Herald privacy policy

1. Who we are

Herald is run by Constant Breeze Studio Pte. Ltd., a company registered in Singapore (UEN 202546197D) ("we", "us"). We are responsible for the personal information described here, and we follow Singapore's Personal Data Protection Act 2012.

Contact and Data Protection Officer: privacy@heraldfamily.app. We aim to reply within 30 days.

2. What we collect and why

2a. Your account

• You sign in with Google or with a one-time code sent to your email. There are no passwords.
• We keep your email address, your first name and a sign-in identifier. If a sign-in provider sends your surname, we don't keep it.
• We use these to recognise you and to keep your household's information separate from everyone else's.

2b. What your household adds

• The adults in a household add what they choose. That can include first names (never surnames), optional birthdays, routines, to-dos, trips, schools and days off, places and photos.
• Children never have accounts. Anything about a child is added by an adult in the household, who decides what to include.
• Anything shown on the dashboard, on a TV, iPad or other screen, can be seen by anyone who can see that screen.

2c. Calendars you connect

• Google Calendar is read-only. Section 3 has the details.
• School calendars you add by link are read the same way, to show the school's dates.

2d. Find plans in email (Gmail), only if you switch it on

Section 3 describes exactly which emails are read, who reads them and what we keep.

2e. Photos and children's artwork

• We keep a prepared display copy of each photo, with location and camera details removed. There is no face recognition.
• For children's artwork, we also keep a cleaned, smaller copy of the whole photo it was taken from, so you can re-frame it. It is never shown on the dashboard, and removing the piece deletes both copies.
• Please add only your own family's photos.

2f. Weather

To show the weather, we send Open-Meteo (Switzerland), or MET Norway as a backup, only an approximate area of about 5 km around your household's town.

2g. Travel times

• If you add places and turn on leave-by times, we send Google Maps only the coordinates of the two places and the time.
• We show the result until the next update, and we don't store Google's travel times.
• Your use of Google Maps features is subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.

2h. Screens that show your dashboard

• When you pair a TV or iPad, we keep a device identifier, its settings and basic health checks, such as when it was last seen and its software version.
• None of these are your household's content.

2i. Payments

• Payments are handled by Stripe. You enter your card on Stripe's own secure page, and we never see or store any card details.
• We keep only your plan, your billing status and Stripe's reference numbers.

2j. Emails from us

• We send sign-in codes, invitations, billing emails (receipts, and trial and renewal reminders) and important service notices through Postmark.
• We don't send marketing emails.

2k. Support and diagnostics

• If you email us, we keep your message to help you, for up to 12 months after our last exchange.
• If you use Report a problem in the app, we keep that report for 180 days.
• Our service doesn't keep request logs. The few technical log lines it writes contain no names, addresses, email content or household content. Cloudflare, which hosts our service, keeps these technical log lines for up to 7 days.

2l. Cookies

We use only the cookies needed to keep you signed in. There are no advertising or tracking cookies and no third-party analytics.

3. How Herald uses Google user data

This section explains how Herald accesses, uses, stores and shares information it receives from Google, and how you can remove it.

3a. What we access, and why

Each permission is asked for separately, on Google's own screen. Gmail is asked for on its own, only when you switch the feature on. We never see your Google password.

3b. Gmail: which emails, and who reads them

• Which emails:
• When you switch it on, we read every email from the last 60 days. After that, we read each new email in your inbox, about every 15 minutes.
• We never read your Promotions, Social or Forums tabs, chats, spam, trash, your Sent folder or emails you sent yourself.
• How much: every eligible email is read in full: sender, subject, date and text. The only attachments we look inside are calendar invitations.
• Who reads them:
• calendar invitations are read automatically by our own software;
• every other eligible email is sent, one at a time, to Anthropic's Claude AI service in the United States. It receives the subject, the sender's name and email domain, the date, your family's time zone and up to about 6,000 characters of text;
• Claude returns only the plan details we ask for, and the email is then discarded from our service;
• Anthropic does not use this data to train its models, and deletes it within 30 days. The exceptions: if its automated systems flag a request under its usage policy, it may keep it for up to 2 years; and where the law requires otherwise.
• No person at our company reads your email, except:
• where you ask us to (for example in a support case);
• where it is needed to keep the service secure;
• where the law requires.

3c. What we keep from Gmail (never the email itself)

Other things we keep:

• "Always add from this sender": if you choose it after adding a plan, we keep that sender's email domain.
• "Looks done?": while a to-do from email is unfinished, we keep three things so that a later email can show it's done:
• the email's conversation reference;
• the sender's domain;
• any order or booking reference, stored only in a scrambled form.

3d. How we store and protect it

• Everything Google sends us travels over encrypted connections (HTTPS).
• Your household's data is stored in our database on Cloudflare, in its Asia-Pacific region.
• The long-lived access Google gives us (the "refresh token") is stored encrypted (AES-256). The short-lived access keys are never stored.
• Emails are held only in memory while they are being read, and never written to storage or logs.
• Only our service can use your Google data, and only for your household. The people and tools that develop Herald work only with made-up test households.

3e. Who we share it with

We share Google user data only with these service providers, and only to run the features you switch on:

• Cloudflare, which hosts our service and database.
• Anthropic, only for Gmail reading, as described in 3b.

We don't sell Google user data, use it for advertising, or share it with data brokers or anyone else. The only exceptions:

• where the law requires;
• to protect people's safety or the service's security;
• if the company is sold or merged, under this policy and after telling you first.

3f. How long we keep it, and how to remove it

Suggestions:

• Suggestions you don't answer are deleted after 30 days.
• Answered event, to-do and trip suggestions are deleted after 90 days.
• Answered school days-off finds are deleted after a week.
• "Looks done?" references are deleted when the to-do is done or deleted, and after 90 days at most.

Switching off "Find plans in email" (in Settings, or by disconnecting):

• We stop reading at once and delete everything we found: suggestions, answered suggestions, sender choices and "Looks done?" references.
• We also end our access to your Gmail at Google. If the same Google account still connects a calendar, Google's permission page keeps one entry until you disconnect that calendar too.
• Plans you already added stay as ordinary items in your household.

Disconnecting a Google Calendar deletes that calendar's events from Herald, deletes our access key and ends our access at Google. The exception is a Google account still used for "Find plans in email": its access ends when you switch that off.

Deleting your account or your household does all of the above for the Google accounts involved (see section 7).

Backups: encrypted backup copies age out within a further 30 days.

At Google's end: you can also remove Herald's access at any time at myaccount.google.com/permissions.

3g. Google's Limited Use requirements

Herald's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our use of Gmail data also follows the Google Workspace API User Data and Developer Policy.

In particular:

• we use Google user data only to provide and improve the user-facing features described above;
• we transfer it to others only as described in 3e: to provide those features, for security, to comply with the law, or as part of a merger or sale after telling you;
• we never use it, or transfer it, for advertising, including retargeting or personalised or interest-based advertising;
• we never sell it, and never use it to decide whether someone can get credit or a loan;
• people don't read it, except:
• with your permission for specific messages;
• for security, such as investigating abuse;
• to comply with the law;
• for our internal operations, where the data has been aggregated and anonymised;
• we don't use it to develop, improve or train generalised AI or machine-learning models, and Anthropic does not train its models on it.

4. How we use AI

• We use AI only to find plans, to-dos, trips and school days off in your Gmail (section 3), and only if you switch it on.
• We don't use your information to train AI models, and Anthropic doesn't either.
• Suggestions can be wrong. That's why nothing is added until you check it and tap Add.

5. Who we share information with

We never sell your information or use it for advertising. We share it only with these service providers, and only to run Herald:

We also disclose information where the law requires it, or to protect people's safety. If the company is sold or merged, your information would pass to the new owner under this policy, and we would tell you first.

6. Where your information is kept

• Herald runs on Cloudflare. Your household's data is stored in Cloudflare's Asia-Pacific region, which may be outside Singapore.
• Some of the providers above process data in the United States and elsewhere.
• Where our providers store or process data outside Singapore, we rely on their contractual commitments to protect it to a standard comparable to Singapore law.

7. How long we keep it

8. Keeping it safe

• Everything travels over encrypted connections (HTTPS). Access keys for connected accounts are stored encrypted.
• Each household's information is kept separate. The people and tools that develop Herald work only with made-up test households.
• No system is perfectly secure. If a breach affects you, we will tell you, and the authorities where the law requires. Where Google user data is involved, we also tell Google.

9. Children

• Herald is for adults. Children don't have accounts, and we don't knowingly collect information from children.
• Parents may add their children's first names, birthdays, schools, routines and artwork. They control it and can delete it.

10. Your choices and rights

• See or export your information in Settings → My preferences → Download (yours) or Settings → Household → Download (the household's).
• Correct it in the app.
• Delete a connection, a photo, your own account (Settings → My preferences → Delete my account) or your whole household (in Settings).
• Switch off "Find plans in email" or disconnect a calendar at any time.
• Ask us to see, correct or delete information, or to withdraw your consent, at privacy@heraldfamily.app. We aim to reply within 30 days.
• US residents: we don't sell or share your personal information for cross-context behavioural advertising. Our service doesn't respond to "Do Not Track" signals, because we don't track you across sites.

11. Changes

If we change this policy, we'll update the date above. If the change is significant, we'll tell you in the app or by email before it applies.

12. Contact

Constant Breeze Studio Pte. Ltd., Singapore (UEN 202546197D) · privacy@heraldfamily.app