What we hold, and what we don’t.

• Your email address and password (or your Google sign-in), held by our authentication provider. We never see or store your password ourselves.
• A display name if you enter one, and the name you give another adult you invite.
• Your household: which adults are in it (one or two), who owns it, and whether you told us you parent together or across two homes.
• Your children’s first names and year groups, exactly as you type them. We ask for these so messages can be matched to the right child.
• Invitations you create for another adult: the invite link’s token, an optional email address you typed, and whether it was accepted.

A family can be one adult or several. Each adult only sees the children shared with them, along with those children’s school items, the same “get ready” lists and the same children — that is the point of sharing. Neither adult can see the other’s email address in full: it is masked in the app.

You can paste text, add a screenshot or photo, or add a PDF letter. Here is what happens to each:

• Uploaded school files are processed in memory and then discarded. We do not save the image or PDF bytes anywhere. (The only files we ever store are the optional profile photos described below.)
• The full text of what you send is not stored either. What we keep is the structured result: the items found, plus a short quote (a “source snippet”) for each item so you can see where it came from.
• Source snippets are visible in the app only to adults who can see that child. They are never included in calendar output.
• We store a one-way fingerprint (a hash) of what you sent so that sending the same letter twice doesn’t create duplicate items. The hash cannot be turned back into the message.
• The same is true of the per-item duplicate check. It compares a keyed code, made with a secret unique to your household and held in a separate vault, so even someone holding a copy of our database could not work out from those codes that “Avery — Year 6 trip — £50” exists.
• We record housekeeping about each submission: which household, which adult, whether it was text, an image or a PDF, how many items came out, how long it took, and a generic error code if it failed.

To turn a school message into a tidy list, Musette sends the content you submitted to a third-party AI model through the Lovable AI gateway (currently Google’s Gemini models). That means the content leaves our system to be processed by that provider. We cannot truthfully claim it is processed only on your device, or that no third party ever sees it — so we don’t.

• We send only the content you chose to submit, plus your children’s names and year groups so the item can be matched to the right child.
• We treat school content as untrusted data: instructions hidden inside a message cannot make the app do anything.
• We do not store the prompt we sent or the raw response we got back. We store the validated result.
• We record how many tokens a request used, so we can watch cost and quality. No content is recorded with it.
• We do not control how the AI provider handles data under Lovable’s gateway terms. If your school messages are sensitive beyond ordinary school admin, don’t send them.

You can add a photo to a child or to your own name so it is instantly obvious who an item is about, and who is handling it. Photos are entirely optional — initials work exactly the same everywhere.

• Photos are stored privately. There is no public link: the app hands out a temporary, expiring link only after checking you are in that household.
• Every photo is rebuilt as a small square image before it is stored, and we check and strip camera metadata such as location on our side too. We do not keep the original file or its file name.
• Photos are never sent to the AI that reads school messages, and we do no face detection, face recognition or any other inference on them.
• Photos never appear in analytics, calendar output or anything shared outside your household.
• You can remove a photo at any time in Children or Settings. Removing a child removes its photo too.
• Your own photo belongs to your account, not to a household. If you leave a household, the other adult stops seeing it — we don’t delete it. If you ask us to delete your account (still a manual request), your photo is deleted with it.

You can edit or delete individual items, children, invites and calendar links yourself at any time. For your whole account, go to Settings → Feedback & requests and choose Delete my account and data. That raises a real request with the founder, who will confirm by email and carry it out. We do that by hand at this stage rather than giving you a one-tap button that might quietly break the household for anyone else in it — and we won’t pretend a request is instant deletion when it isn’t.

You can also ask what we hold about you, ask us to correct it, or object to how we use it, through the same route.