Privacy notice

Information and why it is used

Adult account and preferences

Email, sign-in/verification information, display name, timezone and settings support your account. An adult profile photo is optional. Authentication providers may process network and security metadata, such as an IP address or access time.

Messages, groups and plans

Messages, memberships, invitations, read positions, plan times/titles/notes/places, participation responses and availability support the conversations and plans you choose. Do not enter unnecessary medical, workplace or other sensitive details.

Family coordination

Private child menus use first names, preset avatars and private class/activity group links. Pickup or playdate requests include selected first-name/avatar copies, time and place shared with the other participant. There are no child accounts, child-photo uploads, birth-date fields or public child directory.

Notifications and technical operation

Optional notification settings, device registration tokens, delivery status and limited retry/rate-limit metadata support delivery and prevent abuse. Provider logs may contain ordinary request and security metadata. Notification expiry and delivery status do not prove that a recipient has seen an alert or that all downstream copies have been erased.

Support and safety

Block settings and correspondence help address problems. We use relevant information supplied with an email request and may record its status, necessary evidence, review and decision. Access is limited to the authorized purpose. Live in-app report intake is currently unavailable; this does not prevent an email concern.

Policy and account-rights records

When an agreement flow is enabled and used, it records the signed-in adult, exact document version and time. Privacy presentation is separate from contract agreement, not permission for unrelated processing. Website publication does not create those records or activate that flow. Account export/deletion operations may keep limited progress or recovery records.

Your audience and access

Relevant members can see group messages and group plans. Private plans, child menus and child-to-group links belong to their owner. A private coordination request is visible to its participants; selected child-name/avatar copies are shared only as shown in its preview. Removing the original child menu does not recall copies already included in a request.

Recipients may copy or screenshot information. Blocking private contact does not erase shared group history or existing agreements. Authorized service and safety access is limited to the relevant function; an ordinary group member does not receive administrator access.

Messages are not end-to-end encrypted. The operator and necessary provider personnel may be able to access stored information for authorized service operation, security, support or lawful requests. This does not make a private group public or give ordinary members administrator access. Application access controls and protected connections are safeguards, not a promise that no system failure or disclosure can ever occur.

Service providers and other disclosures

Supabase

Authentication, application records, controlled service functions and private adult-photo storage.

Resend

Account emails and messages sent from Pifello support addresses, including recipient details and necessary message content. Its email and Inbox tools store sent correspondence used to handle support. Incoming contact mail is currently forwarded to the operator’s Gmail inbox.

Cloudflare and the operator’s Gmail inbox

Cloudflare provides website hosting and delivery, domain/security services, scheduled tasks and forwarding of mail sent to Pifello contact addresses. Google processes forwarded correspondence in the operator’s Gmail inbox. Forwarding does not establish a response time.

Expo and Apple

When notifications are enabled, device delivery information and generic update alerts. The app’s push payload excludes message bodies, child details and plan locations. App distribution and provider-side device/diagnostic handling are subject to the relevant provider arrangements.

Healthchecks

Task-status signals to detect missed or failed scheduled work, designed to exclude app conversation contents.

The primary application database is hosted in the United States. Providers may process information in other countries under their applicable arrangements. Choosing a U.S. database region does not mean every email, notification, support record or provider operation stays only in the United States.

Any disclosure required by valid legal process, a specific emergency or another lawful duty must be assessed for authority, necessity and scope. This is not permission for routine public disclosure of private conversations. We do not sell personal information, use it for targeted advertising or authorize general-purpose AI training on app content.

Website storage and tracking

These website pages use local assets and include no analytics scripts, advertising, sign-in form or tracking-cookie feature. We do not track visitors across third-party sites. A Do Not Track signal does not change that behavior because we do not perform that cross-site tracking.

Cloudflare processes ordinary network and request metadata, such as IP address, requested URL, time and browser information, to deliver and protect the website. Operational or security records have provider-specific retention; they are not app messages. We do not use those records for advertising profiles.

The app stores session and working data needed for its features, such as settings, drafts or retry state. Removing the app does not delete server records. Optional photo or notification permission is not agreement to advertising or unrelated tracking.

Your choices and privacy requests

Review audiences, edit available profile/settings fields, manage blocks, and switch notification categories or phone permission off. In app versions containing the controls, use Your space → Download your data for a data copy. Installed versions may differ; the screen reports availability or failure. Automatic account-deletion execution is currently unavailable.

Email privacy@pifello.com, or support@pifello.com, to request access, correction, deletion or a data copy, including when you cannot sign in. The operator reviews these requests manually. We may need proportionate information to verify the request and any representative’s authority. Do not send passwords, verification codes, identity documents or children’s detailed information in an initial email.

We handle applicable rights within the requirements of the relevant law. If a request is declined in whole or part, we explain the reason and how to request reconsideration where permitted. You may appeal through the same contact and retain any right to contact the relevant regulator. An unavailable app control does not suspend applicable legal rights or deadlines.

Retention, deletion and copies

We retain identifiable information for the purpose described here or a specific, documented legal or safety need. The following rules apply to records under our control; a longer exception must have a limited scope, a reason and a review date.

Account information, conversations and plans

We keep information needed for your active account and the features you choose, until it is removed through an available control or a verified deletion request is completed. Signing out or becoming inactive does not itself close an account. Our closure policy removes private child menus, personal account information, your own message text and your personal shared-plan details, with separate checks for photos and authentication. Other people’s contributions and necessary shared structure can remain.

Short-lived operation records

Our service expires notification jobs after 24 hours and device registrations after seven days unless refreshed. Pending adult-photo uploads expire after 24 hours; completed photo-operation records become eligible for cleanup after seven days. Expiry or eligibility is not proof of immediate physical erasure: bounded cleanup, subsequent activity or a provider failure can affect removal time. It does not recall delivered alerts or photos already copied by others.

Ordinary support correspondence

We manually remove ordinary support correspondence from the mailboxes and working copies we control within 90 days after the issue is resolved. An unresolved dispute, verified rights request or specific legal/safety obligation may require a relevant subset for longer; it is recorded separately and reviewed, not kept indefinitely by default.

Temporary exports and diagnostic copies

Operator-created troubleshooting exports and temporary development snapshots are removed within 30 days of creation unless a documented ongoing need requires a limited extension. These are manual operating rules, not a claim that every provider or user’s downloaded copy has an automatic deletion timer.

Safety, legal and completion records

Necessary evidence, review decisions and minimal request-completion records are kept for the specific case, applicable legal obligation or continuing shared-record dependency. We record the purpose and review continuing need at least every 90 days, or sooner when a deadline or case event requires it. A review interval is not a fixed minimum retention period. Unneeded information is removed; a technical hold alone is not a reason to retain it.

Agreement records and provider copies

Agreement records are kept with the account and the current system removes them when the authentication account is deleted. Providers may keep separate security records and residual copies under their own service schedules and legal obligations. We do not promise one deletion deadline for every provider, backup or recipient inbox. We restrict operator-held copies and account for prior deletion requests before any restoration.

Some historical identifiers and limited deletion records may remain linkable while needed for the purposes above; removing a display name is not complete anonymization. We explain any specific retained scope when handling a request. See account and data help; a submitted request or interrupted operation is not completed deletion.

Adults coordinate; children do not sign in

Pifello is for adults aged 18 or older. Enter child information only if you have authority to do so, use a first name and preset avatar, and share only what is needed with the intended adults. Do not upload child photos through adult profile-photo features.

If you believe a child is using an account or child information has been disclosed improperly, contact safety@pifello.com, privacy@pifello.com or support@pifello.com without resending unnecessary sensitive content. Adult-only design does not remove the need to protect child-related information.

Changes and contact

We identify updates with a date and version and keep prior published versions available. We bring material changes to users’ attention through an appropriate website, app or account communication and request any legally required consent separately. Contact privacy@pifello.com or support@pifello.com for questions about this notice or a previous version.