Privacy notice

In short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register on the Services, express an interest in obtaining information about us, participate in activities on the Services, or otherwise contact us. What we collect depends on how you interact with us and the features you use:

• Names
• Email addresses
• Passwords, and contact or authentication data
• Information from a Google account, if you choose to sign in with Google or connect Google Calendar

Sensitive information. When necessary, with your consent or as otherwise permitted by applicable law, we process calendar data, and the contents of emails, documents and photos you choose to put into your Family Inbox.

All personal information you provide must be true, complete and accurate, and you must notify us of any changes to it.

Google API. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not collect information about you from third parties, other than the accounts you choose to connect.

In short: To provide, improve and administer our Services, to communicate with you, for security, and to comply with law. We process for other purposes only with your prior explicit consent.

• To create and manage your account, so you can sign in and it keeps working.
• To deliver the Services you asked for - reading what you put in, putting it on your calendar once you confirm it, and sending the daily brief if you have turned notifications on.
• To protect the Services, including preventing and investigating abuse.
• To comply with our legal obligations, or to establish, exercise or defend legal claims.
• To save or protect someone’s vital interests, such as to prevent harm.

We do not process your information to advertise to you, and we do not sell it.

In short: We process your personal information only when we have a valid legal reason to do so.

If you are in the EU or UK, the GDPR and UK GDPR require us to explain the legal bases we rely on. We may rely on:

• Consent. Where you have given us permission for a specific purpose - for example letting an AI service read what you put in. You can withdraw consent at any time.
• Performance of a contract, to provide the Services you have asked for.
• Legitimate interests, where reasonably necessary and not overridden by your rights - for example diagnosing problems and preventing fraudulent activity.
• Legal obligations, where necessary for compliance, or to exercise or defend legal rights.
• Vital interests, where necessary to protect someone’s safety.

If you are in Canada, we process your information with your express or implied consent, which you can withdraw at any time. In limited cases the law permits processing without consent - for example where collection is clearly in an individual’s interests and consent cannot be obtained in time, for investigating a breach of an agreement or a contravention of law, or where disclosure is required to comply with a subpoena, warrant or court order.

In short: Only in the specific situations described here.

• With your own family space. Everything in a family space is visible to everyone in it - that is what it is for. There are no private items within a space, and nothing is ever shown to another family.
• With our AI service provider, Anthropic, and only if your family has turned that on. See section 6.
• With our hosting and infrastructure providers, who store the data on our behalf under written contract and may not use it for their own purposes.
• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.
• Where the law requires it, such as to comply with a lawful request.

We have not disclosed, sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve months, and we will not sell or share personal information belonging to users in the future.

In short: Only the cookies needed to keep you signed in and to remember who uses a shared device.

EightyStar sets two cookies. One holds your session so you stay signed in. The other remembers which people use a device, so a shared family tablet can show faces to tap rather than an empty email box. Both are httpOnly, meaning page scripts cannot read them, and both are marked secure in production.

We do not use analytics, advertising or third-party tracking technologies, and we do not permit third parties to place them on the Services. There is therefore no targeted advertising, and nothing that would constitute a “sale” or “sharing” of personal information under US state privacy laws.

Most browsers accept cookies by default and let you remove or reject them. Rejecting ours will stop you being able to stay signed in.

In short: Yes - and only if your family turns it on. It is off until then, and nothing is sent before you choose.

As part of our Services we offer features powered by artificial intelligence (“AI Products”). These read what you put into your Family Inbox - a photo of a letter, a forwarded email, a PDF - and turn it into a suggestion you confirm, and answer questions in Ask in ordinary language.

Use of AI technologies. We provide the AI Products through a third-party service provider, Anthropic. Where you have turned this on, your input, output and the personal information contained in what you submit are shared with and processed by that provider so the feature can work. You must not use the AI Products in any way that violates that provider’s terms or policies.

Your content is not used to train models. We do not use what your family puts into EightyStar to train any model, and our agreement with our AI service provider does not permit them to either.

How to turn it on or off. This is off for every family until somebody chooses otherwise. Open Your choices in the app, where any parent in your family space can turn it on or off at any time. With it off, EightyStar still reads dates and works out what kind of thing something is using its own processing on our servers, and Ask still answers by searching your own records - nothing leaves to be read.

In short: If you sign in with Google, we receive basic profile information from Google.

Our Services let you register and sign in using your Google account. Where you choose this, we receive your name and email address from Google, and use that information only for the purposes described in this notice.

We do not control, and are not responsible for, other uses of your personal information by Google. We recommend you review their privacy notice to understand how they collect, use and share your information, and how to set your preferences.

In short: Our servers are in the United States.

Your information may be transferred to, stored by, and processed by us and by the providers described above, including in the United States and other countries.

If you are in the European Economic Area, the United Kingdom or Switzerland, those countries may not have data protection laws as comprehensive as your own. We will take all necessary measures to protect your personal information in accordance with this notice and applicable law.

In short: For as long as you have an account, unless a longer period is required by law.

We keep your personal information only for as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law. No purpose in this notice requires us to keep it for longer than the period in which you have an account with us. Server logs are kept for two weeks.

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymise it. Deleting your account deletes it immediately; we do not keep a copy.

In short: Through organisational and technical measures - though no system can be guaranteed secure.

Passwords are hashed with scrypt and a per-password salt. Session and device cookies are httpOnly and, in production, secure. Tokens for connected accounts are stripped before anything reaches your browser. The boundary between family spaces is enforced in one place rather than trusted to each screen.

However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals or other unauthorised third parties will not defeat our security and improperly collect, access, steal or modify your information. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

In short: Depending on where you live, you have rights of access, correction, deletion and more. You can review, change or terminate your account at any time.

In some regions - including the EEA, UK, Switzerland and Canada - you have rights under applicable data protection law. These may include the right to request access to and obtain a copy of your personal information, to request rectification or erasure, to restrict processing, where applicable to data portability, and not to be subject to automated decision-making. In certain circumstances you may also object to processing.

Withdrawing your consent. Where we rely on your consent, you may withdraw it at any time - for AI processing, from Your choices in the app, or by contacting us. Withdrawal does not affect the lawfulness of processing before it, nor processing carried out on other lawful grounds.

Your account. To review or change your information, open Settings. To delete your account, open Settings and use “Delete your account”. It takes effect immediately and cannot be undone. We may retain limited information where necessary to prevent fraud, resolve disputes, or comply with legal requirements.

If you have questions about your privacy rights, email privacy@eightystar.com. We will consider and act upon any request in accordance with applicable data protection laws.

If you are in the EEA or UK and believe we are unlawfully processing your information, you have the right to complain to your Member State data protection authority or the UK Information Commissioner’s Office. If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

If you complain to us directly, we will acknowledge it within 30 days, investigate without unjustifiable delay, keep you informed of progress, and explain the outcome.

Most browsers include a Do-Not-Track (“DNT”) setting. No uniform standard for recognising and implementing DNT signals has been finalised, and we do not respond to them at this time. California law requires us to say so. In practice there is nothing for a DNT signal to switch off here, because we do not track you across other sites at all.

In short: Yes, in many states - including rights to know, access, correct, delete and obtain a copy of your personal information, and to withdraw consent.

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have the right to request access to and details about the personal information we hold about you, correct inaccuracies, obtain a copy, or delete it. You may also withdraw consent to our processing. These rights may be limited in some circumstances by applicable law.

The table below shows the categories of personal information we have collected in the past twelve months.

We collect sensitive personal information only as permitted by law or with your consent, and we do not collect or process it to infer characteristics about you. You may have the right to limit its use or disclosure.

Your rights include the right to know whether we are processing your personal data; to access it; to correct inaccuracies; to request deletion; to obtain a copy; to non-discrimination for exercising your rights; and to opt out of processing for targeted advertising, the sale of personal data, or profiling with legal or similarly significant effects. We do none of those three, so there is nothing to opt out of.

How to exercise them. Email privacy@eightystar.com. You may designate an authorised agent to make a request on your behalf; we may deny a request from an agent who does not submit proof of valid authorisation. On receiving a request we will verify your identity against the information we already hold, and will only use what you provide for that verification.

Appeals. If we decline to act on your request, you may appeal by emailing privacy@eightystar.com. We will inform you in writing of any action taken or not taken, with the reasons. If your appeal is denied you may submit a complaint to your state attorney general.

California “Shine the Light”. California residents may request once a year, free of charge, information about personal information disclosed to third parties for direct marketing purposes. We disclose none, and there are no such parties to name.

In short: Nobody under 13 signs themselves up. A parent sets a child’s sign-in up and remains responsible for it.

EightyStar is built for families and expects children to appear in it. A child can be listed as a member, appear on the calendar and be assigned things without ever having an account or signing in - that requires nothing from them at all.

When a child is added, the form asks whether they are under 13, and “prefer not to say” is treated exactly the same as under 13, so declining to answer is never the riskier option. Under-13s are not offered an invite link and cannot create an account for themselves.

If a parent wants a child to be able to open EightyStar, the parent sets the sign-in up from inside the app using an email address the parent creates and controls, and in doing so takes on responsibility for that account. Nothing is ever sent to that address. The parent can change the password or delete it, and the account is deleted when the child is removed from the space or when the parent deletes their own account.

The age question is stored as a band rather than an age, and nothing other than the sign-in rule above ever reads it.

EightyStar is provided “as is”, with no warranties of any kind, express or implied - including fitness for a particular purpose and uninterrupted or error-free operation.

There is no promised uptime, no guaranteed backup, and no guarantee that a reminder or notification will arrive. Notifications depend on your browser, your device and services outside this one.

In short: Yes, as necessary to stay compliant with relevant laws.

We may update this notice from time to time. The updated version will be indicated by an updated date at the top. If we make material changes we may notify you either by prominently posting a notice of the changes or by sending you one directly. We encourage you to review this notice from time to time.

If you have questions or comments about this notice, email privacy@eightystar.com.

Depending on the laws of your country or state, you may have the right to request access to the personal information we collect from you, details about how we have processed it, to correct inaccuracies, or to delete it. You may also have the right to withdraw your consent. These rights may be limited in some circumstances by applicable law.

Most of this you can do yourself, immediately: Settings holds your account and lets you delete it, Your choices holds your consent decisions, and everything EightyStar knows about your family is visible in the app - there is no hidden profile. For anything else, email privacy@eightystar.com.