Privacy Policy for Butler

1. Zero Advertising & Data Monetization Policy (Strict Commitment)

We believe that family life is private.

• No Selling of Data: We never sell, rent, lease, or trade your personal or family data to third parties, advertising networks, or data brokers.
• No Advertising Use: Your data (including your name, email, profile details, family calendar events, household tasks, shopping lists, and forwarded documents or emails) will never be used for targeted advertising, profiling, or marketing purposes.
• No Ad Trackers: There are no third-party advertising SDKs, tracking pixels, or behavioral analytics tools embedded within our applications. We use a privacy-focused product analytics tool (PostHog) solely to understand aggregate feature usage and improve the app experience — never for advertising or profiling (see Section 2C).

2. Information We Collect

We collect only the minimum amount of information necessary to provide you with a premium, fully-featured family assistant.

A. Data You Provide Directly

• Account & Profile Information: When you create an account, we collect your name, email address, password, and your role within the household (e.g., Parent, Guardian, Child).
• Family Member Profiles: Parents or guardians can add other family members to the household group. We collect the first name, last name, role, date of birth, and school grade/class for these members to enable features like age-appropriate suggestions and birthday countdowns.
• Family Collaboration Content: To coordinate your household, we store the content you create within the app, including:
  • Tasks, to-do lists, and checklist items.
  • Shared and private family plans or itineraries.
  • Grocery and shopping lists.
  • Chat messages exchanged between family members on shared plans.
  • Profile pictures or avatars uploaded for household members.
• Forwarded Communications & Attachments: If you forward emails, flyer images, school letters, or PDF attachments to your dedicated Butler inbox, we collect these documents to automatically parse and extract calendar events, tasks, and notes for your family.

B. Third-Party Integrations & Connected Sources

If you opt to connect external accounts, we collect and sync the relevant data strictly to display it inside the Service:

• Connected Calendars (Google Calendar, Microsoft Outlook, Apple CalDAV/iCal feeds): We sync and display calendar events. You maintain full granular control over which calendars are kept private to your profile and which are shared with the household.

C. Data Collected Automatically (Technical & Diagnostics)

• Device & Diagnostic Data: We collect device identifiers, operating system version, and system crash reports (via Firebase Crashlytics) to diagnose technical bugs, measure performance, and keep the app stable.
• Product Analytics (PostHog): We use PostHog to collect anonymous product analytics, including screen views, feature usage events (e.g., tasks created, meals planned), and app lifecycle events. PostHog identifies users by an internal ID to track usage patterns — it does not collect browsing history, location data, or any data outside of the Butler app. PostHog data is used exclusively to improve the app experience and is never shared with advertisers or third parties.
• Log Data: For security, fraud prevention, and system integrity, we log technical details such as your IP address and access timestamps.

3. How We Use Your Information

We process your data strictly to deliver, run, and improve our core Services, specifically:

• Coordination & Automation: Creating your meal plans, managing family tasks, and syncing shared schedules across your family's devices in real-time.
• AI-Powered Features: We utilize secure Artificial Intelligence services to power Butler's intelligent features. In-app consent is obtained before any personal data is sent to AI services. The following AI providers process specific categories of your data:
  • Google Gemini API: Processes chat messages, user-uploaded photos (e.g., school flyers, receipts, pantry images), family member names/ages/dietary preferences, calendar event descriptions, task descriptions, and meal planning preferences. Used for document parsing, natural language understanding, and structured data extraction.
  • Perplexity: Processes search queries for web research when recommending local activities, products, or answering user questions. Also used for curating relevant news and information for your household.
  • Tavily: Processes search queries for web search to provide real-time information for Butler's concierge features, such as finding event details, product recommendations, and answering factual questions.

  Crucially, all AI providers process your data via secure, private API endpoints. Your family's data is never used to train public foundation models or shared with external parties beyond the scope of processing your request.

• Voice Transcription (On-Server): Butler supports voice input powered by Whisper (whisper.cpp). Voice transcription runs entirely on Butler's own server — no audio data is ever sent to any external third-party service. Your voice recordings are processed locally and deleted immediately after transcription.
• Service Notifications: Sending push notifications and transactional emails regarding family updates, task assignments, and calendar reminders.
• App Stability: Monitoring diagnostics and crash logs to resolve software bugs and improve loading speeds.

4. How We Share Your Information

We share your data only with trusted infrastructure subprocessors necessary to host and run the Service. All partners must guarantee the same or higher levels of security and compliance as set forth in this policy.

A. Cloud & Database Providers

We host our secure databases and storage using industry-standard, encrypted cloud services (such as Supabase and PostgreSQL).

B. Third-Party AI Services

We use the following AI service providers to power Butler's intelligent features. Each provider receives only the minimum data necessary to fulfill the specific request, and all communication occurs over encrypted API connections:

Important safeguards for all AI providers:

• User consent: In-app consent is obtained before any personal data is sent to AI services.
• Secure endpoints: All AI providers process data via secure, private API endpoints over encrypted connections (TLS/HTTPS).
• No model training: Your data is not used to train public AI models. We use API-only access tiers that contractually prohibit the use of customer data for model improvement.
• Minimal data: We send only the minimum data necessary for each specific request — never bulk exports of your family's information.

C. AI Observability & Debugging

• LangSmith (by LangChain): We use LangSmith for AI call observability, performance monitoring, and debugging. LangSmith receives metadata about AI requests (such as token counts, latency, and error states) to help us ensure the reliability and quality of Butler's AI features. LangSmith is hosted in the EU. No raw user content is stored beyond what is necessary for debugging purposes, and all data is subject to LangChain's privacy policy.

D. Product Analytics

• PostHog: We use PostHog for anonymous product analytics to understand how features are used and to improve the app experience. PostHog collects screen views, feature usage events, and basic app lifecycle data. It does not collect message content, family data, or any information shared with AI services. PostHog data is never used for advertising or shared with third parties.

E. Notification Services

We utilize push notification and transactional email delivery networks to send system updates.

F. Legal Compliance

We may disclose data if strictly required by a court order, applicable law, or valid governmental request.

5. Security & Data Storage

Your data is highly protected at every level:

• Encryption in Transit: All communication between your device and our servers is secured using industry-standard Transport Layer Security (TLS/HTTPS).
• Encryption at Rest: All data stored in our databases is protected with robust AES-256 server-side encryption.
• Access Control: Strong firewall protocols and JWT authorization ensure that only authenticated family members in your designated household can access your shared data.

6. Data Retention & Account Deletion Policy (Leaving the Platform)

In compliance with Apple's App Store Guideline 5.1.1(v), we provide a clear, permanent, and straightforward mechanism for users to delete their data.

A. How to Delete Your Account & Data

You can permanently delete your account and clear your personal data at any time:

1. Within the App: Open the app, navigate to Profile > Help & Privacy > tap Delete My Data under the privacy section, and confirm.
2. By Request: Send an email from your registered email address to privacy@trybutler.ai requesting account deletion, and our team will process it immediately.

B. What Happens Upon Account Deletion

When you delete your account, your data is processed as follows:

• Immediate & Permanent Deletion: We instantly and permanently delete all your individual personal data, including your user profile, personal preferences, device push tokens, notification logs, read/snooze statuses, and connected external calendar sources. Your auth record is entirely destroyed.
• Shared Family Group Data Handling: Butler is a collaborative family platform. To prevent breaking the system for other active family members, if you choose to leave a household group but other family members remain:
  • The group's shared plans, todos, groceries, and notes are preserved.
  • However, all personal identifiers linking you to those items are completely stripped or anonymized, ensuring they can no longer be associated with you.
  • If the entire household closes its account (or you are the sole member), all shared family group data, plans, todos, feeds, and calendar configurations are permanently and completely deleted from our active database.
• Third-Party Data Removal: Upon account deletion, we also ensure that any identifiable data held by third-party subprocessors (such as PostHog and LangSmith) is deleted or anonymized in accordance with their respective data retention policies.
• Backups: Residual data stored in encrypted, offline backup archives is overwritten during our normal backup rotation cycles (within 60 days) and will not be restored to active systems in the interim.

7. Children's Privacy (COPPA Compliance)

Butler is a household management tool designed for parents and guardians.

• Parental Consent: Children's profiles can only be created within a family group by a parent or guardian who has verified their own account.
• No Direct Collection: We do not knowingly collect personal contact information (such as email or phone numbers) directly from children under the age of 13.
• Rights: Parents have the right to inspect, edit, or delete any information stored about their children, or remove their child's profile from the group at any time.

8. Your Privacy Rights (GDPR & CCPA Compliant)

Depending on your residency, you possess powerful rights over your personal data:

• Right of Access & Portability: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can edit or update your account information directly in your profile settings.
• Right to Erasure: You can delete your personal data permanently as detailed in Section 6.
• Right to Restrict or Object: You can opt-out of notifications and communication preferences inside the app.
• Right to Withdraw Consent: You may withdraw your consent for AI data processing at any time by contacting us. Note that withdrawing consent may limit certain AI-powered features of the Service.

9. Contact Us & Data Protection Officer (DPO)

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@trybutler.ai
• Support Page: trybutler.ai/support