3. After that, at most once a week, when the member opens Home, the app compares each unpinned tool widget with the next one above it. A widget moves up one place, and the other moves down one, only if its total is at least two more. Otherwise they keep their order. No widget moves more than one place at a time.
  4. The order then stays fixed for the rest of that visit to Home. Using a tool during the visit does not move anything.
  5. Pinned and hidden widgets are never compared or moved, and moving a widget by hand pins it. The Routines widget never moves.
  6. If the group's time zone changes, the record is cleared and the seven days start again from that day.

The consequences. The only effect is the order of that member's own widgets on their own Home, on that phone. It does not change what any widget shows, the order of anything inside a widget, the tool shortcuts, the photos or the chat, and nobody else sees the order it produces. A widget the member reads without tapping may move down; pinning it keeps it where it is.

Where the record is, and how long it lasts. It is kept on that phone, in the app's own storage, and is never sent to us, to an AI provider, to an analytics service or to another member. For that reason it is not in the copy of their data a member can download. Like the rest of the app's storage, it can be included in the phone's own backup to iCloud or to a Google account; we do not receive that backup. Days older than 28 are removed whenever the app reads or updates the record. The whole record is deleted when the member switches Arrange by use off, signs out on that phone or deletes their account, and for one group when the app on that phone next learns that the member has left or been removed from it. A phone that is not running the app keeps its record until it next opens.

Turning it off, or starting again. Switching it off in Edit Home deletes the record and puts the widgets back in the order the member saved, or the standard order. "Reset usage" keeps it on but clears the record, so the seven days start again.