Privacy, in plain words
Your family's words are your family's.
Inside jokes, worries, a kid's first conversation with an AI. That's your business and nobody else's, so the product is built around one rule: we hold as little as possible, we can read almost none of it, and what you delete is gone. Here's exactly how, without asking you to trust a slogan.
What your family says
psst… we’re throwing Dad a surprise party Saturday 🎉
enc:v1:5752yCmooj5Hhnnvydo2ht8IQRTyaMj9HZb719SCvNkQU8MDj9msp3cVqUedLfEap+p+bgZSxrLExrV6VUYzy397yqo5SpYwLopBHSkD4A8dAvZ83BQR
My lips are sealed. Want me to remind you to hide the cake? 🎂
enc:v1:iOhyN2bxBL01jePJmAvmSaLV8bBMd7MDYrD5MBVZJNYjTJtmNRndzlpvfLsl9Dvxn5lbYEqzyKXBVW48EGAsPv9tBHZOj23neY1vSNKC9zoY+iP7AQFrznrWL1Js
That's what a message looks like in our database: the words themselves are stored scrambled, and without your family's key they're just noise. The key is kept somewhere else.
Every message is scrambled the moment it's saved, with a separate key for each person in the house and one for the family. The keys themselves are locked away in a separate vault, apart from the data.
What we promise
Five things, and the fine print agrees.
🚫
No ads. No data brokers. Never sold.
Your family isn’t the product; the assistant is. Nobody buys your data, because nobody can. There’s no ad network to feed.
🧠
Your words never train AI.
Not by us, and not by the companies that help us. Our agreements with them say so in writing. Our own models don’t exist; we build the product, not the AI.
🔑
Encrypted per person.
Chats, memories, pictures, songs and forwarded email are encrypted before they’re stored. Each person, kids especially, has their own key. Delete a profile and the key is destroyed, which makes every leftover copy unreadable, backups included.
🗑️
Deleted means gone.
Deleting removes it from the service right away. Backup copies kept only for outages age out within 30 days. If we ever restore a backup, a ledger re-applies every deletion made since.
🌱
You decide how much to share.
Use nicknames. Skip the location. Leave calendars unsynced. Everything works from day one; each detail you add just makes the help sharper. Nothing is required.
📬
Ask us anything.
Export everything your family has ever made from Settings, any time. Or email [email protected] and a person answers.
Children
A kid's information gets the strictest treatment in the house.
Kids can't sign up. You create every child's profile, after you've read the Children's Privacy Notice and consented, and the checkout that follows is how we verify a parent is at the wheel. From there the defaults are closed, and every door you open is one you chose.
Read the Children's Privacy NoticeFirst name and an age range
No birthday, no photo required, no school. We only ask for what a feature needs.
Doors closed by default
Web, watches, sharing, pictures, texting and outside accounts are off for a new kid.
Their name stays home
When a child asks Rumpus to look something up, their name, school and town are kept out of the request.
Check-ins
Turn them on with a code from your email and you can read and export everything your child has made.
Withdraw any time
Delete the profile in Settings, or email us. Everything collected from the child goes, and the key with it.
A record, not a memory
After deletion we keep only the record that you consented (who, when, which notice), as the law requires. Nothing the child said.
Who helps, and what each one sees
The whole list. Nothing hidden in a footnote.
An assistant that answers you has to read your words in the moment. So a small set of companies help make specific features work, each seeing only what its job needs, under contracts that forbid using your family's content for ads, selling it, or training AI.
| Who | What for | What it sees |
|---|---|---|
| Anthropic | The assistant’s replies, web search | The conversation it needs to answer; search words |
| OpenAI | Making and editing pictures | The picture request, and a photo you ask to edit |
| ElevenLabs | Voices and songs | Text to speak; lyrics and style. Deleted from their systems right after |
| Browserbase | Reading web pages you name | The pages you ask it to check, and what it clicks and types there |
| Google Cloud | Key management | Encrypted keys only, never content |
| Google Calendar, Apple iCloud | Calendar sync, if you connect one | Events in the calendars you choose |
| Railway | Hosting and database | Encrypted content at rest |
| Cloudflare | File storage and the website | Encrypted files; cookie-free page counts |
| SendGrid | Sign-in codes, briefs, and the school email you forward | |
| Twilio | Text messages, if you turn them on | The texts you send and receive |
| Stripe | Payments | Billing details. We never see card numbers |
| Apple, Google, Mozilla | Push notifications | An encrypted notification they can’t read |
| Open-Meteo, OpenStreetMap, CARTO | Weather and maps | Your household’s location or the address you type |
| Wikipedia, Openverse | Pictures for “show me” answers | The topic, never who asked |
Some AI providers keep request data for up to 30 days solely to detect abuse; we've asked for zero-retention settings wherever they're offered. The Privacy Policy keeps the definitive, dated version of this list.
Under the hood
For the parent who wants the details.
- Envelope encryption. Every message, memory, picture and file is encrypted with AES-256 under a key for that person or family. Those keys are wrapped by a master key in Google Cloud KMS, a separate service from the database.
- Identities too. Names, emails and phone numbers are stored encrypted, and looked up by blind index, so even a database copy doesn't list who's who.
- Files never leave as plain links. Pictures and songs are encrypted in storage and served through short-lived signed links from our own servers.
- No passwords to leak. Sign-in is a one-time code by email; kids sign in with a code you generate. Sessions expire.
- Short retention by design. Reminders, assistant traces, watch history and forwarded email bodies all age out on a fixed schedule, listed in the policy.
- Privacy Policy
Everything on this page, with the dates and the exact retention schedule.
- Children’s Privacy Notice
What we collect from children, how you consent, and your rights.
- Terms of Service
The agreement, including plans, billing and cancellation.
Kerfuffle Labs LLC · 2 Bridgeview Cir, Ste 8 #267, Tyngsborough, MA 01879 · [email protected]
Start with as little as you like.
Nicknames are fine. Skip the location. Add a kid when you’re ready. It works from the first minute, and gets sharper with each thing you choose to share.