PIA: "Help us improve the assistant" — sharing a record of your own AI requests with our tracing tool

Status: Accepted on 28 September 2026. Revised on 2 October 2026 to record more, for the reasons in §1, with the residual risks in §8 accepted again on that date. The fuller record is sent only to members who turn the switch on under the new wording; nobody who agreed to the earlier, reduced record is moved onto it. Revised again on 3 October 2026 so that every typed assistant request carries its words, whatever it is about — the baby tracker, health, group management and summaries included — with only forwarded emails kept to the outline (§1), and with the residual risks in §8 accepted again, items 9 and 10 added. The same day the outline gained each feature's model calls and the outcome its reply states (§2.1): labels and numbers only. Revised on 12 October 2026: Add several and Describe a routine now use the same switch for outline-only traces. Their route names and distinct tags identify them separately from assistant chat; the route decision and each Jev/Gemini call are labels, timings and token counts, without the submitted words or proposed items. Dictation in these two boxes is transcribed on the phone; its text follows those ordinary feature routes, but neither audio nor transcript enters the LangSmith outline. Feedback thumbs use the separate, per-send GroupApp feedback flow and create no LangSmith score or annotation. Revised on 15 October 2026: the words typed into Add several tasks and Add several events now travel too, name-replaced (§2.2a): what the member typed, what TypeSafe's Jev and Google's Gemini were sent and answered, and the drafts proposed — whether the member typed or dictated them; audio never travels. Describe a routine was added the same day, on the same terms. A record of an assistant request or an Add several request tells the phone its identifier, so an item the member then sends with “Send feedback to GroupApp” links to it (see the feedback assessment); that is still no score or annotation. §8 items 11 and 12 were accepted on that date. Also on 15 October the separate "Turn on" prompt was removed: the switch agrees to the words beside it (§4). Nothing sent changes. Revised on 22 October 2026 under HQ PIA-003 (an AI coding assistant reads consenting members' records), for the release of 23 October 2026: an AI coding assistant whose model Google runs on Vertex AI may read the words of records sent under the new wording c2.2 from adults the maintainers name (§3, §4); every record carries the version of the wording it was sent under; the switch row shows one line and turning it on opens the full wording; §5 gains a risk, §8 items 13 and 14 are accepted, and §9 a trigger. What is sent to LangSmith does not change. Revised on 28 October 2026 for photos and PDFs a member attaches to the assistant (built, switched off): any request that carries a file's words, or that carried a file at all, keeps to the outline (§1, §2.3, §5, §6). Nothing more is sent. Revised on 1 November 2026 under HQ PIA-015 (our analysts may use AI tools on these records), for privacy policy version 3.15: under the newer wording (c2.3), people on our team may also study parts of records with Claude Code (Anthropic), Codex (OpenAI) or Antigravity (Google), on business accounts only (§3, §4). §5 gains a risk, §6 its conditions, §8 item 15 is accepted and §9 gains triggers. What is sent to LangSmith does not change, and no such session happens until version 3.15 is on phones and the extended pull script has been reviewed. Written: 28 September 2026 · Last revised: 1 November 2026 Nothing here is legal advice. Children's Code citations are to the exposure draft; section numbers may move on registration (due 10 December 2026).

Shopping has a separate per-run choice under the shopping assessment. It can share a shopping journey even when this assistant switch is off. This assessment describes the assistant switch, not an exclusive gate on every record sent to LangSmith.

1. Purpose and scope

When the assistant does something wrong — picks the wrong tool, asks a question it did not need to, refuses something it could have done, takes twenty seconds, or never answers at all — we cannot see why from a screenshot, and we deliberately cannot read members' assistant conversations. A member who chooses to can turn on "Help us improve the assistant" in the app's settings. While it is on, a record of how the assistant and our other AI features handled each of their requests is sent to our tracing tool, LangSmith, run by LangChain, Inc., in its Australian region. We use those records to find what went wrong, and we turn what we find into new made-up test cases for our experiments; the records themselves are never copied into our test cases.

What changed on 2 October 2026, and why. The first design sent a deliberately reduced record: the member's sentence, the names of the steps the assistant took, and nothing it looked up. In use it answered none of the questions it existed for:

No record ever reached the tracing tool. A configuration fault on our side meant every record was refused; nobody could tell, because the refusal was not logged. That is fixed, and a refused record is now logged with the reason.
The commonest failures were invisible by design. A request that failed before the assistant had sorted it into a kind (for example, when the Australian model service was out of capacity), a request the member gave up waiting for, and a refusal or "try again later" from any of our other AI features were never recorded, because the record was only built after a request had been sorted and had finished.
The reduced record could not explain a wrong answer. Most wrong answers come from what the assistant looked up and what it made of it; a record that leaves both out shows that a step happened and not why it went wrong.

So the 2 October revision recorded every request a consenting member makes to an AI feature in outline — which feature, how long each step took and how it ended, failures included — and, for a typed assistant request that was not about the baby tracker, group management, a summary of the group's records, health or a forwarded email, also the words. That was a larger disclosure, so it was a new wording, a new choice, and a revised assessment.

What changed on 3 October 2026, and why. In use, the exclusions left most typed requests as an outline. The assistant files an everyday question such as "what's on today?" as a summary of the group's records, so many of the requests people make most often — and every question about the baby tracker — reached the tracing tool with no words, and we still could not see why an answer to them was wrong. We decided that a member who chooses to help us improve the assistant shares every typed request with its words, whatever it is about. Only a forwarded email keeps to the outline: those are a stranger's words, not the member's, and the sender agreed to nothing. The group's names (people and babies) are still replaced, and ids, email addresses and credentials still removed; lines that mention health are no longer withheld. The features outside the assistant (the daily brief, the baby summary and the rest) still send an outline only.

28 October 2026: an attached file keeps to the outline, like a forwarded email. A member can attach a photo or a PDF to a message to the assistant (built, switched off; see the attachments assessment). What was read from the file is someone else's words as often as the member's (a school notice, a poster, a letter), and the people in it chose nothing. So a request is recorded in outline only when it carries what was read from a file, in that message or in any recent turn it sends; when its message carried any file at all, even one whose words were not used; and when it is the sentence re-sent after Forget the file. The request that reads the files is not traced at all, and neither of its model calls (the picture call and the guard call) carries a tracing callback. Our nightly improvement labels (HQ PIA-009) treat these records as they treat a forwarded email's: labels from fixed lists only, never a model reading of the record and never a rewritten test case. Those labels moved to their second version (label_schema v2) for the new columns; first-version labels are never rewritten.

In scope: what the record contains at each level of detail and what it deliberately does not, where it is stored and for how long, who can see it, how a member stops it and how it is deleted, and the people a member's request can mention who did not choose this themselves.

Out of scope, covered elsewhere: the assistant itself and where its model runs (the cloud-inference assessment); how assistant conversations are stored in the app (sealed under the member's own key, the privacy-levels and tier assessments); the experiment test cases, which are invented households with no personal information in them.

2. Data involved

2.1 Every record (the outline)

Sent for each request the member makes, in the app, to the assistant, the daily brief, the baby summary, task allocation, goal suggestions, a ceremony's facilitator, task search or event time suggestions, Add several or Describe a routine — including requests that were refused or failed:

Kind	Whose	Children's?	Sensitive?	Free text?
Which feature, when, how long it took, and how it ended: success, a refusal's short code (for example "capacity" or "busy"), an error's type and status, a request still running after 90 seconds, or a request the member gave up waiting for; and the outcome its reply states, as a short code or a count — for example whether an answer was reused from a cache, why nothing was written ("over_budget"), or how many results came back	—	no	no	no
For every feature: each AI model it asked (its name and region), how long each took, how many tokens it used and how it finished; for a search, the embedding model, its tokens and how many items were compared	—	no	no	no
For the assistant: the kinds of request found in the message (for example "calendar" or "baby"), each tool used, and for a change, whether it was saved and how many items it touched	—	no	the kind label can show that a group uses the baby tracker	no
For the daily brief: how its edition was made — the stage it reached, its writing passes and attempts, how many facts were shown and fitted, the tokens each pass used, its route and model, whether health or baby facts kept it in Australia, and the editor's verdict, as codes and counts	the group	no	the routing label can show that a day's brief touched health or a baby	no
A pseudonymous tag: a keyed hash of the member's account identifier	the member	no	no	no
The group's privacy level and which device platform sent the request	the group	no	no	no

2.2 The words, for a typed assistant request

Since 3 October 2026, every typed request to the assistant carries the words as well, whatever it is about — the baby tracker, health, group management and summaries included — unless it carries a forwarded email:

Kind	Whose	Children's?	Sensitive?	Free text?
The sentence the member typed	the member's own words; can mention others	possibly — a sentence can mention a child, or describe one	yes, can be health — a feed, a dose, a symptom	yes
The instructions each AI model was given, including the group's member list	the group	possibly — children on the group's list	no	yes
The recent conversation the app sent for context	the member	possibly	possibly, including earlier baby-tracker and health turns	yes
What the assistant looked up: the group's task titles and notes, events (with their notes and places), shopping lists and meal plans, as each tool returned them	every member of the group	possibly — a task about a child	possibly	yes
What the assistant looked up in the baby tracker: a baby's feeds, sleeps, nappies, medicines, growth and notes, as each tool returned them	the baby, and the parents who logged them	yes	yes — health information	yes
For group management: who is in the group, their roles and invitations	the group's members	possibly	no	some (email addresses are removed)
What the assistant wrote back, the details it passed to each tool, and what each change saved	the group	possibly	possibly	yes
An error's own message, when something failed	—	no	can echo a fragment of a request	yes

Cleaned before it leaves our server, in this order:

The names of people and babies on the group's list are replaced with placeholders ("Member A", "Baby 1"), longest name first.
Identifiers (every id shaped like a database key), email addresses, encoded blobs, and anything shaped like a key, token or password are removed; a field whose name says it holds a credential is dropped.
Each piece of text is capped in length.

Until 3 October 2026 two more steps withheld any line that mentioned health and any earlier part of the conversation about the baby tracker, group management or a summary. Both are gone: they existed to keep those requests out, and those requests are now in.

2.2a The words, for Add several tasks or events, and Describe a routine

Since 15 October 2026, a request from Add several tasks, Add several events or Describe a routine carries its words, typed or dictated, from an app version that carries the privacy policy saying so:

Kind	Whose	Children's?	Sensitive?	Free text?
The words the member typed, or the phone's transcript of what they dictated, and the lines they were split into	the member's own words; can mention others	possibly — a list can name or describe a child	possibly — "Remi's medicine at 6"	yes
What TypeSafe's Jev was sent (the same words, with the group's names already replaced) and the choices it answered with	the member's	possibly	possibly	yes
What Google's Gemini was sent and what it suggested, when the words needed splitting	the member's	possibly	possibly	yes
The drafts proposed for review: each piece's words and kind, and whether a member was suggested to do it; for a routine, the proposed title, how often, days, time and who takes turns	the member's; a suggested member's id is removed	possibly	possibly	yes

They are cleaned exactly as §2.2 describes. Nothing of the group's records is looked up for these requests, so none is in the record. Dictated words are included (a transcript can contain words the member did not mean to say, or another voice in the room; the member reviews the box before it is sorted, or it is sorted when speech ends). Audio never is: transcription happens on the phone or at Apple's or Google's speech service, and only text reaches our server. An app version from before this change does not say it may send words, so its requests keep the outline its members were told about.

2.3 What is never sent

Words from a forwarded email (Mail Sifter): its sorting, and a "turn into cards" request on it, are recorded in outline only, decided from the request itself before anything runs.
Words from an attached photo or PDF, and the files themselves (since 28 October 2026, built and switched off): a request carrying what was read from a file, now or in its recent turns, a message that carried any file, and the sentence re-sent after Forget the file are recorded in outline only. The outline gains labels only: the kinds of file, a count bucket, each file's outcome, the guardrail's result per file, which pattern families matched and the model's reason, the guard's latency bucket and tokens, which part of the assistant the gate dropped, and whether the file was forgotten. Never the file, its words, the text the guardrail flagged, the matched words, the quote shown to the member, positions in the text or the pattern itself. The request that reads the files and the guard call are never traced.
Audio and spoken assistant requests. Spoken assistant requests are not recorded at all: a consent conversation would have to happen out loud, in a room, with no screen to read the wording on. A member may dictate into Add several or Describe a routine on their phone after reading the microphone notice. Since 15 October 2026 either transcript is recorded like typed words (§2.2a). Audio is never recorded.
Anything from the group's shared wall screen. It answers for whoever is standing at it, and consents to nothing.
The daily brief's own facts and words, the baby summary's, task allocation's and the other features' prompts and replies. For these the record is the outline in §2.1.
Nothing from a child account: children's accounts have no assistant and cannot turn this on.
No credentials: the session token is never in what is recorded, and the final pass removes anything that looks like one.
No graph state or configuration: the record is built from scratch, step by step, never by copying the assistant's own working state.

Is any of it strictly necessary? No. The assistant works identically with the switch off, which is why it is off unless a member turns it on (s 38(2)(b): we do not claim necessity; we rely on the member's own, specific, revocable choice). What the revision changes is how much the member chooses to share, and it is told so on the screen.

3. Flows and locations

Data	Device	Supabase (Sydney)	Our assistant server (GCP, australia-southeast1)	LangSmith (LangChain, Inc.)	Region
The member's request	made on the device	—	processed as normal; the record is built here, step by step, and cleaned here	—	Sydney
The member's switch	set on the device	stored as their own setting; read through their own session on every request	read per request, never from what the app sends	—	Sydney
The record	—	—	sent before the reply goes out, waiting at most about 2.8 seconds, only for a member who turned it on; a request still running after 90 seconds is sent as it stands and completed when it ends	stored in its Australian region: the application on Google Cloud `australia-southeast1` and its trace database in Sydney; its login data on AWS `ap-southeast-2` (Sydney)	Sydney, Australia
Our own billing details with LangChain	—	—	—	held in the United States	not group data

The Australian region and our LangSmith workspace are fixed in our code, not in configuration: the address the records go to cannot be changed by an environment setting, and older versions of our server cannot send them at all (they look for a key under a different name).
Who can see the records: named maintainers on our LangSmith workspace. Whether LangChain's own staff or its subprocessors can access the Australian region from outside Australia is not stated in LangChain's regional documentation and is unverified. We have asked, and until it is answered we do not say the records "never leave Australia". Since 23 October 2026, also an AI coding assistant whose model (Claude) Google runs on Vertex AI at its global location, in our groupapp-evals project, under Google Cloud's terms, for records sent under wording c2.2 from adults the maintainers name, never baby-tracker turns or what tools looked up, read under HQ PIA-003's conditions and recorded in the operator access register for each read. Every record carries the version of the wording its member agreed to (consentVersion), and the reviewed pull script keeps only c2.2 records from the named accounts that a birth month on record shows are 18 or over, and drops the rest before anything is saved. From policy version 3.15 it also keeps records sent under the newer wording (c2.3), which repeats the c2.2 sentence naming this reader.
From policy version 3.15, people on our team using AI tools (HQ PIA-015). For records sent under c2.3 by members whose record shows they are adults, an analyst our team names in writing may study parts of records with Claude Code (made by Anthropic), Codex (made by OpenAI) or Antigravity (made by Google). The tool sends what it reads to its maker, a United States company, which may process it outside Australia. Only business accounts whose terms forbid training on it and delete it within 30 days are used, never a personal account; for now the founder's sessions that read members' words run through Claude on Vertex AI in our own Google Cloud project. A tool receives only the parts of records a question needs, after our pull script has replaced names, ids and contact details, and never a baby-tracker turn or what the assistant looked up. A request that mentions health goes only to a tool Google runs for us. Each session is recorded in the operator access register, and its copies are deleted the same day.
Our own logs carry none of this content; they record labels, counts, timings and, when a record is refused, its status code.

Why the record is sent before the reply. Our server's computing power is withdrawn once a reply has gone out, so a record sent afterwards may never arrive — which is part of why no record had ever arrived. The reply now waits for the send, for a member who turned the switch on, for at most about 2.8 seconds (up to 0.3 seconds for their switch to be read, then up to 2.5 seconds to send). A member who has not turned it on is not held.

Retention and deletion.

Kept for 14 days, LangSmith's base retention, then deleted by LangSmith.
Nothing that extends retention is used on the workspace: no feedback scores, annotation queues, datasets, online evaluators or automations. Some of these extend a record's retention automatically, which is why none is used.
Turning the switch off stops sending from the member's next request. Records already sent expire within 14 days, or sooner on request.
On a privacy request, or a request to delete, we find the member's records by their pseudonymous tag and ask LangSmith to delete them. LangSmith runs deletions in a weekly job and sends no confirmation, so we check afterwards that they are gone. So: "removed within about a week, then confirmed" — never "immediately".
When an account is deleted, its records expire with the 14-day retention. They are not individually deleted unless asked, because that would need a service that holds the tracing key and runs on its own, which we have chosen not to build (§8).

10 November 2026 — improvement ask prominence (PIA-009 I16)

The founder's signed decision “consent notices, middle path” of 10 November 2026 amends I16 to require equal prominence: equal button size, text weight and 48 dp targets, with a filled Turn on and an outlined Not now. Neither is pre-selected; no reward or feature is tied to the choice. The four-ask cap and Don't ask again remain in place.

4. Legal basis and consents

Purpose: improve_app_traces, given by the member for themselves, recorded in the consent ledger with the version of the wording they read.
What they are told, at the moment they choose (since 23 October 2026): the switch's row shows one line naming LangSmith, an AI coding assistant, the 14 days, that names in the group are replaced and that records are linked to their account. Turning the switch on opens a sheet with the full wording and a Turn on button; only that button records the grant, and cancelling leaves it off. The full wording adds that the records are linked to their account, and that, to find what went wrong, an AI coding assistant using Google's Vertex AI, which may process outside Australia, including in the United States, may also read the words of their requests and the assistant's replies, except about the baby tracker. An overseas AI reader is a material part of the consent, so it is shown at the grant, not behind a link (HQ PIA-001 round 2, 10-1). From 15 to 23 October 2026: the words beside the switch, which the switch itself agreed to (there was no separate prompt): that it shares a record of how the assistant and our other AI features handle their requests with LangSmith (run by LangChain, a United States company), stored in Australia and deleted after 14 days; that it can include what they asked about anything, the baby tracker and health included, and what the assistant looked up and wrote, with the names of people in their group replaced; that it is off unless they turn it on; and that they can turn it off there at any time. A link under the switch, "What it records", opens the privacy policy at the paragraph that says everything in §2 — including that failed requests are recorded, that forwarded emails keep only the steps, and that the words typed or dictated into Add several and Describe a routine are kept (§2.2a) — so the words stay short enough to read, and the detail is one tap away rather than absent. A grant is recorded under the version of the words shown (c2.2-2026-10-tracing from 23 October 2026; c2.1-2026-10-tracing before); a grant given through the earlier prompt still counts.
One question after a failed request (19 October 2026). The first time a member's assistant request fails for a reason on our side (the server or the model went wrong, or never answered), and tracing is off, the app asks once whether they'd like to help us find out what went wrong. The question turns nothing on: its only button opens Settings at the switch, where the words above are shown and the switch is the choice. It is asked once per account on each phone, whatever the answer, and the record of having asked stays on that phone. It is never asked of a child account or an account whose age is not yet known, and never at the shared wall. Asking at the moment something went wrong is when the choice means something to the member; asking once keeps it from becoming pressure.
The wording changed on 2 October 2026, because the record now includes what the assistant looked up and covers every AI feature. A member who turned the switch on under an earlier wording has not agreed to this one, so their earlier choice does not count: the switch starts off, and the settings screen says why it is off. Nothing is sent until they read the new wording and turn it on again.
The wording changed again on 3 October 2026, to say that requests about the baby tracker and health are included. This time we decided that a yes given under the 2 October wording keeps counting rather than being asked again: the one member who had turned it on under that wording had asked for the change. Anyone who turns it on from now is shown the new wording, and a new yes is recorded under the new version. The privacy policy's change notice tells everyone what changed.
The wording changed again for the release of 23 October 2026 (c2.2, HQ PIA-003 F2), to name the AI coding assistant that may read records' words. A yes given under c2.1 keeps counting for LangSmith, as on 3 October, but it did not name the AI coding assistant, so only records sent under c2.2 can be read by it. Every record carries its member's wording version, and the reader keeps c2.2 alone. The row shows a c2.1 holder the new sheet, and their switch stays on under c2.1 until they choose. The founder and partner turn the switch off and on after the release.
Withdrawal: the switch, one tap; effective from the next request.
Expiry at twelve months (exposure draft ss 15–16): the consent sweep turns the switch off, and the settings screen says it was turned off because a year had passed.
Not bundled (s 14(3)(b)): it is its own switch, separate from the assistant itself and from the group's privacy level.
Other people in the group. A member can consent for themselves but not for the people their request mentions, nor for the rest of their group, whose tasks, events and lists the assistant looks up. This is the largest change in the revision, and it is the trade the revision makes deliberately: a member who opts in to help us fix the assistant shares, for 14 days, the slice of their group's records the assistant read for them — names replaced, ids and email addresses removed, and since 3 October 2026 including the baby tracker and health. It is the same information every member of the group can already see in the app, sent to a processor we name, for one purpose. §8 records it as accepted.
Overseas. The records are stored in Australia. LangChain, Inc. is a United States company, and whether its staff can access the Australian region from overseas is unverified (§3), so we treat possible access from overseas as a disclosure the member is told about, by naming the company in the wording. For the AI coding assistant's read (since 23 October 2026), the words of c2.2 records from named adults go to Google LLC, a United States company, through Vertex AI at its global location, which may process them in any country where Google operates, the United States included. The wording names Google's Vertex AI and that it may process outside Australia.
The wording for policy version 3.15 (c2.3, HQ PIA-015 F2). The founder chose to fold PIA-015 into the c2.3 wording, so members are asked once. Before "It is off unless you turn it on", the sheet says: "People on our team may also use AI tools to study these records: Claude Code (Anthropic), Codex (OpenAI) and Antigravity (Google), all United States companies that may process them outside Australia, including in the United States. They get only the parts of a record a question needs, never about the baby tracker and never what the assistant looked up in your group. Each promises in its business terms not to train its AI models on them and keeps them for up to 30 days." The row's line adds "Our team may study them with AI tools from Anthropic, OpenAI and Google." A member who agreed to c2.2 keeps that yes for LangSmith and the coding assistant on Vertex AI; the row shows them a note that leads with the AI tools, and only the sheet's Turn on records a c2.3 yes. Records sent under any earlier wording are never given to these tools. Under APP 8, each tool's maker is a new overseas recipient, which is why the wording names all three and where they may process.

5. Risks and mitigations

Risk	Who is harmed	Mitigation	Structural or conventional?	Residual
A member writes "move Sam's counselling session to Thursday" and the sentence reaches the tracing tool	Sam, who did not choose this	group names replaced by placeholders; kept 14 days	name replacement is code, pinned by an automated check that inspects every request actually sent	the sentence, health words included, is shared; a sentence can describe another person in words no list catches (§8)
The assistant reads the group's tasks and events while answering, and those rows reach the tracing tool	every member of the group	sent only for a typed request of a member who opted in; names replaced, ids and emails removed	the cleaning is code, pinned by a check that plants markers in a looked-up row and checks what reaches the wire at both levels of detail	other members' records are shared for 14 days on one member's choice (§8)
A parent logs a feed or asks about a medicine ("Remi had 120 ml, and add nappies to the list")	the baby	the baby's name is replaced; kept 14 days; sent only on the parent's own choice	code, pinned by the check with a mixed baby-and-errand message	a baby's feeds, medicines and notes are shared for 14 days on a parent's choice (§8)
A forwarded email's words reach the tracing tool	the sender and anyone the email names	a turn that carries a forwarded email is an outline, decided before anything runs	code, pinned	none known
An attached file's words reach the tracing tool (since 28 October 2026)	anyone the file shows or names, children included	a request carrying what was read, now or in its recent turns, is an outline, decided from the request before anything runs; the read request and its two model calls are not traced; the labels come from fixed lists	code, pinned by a check that sends four kinds of attachment request through the real tracing path and looks for words, picture data and quotes; for a message whose files were all set aside, and the sentence re-sent after Forget the file, the outline depends on a label the phone sends	a reply that restates a file is ordinary reply text, and on an older app, or once the file has left the recent turns, a later request can carry it as words
An id or a name reaches the tracing tool inside an encoded value (for example, a tool's structured result)	the group	encoded values are removed before the text is cleaned	code, pinned by the wire check	none known
A member's session token reaches the tracing tool	the member	the token is never in what is recorded; a final pass removes anything shaped like a token	code, pinned	none known
An older version of our server, redeployed, sends full traces through the library's own tracer	everyone who turned the switch on	the key is stored under a name older versions do not read; the address and workspace are fixed in code; an emergency switch-off procedure removes the key's reference	structural for older versions; the procedure is conventional and written down	none known
Records are kept longer than we say	the member and people they mention	14-day base retention; nothing that extends it is used	retention is LangSmith's setting; not using the extending features is conventional	a maintainer could enable one (§8)
LangChain staff access the records from outside Australia	the member and their group	14-day retention; we have asked LangChain	unverified	real until answered (§8)
A record is linked back to the member	the member	the tag is a keyed hash; LangChain cannot reverse it; we can, which is what makes deletion on request possible	structural while the key stays secret	a leaked key would let the holder link records to account identifiers (§8)
A member who agreed to an earlier wording is traced under this one	the member	earlier switches do not count; the switch starts off and the screen says why	code: the server reads only the switch that records the new wording	none known
The shared wall turns tracing on for a household	everyone at the wall	the wall consents to nothing: its switch is never read as a yes, and its turns are never traced	code, in two places	none known
Trace words go back to Google, outside Australia, for one diagnosis by an AI coding assistant (since 23 October 2026)	the member, and anyone their sentence mentions, a child included	only `c2.2` records from accounts the maintainers name whose birth month on record shows 18 or over (an account with no birth month is refused); baby-tracker turns, tool results, instructions and error messages dropped before the file exists; the AI coding assistant holds no key and reads one file; the T1 settings check (Vertex `global` in `groupapp-evals`, nothing to Anthropic); the scratch file and transcript deleted the same day	the consent-version, named-account, age and exclusion filters are code, pinned by an automated check that feeds them records that must not be kept; the age filter works from the birth months a registered query returns, which the founder runs (§6); the rest is conventional, attested by the register	Google's abuse-monitoring logs and transient caches, outside Australia, for its stated periods (§8 item 13)
Parts of records reach Anthropic, OpenAI or Google through an analyst's AI tool (from policy version 3.15, HQ PIA-015)	the member, and anyone their sentence mentions, a child included	only `c2.3` records from adults; baby-tracker turns and what the assistant looked up never; health-word turns only to a tool Google runs; outline-only data to any approved tool; names, ids, email addresses, phone numbers, street addresses and long digit runs replaced before the file exists; business accounts whose terms forbid training and delete within 30 days; sessions on the analyst's own computer, never a shared server account; copies and transcripts deleted the same day; a register row for every session	the consent-version, adult, exclusion and replacement filters are to be code in the reviewed pull script, pinned by its check, and no session runs before that review; the account rule, the computer and the deletion are conventional, attested by the register	each maker's retention for up to 30 days under its own terms, which we cannot check (§8 item 15)
Tracing slows the member's reply	the member	the reply waits at most about 2.8 seconds for the send, only for a member who opted in; a failure never changes the reply	code	a slow tracing service adds up to about 2.8 seconds to a traced request

6. Structural versus conventional

Structural (held by code or by the absence of something, and pinned by automated checks that fail loudly):

The record is built from scratch, step by step, from the callback arguments it is given: nothing the tracing library would normally attach is copied, and the assistant's working state and configuration are never read.
Words are added only for a typed assistant request that carries no forwarded email, and (since 28 October 2026) no words read from an attached file, now or in its recent turns, decided from the request itself before anything runs. Other records governed by this switch cannot carry words. Shopping has a separately assessed, per-run choice that can share shopping text under the shopping assessment.
Names are replaced and ids, emails, encoded values and credentials removed in our server, before sending.
The Australian address and our workspace are constants in code, and the key is read from a name older server versions do not know.
The server reads the member's switch on every request, from the member's own settings, never from what the app sends; the switch is off unless the member turned it on under the current wording, and a wall's switch is never a yes.
An attached file's record (since 28 October 2026) becomes fixed-list labels only in our nightly improvement labels, never a model reading or a rewritten case; pinned by the labels job's own check.
The spoken assistant route has no tracing; only listed routes can trace. Dictation into Add several or Describe a routine is recorded as words (§2.2a); audio never reaches our server, so it cannot be recorded.

Conventional (written down, and not enforced by anything we control):

Not enabling any LangSmith feature that extends retention or copies records (feedback, annotation queues, datasets, evaluators, automations).
Limiting access to named maintainers.
Deleting on request within about a week and checking afterwards.
Writing new test cases from scratch rather than copying from a record.
Using the records only to find and fix the assistant's mistakes.
For a message whose attached files were all set aside, and for the sentence re-sent after Forget the file (since 28 October 2026): neither carries a file's words, and each is kept to the outline because the phone sends a label saying so. Our server decides it from that label; a phone that left it off would record the member's own sentence, still with no file's words.
For an AI coding assistant's read (HQ PIA-003 §4): the pull script refuses every account it is not shown a birth month for, or that is under 18, but the birth months come from one registered metadata query the founder runs and hands it; the script holds no database credential, so the age check is as good as that query's output. Also checking, before each pull, that the reading session runs only on Vertex AI in groupapp-evals at global, with nothing sent to Anthropic, request logging off and Google's no-training term read that day (T1); writing only a findings note with invented examples, read by the founder before it leaves the machine (T7); and deleting the scratch directory and the session's transcript the same day (T8).
For an analyst's AI tool (HQ PIA-015, from policy version 3.15). Structural, once the extended pull script is reviewed (AT4, AT5): only c2.3 records marked adult, only the fields a question needs, capped, with ids replaced by sequence numbers and contact details and credentials scanned for and removed before the file exists. Conventional: the business-account rule and the check of each tool's terms on the day (AT1); running on the analyst's own computer or a dedicated account, never an account shared with our other automated work, and deleting the extract, the tool's transcript and its session store the same day (AT7); a register row for every session (AT8).

7. Best interests of the child

Children's accounts have no assistant, so a child cannot turn this on and no child's own words are traced. Children appear only as the subject of a parent's request, or of the group's records the assistant looks up.

What it gives a child: nothing directly. Indirectly, fewer wrong and missing answers about the household they live in.
What it costs a child: since 3 October 2026, a parent's request about them — including their feeds, sleeps, medicines and notes in the baby tracker, and what the assistant looked up there — can be stored for 14 days by a third party, in Australia, with the child's name replaced if they are on the group's list.
The safer design, and why we stepped back from it: until 3 October every message touching the baby tracker or health was outline only, and every line that mentioned health was withheld. In use that hid many of the requests people make most often, the baby tracker's among them, so we could not find or fix their mistakes. We decided that a parent who chooses to help us improve the assistant shares those requests too, and that the words beside the switch say so before they choose.
Where a parent's interest and a child's diverge: the parent chooses to share their own requests to get a better assistant; the child did not choose. The weight we put on the child's side is now that it is off unless the parent turns it on, after reading that the baby tracker and health are included; that the child's name is replaced; that the records stay in the Australian region for 14 days; and that they are used only to find and fix the assistant's mistakes.
Baby-tracker turns are never read by the AI coding assistant (since 23 October 2026): the pull script drops them before anything is saved.

8. Residual risk we accept

Accepted on 28 September 2026; again, with items 1 and 7 added or widened, on 2 October 2026; and again, with items 9 and 10 added and item 1 widened, on 3 October 2026; again, with items 11 and 12 added, on 15 October 2026; again, with items 13 and 14 added, on 22 October 2026; and again, with item 15 added, on 1 November 2026 (HQ PIA-015, approved by the founder 31 October 2026).

What the assistant looked up about the group travels, name-replaced, on one member's choice. The other members of the group did not choose it. We accept this because it is the only way to see why the assistant answered wrongly, because they can already see the same records in the app, and because the cleaning and the 14-day retention bound it.
A member's own sentence travels, name-replaced. Names that are not on the group's list (a nickname, a teacher, a friend), and descriptions that no word list catches, can reach the tracing tool about people who did not choose this.
Whether LangChain's staff can access the Australian region from overseas is unverified. We accept that until LangChain answers, and we name LangChain in the wording so the member knows who the recipient is.
Retention depends on the vendor's setting and on our not enabling features that extend it. Nothing in our code can stop a maintainer enabling one.
After an account is deleted, its records expire rather than being deleted individually (within 14 days). Deleting them automatically would need a service that holds the tracing key and runs on its own schedule. We judged a key-holding scheduled service to be the bigger risk, and deletion remains available on request.
The pseudonymous tag is stable for as long as a record exists, so LangChain can tell that records belong to the same member (not who that member is). If the key that makes the tag were leaked, the holder could link records to account identifiers.
An outline shows which features a member used, including that a request was about the baby tracker, and, for the daily brief, whether that day's facts touched health or a baby. It carries no words or numbers from the tracker. We accept this because a failure in the baby tracker is as important to find as any other.
A traced reply can be up to about 2.8 seconds slower when the tracing service is slow.
A baby's tracker records and health details travel, name-replaced, on a parent's choice. Feeds, sleeps, medicines, symptoms and notes in a parent's request, and what the assistant looked up in the tracker, are stored by LangSmith for 14 days. We accept this because the baby tracker's mistakes are as important to find as any other's and an outline cannot explain them; it is bounded by the parent's own specific choice, made after reading that the baby tracker and health are included, by name replacement, by the Australian region and by the 14-day retention.
A yes given under the 2 October 2026 wording was not asked again when the wording changed on 3 October to say that the baby tracker and health are included. The one member it affected had asked for the change, and the privacy policy's change notice tells everyone else.
The words typed or dictated into Add several or Describe a routine travel, name-replaced, on one member's choice (since 15 October 2026). A list can mention other people and children, and health ("Remi's medicine"); a dictated transcript can also catch words not meant for the list, or another voice in the room. Before that date the policy promised a dictated transcript was never recorded; the version 3.9 change notice says it now is. We accept this because a wrong split or a wrong kind cannot be understood from labels alone, and it is bounded as item 2 is. The switch's own sentence already says a record "can include what you asked about anything", so a yes given before is not asked again; the privacy policy's change notice (version 3.9) tells every member.
A record can be linked to an item the member sends us (since 15 October 2026). The feedback email then leads to a record that carries the member's pseudonymous tag. We accept this because the member chose both, and the sheet says the record is included before Send.
What the AI coding assistant reads goes back to Google, outside Australia, for a second purpose (since 23 October 2026), and a sentence can still mention or describe people, children included, who chose nothing. Google may keep read words in abuse-monitoring logs and transient caches for its stated periods; that is its promise, not our control. We accept this because the member chose it under words that name it, it is adults only, without what tools looked up or baby-tracker turns, and deleted from our side the same day.
On 4 and 13 October 2026, before this revision, an AI coding assistant whose model runs at Anthropic read the founder's own full traces (six, and three sentences) without Anthropic being a named recipient. Recorded in the operator access register, and the household told.
From policy version 3.15, parts of records can reach Anthropic, OpenAI or Google through an analyst's AI tool, outside Australia. Each maker promises in its business terms not to train on them and to delete them within 30 days; that is its promise, which we cannot check. A sentence can still mention or describe people, children included, who chose nothing, and the analyst's own computer holds a copy until it is deleted the same day. We accept this because the member chose it under words that name the three companies, it is adults only, without baby-tracker turns or what the assistant looked up, health stays with Google, and each session is minimised and recorded.

9. Review trigger

A forwarded email's words are let through, or the assistant gains a way into data it does not read today.
A new feature's prompt or reply, rather than its outline, is added to what is sent.
Voice or the shared wall is traced.
Retention is raised, or a feature that extends retention or copies records is enabled.
The region or workspace changes, or LangChain answers the overseas-access question.
Child accounts gain an assistant.
Records start being used for anything other than finding and fixing the assistant's mistakes.
The AI coding assistant reads looked-up records or baby-tracker turns, or trace words reach any provider or endpoint other than Vertex global in groupapp-evals, apart from an analyst's tool under HQ PIA-015.
An analyst's tool runs on a personal or consumer account, a new tool or maker is added, a kind of data moves to a different tool than HQ PIA-015 allows, or Australian processing becomes available for one of these tools.

10. Checklist against exposure draft s 38(2) (verified 2026-09-08)

s 38(2)	Requires	Answered in
(a)	nature, scope, context, flow and purposes	§§1–3
(b)	why collection of children's personal information is strictly necessary	§2 — it is not; the feature is optional and off by default, and since 3 October 2026 carries baby-tracker and health requests on the parent's choice, accepted in §8 item 9
(c)	lawful and fair collection	§4
(d)	best interests of the child	§7
(e)	how the entity complies with the Code and the Act	§§4, 6
(f)	risk of harm to children	§§5, 7

s 38(3): written before the feature is switched on, and revised before the fuller record was, and again before baby-tracker and health requests carried their words. s 39: listed on the published register.

11. Sources

LangSmith, "Cloud (SaaS)" — regions, including APAC on Google Cloud australia-southeast1 and the Sydney locations of its trace database and login data: https://docs.langchain.com/langsmith/cloud (read 27–28 September 2026).
LangSmith, "Data purging and compliance" — 14-day base retention, deletion by trace identifier, the weekly deletion job and the need to verify: https://docs.langchain.com/langsmith/data-purging-compliance (read 28 September 2026).
LangSmith, "Run (span) data format" — the record format the server builds: https://docs.langchain.com/langsmith/run-data-format
LangChain support, "Why are my traces being automatically upgraded to extended retention?": https://support.langchain.com/articles/3206725817-why-are-my-traces-being-automatically-upgraded-to-extended-retention
Google Cloud, Vertex AI's data-governance and zero data retention page (now titled for Google's Enterprise platform; last updated 21 October 2026) — "Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction", for "all managed models" (Claude is not named); request-response logging off by default; prompt logging for abuse monitoring; in-memory caching deleted within 24 hours: https://docs.cloud.google.com/vertex-ai/generative-ai/docs/data-governance (read 22 October 2026).
Google Cloud, "Deployments and endpoints" (last updated 21 October 2026) — Claude's global location, the us and eu multi-regions, and the single regions; global does not support data residency: https://docs.cloud.google.com/vertex-ai/generative-ai/docs/learn/locations (read 22 October 2026). Anthropic, "Claude on Google Cloud" — data handling governed by Google Cloud, and single regional endpoints carry Claude Sonnet 4.6 and earlier: https://platform.claude.com/docs/en/build-with-claude/claude-on-vertex-ai (read 22 October 2026).
HQ PIA-003, "an AI coding assistant reads consenting members' full traces" (20 October 2026), and HQ PIA-001 round 2 addendum §4 (the wording).
HQ PIA-015, "analysts may use AI tools on 'Help us improve' records" (approved 31 October 2026), and Security's full draft, conditions AT1 to AT17. Its vendor terms were read on 30 October 2026: Anthropic, "Claude Code data usage" (code.claude.com/docs/en/data-usage); OpenAI, "Your data" (developers.openai.com/api/docs/guides/your-data); Google, Antigravity's enterprise announcements (antigravity.google and cloud.google.com, 2026) and Google Cloud's generative-AI data governance page above.
Our own code and documents: agent-server/src/improveTraces.ts (the record, the levels of detail, the cleaning, the fixed address and workspace, the pseudonymous tag, the route middleware), agent-server/checks/tracing.check.ts (the checks that inspect every request actually sent, at both levels of detail, and that a refused request is traced), agent-server/scripts/traceErasure.ts (deletion on request), agent-server/scripts/tracePull.ts and agent-server/checks/tracePull.check.ts (the AI coding assistant's pull), lib/improveTraces.ts and constants/consentPrompts.ts (the wording), constants/legalTexts.ts (the privacy policy), docs/runbooks/deploy-secrets.md (the key and the emergency switch-off), and docs/assistant_reliability_and_tracing_plan.md §2 (the design this assessment gates).

Shopping's separate per-run choice (4 October 2026)

Shopping now has its own off-by-default choice at the start of each run. It neither inherits nor changes the assistant's standing tracing switch. Its record joins searches, product choices, model calls, basket checks and handover under one run. The shopping assessment describes its data, boundaries and accepted residuals. These records use this assessment's Australian storage, 14-day retention and pseudonymous tag for erasure.