Privacy policy

KidGist ("we", "us", "our") is a tool that helps parents and guardians manage school and activity emails. This policy explains, in plain language, what data we collect, how we use it, who we share it with, and the choices and rights you have. It applies to our website, our web app at kidgist.com, and our mobile apps. Please read it alongside our Terms of Service.

Who we are

KidGist is the data controller for the personal data described here. If you have any question about this policy or your data, contact us at contactkidgist@gmail.com.

A service for parents, not children

KidGist is designed for and directed to parents and guardians — adults aged 18 or over. It is not directed to children, and children may not create accounts or use the service. We do not knowingly collect personal information directly from a child.

To help you organize your family, you (the parent) may choose to enter limited information about your children — a first name or nickname, a grade or year level, and a color you assign to them. You provide this yourself; we never collect it from the child, and we never ask children for information. We explain how we protect this information in the "Children's information" section below.

What data we collect

• Account information: your email address and password (stored securely via Supabase Auth). If you sign in with Google or Microsoft, we receive your email address and name from them.
• Children's profiles: the first name/nickname, grade level, and color you assign. We do not collect children's contact details, photos, precise location, or any information directly from children.
• Email content: when you forward an email to your KidGist address, we receive and store its subject, sender, body text, and HTML content.
• Calendar events: dates, times, titles, locations, and action items extracted from the emails and documents you send us.
• Notification preferences: your reminder schedule, delivery method choices, and time zone.
• Phone number: only if you opt in to SMS reminders (a paid feature).
• Device tokens: if you enable push notifications, a token used to deliver alerts to your device.
• Calendar integration tokens: if you connect Google Calendar or Microsoft Outlook, we store OAuth access tokens to add events on your behalf.
• Basic technical/usage data: log data and diagnostics needed to run the service securely and fix problems.

How we use your data

• To categorize emails, extract dates and action items, and create calendar events automatically.
• To send you daily reminders and weekly summaries about upcoming events.
• To add events to connected calendar services (Google Calendar, Microsoft Outlook).
• To deliver push notifications, and SMS reminders if you have opted in.
• To keep the service secure, prevent abuse, and provide support.
• We do not use your data for advertising, we do not sell your data, and we do not use your children's information for any purpose other than helping you organize your family's schedule.

Our legal bases (for users in the UK, EU and similar regions)

Where data-protection law such as the UK GDPR or EU GDPR applies, we rely on the following legal bases:

• Contract: to provide the service you sign up for — receiving your emails, extracting events, and sending reminders.
• Consent: for optional features you switch on, such as push notifications, SMS reminders, and connecting an external calendar. You can withdraw consent at any time in Settings.
• Legitimate interests: to keep the service secure, prevent misuse, and improve reliability — balanced against your rights.
• Legal obligation: where we must retain or disclose data to comply with the law.

Mobile information and SMS consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are never shared with any third party, and are never sold, rented, or transferred to data brokers or lead generators under any circumstances.

Your mobile number is used only to deliver the reminders and summaries you asked for. The single exception is our messaging carrier, Twilio, which receives your number solely to deliver those messages to your phone and may not use it for any other purpose. Full details are on our text message reminders page.

Third-party services we use (our processors)

Running KidGist requires us to share certain data with the service providers below. They process data only on our instructions, under contract. We do not sell data to anyone. This excludes text messaging originator opt-in data and consent, which is not shared with any third party for marketing or promotional purposes.

Google user data: who we share it with

If you connect a Google feature, here is exactly what we receive and who it is shared with:

• Sign in with Google: Google shares your name and email address with us to create and log you into your KidGist account. This is stored in our Supabase database (see above) and is not shared with any other third party, and is never sent to Google Gemini or any other AI/ML model.
• Google Calendar (optional): if you connect Google Calendar, we request the calendar.events permission solely to add events KidGist creates on your behalf. We only write events to your calendar — we do not read your existing calendar events, and this data is never shared with Google Gemini, any other AI/ML provider, or any third party.

Google user data is shared only with the infrastructure providers strictly necessary to run the service — Supabase (storage) and Vercel (hosting), both listed above and both bound by contract to process it only on our instructions. We never sell Google user data, never use it for advertising, and never share it with data brokers.

AI use and the Limited Use policy

The only content we send to an AI model is the subject and body of emails/documents you choose to forward to your KidGist address, which Google Gemini processes to extract dates, titles, and action items. This is separate from, and never includes, the account name/email from Google Sign-In or any data from a connected Google Calendar described above.

Our use of any data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we do not use Google user data to train or improve any AI/ML model — ours or a third party's — and Google user data is never transferred to a third-party AI service for model training. We use Google Gemini directly through Google's own API under its paid-tier terms, not through any third-party aggregator or gateway.

Where your data is stored (international transfers)

KidGist's data is stored and processed in the United States. If you use KidGist from the UK, EU, Australia, Canada, or elsewhere, your data is transferred to and processed in the US and by the providers listed above. Where required, these transfers are covered by appropriate safeguards such as the providers' Standard Contractual Clauses and, where applicable, the EU–US and UK Data Privacy Framework commitments.

Email content and privacy

We know school emails can contain sensitive information about your children. Here is how we handle email content:

• We only receive emails that you explicitly forward to your KidGist address. We never connect to your email inbox directly unless you choose to grant access to a future opt-in feature.
• Email bodies are stored in our database so you can view them in the app.
• Email content is sent to Google Gemini for analysis, as described above.
• A small number of authorized KidGist staff may access stored content only when needed for debugging or support, under confidentiality obligations.

Children's information (COPPA)

KidGist is intended for parents and guardians, not children, and is not directed to children under 13. We do not knowingly collect personal information from children. The only information about a child in KidGist is what you, the parent, choose to add — a first name or nickname, a grade level, a color, and whatever appears in the school emails you forward.

You control this information at all times: you can view, edit, or delete a child's profile in the app, and deleting your account removes it entirely (see below). We do not require a child's full name, address, photo, or contact details, and we ask you not to add more about your child than you need to. If you believe a child has provided us personal information directly, or you want a child's information reviewed or removed, email contactkidgist@gmail.com and we will act promptly.

Family sharing

If you invite a family member to share your KidGist account, they will be able to see all children, calendar events, and emails associated with your family account. You can remove a family member at any time in Settings → Family.

Your rights and choices

Depending on where you live, you have some or all of the following rights. To exercise any of them, use the in-app tools below or email us — we will respond within 30 days and will not charge you or discriminate against you for asking.

• Access: view all data we hold about you directly in the KidGist dashboard.
• Correction: update your children's details and event information directly in the app.
• Export / portability: export your calendar events as an .ics file in Settings → Calendar.
• Deletion / erasure: delete your entire account and all associated data yourself, instantly, in Settings → Family → "Delete your account" (see the next section). You can also email us to request deletion.
• Withdraw consent: turn off push, SMS, or calendar connections at any time in Settings.
• Object / restrict: ask us to stop or limit certain processing.
• Complain: if you are in the UK/EU you may complain to your local data-protection authority (for example, the UK ICO); we ask that you contact us first so we can help.

Deleting your account and data

You can permanently delete your account at any time — no email or waiting required. Go to Settings → Family → Delete your account, type DELETE to confirm, and we immediately remove your profile, notification settings, phone number, device tokens, and connected-calendar tokens.

• If you are the only person on your family account, your children's profiles, calendar events, and stored emails are erased at the same time.
• If other family members remain, the shared family data stays with them, and only your personal account is removed.
• Deleted data is removed from our live systems immediately and purged from encrypted backups within 30 days.
• Prefer us to do it for you? Email contactkidgist@gmail.com and we will action the request within 30 days.

Data retention

We keep your data for as long as your account is active so the service works. When you delete your account (or ask us to), personal data is removed from live systems immediately and from backups within 30 days. We may retain anonymised, aggregated statistics that cannot identify you, and any records we are legally required to keep.

Security

Passwords are hashed and never stored in plain text. Data in transit is encrypted via HTTPS. Access to your data is restricted to your family account and a small number of authorized staff. No system is perfectly secure — if you discover a vulnerability, please email contactkidgist@gmail.com.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email. The date at the top of this page reflects the most recent update.

Contact

Questions, requests, or concerns about your data? Email us at contactkidgist@gmail.com.