Privacy Policy — Familyoo

Last updated: October 2026

Familyoo (“Familyoo”, “we”, “us”) helps parents turn the chaos of family emails, messages, screenshots and documents into one shared inbox of things to do. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using Familyoo you agree to this policy.

Who we are. Familyoo is run by Behnam Bashokooh, trading as Familyoo, who is the data controller for the personal data described in this policy. You can reach us at contact@familyoo.com. We are registered with the Information Commissioner’s Office, registration number ZC277855.

1. Information we collect

Account information — your name, email address, and the password you set (stored only as a salted hash). For invited members, the email and role used to invite you.
Family profile you provide — details you choose to add, such as family, parent, caregiver and child names, schools, year groups, and the keywords you enter to help us judge what is relevant to your family.
Connected mailbox data (Google) — if you connect a Gmail account, we access your email messages on a read-only basis — the sender, subject, date, message body and attachments — to find items relevant to your family. See “Google user data” below.
Connected mailbox data (Microsoft) — if you connect an Outlook.com, Hotmail, Live, MSN or Microsoft 365 account, we access your email messages on a read-only basis through Microsoft Graph — the sender, subject, date, message body and attachments — to find items relevant to your family. See “Microsoft account data” below.
Content you add — screenshots, documents and text you upload or forward for processing.
Pilot questionnaire answers — during the closed test, your answers to the first-week and weekly questions: the multiple-choice answers and the week are stored; anything you type is emailed to us and not stored.
Usage and technical data — basic logs needed to operate the service securely (for example, sign-in events and error logs).

2. Google user data

When you connect a Google account, Familyoo requests read-only access to your Gmail messages so we can detect and summarise family-relevant items (events, tasks, deadlines). Familyoo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We use Google user data only to provide and improve Familyoo’s features for you.
We do not sell Google user data.
We do not use Google user data for advertising, and we do not transfer it to others except as necessary to provide or improve the service, to comply with applicable law, or as part of a merger or acquisition with appropriate notice.
We do not allow humans to read your Google user data unless we have your consent for specific messages, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and anonymised.

Specifically, Familyoo asks Google for: your email address (the openid and userinfo.email scopes), which we use to label the inbox you connected and to avoid connecting it twice; read-only access to Gmail (gmail.readonly), which we use to read your messages — sender, subject, date, body and attachments — to find items relevant to your family, and we never send, change, label or delete mail; and permission to create events in your Google Calendar (calendar.events), which we use only when you tap Add to Calendar on a card. We then create one event in that account’s primary calendar carrying the card’s title, date, details, any amount and action list, and a link back to the original email. We never read, list, change or delete your existing calendar events, and we do not touch your calendar unless you tap Add to Calendar. You can leave the calendar box unticked on Google’s permission screen and still use Familyoo; only Add to Calendar will not work.

You can disconnect a mailbox at any time from Settings; disconnecting deletes the access tokens we hold for it and asks Google to revoke Familyoo’s access. You can also withdraw Familyoo’s access from your Google Account permissions.

Microsoft account data

When you connect a Microsoft account (Outlook.com, Hotmail, Live, MSN or Microsoft 365), Familyoo requests read-only access to your mail (Microsoft’s Mail.Read permission), your name and email address, and permission to keep that access until you withdraw it. We use that data in exactly the same way, and under the same limits, as Google user data above: only to provide and improve Familyoo’s features for you, never sold, never used for advertising or to train AI, and never read by humans except with your consent, for security purposes, or as the law requires.

You can disconnect a mailbox at any time from Settings; disconnecting deletes the access tokens we hold for it. You can also withdraw Familyoo’s access from your Microsoft account’s app permissions; for a work or school mailbox, your organisation’s administrator can do this too.

3. How we use information

To extract, organise and remind you of family-relevant events and tasks.
To personalise what counts as relevant using the profile and keywords you provide.
To email you reminders before a card is due and a weekly digest of what is coming up. Reminders are on by default when you join; the digest is on by default for the parent who sets up the family and off for everyone else until you or a parent turn it on. Every one of these emails has a one-click unsubscribe link, and you can turn each on or off under Settings → Notifications. In your first two weeks we may also send up to three short getting-started tips, which stop with the same unsubscribe.
To run and secure your account: family invitations a parent asks us to send, sign-in and verification codes, password-reset links, a notice after any change to your password, sign-in email or two-step verification, a notice when a connected inbox needs reconnecting and, during the closed test, a Friday email with a few questions about your week. Apart from the Friday questions, which you can stop with their one-click link or under Settings → Notifications, these are part of providing the service and cannot be turned off.
To operate, secure, troubleshoot and improve the service.

Our lawful bases

UK data protection law requires a lawful basis for each use of personal data. Ours are:

Running your account and providing the service (sections 1, 3, 5 and 6) — performance of our contract with you, the Terms of Service.
Reading a mailbox you connect and turning its emails into cards, including the automated processing in section 4 — your consent, which you give when you connect the mailbox and approve Familyoo’s access on Google’s or Microsoft’s permission screen. You can withdraw it at any time by disconnecting the mailbox in Settings or by revoking access with Google or Microsoft; the cards already made stay until you delete them.
Details you add about your children — your consent, asked for during setup before anything about a child is stored, and withdrawn by deleting the child’s profile or the family.
Keeping the service secure and working (sign-in records, error logs, audit records, abuse prevention) — our legitimate interest in running a safe service, balanced against your rights.
Anything the law requires of us — legal obligation.

4. Automated processing (AI)

Familyoo uses automated systems, including third-party AI models run through Amazon Web Services (Amazon Bedrock), to read the content you provide or connect and to produce summaries and suggested action items. These outputs can be incomplete or inaccurate, so please verify important details before acting on them.

We do not use your data to train AI. Google user data — and any data derived from it — is used only to generate your own results. It is never used to develop, improve or train generalised machine-learning or AI models, and it is never transferred to any third-party AI service that would use it to train its models. The AI models we use process your content solely to return your result; Amazon Bedrock does not use content submitted to it to train the underlying models and does not share it with the models’ providers.

Familyoo’s use of raw or derived user data received from Google Workspace APIs (including Gmail) adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we share information

We do not sell your personal information. We share it only:

With service providers who process data on our behalf to run the service — for example cloud hosting and AI processing (Amazon Web Services) and email delivery — under obligations to protect it.
With members of your family you invite, who can see the shared family profile and items.
For legal reasons, if required to comply with law or to protect rights, safety and security.

6. Data retention and deletion

We do not keep the original content of what you import. Once Familyoo creates your action cards from an email, pasted message or uploaded file, the original text and any uploaded files are discarded — we retain only the cards. A card created from an email keeps a link back to the original message in your own mailbox; we do not store the email itself.

We keep your account and the cards we create for as long as your account is active or as needed to provide the service. You can delete imported cards, disconnect mailboxes, export your data, or delete your account or family from Settings → Privacy & Data. Deleting your account or family removes the associated profile and cards. Audit records of account actions keep names and email addresses for 12 months; after that only the action, its time and internal identifiers remain.

7. Security and where your data is stored

Familyoo is hosted on Amazon Web Services and your data is stored and processed in the United States. We use reasonable technical and organisational measures to protect it, including encryption in transit and at rest and access controls limited to running the service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If you use Familyoo from the United Kingdom, the EU/EEA, or elsewhere outside the United States, your information is transferred to and processed in the US. Where required, we rely on recognised safeguards for such transfers. You can exercise your data rights — access, export, correction and deletion — from Settings → Privacy & Data or by contacting us.

8. Children’s information

Familyoo is intended for use by adults (parents and caregivers). It is not directed to children, and children may not create accounts. Information about children in a family profile is provided and controlled by the parents or caregivers who manage that family.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, export or delete your personal data. You can exercise many of these directly in Settings, or contact us at contact@familyoo.com. To stop reminders, digests and tips, use the unsubscribe link in any of those emails (no sign-in needed) or Settings → Notifications; security notices cannot be switched off. If you think we have handled your information wrongly, please tell us first at contact@familyoo.com and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.

10. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you.

11. Contact us

Questions about this policy? Email contact@familyoo.com.