Privacy policy
Last updated: 1 October 2026
This policy explains what information Edd-Tech collects when you use this website, Family Hub and our other apps, why we need it, and how we keep it safe. We have tried to write it in plain English. If anything is unclear, just ask.
Who we are
Edd-Tech is run by Edd [SURNAME], a sole trader based in Exmouth, Devon. For the information you put into our apps, Edd-Tech is the "data controller". That means we are responsible for looking after it under UK data protection law (the UK GDPR and the Data Protection Act 2018).
- Email: [YOUR EMAIL]
- Post: [BUSINESS ADDRESS]
- ICO registration number: [ZA000000]
If we build a custom app for a club, group or business, that organisation is usually the controller of its members' data, and we act on its instructions. Its own privacy notice will apply, and we will sign a data processing agreement with it.
This policy covers people aged 13 and over. If you are a parent, it also explains how we handle the information you add about your children.
This website's contact form
When you send a message through the contact form, we receive your name, email address and what you write. We use it only to reply to you and discuss your project. The message is delivered to us by email through Brevo. We keep enquiries for up to 12 months unless we go on to work together.
What information our apps collect
We only collect what the app needs to work. We never ask for more just in case.
| Type | What it includes | Where it comes from |
|---|---|---|
| Account details | Name, email address, password (stored scrambled, never readable), the family you belong to | You, when you sign up or are invited |
| Family content | Calendar events, meal plans, shopping lists, jobs and reminders | You and the family members you invite |
| Calendar links | The private links you connect from Google, Outlook, school or club calendars | You, if you choose to connect them |
| Children's profiles | First name or nickname, chosen avatar and colour, routines, homework tasks, stars, streaks and rewards | The parent or carer who sets up the profile |
| Documents and receipts | Files and photos you upload to your vault | You. These are end-to-end encrypted (see below) |
| Billing | Name, email and subscription status. Card details are handled by our payment provider, never by us | You, when you subscribe |
| Technical data | Device type, browser, error logs and basic security logs such as sign-in times | Collected automatically when you use the app |
We do not collect children's surnames, dates of birth, photos of children, school names or location data for children's profiles. We do not use advertising trackers.
How we use it, and our legal reasons
| What we do | Lawful basis |
|---|---|
| Run your app: calendars, lists, jobs, reminders and kids mode | Contract: we need it to provide the service you signed up for |
| Send service emails, such as sign-in links, reminders and important changes | Contract |
| Take payment and keep financial records | Contract, and legal obligation (tax law) |
| Reply to enquiries sent through this website | Legitimate interests: answering the question you asked us |
| Keep the app secure, fix bugs and prevent misuse | Legitimate interests: keeping your data and the service safe |
| Send occasional news about new features | Consent. You can opt out at any time |
We do not sell your information. We do not use it for advertising. We do not use your family's content or your children's information to train AI models. If we add a feature that uses AI to process your content, we will tell you first, explain what is sent and to whom, and make it optional.
Children's information
Children's information gets extra protection, and we follow the ICO's Children's Code (the Age Appropriate Design Code).
- Parents stay in control. Only an adult account holder can create a child's profile. Children cannot sign up by themselves.
- The minimum we need. A first name or nickname, an avatar and the routines, tasks and rewards you set.
- Private by default. A child's profile is only visible to your family. There is no chat, no messaging with people outside the family, no public profile and no way for strangers to contact them.
- No nudging or tracking. No adverts, no in-app purchases for children, no profiling and no analytics on what children do.
- Easy to delete. You can delete a child's profile at any time, and everything linked to it is deleted with it.
Games we build with your child follow the same rules: no adverts, no chat with strangers, no purchases and no personal data collected.
Private documents: what we can and cannot see
Documents and receipts in your vault are end-to-end encrypted. They are locked on your device before they are uploaded, using a key made from your family's vault passphrase. We only ever store the locked version.
- We cannot open your documents. Neither can our hosting providers.
- Your passphrase never leaves your devices. We do not store it and cannot reset it.
- Keep your recovery key safe. If you lose both your passphrase and your recovery key, we cannot recover your documents.
- What we can see. That a file exists, its size, when it was added and which family it belongs to. File names and contents are encrypted.
Other family content is encrypted while it travels and while it is stored. We can technically access it, but we only do so when you ask us to help, or when we must to fix a fault or keep the service secure. Every such access is logged.
Who we share it with, and where it is stored
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in and encrypted file storage | Data stored in London, UK |
| Vercel | Hosts this website and our apps | Global network; company based in the USA |
| Brevo | Sends emails, including contact form messages | EU |
| [PAYMENT PROVIDER] | Takes subscription payments | UK/EU, with some processing in the USA |
Where your information is handled outside the UK, we make sure it is protected by approved safeguards, such as the UK–US Data Bridge or the ICO's International Data Transfer Addendum. We will only share your information with anyone else if the law requires it. We will never sell it.
How long we keep it
| Information | How long |
|---|---|
| Website enquiries | Up to 12 months, unless we go on to work together |
| Family content, children's profiles and vault | While your account is open. Deleted within 30 days of you closing it |
| Backups | Overwritten within a further 30 days |
| Billing records | 6 years, because tax law requires it |
| Security and error logs | Up to 90 days |
How we keep it safe
- Everything is encrypted in transit (HTTPS) and at rest. Vault documents are also end-to-end encrypted.
- Each family's data is walled off from every other family's at database level.
- Access to our systems is protected by two-factor authentication and limited to Edd-Tech.
- If a data breach puts you at risk, we will tell you and the ICO as the law requires, usually within 72 hours.
Your rights
You have the right to ask for a copy of your information, correct anything that is wrong, have it deleted, restrict or object to how we use it, take it to another service, and withdraw consent at any time where we rely on consent. To use any of these rights, email [YOUR EMAIL]. We will reply within one month. Parents can exercise these rights on behalf of their children.
Cookies
This website does not use cookies. Our apps only use cookies and similar storage that are essential to keep you signed in and the app working. We do not use advertising or tracking cookies. If that ever changes, we will ask first.
Complaints
If you are unhappy with how we have handled your information, please tell us first at [YOUR EMAIL]. We will acknowledge your complaint within 30 days and investigate it without undue delay. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this policy
If we make important changes, we will tell you by email or in the app before they take effect. The date at the top shows when this policy was last updated.