Zero advertising or sale of data: We never sell, rent, monetise, trade, or share your personal or household information with advertising networks or data brokers.
Pre-LLM anonymisation & tokenisation: Before generating AI morning briefings or parsing natural-language scheduling requests, family member names, telephone numbers, postcodes, and email addresses are automatically scrubbed and replaced with anonymous tokens prior to transit to Google Gemini.
Strict Google API Limited Use compliance: Your Google Calendar and Gmail data is used strictly for display and user-defined life administration rules, never for advertising, profiling, or training artificial intelligence models.
Zero tracking cookies: We use strictly necessary session cookies and functional client storage only. Read our dedicated Cookie & Local Storage Policy.
Transparent Subprocessors: Inspect our vetted data processors in our Subprocessors Directory.
Full self-service GDPR control: Instant one-click Data Export (JSON) and Permanent Account Deletion are available directly in Settings → Privacy & Data Protection.
1. Data Controller & Product Purpose
Perrymore Calendar (“Perrymore”, “the Hub”, “we”, “us”, or “our”) is a private family organisation and ambient wall-tablet kiosk platform operated by Perrymore Systems (United Kingdom). The platform is designed to coordinate household schedules, display ambient daily overviews, categorise school and life admin notices, assist with meal planning, and provide seamless natural-language event scheduling.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), the Data Controller responsible for your personal data is Perrymore Systems. If you have questions regarding this Privacy Policy or wish to exercise your statutory rights, please contact our designated Data Protection Lead at [email protected].
Under UK GDPR Article 6, we process your personal data only where a recognised lawful basis applies:
A. Performance of a Contract (Article 6(1)(b))
To create and manage your household account, authenticate family members, synchronise scheduled calendar events, calculate subscription billing through Stripe, and deliver core platform functionality requested by you.
B. Explicit Consent (Article 6(1)(a) & Article 9(2)(a))
When you connect your Google Calendar and Gmail accounts via OAuth 2.0, opt into generating Daily AI Overviews, or capture photos of grocery receipts or fridge shelves for AI inventory parsing. You may withdraw consent at any time by disconnecting integrations or disabling individual features in Settings. Furthermore, where calendar entries voluntarily created by family members contain special category data (such as medical appointments, dental checkups, or therapy visits), your explicit affirmative action in creating the entry constitutes your explicit consent under Article 9(2)(a).
C. Legitimate Interests (Article 6(1)(f))
To maintain server security, prevent unauthorised access or Cross-Site Request Forgery (CSRF), monitor operational uptime, and maintain error diagnostics. For households participating in the VIP Beta programme, we track Daily Active Usage (DAU) counter dates and milestone survey triggers (e.g. Day 3 micro-pulse, Day 7 usability, and Day 14 comprehensive review) to monitor pre-release platform stability, measure domestic friction, and guide product refinement under Article 6(1)(f). We also process aggregate, privacy-preserving visitor footfall and geographic demographics (UK devolved nation, county, and municipality) to allocate server capacity and understand domestic service demand. Unique visitors are measured via an ephemeral daily cryptographic salt rotated every 24 hours; raw IP addresses are discarded in-memory instantly, zero tracking cookies are employed, and metrics are never shared with advertising networks or data brokers.
D. Compliance with Legal Obligations (Article 6(1)(c))
To maintain statutory VAT and financial accounting records for subscription transactions processed through Stripe, as required under UK tax legislation (HMRC).
3. Information Stored & Database Architecture
To provide family scheduling and coordination services, Perrymore stores structured operational data in a dedicated, private PostgreSQL database hosted within secure cloud infrastructure:
A. User Accounts & Household Profiles
Email address, display name, household grouping, account role (ADMIN, ADULT, or CHILD), and passwords hashed using bcryptjs (with 10 salting rounds; plaintext passwords are never stored or accessible). We store family member profiles (first names, calendar colour assignments, nicknames/aliases) and household invite tokens.
B. Calendar, Household Routines & Life Admin Configurations
User-created calendar appointments, recurring event rules (RRULE), user-defined email classification rules (mapping school, sports club, or utility sender addresses to designated categories), dismissed email message identifiers, and generated daily briefings. Sensitive household routine settings (including private home residential address, workplace locations, children's school locations, transport modes, and work/school day timings) are sealed within an authenticated AES-256-GCM application-level Domestic Vault prior to database persistence. Domestic Vault data is stored as encrypted ciphertext and is completely inaccessible in plaintext to database administrators, cloud hosting operators, and system superadmins.
C. Relational Storage vs Encryption at Rest
In line with standard relational database architecture, fields required for user authentication, foreign key joins, calendar querying, and display (such as account emails and member names) are stored as indexed relational columns. In addition to disk-level AES-256 cloud encryption, our proprietary application-level Domestic Vault adds a second layer of authenticated AES-256-GCM encryption over private residential coordinates and commute configurations. Communications between our application runtime and the database are encrypted in transit over private TLS connections.
D. Client-Side Preferences (Local Only)
Kiosk display preferences are stored strictly in your browser or wall-tablet's localStorage. This includes accessibility configurations (font size scaling, high contrast, reduced motion, OpenDyslexic typeface, large touch targets), kiosk screensaver idle timeouts, night clock dimming schedules, and theme selection. This data never leaves your client device.
E. Privacy-Preserving Aggregate Visitor Demographics & Telemetry
To plan cloud server capacity and evaluate domestic platform reach, we measure high-level aggregate metrics (daily unique visitor totals, route hit counts, form factors such as wall-tablet displays, and UK regional distribution). This telemetry is self-hosted within our private database. Raw IP addresses are processed in-memory solely to generate an ephemeral daily salted hash (SHA-256(IP + UserAgent + Date + Salt)) and are discarded instantly. Raw IPs are never written to disk or database logs, zero tracking cookies are placed, and aggregate metrics are never sold or shared.
F. VIP Beta Usage Telemetry & Feedback Responses
For households enrolled in the VIP Beta programme, we record non-personally identifiable daily active dates (DAU counter), survey milestones reached, and voluntary questionnaire responses (setup baseline, UMUX-Lite usability ratings, and Sean Ellis product-market fit reflections). Households retain direct autonomy over milestone prompts: users may defer prompts by one week via “Remind me later” (168-hour snooze) or permanently opt out of automated feedback popups via “Don’t ask me again”. These preferences and responses are stored in encrypted database settings accessible solely to platform superadministrators and are permanently expunged upon account deletion under your Right to Erasure.
G. School & ClassDojo Calendar Subscriptions (Webcal / iCal Feeds)
When you input a public or tokenised school calendar feed URL (such as an iCal or ClassDojo webcal:// link), Perrymore periodically fetches event summaries, start/end times, locations, and descriptions over encrypted HTTPS connections (cached with a 15-minute time-to-live) directly from the publishing school server. Perrymore stores only the feed URL, your chosen label, and the assigned family member association in our database. We do not transmit or share your school feed URLs with third parties.
H. Apple Account & iCloud Shared Calendar Synchronisation (CalDAV)
When you connect an Apple account, Perrymore communicates directly with Apple's servers (caldav.icloud.com) using the industry-standard RFC 4791 CalDAV protocol. For security and privacy, you authenticate exclusively using an Apple App-Specific Password; your primary Apple account master password is never requested, transmitted, or stored. Your App-Specific Password is encrypted at rest using authenticated AES-256-GCM envelope vault encryption. Perrymore retrieves calendar metadata, event titles, timings, locations, and shared status for your selected personal and iCloud Shared Family calendars to display your unified household schedule. CalDAV synchronisation may be disconnected at any time from your account settings, which immediately purges your vaulted credentials and cached Apple events.
4. Google API Services & OAuth 2.0 Integration
How Perrymore interacts with Google Calendar and Gmail
When you link a Google account, our application requests explicit consent via Google OAuth 2.0 for the following minimum required scopes:
Google Calendar: Used solely to display household timelines, fetch upcoming appointments across selected family calendars, and insert newly confirmed events generated via manual entry on Essentials or AI-assisted Smart Add and email suggestions.
https://www.googleapis.com/auth/gmail.readonly
Gmail (Read-Only): Strictly used to inspect incoming message headers and snippets against your custom email filter rules (such as school notices, extracurricular sports, or utility bills). Personal correspondence outside your defined rules is completely ignored and never ingested into summaries.
openid • email • profile
Used solely to associate and authenticate the connected Google email address with your Perrymore household profile.
Google API Services User Data Policy Compliance (Limited Use)
Perrymore Calendar's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:
Google user data is strictly used to provide user-facing calendar and life administration features within Perrymore.
Google user data is never transferred or sold to third parties, advertising networks, or data brokers.
Google user data is never used for serving advertisements, including targeted or behavioural ads.
Google user data is never used to train generalised artificial intelligence or machine learning models.
No humans read your emails or private calendar events, unless you provide explicit consent for technical troubleshooting, it is necessary for security investigations, or it is required by law.
Perrymore integrates with the Google Gemini API (hierarchical multi-model failover architecture spanning primary gemini-3.8-flash, gemini-3.6-flash, and dedicated high-throughput fallback gemini-3.5-flash-lite with real-time model discovery via enterprise @google/genai) to power assistive household features. To guarantee family confidentiality, we deploy active software sanitisation and tokenisation layers across all AI entry points:
A. Smart Add (Bidirectional Pre-LLM Tokenisation)
When you schedule events using natural language (e.g. “Leo piano lesson Friday 4pm”), our server replaces configured family names and nicknames with anonymous tokens (e.g. {{MEMBER_0}}) and scrubs any email addresses, telephone numbers, and postcodes prior to transit. Google Gemini returns structured calendar data containing only the anonymous tokens, which our server decodes locally back into your family member's name before presenting it on your screen. Google Gemini never receives your family's real names.
B. Daily AI Overview & Morning/Evening Spoken Audio Briefings
Before synthesising your morning briefing, evening readiness debrief, or spoken audio dispatches, all calendar events, household work/school schedules, commute travel buffers, logistics handoffs, and custom guidelines pass through our sanitisation pipeline. Family names are systematically scrubbed and replaced with anonymous tokens, and contact telephone numbers and postcodes are masked. Personal home residential street addresses are never transmitted to external foundation AI models; our server-side commute calculation engine computes road distances, time-of-day historic internet traffic delays (morning school run, evening rush hour, off-peak), known scheduled roadworks and lane restrictions (via public transport authority open data feeds including Transport for London), and departure recommendations locally using OpenStreetMap / Photon / Postcodes.io, supplying only generalised references (e.g. “Home Base”, “Workplace”) to Google Gemini. Email ingestion in morning briefings is strictly restricted to households on eligible subscription tiers (Family Pro and Lifetime Founding Pass). For eligible households, only emails matching your configured Life Admin rules (e.g. schools, clubs, utilities) are included; personal inbox correspondence and senders or emails you have designated as ignored in “Train your inbox” are completely excluded. For households on standard tiers (Family), briefings are strictly grounded in official Google Calendar events, weather forecasts, and domestic routines without any email scanning or ingestion. Spoken audio dispatches are converted to voice audio using Google Cloud Text-to-Speech or local browser Web Speech synthesis, with zero voice biometric retention. Real names are restored locally on your server upon return.
C. AI Physical Documents, Invitations, Appointments & Fridge Vision Scanner
When you photograph or upload a physical document (such as an NHS hospital appointment letter, clinic card, dentist slip, vaccination reminder, children's birthday party invitation, school notice, sports fixture, or booking confirmation) using Smart Add, or photograph food items in your fridge and pantry, the media is processed under rigorous, privacy-first technical constraints:
Client-Side High-Definition Downsampling: Images are compressed directly on your device via an offscreen HTML5 <canvas> element to an optimised 1800px resolution at 0.85 quality before transmission. This reduces raw camera payloads by over 95% while keeping printed 8pt–10pt text crisp for optical character recognition.
Zero Disk, Database, or Cloud Storage Persistence: Perrymore never writes, archives, or persists uploaded photos or document scans to disk, database storage, or cloud object buckets (such as Amazon S3). The image data exists transiently in server memory solely for the seconds required to execute the structured JSON extraction, and is immediately purged and garbage-collected once processing concludes.
Application Metadata Isolation: Perrymore never attaches your stored account profile data (such as your account email, family surname, registered home base address, billing records, or past calendar history) to the Vision AI prompt payload. The vision prompt is supplied only with the first names of your household members as a candidate roster to link the extracted event to the appropriate child or adult timeline.
Strict Recipient Postal Address & Identifier Disregard: In printed correspondence (such as NHS letters arriving in clear window envelopes), the recipient's home address may be visible within the image frame. Gemini Vision is explicitly governed by strict prompt directives instructing it to never extract, record, or use the recipient's home address as an event location or description (the location is strictly confined to external clinics, hospitals, party venues, or schools). Furthermore, the AI is instructed to disregard confidential personal or government identifiers, including NHS Numbers, National Insurance numbers, hospital patient MRN numbers, and dates of birth.
Automated Server-Side Post-Extraction Scrubbers: As a secondary defence layer, all text extracted by the Vision AI passes through server-side regex scrubbers that automatically redact detected 10-digit UK NHS numbers ([REDACTED_NHS_NO]), National Insurance numbers ([REDACTED_NINO]), and date of birth markers ([REDACTED_DOB]) before event cards are rendered to your screen or committed to your calendar.
Parent Zero-Knowledge Letter Folding Technique: Parents seeking 100% zero-knowledge assurance regarding their home address may simply fold down the top third of the letter (the recipient address window block) or cover it before photographing. The Vision AI requires only the letterhead, clinic department, date, time, and instructions to generate an accurate calendar event.
Enterprise AI Non-Training Exemption: All multimodal vision analyses operate under Google Cloud Enterprise API terms (@google/genai). Uploaded document photos and schedules are never used to train, retrain, or improve Google's foundation models, and are never harvested for advertising, identity resolution, or consumer profiling.
In-App Transparency Padlock: Users can inspect real-time data privatisation and security disclosures at any time directly within the Smart Add interface and chat dialogues by tapping the dedicated [ 🔒 Private & Tokenised ] padlock badge.
Client-Side Document Recovery Failsafe: In the event of a transient service disruption, timeout, or capacity spike on Google's AI servers, Perrymore retains the captured document safely in your browser's ephemeral local memory. You are immediately presented with an explicit server status notice and options to either save the image directly to your device storage for later processing or re-try the scan with a single tap, ensuring photographs of physical paperwork are never lost.
Usage Metering & Quota Tracking: To govern platform infrastructure and enforce subscription tier boundaries, Perrymore maintains strictly an integer count of completed scans associated with your household ID (5 monthly scans on Family Essentials, 20 monthly scans on Perrymore Family, and unlimited scans on Family Pro and Founding Family Lifetime Pass). Document photos, thumbnails, extracted text, and document metadata are never saved to database telemetry or linked to billing profiles.
D. Context-Aware AI Help Assistant (Ephemeral In-Memory Guidance)
When you tap the Help button (“?”) in the navigation pill or sidebar to consult the AI assistant, your enquiry and high-level screen context (such as the active page title or view mode) are processed ephemerally. Before transit to Google Gemini, our server automatically tokenises all family member names (e.g. {{FAMILY_MEMBER_0}}) and scrubs any telephone numbers, postcodes, and email addresses. Google Gemini returns guidance containing only tokenised references, which are deanonymised locally on your server prior to display on your screen. Help conversations are ephemeral in active browser memory and are never persisted to disk, stored in database logs, or utilised to train foundation AI models.
E. Ask & Add with Live Web Search Grounding (Family & Family Pro)
When using “Add anything to calendar” or entering calendar queries that cannot logically produce an event without real-world external dates (such as school half-term calendars, UK film releases, sports fixtures, or public holidays), our system automatically engages Ask & Add. To ensure total transparency and control, an explicit consent dialogue displays the exact anonymised query terms to the user before any external search request is transmitted, allowing them to confirm the search, decline it, or enter the event manually (“Add Manually”). All family member names, telephone numbers, and addresses are systematically masked prior to search execution. External search grounding queries are executed in real time solely to retrieve public dates and are never persisted or utilised for AI training.
To eliminate visual repetition and protect system resources, speculative bulk batch processing of unread inbox items has been retired in favour of Just-In-Time (JIT) extraction. When a user actively opens an email, Google Gemini analyses the full email content along with any attached correspondence (such as school newsletter PDFs or schedule documents, processed transiently in server memory). The pipeline extracts genuine upcoming calendar events, actionable requirements (such as permission slips, forms, and payments with due dates), and a concise British English takeaway with automated family member de-anonymisation. Suggested events are cross-referenced directly against your connected Google Calendar to automatically flag existing bookings (“Already in Calendar”) and detect schedule clashes for assigned family members without transmitting calendar data to third parties. Structured intelligence is cached within your household settings so that each email is processed at most once. Senders designated as “Ignored” are completely excluded prior to transit, attachments are never written to disk or database storage, and all processing operates under zero model training enterprise terms.
G. Responsible Agentic AI Governance & Upstream Compliance (October 2026 Guidelines)
Perrymore adheres strictly to Google Cloud's Agentic AI Responsible Use Guidelines (effective October 12, 2026), Platform Service Specific Terms, and Generative AI Prohibited Use Policy. Our AI pipelines implement deterministic runtime policy enforcement: AI models operate within strictly scoped, non-autonomous candidate generation envelopes with zero autonomous write access to external Google Calendars, user email accounts, or financial systems. Candidate calendar bookings generated by AI workflows (such as Smart Add or Smart Inbox) require affirmative human confirmation prior to persistence. Furthermore, bidirectional pre-LLM tokenisation, deterministic schema validation, and rigorous sanitisation layers protect against prompt injection, jailbreaking, and data leakage, ensuring personal household data is never compromised.
Model Training Exemption: Data transmitted to Google Gemini via our enterprise Google Cloud API integration is not logged or retained by Google to train foundation AI models, in accordance with Google Cloud's commercial data governance agreements.
Perrymore offers optional recurring subscriptions (Family and Family Pro) with a 14-day free trial, as well as one-off purchases (Founding Family Lifetime Pass). Payment processing and billing lifecycle operations are handled securely by Stripe Payments Europe Ltd / Stripe Inc., a certified PCI-DSS Level 1 Service Provider.
Zero Raw Card Storage: Payment card details (card number, expiry date, CVV) are entered directly into Stripe's hosted elements and are never transmitted to, viewed by, or stored on Perrymore servers.
Stored Billing Identifiers: We store only the Stripe Customer ID (cus_*), Stripe Subscription ID (sub_*, for recurring plans), Stripe Checkout Session ID, and active entitlement status to provision your household's features and enforce plan boundaries.
Self-Service Customer Portal: You can view payment receipts, invoices, update payment cards, or cancel recurring subscriptions at any time via the Stripe Customer Portal link in Settings → Subscriptions & Billing.
7. Weather & Third-Party Meteorological Services
Perrymore integrates with the Open-Meteo API (api.open-meteo.com) to display ambient weather conditions, daily temperatures, and rain forecasts on your dashboard, screensaver, and morning overview.
Weather requests utilise broad regional geographic coordinates (defaulting to the London/Surrey area, UK: 51.33° N, 0.27° W). Perrymore does not track, collect, or transmit real-time GPS telemetry or continuous background device locations.
8. Subprocessors & International Data Transfers
We engage vetted third-party service providers (“subprocessors”) to deliver compute hosting, database management, artificial intelligence, and billing. A full list is maintained in our public Subprocessors Directory.
Where data is processed outside the United Kingdom or European Economic Area (e.g. by Google LLC or Stripe Inc. in the United States), transfers are safeguarded by legally recognised transfer mechanisms, including the UK International Data Transfer Agreement (IDTA), European Commission Standard Contractual Clauses (SCCs), and relevant UK adequacy regulations.
9. Data Retention & Erasure Schedules
We adhere to strict data minimisation and retention schedules:
Active Accounts: Account data, calendar entries, and email rules are retained for the lifetime of your active household account.
Instant Self-Service Erasure: When a Household Administrator triggers account deletion, all database records (users, family profiles, OAuth tokens, events, email rules, briefings, and widget configurations) are permanently wiped immediately via cascade deletion.
OAuth Tokens: When an account is unlinked in Settings, stored access and refresh tokens are deleted instantly.
Diagnostic Server Logs: Operational access and error logs are retained ephemerally and automatically rotated every 30 days.
Tax & Financial Invoicing: Stripe transaction invoices and tax records are retained for 6 years in compliance with HMRC statutory accounting requirements.
10. Children's Privacy & Age-Appropriate Design
Perrymore is designed specifically for domestic household coordination, which naturally involves children's school events, clubs, and schedules. We adhere to the standards of the UK Age-Appropriate Design Code (Children's Code):
Child profiles and accounts can only be created and supervised by an adult Household Administrator.
We do not profile, track, or serve advertising to children.
Pre-LLM anonymisation ensures children's real names are systematically tokenised and scrubbed before interacting with third-party generative AI models.
Kiosk devices operate with privacy-first ambient displays that do not expose sensitive life admin correspondence to child accounts.
11. Your Statutory Data Protection Rights (UK & EU GDPR)
Under Chapter III of the UK GDPR and EU GDPR, you have the following rights:
Right of Access (Art. 15): Request a copy of the personal data we hold about you.
Right to Rectification (Art. 16): Update or correct inaccurate family information directly in Settings.
Right to Erasure (Art. 17): Permanently wipe your household data via self-service in Settings.
Right to Portability (Art. 20): Instantly download your full household data archive in structured JSON.
Right to Lodge a Complaint: You have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or via helpline on 0303 123 1113.
Document Revision History & Policy Changelog▼
Version 5.0 — 22 October 2026
Responsible Agentic AI Governance & Upstream Alignment: Added Section 5(G) documenting compliance with Google Cloud's October 2026 Agentic AI Responsible Use Guidelines, Platform Service Specific Terms, and Generative AI Prohibited Use Policy. Formally articulated deterministic runtime policy enforcement across all AI capabilities, mandating non-autonomous execution and affirmative human confirmation prior to any calendar or database mutation.
Subprocessor Directory Synchronisation: Updated Google LLC subprocessor terms to encompass enterprise Data Processing Addendum (DPA) covenants and October 2026 responsible agent deployment frameworks.
Version 4.9 — 20 October 2026
Life Admin Radar & High-Performance Notice Architecture: Upgraded email triage storage from monolithic configuration maps into an indexed, relational database model (LifeAdminNotice). All notice envelopes and extracted scheduling intelligence are strictly scoped to the authenticated user and household (userId), enabling instantaneous zero-latency retrieval and automatic cascade erasure upon account deletion.
Decoupled Background AI Ingestion Worker: Introduced an asynchronous background classification and synchronisation worker that ingests school newsletters, club announcements, and domestic invoices without blocking active page rendering, ensuring zero-latency dashboard loads.
Kit Radar & Sunday Family Briefing Synthesis: Documented the extraction of uniform, sports kit, and equipment requirements alongside scheduled dates and outstanding fees, compiled into a calm, WhatsApp-formatted Sunday Family Briefing with bidirectional pre-LLM identity anonymisation and strict zero-training guarantees.
Version 4.8 — 19 October 2026
Apple Account & iCloud Shared Calendar Synchronisation: Added Section 3(H) and updated Subprocessors Directory detailing native RFC 4791 CalDAV integration with Apple iCloud Calendar services. Documented that user-authorised App-Specific Passwords are encrypted at rest using authenticated AES-256-GCM vault security. Master Apple ID account passwords are never accepted, requested, or stored. Calendar metadata and event titles are synchronised directly with user-configured household calendars, supporting personal and iCloud Shared Family calendars with strict tenant isolation.
Version 4.7 — 17 October 2026
Feedback Pop-up Autonomy & Telemetry Snooze Controls: Updated Section 2(F) to articulate granular household privacy controls over milestone telemetry prompts. Users may defer prompts by seven days (168 hours via “Remind me later”) or permanently opt out of feedback pop-up dialogues (“Don’t ask me again”), recorded via encrypted household settings and local browser preferences with zero adverse impact on service availability.
Version 4.6 — 12 October 2026
Envelope Encryption & Credential Protection at Rest: Implemented authenticated AES-256-GCM application-level encryption at rest for Google OAuth refresh and access tokens, guaranteeing that cloud database dumps contain zero plaintext credentials.
Household Tenant Isolation Hardening: Fortified tenant boundary controls across household invitation flows and Google OAuth sign-in auto-provisioning to guarantee distinct, isolated household generation for all new users and eliminate legacy cross-household fallbacks.
Scanned Document Security & Private Caching: Enforced mandatory session authentication and tenant verification on physical scanned letters and documents, with strict private non-caching HTTP directives (Cache-Control: private, no-store).
GDPR Article 17 Erasure Cascade: Verified that permanent household account erasure workflows automatically cascade to purge all associated scanned documents and encrypted household configuration settings.
API Perimeter & Telemetry Hardening: Decommissioned legacy database metrics endpoints and enforced strict Bearer token header authorization across all background cron operations.
Version 4.5 — 10 October 2026
AI Model Hierarchy Update: Removed deprecated gemini-3.7-flash model from the automated multi-model failover infrastructure and subprocessors directory following upstream deprecation. Traffic is automatically rerouted to gemini-3.8-flash ensuring continuous service resilience and zero-downtime operation.
Version 4.4 — 7 October 2026
Automated Background Email Scanning (Premium): Documented the new zero-delay background email auto-scanning feature. For users on the Perrymore Family Pro tier, urgent un-scanned emails are silently triaged against the user's criteria of interest upon dashboard access. Results (calendar suggestions, conflict checks) are cached directly in the user's encrypted database record without requiring explicit manual interaction. Anonymisation tokens are still fully applied prior to LLM processing.
Version 4.3 — 7 October 2026
Vision AI Scan Quota Metering & Availability: Updated Section 5(C) to document the data protection architecture supporting tiered Vision AI availability (5 monthly scans on Family Essentials, 20 monthly scans on Perrymore Family, unlimited on Family Pro and Lifetime Pass). Clarified that usage tracking stores strictly an anonymised numerical integer counter per household without persisting scan images, document thumbnails, or metadata.
Version 4.2 — 5 October 2026
Smart Inbox Notification Bell & Alert Dismissal Processing: Documented dashboard notification bell surfacing active notices matching user-defined criteria of interest, with explicit confirmation required before dismissing alerts to prevent inadvertent data loss while preserving correspondence in the primary Smart Inbox archive.
Version 4.1 — 26 September 2026
Automated Calendar Duplicate & Clash Detection: Documented automated cross-referencing of extracted email events against connected Google Calendars, flagging duplicate bookings (“Already in Calendar”) and notifying users of member schedule clashes directly within the email reader modal.
Secure Server-Side Family Member De-Anonymisation: Implemented automated post-processing restoring pseudonymised family tokens back to actual household member names across all summaries, action items, and event forms with zero data leak to model outputs.
Version 4.0 — 26 September 2026
On-Demand Multimodal Extraction: Retired speculative bulk batch triage across unread inbox items on page load, migrating to on-demand Just-In-Time extraction invoked exclusively when an email is opened.
Multimodal Attachment Document Reading: Disclosed automated in-memory inspection of attached PDFs and images (e.g. school newsletters, term dates, and letters) alongside email text via Google Gemini, with zero disk or database storage of attachment files.
Clean Inbox Stream & Redirection of Summaries: Removed repetitive summary boxes from the inbox list view; actionable tasks and calendar events are presented within the email reader upon active inspection.
Version 3.9 — 26 September 2026
Smart Inbox Single-Batch AI Triage & Information Extraction: Added Section 5(F) detailing high-throughput single-batch processing of incoming Life Admin correspondence via Google Gemini 3.5 Flash Lite with automated failover.
Contextual Action Relevance & Informational Suppression: Documented intelligent distinction between actionable calendar events, pending tasks/payments, and purely informational notices (such as lesson cancellations, updates, and receipts), ensuring calendar scheduling CTAs are suppressed when no calendar event exists.
Persistent Zero-Redundancy Cache: Triaged summaries and intents are permanently stored in encrypted household settings, ensuring each email is processed by Google Gemini at most once.
Strict Event Verification: Guarded suggested event banners against rendering when emails lack actionable scheduling details, preventing ghost calendar entries.
Version 3.8 — 26 September 2026
Smart Inbox Unified Architecture & Progressive Disclosure: Rebranded and unified Life Admin into the Smart Inbox, introducing a single-stream chronological feed, top category filter pills, and inline 1-tap sender training.
Just-In-Time (JIT) AI Event Extraction & Local Caching: Documented on-demand invocation of Google Gemini for event date extraction upon active email opening, caching structured results locally within household settings to eliminate redundant API token transmissions and preserve zero foundation model training.
Sub-Account Task Delegation Verification: Documented that partner and household email assignment is strictly gated to verified family members with active login sub-accounts.
Version 3.7 — 26 September 2026
Life Admin Email Triage & Household Radar: Documented persistent category routing, Sender Directory with 1-tap re-classification, in-category sender filtering and grouping, dual-parent inbox synchronisation with recipient labelling, and partner task delegation.
School Newsletter & Letter Attachment OCR: Disclosed on-demand scanning of attached school PDF letters and newsletters via Google Gemini Vision (scanDocumentAction) with transient in-memory extraction of dates and schedules, zero disk or database retention of attachment files, and zero foundation model training.
Weekly AI Family Digest: Documented automated household summaries (generateWeeklyDigestAction) analysing aggregated subject and snippet metadata in transient memory with zero external sharing.
Household Triage Metadata Storage: Documented encrypted first-party storage of email triage flags (handled/done status, kiosk pins, snooze timers, and member assignments) within authenticated household settings.
Version 3.6 — 26 September 2026
School & ClassDojo Calendar Subscriptions (Webcal / iCal Feeds): Added Section 3(G) detailing encrypted periodic HTTPS polling of external calendar feeds (RFC 5545 .ics and webcal://) with 15-minute caching. Disclosed zero sharing or transmission of school feed URLs to third parties.
Universal Multimodal Vision AI for Documents & Invitations: Extensively updated Section 5(C) detailing physical and digital document scanning across NHS hospital appointments, clinic cards, birthday party invitations, school notices, and booking confirmations. Documented high-definition client-side canvas compression (1800px @ 0.85 JPEG, 95%+ data reduction), transient in-memory processing via Google Gemini Vision, strict zero-persistence guarantees (no images saved to database, disk, or S3), recipient home address disregard for window envelopes, automated server-side regex scrubbers for NHS/NI numbers and dates of birth, zero foundation model training, physical zero-knowledge folding guidance, the interactive in-app [ 🔒 Private & Tokenised ] transparency modal, and client-side failsafe document preservation with 1-tap device download if Google's servers experience service interruptions.
Version 3.5 — 24 September 2026
Known Roadworks & Planned Streetworks Ingestion: Updated Section 5(B) and the Subprocessors Directory to document the ingestion of open, public road disruption feeds (Transport for London Open Data). Disclosed that route corridor spatial filtering and lane closure buffer calculations are performed strictly server-side without transmitting personal street addresses, user identifiers, or household profiles to third-party APIs or foundation AI models.
Version 3.4 — 24 September 2026
Introduced Domestic Sanctuary Vault: Added authenticated AES-256-GCM application-level encryption at rest for household routines, home residential addresses, workplace locations, and children's school settings, ensuring zero plaintext visibility to system administrators or cloud operators.
Documented Real-World Address Autocomplete & Commute Engine: Disclosed real-world address search via OpenStreetMap Photon and Postcodes.io, alongside a time-of-day historic traffic calculation engine. Commute durations, road distances, and departure buffers are computed server-side without transmitting personal street addresses to foundation AI models.
Version 3.3 — 24 September 2026
Documented Household Work, School & Travel Routines: Disclosed optional storage of parent workplace locations, working hours, children's school locations, day timings, and travel duration buffers in encrypted household settings.
Specified that routine locations and commute times are utilised solely to calculate departure deadlines and transition windows in daily AI overviews and spoken audio dispatches, passing through our pre-LLM tokenisation pipeline with zero external model training.
Version 3.2 — 23 September 2026
Documented Daily AI Audio Briefings (Morning Logistics Dispatch & Evening Readiness Debrief), detailing that audio dispatches are synthesised from pre-anonymised scheduling and meteorological data, with voice synthesis performed via Google Cloud Text-to-Speech or local client-side Web Speech engines with zero voice biometric retention or model training.
Updated Section 5(B) and Subprocessors Directory to reflect Google Cloud Text-to-Speech API integration.
Version 3.1 — 23 September 2026
Disclosed non-personally identifiable Daily Active Usage (DAU) telemetry and milestone feedback survey prompts (Day 3, Day 7, Day 14) for VIP Beta households under UK GDPR Article 6(1)(f) Legitimate Interests.
Added Section 3(F) detailing secure first-party storage of voluntary questionnaire submissions, complete superadmin access restriction, and instant permanent deletion under Right to Erasure.
Version 3.0 — 19 September 2026
Updated Section 6 to document one-off checkout processing via Stripe for Founding Family Lifetime Pass purchases alongside recurring subscription billing, with zero raw payment card retention.
Documented enhanced client-side dashboard layout preferences, including touch and mouse drag-and-drop widget reordering, multi-column card width selections (1/3, 1/2, or full width), and dynamic content density/height configurations.
Reaffirmed that all dashboard layout customisation choices are preserved locally or synced to authenticated household settings without external tracking or profiling.
Version 2.8 — 14 September 2026
Updated Section 5(E) to document automated Ask & Add web search triggering for queries requiring real-world external dates (e.g. school term calendars, cinema releases, fixtures, public holidays) within the modal engagement flow.
Articulated the mandatory user consent prompt and anonymised query preview presented prior to transmitting any search request to live internet grounding engines.
Reaffirmed zero retention of search queries and bidirectional tokenisation of family names, contact details, and locations.
Version 2.8 — 20 September 2026
Updated Section 5(B) to document strict subscription tier boundaries for Daily AI Overview data ingestion: inbox email scanning is exclusively executed for households on Family Pro and Lifetime Founding Pass tiers.
Formalised zero-hallucination grounding mandate ensuring morning briefing generation is strictly restricted to confirmed official Google Calendar schedules and user-configured preferences.
Documented multi-account event deduplication across family calendars and complete suppression of unverified email correspondence on standard Family plans.
Version 2.7 — 13 September 2026
Documented manual calendar event entry for Essentials tier households, ensuring events are scheduled directly into Google Calendar without third-party AI processing or tokenisation.
Maintained bidirectional pre-LLM tokenisation disclosures for AI Smart Add entries on qualifying Family tiers.
Version 2.6 — 13 September 2026
Added granular user controls in “Train your Inbox” allowing household users to explicitly ignore individual emails or entire senders.
Documented strict exclusion of ignored emails and senders from Life Admin, Radar dashboard displays, and Morning AI Overview briefing generation.
Provided transparent interface tabs for reviewing ignored senders and individual emails with instant restoration and category reassignment capabilities.
Version 2.5 — 13 September 2026
Added Section 5(D) disclosures for the interactive Context-Aware AI Help Assistant, detailing bidirectional pre-LLM tokenisation, screen context sanitisation, ephemeral in-memory processing, and zero disk/log retention.
Version 2.4 — 13 September 2026
Enhanced contextual privacy transparency across all AI touchpoints (Smart Add, Daily AI Briefing, AI Family Chef, Life Admin Radar, and Fridge Scanner) with ambient layman reassurances documenting pre-LLM anonymisation, ephemeral in-memory processing, and zero model training.
Version 2.9 — 25 September 2026
Automated property UPRN population from household addresses using encrypted local authority contractor registers, custom household bin colour configurations, and calibrated alternating fortnightly multi-waste stream scheduling.
Clarified that address lookups transmit only property postcodes and reference numbers in AES-256 encrypted payloads with zero personal profile or account identities.
Version 2.8 — 24 September 2026
Upgraded UK council waste and recycling integration with direct, encrypted live council contractor API queries (incorporating Epsom & Ewell Borough Council and iTouchVision platforms via UPRN) alongside verified household confirmation controls, establishing a strict Zero-Guessing Guarantee where unconfirmed schedules are suppressed rather than estimated.
Documented conditional ingestion of live rail strike warnings and transit disruptions via Transport for London and National Rail public disruption feeds, triggered strictly when household members select public transit or schedule events at central city rail hubs.
Reaffirmed zero transmission of personal identities, profile names, or account records to external public open data services.
Version 2.7 — 24 September 2026
Documented operational service communications dispatched via Resend to VIP Beta testing cohort participants (specifically automated notifications regarding temporary maintenance pauses and operation restoration) pursuant to UK GDPR Article 6(1)(b) (performance of testing agreement) and Article 6(1)(f) (legitimate operational interests).
Version 2.6 — 23 September 2026
Added disclosures for the VIP Beta Waitlist & Market Need Discovery survey (/waitlist) and interest registration pipeline, capturing applicant contact details, household size, domestic hardware, and scheduling goals under UK GDPR Article 6(1)(b) (pre-contractual steps at data subject request).
Documented statutory Day 11 commercial free trial reminder notifications under the UK Digital Markets, Competition and Consumers (DMCC) Act 2024, confirming that private VIP Beta cohort accounts are strictly exempt from commercial billing reminders.
Version 2.5 — 16 September 2026
Family photo album features and Google Photos Shared Album integration transitioned to development preview on the staging environment.
Version 2.4 — 13 September 2026
Added Section 5(E) detailing the “Ask & Add” AI feature with Google Search Grounding for Family and Family Pro plans.
Documented pre-search query confirmation layer, user rejection options (“I'll Search Myself”), and systematic tokenisation of family identities prior to external web queries.
Updated Subprocessors Directory for Google LLC to encompass Google Search Grounding within enterprise Gemini APIs.
Version 2.3 — 13 September 2026
Added Resend Inc. as an authorised subprocessor for transactional email dispatch (registration verification, household invitations, and password recovery).
Documented regional processing within Ireland (European Union) with TLS encryption in transit and strict zero-marketing covenants.
Version 2.3 — 24 September 2026
Documented automated multi-model failover infrastructure and dynamic model discovery across Google Gemini Flash models (gemini-3.6-flash, gemini-3.8-flash, and high-throughput isolated fallback gemini-3.5-flash-lite) to ensure maximum uptime, zero-downtime model rollouts, and resilient request completion during temporary upstream cloud capacity spikes.
Reaffirmed identical tokenisation, sanitisation, and zero-training data covenants across all active failover pools.
Version 2.2 — 13 September 2026
Added Section 2(C) and Section 3(E) disclosures for first-party, privacy-preserving aggregate visitor footfall and UK regional demographics.
Disclosed ephemeral daily salted cryptographic hashing (SHA-256(IP + UserAgent + Date + Salt)) and immediate in-memory IP discarding.
Reaffirmed zero third-party tracking scripts, zero advertising networks, and 100% cookieless footfall measurement under UK GDPR Article 6(1)(f) (Legitimate Interests).
Version 2.1 — 13 September 2026
Added comprehensive disclosures for bidirectional pre-LLM tokenisation in Smart Add (ai-parser.ts).
Clarified relational database plain-text storage vs volume-level AES-256 disk encryption at rest and TLS encryption in transit.
Added Stripe Payments Europe Ltd subprocessor entry and PCI-DSS Level 1 payment handling terms.
Documented ephemeral in-memory processing for the Gemini Vision fridge and pantry scanner (zero disk persistence).
Formalised UK GDPR Article 6 lawful bases, Article 9 special category data handling, and ICO regulatory contact details.
Integrated unobtrusive Essential Cookies & Zero Tracking disclosure banner and documented perrymore_cookie_consent storage preference.
Standardised all copy, headings, and terms strictly to British English.
Version 2.0 — 10 September 2026
Initial comprehensive UK GDPR & DPA 2018 policy baseline.
Integrated Google API Limited Use compliance covenants.
Added self-service data portability (JSON) and permanent erasure controls.
Perrymore Calendar • Dedicated to private, secure family coordination