Privacy Policy

Family Rumpus is operated by Kerfuffle Labs LLC, a Massachusetts limited liability company ("we," "us"). This explains what we collect, why, who we share it with, and the controls you have.

The short version

• Your family's content is encrypted before it's stored, under keys kept separately from the data.
• We do not sell your data, show ads, or hand anything to data brokers.
• Your content is never used to train AI models — not ours, and not our providers'.
• You can export everything and delete everything from Settings at any time. Deleting destroys the encryption keys, so deleted content can't be recovered by anyone, including us.

What we collect

What you give us: family and member names, roles, email addresses, and optionally phone numbers, birthdays, pronouns, photos and short bios. Content you create: chats, projects and their assets (documents, images, songs, boards, storybooks), calendar events, lists, tasks, polls, remembered facts, and preferences. Optional connections you set up: calendars, forwarded email, and pages you ask the assistant to watch.

What's created automatically: usage and cost records so we can enforce plan limits and show your usage breakdown; technical logs for security and debugging, kept [LOG RETENTION WINDOW — not set]; and push subscriptions if you enable notifications.

What we never collect: payment card numbers (our payment processor handles those directly), precise device location, or your contacts, photos or files beyond what you share.

How we use it

To run the Service — answer questions, manage your calendar and lists, make what you ask for, send notifications you've enabled — and to keep it reliable and safe. We do not use your content for advertising, for profiling, or to train AI models.

When the assistant looks something up

Some things you ask for can't be answered from your family's own data, so the assistant reaches outside:

• Web search. When you ask about opening hours, a school schedule, or anything current, the assistant runs a web search. The search runs on our AI provider's infrastructure, and the words of the search query leave our systems — so if you name a person or place in a question, that can appear in a search. The rest of your conversation does not.
• Deep research. A research request runs many such searches and reads the pages it finds.
• Reading a page for you. When you ask the assistant to watch or read a specific page, a browsing service fetches that page on our behalf.

We don't search on our own initiative — only in response to something you asked.

Children

Family Rumpus is built for families, including children, under a parent's control. A parent creates every child profile; children never sign up on their own. Parents can review a child's chats and creations, set ground rules, limit what the assistant does, and delete the child's profile and content at any time. Deleting a child's profile destroys their encryption key, permanently rendering their content unreadable. See our Children's Privacy notice for details.

How your content is protected

Chats, memories, briefs, artifacts and inbox items are encrypted before storage using AES-256-GCM, with a separate key per person for private content and per family for shared content. Those keys are themselves encrypted by a master key in Google Cloud KMS, held apart from the data. Traffic is encrypted in transit.

We are not an end-to-end encrypted service: our servers decrypt content in memory to answer you, and the AI provider that generates a reply necessarily sees the conversation. We say so plainly rather than implying otherwise.

Who we share it with

A small set of vendors that make features work, each seeing only what their function needs, under contracts restricting further use:

We may also disclose information if legally required, to protect safety, or in a business transfer — in which case we'll notify you and these protections travel with the data.

Keeping and deleting

Content is kept until you delete it or close the account. Deleting removes it from the Service; backups age out within [BACKUP RETENTION WINDOW — not set], and key destruction makes deleted content unreadable in the meantime. Two kinds of records are retained after deletion, neither containing any of your content: usage and billing records as accounting rules require, and the record of parental consent (who confirmed, when, and which version of the children's notice they saw) as children's-privacy law requires us to be able to show.

Your controls

• Export: Settings → Download your data.
• Delete: Settings → Delete family & cancel account, or delete any individual member, chat, list, memory or asset.
• Correct: edit member details; remove or fix anything the assistant remembers.
• Notifications: choose which kinds you get, and set quiet hours.

Residents of states with comprehensive privacy laws have rights to access, correct, delete and port their information, and to appeal a denied request. We honor these for everyone, through the controls above or by writing to us. We do not sell personal information or share it for cross-context behavioral advertising.

Where data is processed

The Service is operated from the United States, and our vendors may process data in the United States and elsewhere. Family Rumpus is intended for households in the United States.

Security incidents

If a breach affecting your personal information occurs, we'll notify affected families and applicable regulators within the timeframes the law requires, and tell you what happened, what was involved, and what we're doing about it.

Changes and contact

We'll post material changes here and, where meaningful, tell you in the app before they take effect.

Kerfuffle Labs LLC, a Massachusetts limited liability company [MAILING ADDRESS — not set] [email protected]