Privacy Policy

Family Rumpus (the "Service") is operated by Kerfuffle Labs LLC, a Massachusetts limited liability company ("we", "us"). This policy explains what we collect, why, who helps us process it, how long we keep it, and the controls you have. The Service is intended for households in the United States.

1. The short version

• A parent sets up the family and creates every child's profile. Children cannot sign themselves up.
• Your family's content is encrypted before it is stored, with a separate key for each person and for the family, each locked by a master key held outside our database.
• We do not sell your information, show ads, or share it with data brokers.
• We do not use your family's content to train our models. We configure and contract with the AI providers that process your content for us so they may not use it to train or improve their general models, unless an adult deliberately submits content through a separately disclosed feedback feature and expressly agrees to that use.
• You can export your information and delete individual items, a child profile, or the family account in Settings. We promptly remove deleted content from active systems and instruct applicable service providers to delete it. Residual copies in encrypted, access-restricted backups expire within 30 days and are not used except for disaster recovery. If a backup is restored, we reapply prior deletion requests.

2. What we collect

Information you give us

• Account details: family name, member names and roles, email addresses, and — if you choose — phone numbers, ages or birthdays, pronouns, photos, and short bios.

For a child, we recommend providing an age or age range rather than a full birth date. Age information is optional and is used only to adjust explanations, safety settings and age-appropriate features. A child can use the Service without providing a birth date.

• What you create: messages to the assistant, projects and what's in them (documents, pictures, songs, storybooks, boards), calendar events, lists, tasks, polls, and facts the assistant remembers to be helpful ("Mia is allergic to peanuts").
• Connections you choose to set up: calendar accounts (Google, Apple iCloud, or calendar feed links), email you forward to your family's address, text messages, and web pages you ask the assistant to read or watch.
• Your household's location, if you set one: an address you type, or your device's position shared once when you tap "use my location."

Your voice. When you talk to the assistant, your speech is turned into text before it reaches us, and only the text is sent. On iPhone and iPad we ask Apple to do this on the device; on older devices Apple may process it on its servers instead. In a web browser, the browser's own speech service does it (Google's in Chrome, Apple's in Safari). We never receive or keep audio recordings or voiceprints.

Information created automatically

• Usage records (which features were used and their estimated cost) to apply plan limits and show your usage.
• Technical logs (times, errors, IP address) for security and reliability, kept for 30 days, with credentials removed.
• Notification subscriptions, if you turn notifications on.
• Page-view counts for our website and app: the page address loaded, where the visitor came from, browser type, country and load speed, counted by Cloudflare Web Analytics without cookies or identifiers and never linked to your account or to anything you write.

What we don't collect: payment card numbers (our payment processor handles them), ongoing or background location, advertising identifiers, or your contacts, photos or files beyond what you share with the Service.

3. How we use it

Only to provide the Service to your family and keep it safe:

• answering questions and doing what you ask (calendar, lists, reminders, pictures, songs, stories, research, reading pages, watches);
• keeping what the assistant remembers useful: once a week the assistant reviews each person's remembered facts, using the same AI provider that writes its replies, to merge duplicates, let short-term notes fade, archive older details, and remove plans that have passed. A parent can see what changed and undo it;
• sending the notifications, emails, and texts you've turned on;
• preventing abuse, fixing problems, and enforcing plan limits;
• telling you about your account, billing, and important changes.

We do not use your information for advertising, sell it, or build profiles for others. We do not use your family's content to train our models, and our contracts with the AI providers that process it for us do not let them use it to train or improve their general models.

4. When the assistant reaches outside your family's data

Some requests need information from the web. These only happen because someone in your family asked for something; the assistant does not browse on its own initiative.

• Web search. The words of a search query are sent to our AI provider's search service. If a question names a person, school or place, that can appear in the query. The rest of the conversation is not sent.
• Research. A research request runs several searches and reads the pages it finds.
• Reading or watching a page. A browsing service opens the page for us. To find what you asked for, the assistant may click, choose options, or type a search on that page — using only what your request contains. It never signs in, creates accounts, enters your family's personal details, pays, accepts a site's terms, solves captchas, or tries to get around a site's blocks on automated visitors. It declines cookie banners where it can. The page's text and images of it are sent to our AI provider to read. A watch checks the page again on a schedule and tells you when what you're watching changes.
• Pictures for spoken answers. Only the subject words (for example "Starship") go to Wikipedia or Openverse.
• Weather and maps. Your home coordinates go to a weather service; the address you typed goes to a mapping service to place it on the map; map images are loaded by your device from a map-tile provider, which sees your device's internet address and the area shown.

5. Children

Family Rumpus is used by families, including children under 13, always under a parent's control. Our Children's Privacy Notice describes in detail what we collect from children, how a parent consents, and a parent's rights. In short:

• Before a child profile is created, the parent or legal guardian reviews the direct Children's Privacy Notice, affirmatively consents, and completes a payment-card transaction that provides notice to the cardholder. We link the consent record to the transaction and may require another verification method — a signed consent form or a video call — if the information does not reasonably establish that the person consenting is the child's parent or legal guardian.
• We collect only what the parent provides and what the child creates while using the Service, and we don't require more than the feature needs.
• For child profiles, web browsing, scheduled watches, external sharing, photo upload and editing, precise location, and new email or text connections start off. A parent may enable an eligible feature after seeing a feature-specific explanation of what data leaves the family account, which providers or outside sites receive it, and how to turn it off.
• A parent can review, export, correct or delete a child's information at any time, and can stop further collection by turning features off or deleting the profile.
• Children's information is never used for advertising and is never sold, and it is subject to the training restrictions in §1.

6. How we protect it

• Encryption at rest. Messages, memories, remembered facts, briefs, forwarded email, watch results, member details (names, emails, phone numbers, birthdays, bios), your home address, and calendar credentials are encrypted with AES-256-GCM under a separate key for each person or family. Those keys are themselves protected by keys held in Google Cloud's key management service.
• Files. Files, including uploaded photos and generated pictures, songs and audio, are encrypted in private storage at rest and in transit. Access links expire within one hour. Access is limited to authorized systems and personnel, logged where technically available, and files are deleted with the item, profile or account to which they belong.
• In transit: everything travels over encrypted connections (TLS).
• Not end-to-end encrypted. Our servers decrypt content briefly to provide assistant features. We say so plainly.
• Access inside the family. A person's private chats are visible only to them. A child's private chats are ordinarily visible only to the child unless parent check-ins are on. Regardless of that setting, a verified parent or legal guardian may request access to all personal information we have collected from the child, including private chats. We reauthenticate the requester and may notify the child before providing access, but we do not deny a verified parent's legal review right.
• Our program. We keep a written information security program with a named person responsible, review it at least yearly, and keep an incident record.

7. Who helps us provide the Service

The companies below process information for us only to provide, secure and support the identified feature. Our contracts prohibit them from using family content for advertising, profiling, sale, model training or their own unrelated purposes; require appropriate security; restrict subprocessors and onward disclosure; and require deletion or return when the service ends, subject only to narrow legal or security-retention exceptions. OpenAI, which provides the Service's AI, keeps no copy of what we send it (zero data retention), with two exceptions: it scans images and files for child sexual abuse material and keeps one it flags for review, and it may hold an encrypted cache of a conversation for up to 24 hours to answer the next message faster. Some other providers keep limited request data for up to 30 days solely to detect abuse, protect their services or comply with law; we seek zero-retention settings where available.

We do not use advertising or crash-reporting services; our only analytics are cookie-free page-view counts that aren't linked to your account.

We keep this list current. If we add a provider that will receive children's personal information for a materially different purpose, we will update the applicable notice and obtain new parental consent when required before that processing begins.

Google user data. When you connect a Google Calendar, we use the calendar events we receive only to show them in your family's calendar, to let the assistant answer questions about your schedule (the events relevant to a question are sent to our AI provider to write that reply) and, where you allow it, to add, change or remove events you ask for. Family Rumpus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not let people read it except to provide the feature, for security, or as the law requires, and do not use it to train AI models.

We don't sell phone numbers, and we don't share phone numbers or text-message opt-in data and consent with third parties for their marketing.

We may also disclose information when the law requires it, to protect someone's safety, or as part of a sale or merger of the business — in which case this policy continues to protect it and we'll tell you.

8. How long we keep it

• Your content stays until you delete it or close the account. We promptly remove deleted items and their files from active systems, as described in §1.
• Short-lived by design: reminders ("nudges") are deleted the day after they expire; patterns the assistant notices, after 8 days; remembered facts marked as short-term ("for now"), about 30 days after they last come up; the record of what the weekly memory review changed (kept so a parent can undo it), after 14 days; detailed assistant traces, after 30 days; forwarded email bodies and attachments, after 90 days (events and tasks taken from them stay); each watch's history of checks, after 90 days (the watch keeps its latest reading); sign-in codes, after 15 minutes; sign-ins, after 30 days.
• Backups are kept only to recover from an outage and expire within 30 days. If we ever restore one, we reapply prior deletion requests.
• Kept without content: usage and billing records for 7 years for accounting; the record of a parent's consent (who, when, which notice version, and the verifying transaction) and of which versions of these Terms and this policy an adult accepted (with the time, IP address and, at checkout, the recurring-charge terms agreed to), for as long as we need to show they were given.
• Feedback an adult sends us (in the app, or what would have made them stay when deleting the account) is kept with their email address after deletion so we can reply. Ask us at [email protected] and we remove it. Feedback from a child's profile is deleted with the child's profile or the family.

For each category of children's personal information, we keep the information only for as long as reasonably necessary for the specific feature or legal purpose described in this policy, then delete it securely. Parents may delete child content sooner. We review the retention schedule at least annually and do not use retained child information for a new purpose without any notice and consent the law requires.

9. Your controls

From Settings, at any time:

• Export your information as one file.
• Delete a message, a chat, a remembered fact, a project, a file, a member, or the whole family (which also cancels the subscription).
• Correct member details and remembered facts.
• Choose notifications, quiet hours, and which features each child can use.
• Texting: reply STOP to any message from the Service to stop texts.
• Email: every morning-brief email has a one-click unsubscribe.

Or write to [email protected].

10. Your state privacy rights

Depending on where you live, you may have rights to know, access, correct, delete, and receive a copy of your personal information, and to appeal if we deny a request. We honor these for everyone, whatever state you live in. We do not sell personal information or share it for targeted advertising. We will explain any denial and how to appeal it. You may use an authorized agent, and we will verify requests before acting on them.

Where required, we obtain consent before processing sensitive personal information and complete legally required assessments for processing that presents a heightened risk. We ordinarily respond to verified requests within 45 days. If the law permits and we reasonably need more time, we may extend once and will explain the extension within the first 45 days.

11. Security incidents

If a security incident affects your personal information, we will tell affected families and the authorities the law requires, within the time the law requires, and explain what happened, what information was involved, and what we're doing about it.

12. Changes

We'll post changes here. For material changes we'll tell account owners by email or in the app before they take effect, and we'll ask for a parent's consent again before using a child's information in a materially different way.

13. Contact

Kerfuffle Labs LLC · 2 Bridgeview Cir, Ste 8 #267, Tyngsborough, MA 01879 · [email protected] · (351) 345-9190