Privacy Policy

Effective Date: May 4, 2026

GHP Labs LLC ("we," "our," or "us") operates Rosie, an AI-powered family assistant service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service via SMS, WhatsApp, email, or related channels, including optional integrations with third-party services such as Google Calendar.

1. Information We Collect

Account Information: When you start using Rosie, we collect your name, phone number, and family member names you choose to share. Your account is managed through GHP Labs' shared authentication system.

Family Data: We collect and store information you share with Rosie, including calendar events, reminders, family schedules, school activities, and other family management information.

Message Content: We store your conversations with Rosie to provide context for ongoing interactions and improve the service. This includes text messages, images of school flyers or event information, and email content you send to Rosie.

Usage Data: We collect information about how you interact with Rosie, including features used, message frequency, and interaction patterns.

Device Information: We collect phone numbers and messaging platform identifiers to deliver messages to you.

Google Account Data: If you choose to connect your Google Calendar, we collect your Google email address and OAuth 2.0 access and refresh tokens. We also access your Google Calendar event data in read-only mode, including event titles, dates, times, locations, and descriptions. See Section 4 ("Google Calendar Integration") for full details.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve Rosie's family assistant features
• Manage your family calendar and send event reminders
• Process photos and documents you share (e.g., school flyers, invitations)
• Send SMS and WhatsApp messages including reminders, calendar updates, and conversational responses
• Respond to your requests and provide customer support
• Analyze usage patterns to improve our services
• Read your personal Google Calendar events (if connected) so Rosie can include them in family schedule summaries and reminders

3. SMS/Text Messaging

If you use Rosie via SMS, you may receive:

• Conversational responses to your family management requests
• Calendar event confirmations and updates
• Night-before and day-of event reminders
• Weekly family calendar summaries

Message and data rates may apply. Message frequency varies based on your usage and calendar activity. You can opt-out at any time by replying STOP to any message. Reply HELP for assistance.

4. Google Calendar Integration

Rosie offers an optional integration with Google Calendar that lets you view your personal calendar events alongside your Rosie family calendar. This section explains exactly what data we access, why, and how we handle it.

What permissions we request:

• Google Calendar (read-only): We request the calendar.readonly scope, which allows Rosie to view your calendar events. Rosie cannot create, edit, or delete events on your Google Calendar.
• Email address: We request the userinfo.email scope to identify which Google account you connected. This email is stored with your connection record so you can see which account is linked.

Why we need this access: Rosie reads your personal Google Calendar so it can include those events in your family schedule summaries, daily briefings, and reminders. This helps you see all your commitments in one place without manually re-entering events.

What data we access: When you ask Rosie about your schedule, we read event titles, dates, times, locations, and descriptions from your Google Calendar. We do not access attendee lists, attachments, or calendar settings.

How we store this data: Your Google OAuth tokens (access token and refresh token) are stored in our database, encrypted at rest, and associated with your parent account. Calendar event data is retrieved on demand when you ask Rosie about your schedule and is not permanently stored in our database.

How to disconnect: You can revoke Rosie's access to your Google Calendar at any time by messaging Rosie to disconnect your calendar, or by visiting your Google Account permissions page and removing Rosie. When you disconnect, we immediately delete your stored OAuth tokens and stop accessing your Google Calendar data.

5. Google API Services — Limited Use Disclosure

Rosie's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google Calendar data to provide and improve user-facing features that are prominent in Rosie's interface (schedule summaries, reminders, and daily briefings).
• We do not transfer Google Calendar data to third parties unless necessary to provide or improve these user-facing features, to comply with applicable law, or as part of a merger/acquisition with notice to users.
• We do not use Google Calendar data for serving advertisements or for any purpose unrelated to the Rosie family assistant service.
• Human access to Google Calendar data is restricted to security investigations, compliance with law, or with your explicit consent.

6. Information Sharing

We do not sell your personal information. We may share information with:

• Service Providers: Third-party services that help us operate Rosie, including cloud hosting (Supabase), AI processing (Google Gemini), messaging delivery (Twilio), and calendar services (Google Calendar).
• Family Members: If you use Rosie's shared family calendar features, calendar information is shared with family members you explicitly invite.
• Legal Requirements: When required by law or to protect our rights and the safety of our users.

AI processing & model training: We use the Google Gemini API on a paid commercial tier. Under Google's Gemini API Additional Terms of Service, Google does not use your prompts or Rosie's responses to train or improve Google's models when accessed through a billed account. We do not train any AI models on your data, and we do not share your data with advertisers.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encryption of stored credentials and secure communication channels. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. You may request deletion of your account and associated data at any time by contacting us.

Google Calendar data: OAuth tokens are retained only while your Google Calendar is connected. Calendar event data is fetched on demand and is not permanently stored. When you disconnect your Google Calendar or delete your account, all associated OAuth tokens are immediately deleted from our systems.

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Opt-out of certain data processing activities

10. Children's Privacy

Rosie is intended for use by parents and guardians to manage family activities. The service is not intended for direct use by children under 13 years of age. We do not knowingly collect personal information from children under 13.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the effective date.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

GHP Labs LLC
111 Oak Avenue
Kentfield, CA 94904
Email: support@ghplabs.ai