FAMILING / YOUR INFORMATION

Privacy policy

Last updated: October 24, 2026.

This Privacy Policy explains how Traintheory Inc. (“Traintheory,” “we,” “us,” or “our”) handles personal information when you use the Familing application, familing.traintheory.com, connected features, and our support and communications services (together, the “Services”).

1. Our privacy commitments

Familing helps families organize their day, calendars, tasks, and lists. Some optional features use generative artificial intelligence (“AI”) to understand information and prepare useful actions.

• We do not sell or rent personal information.
• We do not use personal information for advertising, targeted advertising, cross-service tracking, or data brokerage, or disclose it to advertising platforms for those purposes.
• We do not use your private content to train or fine-tune AI models, and do not authorize AI providers to use it for model training or improvement.
• Connected accounts and AI features require the applicable permissions and choices. Signing in does not, by itself, authorize access to your email or calendar.
• Family sharing is intentional: information added to a shared family space can be visible to other authorized members.

These commitments do not mean that no information leaves your device. Familing processes information on its servers and uses service providers, including AI providers, to deliver the features you choose.

2. Information we collect

Account and authentication information. We process sign-in identifiers, your name and email address, household membership and invitations, authorization records, session information, and preferences. When you connect a provider, we process access and refresh tokens needed to maintain the connection. We do not receive your Google password.

Family profiles and preferences. Information you or authorized family members enter may include names, birthdays, relationships, school or grade information, profile appearance, assignments, city, time zone, and other preferences. Family information may concern children or other people who do not have their own accounts. Provide only information you are entitled to share and that is needed for the feature.

Calendar information. With authorization, we access information about available and selected calendars and their events, such as titles, descriptions, dates, times, locations, source information, and participants where returned by the connected service. We also process calendar items you create through Familing and the destination needed to save them. Permissions requested by a provider can be broader than the subset used by a particular feature; the permission screen and in-app explanation describe the requested access.

Email information. If you enable the email integration, Familing processes supported incoming email content and related metadata, including subject lines, message text, dates, message identifiers, and relevant sender information where available. This can include information about third parties, school activities, appointments, or other potentially sensitive matters. You may also paste email text for analysis. The current email feature processes supported message text; it does not fetch linked webpages or attachments, send email, or delete messages. Email connection and background processing are optional and start disabled.

Tasks, lists, assistant content, and derived information. We process task and list content, assignments, due dates, completion status, assistant messages and replies, extraction summaries, source excerpts or evidence, suggested actions, and records of whether an action was reviewed, dismissed, or applied. Derived information may still be personal information even when the original message body is not retained.

Weather and external information. We retrieve forecasts and alerts using the configured city or region and associated coordinates. The current weather feature does not require continuous device location tracking. Public external data can be combined with family context to provide a daily briefing or planning suggestions. Future integrations will be explained before activation, with additional permission where required; this policy does not authorize unrestricted access to new sources.

Technical, security, and support information. Our systems and infrastructure providers may process IP addresses, request timestamps, app or device version information, error and diagnostic information, security events, and operational records. If you contact us, we receive your contact details and the information you choose to send. Avoid including passwords or unnecessary sensitive family information.

Subscription information, if offered. If a paid plan is introduced, we may process plan, entitlement, and transaction reference information needed to manage it. Payment collection and the relevant payment provider will be disclosed when that feature is introduced. This policy does not imply that a particular billing system is currently active.

3. Why we use information

We use information to authenticate users; maintain household access; display and synchronize plans; provide tasks, lists, briefings, and optional AI features; carry out authorized actions; communicate about support, security, and service operation; prevent fraud and abuse; diagnose problems; comply with legal obligations; and respond to privacy requests.

We seek meaningful consent for optional or sensitive processing where required. You may decline a connection or AI feature, although the related functionality will be unavailable. We do not treat acceptance of this policy as blanket consent to every optional use. Where another legal basis is required or permitted, it depends on the applicable law and processing purpose. Canadian privacy requirements, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where applicable, inform this policy. Additional rights and requirements may apply depending on where you live.

4. Generative AI: what is sent and why

When you request an AI feature, or enable an automated email feature, Familing sends the information needed for that request to an AI service provider. This may include identifiable personal information; AI input is not necessarily anonymized. Depending on the feature, input can include email text and subject lines, your instructions, relevant calendar or planning details, family member names and profile context, school-stage information, list names, time zone, and recent assistant conversation history. We use the resulting output to extract or organize information, answer planning requests, and propose or prepare calendar events, tasks, and list items.

The current implementation uses OpenAI’s API. We configure requests to disable response storage where supported and do not opt in to sharing private content for training. OpenAI states that API input and output are not used for model training by default. This is separate from retention: providers may process or temporarily retain content for service operation, security, abuse prevention, caching, or legal requirements under the applicable service terms and controls. OpenAI’s published default abuse-monitoring period is up to 30 days, with exceptions. We do not promise zero retention. See OpenAI’s data controls.

Where a household supplies its own AI API key, the associated provider account and its settings can affect processing, retention, and charges. Keys are used to authenticate the configured service, not as assistant conversation content. Data-sharing and retention settings for that account must be consistent with the commitments in this policy.

Actions and review. AI output may be incomplete or wrong. Review dates, people, content, and destinations before confirming an action. Assistant plans require review. Where an adult separately enables automatic email processing, supported clear actions may be created without reviewing each one; uncertain or conditional actions remain subject to review. Creating an event can place source-derived information into a calendar or shared family space. The current implementation does not send event guest invitations. Any future invitation-sending feature must clearly disclose recipients and obtain the necessary authorization before sending information to them.

AI features are for family organization. We do not use them to make decisions about credit, employment, insurance, education eligibility, or similarly significant legal interests. Avoid submitting unnecessary health, financial, identity-document, or other highly sensitive information. Turning off AI or an integration stops future processing for that feature; it does not automatically remove existing outputs or items already saved elsewhere.

5. Google connections and Limited Use

Google connections are subject to your granted permissions and Google’s controls. You can remove Familing’s access through your Google Account’s third-party connections settings, and use available Familing settings to disable processing. Revocation stops future authorized access but does not automatically delete existing Familing records or items already created in Google Calendar.

Familing’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the applicable Limited Use requirements and Google Workspace user data policy.

Google data is used for the user-facing features you authorize. It is not sold, used for advertising or credit assessment, or used to train generalized AI models. Transfers to processors, including AI providers, are limited to permitted purposes and the required consent. Human access to Google data is limited to permitted circumstances, such as your explicit agreement to access specified content for support, necessary security investigation, legal requirements, or permitted internal work with aggregated and anonymized information. Google-derived information remains subject to applicable restrictions even when transformed or summarized.

6. Family sharing and other disclosures

Your household and chosen destinations. Shared calendars, family tasks, lists, and profile details are available to authorized members according to the feature’s access rules. Personal areas and unapproved email proposals are restricted according to those rules. When an item is applied to a shared area, relevant information becomes shared. Others may retain information they have already seen or copied. Disconnecting a mailbox or leaving a household does not necessarily retract shared items.

Service providers. We use providers for infrastructure, hosting, data storage, security, authentication, connected account access, AI processing, and support. They receive information necessary for their role, subject to appropriate arrangements. Current integrations include Google, OpenAI, Open-Meteo forecasts, and Environment and Climate Change Canada alerts. Weather requests currently use city-level lookup information rather than mailbox content or family profiles.

Legal and security needs. We may disclose information where legally required or permitted to respond to valid legal process, protect rights and safety, investigate misuse, or resolve disputes. We limit disclosure to what is appropriate in the circumstances.

Business changes. If a merger, acquisition, or similar transaction affects the Services, information may be transferred subject to applicable law, confidentiality protections, and existing privacy restrictions. We will provide required notice or consent, including any explicit consent required for transfers of Google data.

7. Product improvement and analytics

We plan to use aggregated and anonymized information to understand feature usage, reliability, and overall product performance and to improve Familing. This is a planned use, not a statement that an analytics system has already been deployed. We do not sell these statistics or use them to build advertising audiences.

Anonymization requires more than removing a name or replacing it with an identifier. Information that can reasonably be linked back to a person remains personal information and is handled accordingly. Our intended analytics exclude raw email bodies, calendar descriptions, assistant conversations, and other private content. We will not attempt to reidentify genuinely anonymized statistics. Any use of Google-derived information must also satisfy Google’s restrictions.

Before introducing analytics that involve personal information, a new provider, or device tracking, we will provide appropriate disclosure and obtain consent where required. General product improvement does not authorize training AI models on private content.

8. Product updates and marketing emails

We may introduce an optional mailing list for Familing news, feature announcements, and marketing. We plan to offer adults a separate, optional choice during onboarding to receive product updates and promotions from Traintheory Inc. about Familing. The choice will be off by default and can be skipped without affecting account creation or core features. Connecting Google, enabling AI, requesting support, or creating an account will not itself subscribe you to marketing. We will not enroll children or teens in the marketing list. We will not harvest addresses from your mailbox, calendar, or household contacts for marketing.

For subscribers, we may process an email address, optional name and preferences, signup source, consent records, delivery status, and unsubscribe records. An email delivery provider may process this information to send messages on our behalf. We will identify the provider before introducing the mailing list. We will not enable individual email-open pixels or marketing click tracking without updating our disclosures and obtaining any required consent. Necessary delivery and unsubscribe records are distinct from advertising tracking.

Each marketing email will identify the sender, provide required contact information, and include a free, accessible unsubscribe option. You may also email hello@traintheory.com. Unsubscribe requests will be honored without delay and within applicable legal deadlines, including no later than 10 business days where Canada’s anti-spam law applies. We may retain a minimal suppression record to respect your choice and evidence of consent where necessary. Unsubscribing does not prevent essential account, security, or service messages that are not marketing.

9. Website cookies and similar technologies

The current landing page has no analytics scripts, advertising pixels, tracking cookies, or third-party fonts. Your browser and infrastructure providers necessarily exchange technical information to load it. The app uses device storage, caches, and session information to operate features and maintain sign-in; these are distinct from advertising trackers. If we introduce optional cookies or similar technologies, we will explain their purpose and provide choices required by applicable law.

10. Retention and deletion

Planned retention schedule. We are introducing the following retention limits. Automated expiry is not yet available for every category; you can request deletion through support in the meantime. Applicable provider restrictions or shorter legal limits take priority.

• Original email bodies and temporary AI inputs: process in memory where practical and discard after the request. If an encrypted temporary retry copy is needed, delete it within 24 hours. Do not retain a general mailbox archive or put private content in operational logs.
• Imported calendar cache: keep only the selected calendars and time range needed for planning, normally no more than 30 days of past events and 12 months of upcoming events. Refresh or expire cached data within provider requirements, including any shorter cache-header limits. Delete the disconnected integration’s cache within 30 days. A separately saved planning item follows the rule for saved items below.
• Email extraction records: keep subjects, summaries, quoted source evidence, and related intake metadata for up to 90 days after analysis. Delete unconfirmed or dismissed proposals within 30 days after creation or dismissal, whichever comes first. Remove source excerpts from separately saved items when no longer needed; an item does not justify keeping its original email indefinitely.
• Assistant conversations: automatically delete messages and replies 30 days after each exchange, or sooner on request. An action separately saved as a task, list item, or event can remain without preserving the full conversation.
• Saved family information: account details, family profiles, and planning items intentionally saved by users remain while needed for the active service or until deleted. Review completed tasks, archived lists, and historical events after 12 months and offer export or deletion rather than automatically destroying useful family records. Archiving alone is not deletion. Information about children receives the same purpose limitation and should be removed when no longer needed.
• Connection credentials and pending work: disable access and stop new queued processing when a connection is removed or an account deletion request is verified. Revoke provider tokens where supported and remove usable credentials and temporary pending input within 24 hours. A request already sent to a provider may finish and remains subject to that provider’s controls.
• Operational and security records: ordinary diagnostic and request logs for up to 30 days; security and abuse records for up to 90 days. Use metadata rather than private message or calendar content. A documented active incident, legal duty, or dispute can justify a narrower, access-restricted exception reviewed periodically.
• Support messages: up to 12 months after the issue closes, unless you request earlier deletion or a documented legal need requires longer retention. Minimize unnecessary sensitive attachments and excerpts earlier.
• Marketing records: subscriber details while opted in; consent evidence while sending and for three years after withdrawal to document consent and its withdrawal. Retain only the minimum suppression information needed to avoid contacting an unsubscribed address while the mailing program operates. Do not retain associated family content for this purpose.
• Backups: encrypted, access-restricted backups expire on a rolling cycle of no more than 35 days after the relevant active copy is deleted. Restore procedures must reapply deletion records so erased content is not returned to ordinary use.
• Inactive accounts: after 24 months without account activity, send a notice to the adult account contact with at least 30 days to retain or export information before starting deletion. Another member’s active household use must be considered; one inactive member must not cause deletion of an active family’s shared space.

Requesting deletion. Contact support@traintheory.com. An in-app account-deletion option is planned. Our deletion service targets are to acknowledge requests within seven calendar days, use proportionate identity checks, and remove eligible information from active systems within 30 days of verification. A shorter applicable legal deadline takes priority; any lawful extension must be explained within the original deadline. Backup expiry may take a further 35 days after active deletion, making the normal maximum 65 days from verification for our own active and backup copies. Provider-held copies have their own schedules and cannot be represented as immediately deleted by Familing.

Deleting a personal account should end that member’s access and remove their private assistant and mailbox records. A primary account holder must be able to transfer household administration or request household closure. Before deleting shared items, we will identify what can be removed or de-linked without improperly deleting another member’s information. We will explain any retained shared information and the reason. Requests concerning a child’s profile require proportionate checks of parental or guardian authority; other adults in a household do not automatically have authority to request deletion of every person’s private information.

Deleting information in Familing does not automatically delete the original email, an event already written to Google Calendar, a copy exported by another person, or another provider’s independent records. Conversely, disconnecting Google, disabling AI, signing out, archiving, or uninstalling the app does not erase server-held information. We will explain any separate steps needed to remove third-party items.

Exceptions and accountability. Any retention beyond these periods must have a specific lawful purpose, limited access, and a documented review or expiry date. Where information must be retained, it will not be reused for marketing or unrelated product development. Minimal deletion records can be retained to show a request was fulfilled without keeping the deleted content. Genuinely anonymized statistics may remain where they can no longer reasonably identify anyone, subject to applicable provider restrictions. We will not anonymize information merely to evade a deletion right.

11. Safeguards and international processing

We use access controls, household authorization boundaries, secure communications, and protection for stored credentials to reduce unauthorized access and disclosure. No service can guarantee absolute security. We will investigate suspected incidents and provide notifications required by applicable law. This policy does not claim certification, independent security assessment, or encryption of every data category unless separately verified.

Information may be processed outside your province or country, including by AI and infrastructure providers, and may be accessible to courts or authorities under local law. Applicable hosting regions, provider locations, and any transfer mechanisms must be confirmed before publication. We do not promise that information remains exclusively in Canada. Where law requires particular contractual safeguards, assessments, or consent for a transfer, those requirements must be met before the processing occurs.

12. Children, teens, and information about other people

Current and future family access. Familing currently supports adults managing family information. Teen login is planned and is not currently available. The age rules below describe adult accounts, managed child profiles, and the planned teen experience.

• Primary account holder: at least 18 years old and legally able to create and administer the account under applicable law. Each household must have an adult primary account holder. Any higher age or authority requirement imposed by applicable law still applies.
• Ages 13–17: when teen access launches, teens may join an existing household only by invitation and with an appropriate parent or guardian’s authorization, an age-appropriate explanation, and the teen’s meaningful agreement where appropriate. They may not independently create a household or consent to adult marketing on behalf of anyone else.
• Under 13: an authorized adult may create a managed child profile. Children under 13 will not have their own login, direct assistant access, or connected mailbox. A child’s email address is not required for a managed profile and should not be collected merely to create one. Use a profile identifier or nickname and collect a full birth date only when genuinely needed; an age band or school grade can often suffice.

We do not offer independent accounts to children under 13. This does not remove our obligations concerning information about children provided by adults. We apply appropriate safeguards and obtain parental or guardian authorization where required by applicable law.

Restricted teen experience. The planned teen role should expose only age-appropriate family information and the teen’s permitted items, with private settings by default. It should not expose adults’ mailboxes, private proposals, credentials, billing details, or unrestricted household administration. A parent’s account membership alone must not be treated as proof of guardianship. The teen experience must explain what parents or guardians can see, rather than promising secrecy within a supervised family space.

AI involving children. An adult’s enabled AI feature can process limited information about a child, such as a name, school grade, or relevant activity, when needed for the chosen planning task. That is distinct from letting a child use AI directly. For future teen accounts, direct generative-AI access and personal email/calendar connections should remain disabled until separate age-appropriate consent, safeguards, and provider eligibility requirements have been met. We will not treat a parent’s AI opt-in as permission for unrestricted use of a teen’s private content. We do not use children’s or teens’ information for advertising, marketing lists, or AI training.

Parental and individual requests. Parents and guardians can contact support@traintheory.com to ask about access, correction, removal of a managed profile, or withdrawal of authorization. We will verify authority proportionately and account for the young person’s interests and applicable rights. We will not routinely demand government identification where a less intrusive method is sufficient. If we learn that an underage child has signed in contrary to the supported age rules, we will restrict access and investigate, then delete improperly collected information or take other action required by law.

Parents, guardians, and other authorized adults should limit what they provide about others and ensure they have the necessary authority. Connecting a mailbox may involve information about other people; authorization to connect an account does not remove our obligations concerning those people. Contact us if information about you or a child should be corrected or removed. Before introducing teen access, we will review age screening, parental authorization, age-appropriate notices, and safeguards required by applicable law.

13. Your choices, requests, and complaints

Depending on applicable law, you may request access to your personal information, correction, deletion, an explanation of its use or disclosure, or withdrawal of consent; other regional rights may include portability, restriction, or objection. Rights are subject to lawful limits, identity verification, and the rights of others. We will explain any refusal or limitation and available complaint options. Withdrawing permission can prevent the related feature from working without requiring you to accept unrelated optional processing.

Contact our privacy contact at support@traintheory.com. Please describe the request without sending unnecessary sensitive information. You may complain to the relevant privacy regulator, including the Office of the Privacy Commissioner of Canada, where applicable.

14. Changes and contact

We will update this policy when our practices change and identify the effective date. For material changes, including new sensitive uses, connected sources, or disclosures, we will give appropriate notice and obtain new consent where required before applying them. A policy update alone is not consent to a new optional use.

Privacy contact: Privacy Officer, Traintheory Inc. / Familing, support@traintheory.com.

General feedback: hello@traintheory.com.

Legal operator: Traintheory Inc.