Insieme privacy policy

DRAFT — to be reviewed by a lawyer. This text describes what the app does today, taken from the code. It is not yet a valid privacy policy: every point marked [TO BE VERIFIED] cannot be checked in the code and must be decided or confirmed by the founder or the lawyer before the beta. The placeholders in square brackets must be filled in.

Translation of the Italian text; the Italian version prevails.

Version: 2026-10-bozza-4

Last updated: 26 October 2026

1. Who we are

The data controller is [CONTROLLER: name or company name, address, VAT number — to be decided with the accountant, decision D12]. The name “Insieme” is provisional (decision D1) and may change before publication.

For any request about your data, write to [PRIVACY CONTACT EMAIL — to be created]. We have not appointed a data protection officer (DPO): [TO BE VERIFIED with the lawyer whether one is needed].

2. What Insieme is

Insieme is an app for organising the family: you write or send a message, a photo or a PDF, the assistant suggests something to remember with a date and a person in charge, you confirm, and the family receives the reminders. Nothing becomes a reminder until a person confirms it.

The app is meant for adults (18 or over). Children do not have an account: their names are entered by their parents. [TO BE VERIFIED with the lawyer: minimum age and parents' responsibility.]

Teens from 14. A parent (an admin of the family) can give a son or daughter who is already 14, the age of digital consent in Italy (Article 8 GDPR and Article 2-quinquies of the Italian Privacy Code, Legislative Decree 101/2018), their own "teen" account. They do it from the child's card: choosing "Teen (14+)" is the parent's statement that the age is reached; we do not ask for a date of birth. Under 14 there is no account: the child stays a card managed by the parents. For a teen we process the same account data as for an adult (email, name if they enter it, acceptance of this notice) and the link between their account and their card. A teen sees only their own things: what they add, what is given to them and what is about them (their card), with their reminders; they do not see other people's things, expenses, bills, subscriptions, amounts, emergency cards (not even their own), lists, useful numbers, forwarded messages and files, the plan and payments, or carpools with other families. They do not invite or remove anyone and do not change the family. What they add, the parents see too. The notifications they receive are only the reminders of their things and the things someone passes to them, with the title only (section 6); they get no family summaries. A teen does not use automatic reading (section 5): nothing of theirs goes to the assistant. No advertising and no use of their data to train artificial intelligence models, as for everyone. On the Free plan a teen sees their things but cannot change them; with Insieme Family they can. The teen can download their data and delete their account from "Your data": their archive contains only what they see in the app. [TO BE VERIFIED with the lawyer: the age of digital consent, the parent's statement instead of age verification, the notice to give the teen in a form suited to their age, and the legal basis for a teen's data entered by the parents.]

3. What data we process

Account data

Your email, which we use to send you the 6-digit sign-in code. There is no password.
Your name, if you enter it, which the other people in the family can see.
When you accepted this policy and the terms, and which version you accepted.

Family data, entered by you or by someone in your family

The family name and its time zone.
The people in the family that you add: children, adults, grandparents, pets. For each one we keep only the name and the type. We recommend using only the first name, without a surname. [TO BE VERIFIED: the app does not currently ask for this explicitly.]
The things to do: title, notes, date and time, amount, category, who is in charge, status (to do, waiting, done, discarded), who confirmed it and who did it and when (the family sees it: “Done by Marco · today 18:42”).
Who handed a thing to do to whom, and when: whether they handed it over, whether they took it themselves, whether they handed it back with “I can’t, can you?” together with the reason chosen from three fixed ones (“Not today”, “I’m not nearby”, “Other”, never free text), and when the person who received it said “I’m on it”. The members of the family can see it; it stays as long as the thing to do exists and is deleted with it.
The “Thanks” for a thing done: who says it, to whom, for which thing and when. Only the people in the family can see them, we do not count them or make rankings; they send no notifications. They are deleted with the thing to do, with the family or with the account of the person who said or received them.
Household chores (bins, bathroom, the dog...): the chore's name, how often it repeats, who is in the rotation and in which order, which adult gets the reminder for someone without the app, the skipped days and the swaps asked. Each turn is a thing to do like the others. In “Who does what” the adults of the family see how many turns each person did in the month: we make no rankings. They are deleted when you delete the chore or the family; someone who leaves the family leaves the rotations.
The reminders generated from the dates.
Carpools with other families (turns driving the children to an activity, and one-off rides), only if your family creates one or joins one through an invite: the activity's name, the days, the times there and back, the meeting place, which family drives each leg, swap requests and answers, and for each family in the carpool the surname the others see it by (taken from the family's name, for example “Bianchi” from “Casa Bianchi”), the free seats in its car and the first name of the children who ride (the first name only: never the surname, never a photo). The families of the carpool see this data too, see point 5. Which adult of your family drives stays inside your family: for you a turn is a thing to do like the others. When your family leaves the carpool, the other families no longer see your children's names or your seats, and your future legs are left with nobody; past legs stay in the carpool without your name. The last family to leave deletes the carpool.
«Give a month»: your family's code and when it was created; for each referral, the inviting family, the new family, which account of the new family used the code, the code and when; when it qualified, or that it was blocked by the anti-abuse checks (same account, own or reciprocal family, same phone); for each family and referral, the reward (0 or 1 month; granted, over the cap or skipped; the date). For the anti-abuse checks we also keep a history of phones: for every account, the fingerprint (SHA-256) of every notification code (token) it has registered, never the code itself (the fingerprint is computed without a secret key), with the last time we saw it. We keep it 400 days from the last time we saw the code (an automatic job deletes it daily), and we delete it at once when the account is deleted. We use it only to stop a family from rewarding itself with a second account on the same phone. It is not in the “Download your data” archive (a fingerprint means nothing to the person and would reveal the check). We keep this data in private tables, with no access from the app. For the reward the legal basis is providing the service (Article 6(1)(b)); for the history of phones and the anti-abuse checks it is our legitimate interest in preventing abuse (point f). [TO BE VERIFIED with the lawyer: the legitimate-interest balance for a 400-day history of phones and whether a fingerprint of a notification code computed without a secret key is pseudonymous data.]
The family's useful numbers (paediatrician, school, babysitter...): name, role, phone and, if you write them, email and a note. These are other people's data: enter only what the family needs. You can type them by hand or pick one from the phone's address book: we read only the contact you pick (name, one number, the email), never the whole address book. On Android the phone asks for the contacts permission for this; on iPhone it does not. They are deleted when you delete them or when the family is deleted.
«People I care about», only if you use it: the people you want to hear from more often (the name you type or take from the family or the useful numbers, and the phone only if you type it or choose to copy it), how often you want to hear from them, the last time you did, the reminder's text, and the times you note that you talked (the date and, if you choose, call, message or in person). This list is yours only: nobody else sees it, not even the other adults of your family, and the reminder it creates is an «Only me» thing to do whose notification says only its title (point 6). Insieme does not read calls, texts, WhatsApp or the phone's contacts: «Call» opens the phone, and we know you talked only if you note it. On the Free plan you see the last 12 times per person; the others stay saved (we delete nothing) and are in the archive. We count only totals (how many people, how many contacts noted), never names. It is deleted when you remove the person («Stop reminding me»), leave the family or delete the account; it is in the “Download your data” archive. [TO BE VERIFIED with the lawyer: these are third parties' data entered for personal use; the legal basis and whether a specific notice is needed.]
Subscriptions and recurring costs (phone, energy, insurance...): the company's name, the amount, how often it is paid, the renewal date, the notice needed to cancel, who takes care of it and, if you write it, the contract or policy number, used only to fill in the cancellation letter. When you mark one as cancelled we keep how much you save a year. The app prepares the letter on the phone and you send it: Insieme does not send it and does not contact the company. Notifications carry only the subscription's name and the date, never amounts or contract numbers. They are deleted when you delete them or when the family is deleted.
The people in the family who do not use the app (an uncle, a grandmother, a friend, the babysitter): name and, if you write it, the phone, and the things they do for you. The phone is only used to open WhatsApp or text messages from your phone: Insieme never writes to these people, you send the message yourself. They are deleted when you remove them from the family or when the family is deleted.
The household expiry dates (what is in the fridge, the freezer, the pantry and among the medicines, with the expiry date), the names the family remembers for a barcode and the count of this month's scans (which entry used a scan, when and who). For medicines there is no barcode lookup and no remembered name.
The messages you send for the assistant to read: the text, or the photo or PDF. For the photo or PDF we keep the file; the sender of a forwarded message, if there is one, is kept with the message. Until you confirm, the message you send (text, file and sender) and the proposals made from it are seen only by you: the other adults do not see them in the app, in summaries, in live updates or in notifications. When you confirm, you choose “The whole family” (default) or “Only me”. The message you sent becomes visible to the other adults only once something made from it has been confirmed for them and nothing made from it is kept private or discarded.
Incoming mail, only if your family uses it: each family can have an Insieme email address to forward messages to. Of an email that arrives we keep the subject, the text and up to 3 attachments, like a message sent from the app. If the sender is not in the family and is not among the approved senders, the email is set aside, with the address of the sender, until an admin approves or discards it, and in any case for no more than 30 days; in the meantime the assistant does not read it. We also keep the addresses of the senders that an admin has approved permanently, with who approved them and when. An email that arrives at the family address from an approved sender, or that an admin let in, and what the assistant reads from it, is seen by the family's adults. An email you send from the address you sign in to Insieme with is like a message sent from the app: until you confirm, it is only yours.
Invitations: a single-use code that is valid for 7 days and the role (only “member”: the current version has no invitations for observers or babysitters).
The family's plan (free or paid, until when), any trial period and, only if someone in the family buys the “Founding family” plan with Stripe, the payments and refunds: type, outcome, amount, currency and date, a single-use purchase code that links the payment to the family and the codes with which Stripe identifies the notification, the payment session and the payment (with these codes Stripe can trace who paid; they do not contain the card, the name or the email). The card details and the details of who paid are handled by Stripe (point 5): we do not keep them. If an adult of the family buys Insieme Family on the website (insieme.day, a monthly or yearly subscription with Stripe): the subscription's state (active, on trial, payment pending, cancelled), monthly or yearly, the price, the dates of the paid period, of the trial, of the cancellation and of any refund, who in the family started it, and the codes with which Stripe identifies the customer, the subscription and its notifications. Only the person who pays sees the receipts, on the website, and Stripe keeps them.

Technical data

For notifications: your phone's notification code (token) and the system (iOS or Android). We also keep its fingerprint for the «Give a month» anti-abuse check (see above).
A log of the notifications sent to you (which reminder or summary, whether it was delivered), for 60 days (point 7).
For each call to the assistant: which provider and which model received it (when the fallback provider answered, its name), how many tokens it used, how much it cost (including the failed attempt with the main provider), the outcome. It does not contain the text.
“Ask Insieme” (the question in words, in “Search”): for each question, only the family's count (how many it asked this month and today), which provider and which model received it, the tokens, the cost and the outcome. The question and the answer are not stored by us; whether the provider keeps them or uses them for training is still to be verified (section 5).
“Suggest a meal” (ideas for the next meal): for each request, only the family's count (how many it asked this month and today), which provider and model received it, the tokens, the cost and the outcome, and for 15 minutes the latest result (the names of the dishes proposed), so the provider is not called again for the same request; then nothing is kept. The ingredients you type in “What I have today” only count for that request; “Ingredients to avoid” stay saved for the family, in plain text, until you change them.
The technical logs of our services: they contain counts and errors, not titles, texts or codes. [TO BE VERIFIED: the logs of the Supabase sign-in service contain the IP address and the user agent; they are deleted when you delete the account.]
Problem reports, if you send one from “Report a problem”: the text you write, the category you choose (optional) and technical data about the app and the phone (app version and build number, iOS or Android and the system version, installation channel, the screen you come from as a technical name without titles or names, the language, the time of sending). The report is linked to your account, so that we can reply to you; it does not contain the family, or titles, notes, names, attachments or data from your lists. We use it only to solve the problem and reply to you. A maximum of 10 reports per day per person.
“Scan” (expiry dates): the expiry date and the barcode are read on the phone, with a library that works inside the app (Google ML Kit, point 5). The image is not sent to any artificial intelligence service, ours or anyone else's, and does not reach our servers. The photo of the date is not saved and does not leave the phone: it is deleted as soon as it has been read. Of the barcode of a food product, only the number goes to Open Food Facts (point 5), to find the name; the name found stays in memory on the phone.
“Scan” on documents (Family deadlines): the expiry date is read on the phone, with the same library as “Scan” (Google ML Kit, point 5), even offline. On the document we read only the expiry date, on the phone: from the passport or ID-card MRZ (only the expiry field, checked with its check digit; the birth date's check digit is verified too but never kept) or from the printed date (Scadenza / Expiry / Date of expiry / 4b / Data di scadenza / Prossima revisione). The photo is deleted right after reading and the recognised text is thrown away from memory as soon as the date is extracted; we do not store, log or send anything (document number, birth date, surname, photo, address, MRZ text): the image does not reach our servers or any artificial intelligence service. Only the date and, if the name read matches a family person's name, the suggested person leave the parser; the scan is not counted in the monthly scans.
In the “Phone calendar” section (if you turn it on): nothing is sent to our servers. See point 6.
Error reports (point 5, Sentry), if the app crashes or a server function fails: the type of error and the point in the code where it happened, the app version and build number, the installation channel, iOS or Android and the system version, the phone model (not the name you gave it), the screens visited before the error as technical names without titles or names, and a random code for this installation, which is not linked to your account or the family. Never the text of the error, titles, notes, names, dates, photos, your email or the IP address (Sentry is set not to keep it). No screen recordings or screenshots. If what crashes is the phone's system underneath the app (a “native” crash or the app not responding), the report is prepared by the Sentry library with its standard technical data: in addition to the above, the state of the app's processes at the time of the crash, the memory, the phone's language and time zone, and the app's technical events (for example “the app moved to the foreground”); it does not contain your texts. You can turn them off in “Your data” → “Send error reports”: from that moment the phone sends nothing more and the random code is deleted.
Alexa (only if you link it yourself from “Your data”, Connections; only with the Insieme Family plan): we keep the link (the family, the person, the date you made it and its last use) and, for each authorisation, only an encrypted fingerprint (SHA-256): no key in clear. What you say to Alexa (“Alexa, ask Insieme to remind me…”) is processed by Amazon under its terms: we only receive the text, which becomes a proposal in “To confirm” like a typed message and never becomes a reminder by itself. To answer “what’s on today” or “who takes…” Alexa reads aloud only titles, times and who takes care of it, never notes, amounts or attachments; with “Discreet health notifications” on (unless you turn it off) a health thing is said and shown only as “Health reminder”, without the title, so the title does not reach Amazon. The link is yours alone; you remove it any time from “Your data”: the link and the authorisations are deleted, what was already added stays. We keep neither the sentence nor the answer.

Special categories of data (health data). Insieme can keep the dates of visits, tests, vaccines and medicines of the people in the family, children included, as things to do with a date and a person who takes care of them. This is data concerning health (Article 9 of the GDPR). We process only what you write or confirm from a message: the title (for example “Paediatrician visit”, “Vaccine booster”), the date or time, the person and who takes care of it. We do not ask for or calculate doses, symptoms or diagnoses, and we do not suggest vaccines or schedules. There are two explicit consents, separate from everything else (Article 9(2)(a)):

when you first open the app, for data of this kind that may be in the messages you decide to send to the assistant (for example a notice from the school about a vaccine); if you do not give it you cannot use the app;
the first time you mark something as health yourself (the “Health” category, the health screens or the confirmation of a health proposal from the assistant), a separate consent, yours alone: without it you cannot add health things, not even by confirming a proposal (you can only discard it). We record when you gave it, the version of the text you saw and its language. You can withdraw it whenever you like from “Your data”: from that moment you cannot add new health things, not even by confirming a proposal; those already saved stay until you or your family delete them, and they are in the “Download your data” file. Withdrawal does not make the processing already carried out unlawful.

Health things are seen only by the people in your family on Insieme, like everything else: no public links, no outside people. In notifications, with “Discreet health notifications” (on unless you turn it off) a health thing appears as “Health reminder”, without the title (point 6). [TO BE VERIFIED with the lawyer: the Article 9 legal bases for children's data (the parent who enters it), for the data of the other adults in the family entered by a family member, and whether the impact assessment on health data is sufficient.]

The emergency card. For each person in the family (adults, children, grandparents) you can keep a card for an emergency: who to call (up to 3 contacts with their phone), date of birth and languages, and, if you want, blood group, allergies with their severity, conditions, regular medicines, devices (for example a pacemaker), the choice about organ donation, the doctor or paediatrician with their phone, the health card number, a note for whoever helps, for a child the school and who may do the school pick-up, for an older person who provides care and their needs. These are the family's own words: Insieme does not check them and gives no advice. The health parts (blood group, allergies, conditions, medicines, devices, organ donation, doctor, health card, needs, note for whoever helps) can only be saved by someone who gave the health consent above; the contacts to call do not need it. Who sees and edits it: the card of an adult with an account is created and edited only by that adult; the other adults of the family see it on Insieme read-only (that is what an emergency card is for), unless its owner chooses “Only me and my emergency contacts”: from then on the other adults no longer see it in the app and only know that the owner fills it in themselves, and the card no longer sends another adult the reminder about changed medicines or allergies. The cards of children, teens and people without an account are seen and edited by the adults of the family. A teen sees no card (see above). So that it opens with no signal, a copy is kept on the phone, encrypted like the session (the key stays in the phone's keychain, not in backups); we remove it from the phone when you sign out, delete the account or leave the family. The card leaves Insieme only if you send it: “Send the card” makes an image or a PDF on your phone with its expiry written on it and you pass it on with the phone's share sheet (no link, nothing on our servers); the health card number stays off unless you choose to include it; whoever receives it keeps a copy we cannot take back. Every six months, and when medicines or allergies change, Insieme adds the thing to do “Check <name>'s emergency card” for the family: the notification contains only this title, never the card's data (section 6). Insieme cannot write into the iPhone Medical ID or Android Emergency information: it shows you the data to copy and you copy it; what you put there is handled by the phone's system, not by Insieme. On the locked phone you choose item by item what to show (by default nothing is visible), with the explicit warning that anyone holding the phone can read the chosen details; you can generate a lock-screen wallpaper image with only the chosen details placed in the safe area between the clock and system buttons. [TO BE CHECKED with the lawyer: the Article 9 basis for the health data of another adult or of a child entered in the card by a family member, and vital interests (Article 9(2)(c)) for whoever reads it in an emergency.]

What Insieme does not do: no medical advice, no doses, no interaction checks, no vaccination schedule. For doses and treatments ask your doctor.

If you ask to try the beta on the website (insieme.day, the “Try me before everyone else” form), even without an account: your email; the optional answers you choose (who you live with: alone, as a couple, with children, with a parent to look after; your phone: iPhone, Android or both; how you heard about us, one line of text); the language of the page; the moment you gave your consent and the version of this notice the page showed; a random code used only by the link to delete the request. A second request with the same email does not create another one and does not change the answers of the first. To limit abuse we count, for 24 hours, the requests coming from the same IP address and for the same email: we keep a fingerprint encrypted with a secret key, never the IP address or the email in clear. The form uses no cookies and no third-party scripts. We use these data only to invite you to the beta and to choose the families (for example iPhone and Android, different households); we do not use them for newsletters or advertising. [TO BE VERIFIED with the lawyer: this paragraph, the legal basis and the retention period of beta requests.]

We do not collect location or advertising identifiers. The microphone is used only if you tap “Speak” or say a sentence to Siri, Gemini or the Assistant (point 5): speech recognition is the phone's, and we receive the text, never your voice. From the phone's address book we read only the contact you choose for the useful numbers (see “Useful numbers” in point 3), never the whole address book. We do not use analytics or tracking tools in the app: the only diagnostics library is the one for error reports (Sentry, above), which does not count how you use the app and which you can turn off. [TO BE VERIFIED before every build: no analytics SDK has been added. Separately, the usage and diagnostic data that the Google ML Kit library may send to Google must be assessed, point 5.]

4. Why we process it and on what legal basis

Providing you with the service (Article 6(1)(b)): account, family, things to do, reminders, notifications, reading messages with the assistant, the problem reports you send us and the reply we give you. Without this data the app does not work.
Your consent (point (a)): notifications (you turn them on in the phone's settings), the phone calendar (you turn it on), the consent for special categories of data in point 3, and the family's consent to keep the original messages to improve reading (point 7). You can withdraw consent whenever you like, without making the processing already carried out unlawful.
Your explicit consent for health data (Article 9(2)(a)): the health data in the messages you send and the health things you mark yourself (visits, vaccines, medicines), with the two separate consents in point 3. We use them only to remind you of the dates and to show them to your family: never for advice, health statistics, advertising or to train models.
Our legitimate interest (point (f)): security, prevention of abuse, limits on the use of the assistant and cost control; understanding whether Insieme really helps families, by counting in aggregate form what the app already records (for example how many things were done in a week by an adult other than the one who added them, or how they are split between the adults): we derive only numbers and percentages across all families together, never names, titles or data of a single family, and without tracking tools in the app; error reports (point 3), to find and fix crashes in the app and in our services. You can object to error reports at any time by turning them off in “Your data”. [TO BE VERIFIED with the lawyer.]
Request to try the beta (point 3): your consent (point (a)), which you give by ticking the form's box; you withdraw it by deleting the request with the link (point 8). Counting requests per IP address and email relies on our legitimate interest in preventing abuse (point (f)). [TO BE VERIFIED with the lawyer: consent (point (a)) or pre-contractual steps at your request (point (b)).]
Legal obligations (point (c)): accounting and tax, for payments, if there are any. [TO BE VERIFIED with the accountant: which payment data must be kept and for how long.]

We do not sell your data. We do not use it for advertising. We do not use it to train artificial intelligence models. Whether the assistant's provider also never uses it for training is not yet confirmed in writing (section 5): [TO BE VERIFIED]. We do not make automated decisions that produce legal effects on you: the assistant suggests, a person confirms.

5. Who we share it with

The people in your family see the things to do, the people and the names of the members. A teen from 14 sees only their own things (section 2). Nobody sees those of another family: the database enforces this, with a rule for every row and with automated tests, also for what a teen sees.

The other families of a carpool. A carpool with other families (point 3) and «Give a month» (next paragraph) are the only things Insieme shares outside your family. A carpool is shared only with the families of that carpool, each of which joined with its own account (there is no guest access and no web page of the carpool). They see: the carpool (activity, days, times, place), which family drives each leg, swap requests, your surname, your free seats and the first name of your children in the carpool. They see nothing else of your family: not the things to do, the people, the members or their names, the documents, nor which of your adults drives. A one-off ride is seen only by the families it is offered to, who are already in a carpool with you. The database enforces this too, with automated tests. The “Share the turns” message is sent by you, from your phone, in the chat you choose (for example WhatsApp): it contains the next dates with the surname of who drives, the invite and, in the picture, also the children's first names and the seats; whoever receives it reads it in their chat, outside Insieme.

«Give a month». If your family joins Insieme through another family's link, the adults of that family (not teens) see, for each family that joined with their link, only «Another family», how many of the new family's first 3 things to do are confirmed (0-3), whether the month was given and whether their own reward hit the yearly cap (12 months in 365 days). They never see your family's name and we do not keep it. They see nothing else of yours: not the things to do, the people, the members or their names. The database enforces this, with automated tests. You see nothing of the family that invited you beyond what the person who sent you the link told you; if you invite, the same holds the other way round.

To make Insieme work we use providers (data processors). With each one a data processing agreement (DPA) is needed. [TO BE VERIFIED: no DPA has been signed yet.]

Supabase — database, sign-in, file storage, server functions. Project hosted in a European Union region. [TO BE VERIFIED: the region of the actual project.]
The assistant providers (artificial intelligence) — the provider receives the text of the message or the photo/PDF (for a photo, if the text the phone has read from it is enough, it receives only that text and not the photo), a list with the names of the members and of the people in the family (only the first name, that is the first word of the name, never the surname, the email or the phone; when two share the same first name, also the initial of the second word) and today's date, to suggest the things to remember. For “Ask Insieme” it receives only the written question, today's date and the first names of the members and people of the family, never the family's things (titles, notes, amounts): the provider only chooses what to look up, and the search, the sums and the dates are computed by our server over the family's things, with the permissions of the person who asked, so never another family's. The answer is composed by the app from the things found; for health it stays what is already there, dates and people, with no advice. Turning off automatic reading also stops questions. For “Suggest a meal” it receives the ingredients you type or pick from the expiry list, the ingredients to avoid, the time available, the season, the titles of the last few days' meals and the names of the family's favourite dishes, never names of people, notes or amounts; it only proposes dish names and ingredients, and what you already have and what is missing is worked out by our server. No calories, no health advice. This also stops when automatic reading is off. Today the provider is Google (Gemini), for everything described here; our server only talks to the provider addresses listed in our code and refuses any other; for Google, besides the Gemini API used today, only Vertex AI regions inside the European Union. Processing may also take place outside the European Union (section 10). [TO BE VERIFIED: the actual region, the data processing agreement with Google, that on the paid plan Google does not use the data to train models, and how long it keeps the requests, including for abuse monitoring.] Mistral AI (France) is the provider we may use as an alternative or as a fallback when Google does not answer (it cannot be reached, is overloaded or is failing); before using it we will say so here. [TO BE VERIFIED: for Mistral AI the region, the DPA, that it does not train on our data and how long it keeps the requests; and whether a fallback provider also receives photos.] We look for providers that do not train on our data and sign a data processing agreement (decision D5); where a provider processes data outside the EU/EEA we rely on an adequacy decision or standard contractual clauses (section 10). The providers receive something only if automatic reading is on: an admin of the family can turn it off in “Your data”, and from that moment nothing that the family sends (text, photo, PDF) reaches any provider; everything is added by hand. The only exception, which cannot be avoided: a message that is already being read at that moment finishes being read (a few seconds). The check takes place on our server, not only in the app, and we record who changed the choice and when.
Open Food Facts (openfoodfacts.org, a free and open database) — if you scan the barcode of a food product, it receives only the barcode number, to return the product name, and sees the phone's IP address like any website you visit. It receives no data about you or the family, no photo, and is never queried for medicines. [TO BE VERIFIED: who runs Open Food Facts and where the servers are; is a data processing agreement needed, or is it enough that a product number is not personal data?]
Apple and Google (the phone's speech recognition) — only if you use “Speak” in the app, or say a sentence to Siri, Shortcuts, the Action button, Gemini or Google Assistant (Insieme Family features). The phone's system turns your voice into text under Apple's or Google's terms; we do not record, receive or keep the audio. We receive and store only the text, which we treat like text you typed: it becomes a proposal for you to confirm and uses one assistant reading. [TO BE VERIFIED against Apple's (Siri and Dictation) and Google's (Assistant, Gemini) notices: where recognition happens, whether the text goes through their servers, the settings a person can change.]
Amazon (Alexa) — only if you link Alexa: it receives your voice from the Echo, processes it and sends us the text; it receives from us the words Alexa says aloud (titles, times and who takes care of it, for that day) and, if you open the Alexa app, the same lines on a card. It is an independent controller, with its own terms. [TO CHECK: Amazon may process data outside the EU/EEA; check the transfer and its basis with the lawyer before the skill is published.]
Google (ML Kit) — the library that, inside the app, reads the text of the date in “Scan” and the text of the photos you send to the assistant (on iPhone and on Android) and, on Android, also the barcode (on iPhone the barcode is read by Apple's camera, on the phone). We do not send the images or the text read to Google. In “Scan” they stay on the phone. For a photo sent to the assistant, the text read goes to our server together with the photo and, if it is enough, to the assistant provider in place of the photo; we do not keep it. However, the library may send usage and diagnostic data to Google (for example which function was used, how long it took, errors, the phone model and system, the app version). [TO BE VERIFIED with Google's data-collection sheet for ML Kit: exactly which data, whether it can be turned off, the legal basis and the transfer outside the EU.]
Sentry (Functional Software, Inc.) — receives the error reports described in point 3, from the app and from our server functions, in the European Union data region (Frankfurt, Germany). Before leaving, every report of an app or server error passes through a filter that keeps only the technical fields listed in point 3 and removes everything else; reports of “native” phone crashes do not pass through this filter and contain the standard technical data described in point 3, and Sentry's automatic personal-data filters are on. Sentry receives nothing if you turn the switch off, and nothing until the service is configured. [TO BE VERIFIED: DPA with Sentry to be signed (#305); Sentry is based in the United States, see point 10.]
Expo (Expo Push Service) — receives the phone's code and the text of the notification to deliver it to Apple (APNs) or Google (FCM). [TO BE VERIFIED: Expo is based in the United States; non-EU transfer, a basis such as the standard contractual clauses or the Data Privacy Framework is needed.] Apple and Google deliver the notification to your phone.
The email sending provider (SMTP) — sends the sign-in code to your email. [PROVIDER: to be decided.]
Your calendar, only if you turn it on or if you choose to import events from it: see point 6.

The incoming mail provider, only if your family uses the Insieme email address — receives the emails forwarded to that address and delivers them to us. It will be a provider that processes data in the European Union (decision D4). [PROVIDER: to be decided; the integration ready is for Mailgun, EU region.]
Stripe, only if you buy the “Founding family” plan or the subscription on the website — handles the payment and receives the data you enter on its page (for example email and card); for the subscription on the website we also send it the email you sign in with, for the receipts, and the family's code, and Stripe tells us the subscription's state. When you delete your account, we remove your email, your name, your address and our codes from Stripe; Stripe keeps the receipts and payments already made, for tax law (point 8). It notifies us of the payment, and of the notification we keep the type, the outcome, the amount, the currency, the date, the purchase code that links the payment to the family and the codes with which Stripe identifies the notification, the payment session and the payment. These codes do not contain the card, the name or the email of who paid, but Stripe, which has them, can link them to that data. [TO BE VERIFIED with the lawyer: whether Stripe is a processor or an independent controller, and the transfer outside the EU.]

Planned, not yet active: RevenueCat (for subscriptions through the App Store and Google Play, decision D13). Before activating it we will update this policy and ask you to accept it again.

We may disclose data if the law or an authority requires it.

6. What goes into notifications and the phone calendar

Push notifications: Insieme never adds a person's name to a notification: you see names only in the app, after opening it. The title of a thing, though, appears as written: if it contains a name, the name shows (see below). Every type of notification contains only:
Reminder: the title of the thing to do and when it is: “Paediatrician · today at 17:15”.
Something handed to you / handed back: the title and, if there is more than one thing, a number: “For you: Pay the canteen”, “For you: 3 things”, “Back to you: Pay the canteen”, “Back to you: 3 things”; for a school run (a swap), the run and the day, never the title: “For you: the pick-up on Thu 22 Oct”: never who handed it over, never the reason.
Evening summary: numbers and counts, never a name: “Tomorrow: 3 things (2 for you) · 1 overdue · 2 to confirm · 2 done by others”; for one other person: “2 done by someone else”.
Morning summary: numbers and counts, never a title: “1 school run has nobody · Today: 3 things (1 for you) · 2 overdue · 2 things expire today”.
Weekly recap: numbers and counts: “This week: 9 things coming up · 14 done together”.
School-run slot (pick-up or drop-off): the kind of turn and a time, never the child's or the helper's name: “Today at 16:30 it’s your turn for the pick-up”, “Today at 08:00 it’s your turn for the drop-off”; if a helper does it and you’re the contact: “Today at 16:30 someone else does the pick-up: you’re the contact”; if nobody has it: “Today at 16:30 the pick-up has nobody”; if it’s someone else’s: “Today at 16:30 there’s the pick-up”.
School calendar question: the days, never the children's names: “Schools closed Monday 8 and Tuesday 9 February: who looks after the children?”.
Live progress on the lock screen (Insieme Famiglia): the kind of turn and a time, or the activity's title, never a name, notes, amounts, a place or a position: “The pick-up has started” · “Pick-up at 16:30”, “Your turn: pick-up at 16:30”, “Done · 16:34” · “Pick-up done”, “Pick-up at 16:30 without ‘Done’”, “Under way: Swimming”.
Carpool with other families: the carpool's name, a day, the leg and a number: “Calcio: can you do the ride there on Thu 15 Oct?”, “Calcio: 2 rides have nobody”: never the name of another family, an adult or a child.
Subscription cancellation deadline: the subscription's name and the date: “To cancel Allianz, send the PEC by 3 November”: never the amount or the contract number.
Conflicts (Insieme Famiglia): the titles of the things: “Overlapping: Dentist and Football”; for health “Health reminder”; for someone else's private thing “busy”; a school run reads “a school run”, never its title: “No adult free for a school run”.
A document that expires before a trip (Insieme Famiglia): only the deadline's title, as you wrote it: “Passaporto di Leo”; never the trip, the destination, the dates or a document number. It arrives once, three months before you leave, to whoever looks after it and can see both the trip and the document.
Notice after “I’ll take it” (on the phone, when someone else was first): “Someone else already has it”, never the name.

Never notes or amounts. The title is written by the family, or suggested by the app when you create a thing from a person (“Festa di Leo”, “Regalo per Leo”, “Controlla la scheda di Leo” in Italian): then the name is in the title and shows in the reminder. Avoid sensitive data in titles (including names). For health things, “Discreet health notifications” (in the notification settings, on unless you turn it off, a choice for each person) shows only “Health reminder · today at 17:15”, even when someone hands it to you (“For you: Health reminder”), so the title cannot be read on the lock screen; this also applies to the notification provider (Expo, Apple, Google), which then does not receive the title.

Phone calendar and health things: if you turn on the phone calendar, health things go there as “Health reminder”, with day and time but without the title, whatever your choice on discreet notifications. In the phone calendar settings, the person who turned it on on that phone can choose to show the title per type (visits, vaccines, medicines, other health); they are all off until you turn them on. If you turn one off, the events already written go back to “Health reminder” at the next update.
Phone calendar (optional, you turn it on): Insieme creates an “Insieme” calendar on your phone and puts the confirmed things in it. The event contains only the title, day and time. If you choose your Google or Apple account, the titles end up in that account (and are also seen by the people you share that calendar with). It is a one-way copy and applies only to that phone. When you turn it off, or delete the account or the family, we remove the events from the phone.
Importing from the phone calendar (optional, you choose it each time): if you tap “Import from calendar”, the app asks for permission and reads, only from the calendars you choose and only on your phone, the events of the next 8 weeks. You see a preview and choose which ones to import: only those you leave selected (title, day and time) reach our servers and become things of the family, visible to all its members; the rest does not leave the phone. This is personal data that you decide to share with the family. Events that Insieme itself wrote on your phone are not read back, and importing twice does not create duplicates. Imported things are deleted like all the others.
Import your lists from Google Tasks (optional, you choose it every time): if you tap "Connect Google Tasks", you sign in with your Google account on the phone and Google gives us, for this operation only, permission to read your lists (read-only scope tasks.readonly). The lists are read once, on your phone: we do not keep the permission (we do not store it, we do not send it to our servers and we revoke it right after reading), we do not ask for a lasting permission, and the next time we ask you again. You see a preview and choose: only the things you leave ticked (title, notes, date) reach our servers and become family things, visible to all its members; the rest never leaves the phone. Limited Use wording: the use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: we use Google Tasks data only to show you the preview and create the things you choose; we do not transfer it to others, we do not use it for advertising and no person reads it, unless you ask us for support, for security or by law; we do not use it to train artificial intelligence models, and no model reads it (imported lists do not go through the assistant). Importing twice does not create duplicates, not even if you first used Google's file (Takeout). Imported things are deleted like all the others.

7. How long we keep it

Original messages (text and files sent to the assistant): we delete them 30 days after they are read. The things to do created from the message stay. The exception is the optional choice “Help improve reading”, which only an admin of the family can turn on: the messages are kept longer to check that Insieme reads dates and amounts correctly, and before using them we remove names and personal data. You can turn it off whenever you like: messages older than 30 days are then deleted. Every change of the choice is recorded with the version of the text shown.
Things to do, reminders, people, family: as long as the family exists or until you delete them. A deleted thing to do stays for 30 days in “Recently deleted”, with the name of who deleted it, and any admin or member of the family can restore it; then we delete it for good (its reminders no longer go out from the moment of deletion). If you do not want to wait 30 days, an admin or member can use “Delete permanently” in “Recently deleted”: we delete it immediately, with its reminders and, if no other thing to do remains from the original message (not even in “Recently deleted”), also with the message, its attachments and the assistant's suggestions that you had discarded. When a thing to do is deleted for good, for the service's internal statistics we keep for 180 days only when it was confirmed or completed, by whom (an identifier, not the name), the category and whether the assistant had read it correctly: never the title, the notes, the amount or the date. After 180 days we delete this data too. They disappear immediately when you delete the family, and your identifier when you delete the account; until then you find them in the “Download your data” file. If you delete the family or the account, deletion is immediate, including the “Recently deleted” items.
Problem reports: 12 months from sending, then we delete them automatically; we delete them earlier if you delete the account. If the phone cannot send one, it stays on the phone, linked to your account, until it goes out; it is deleted by deleting the account.
Scans and barcode names (“Scan”): the scan count (which entry used a scan, when and who) is needed only for the current month: every day we automatically delete that of past months, according to the family's time zone. The names the family remembers for a barcode stay as long as the family exists: they can be changed but not deleted one by one, and they are all deleted when the family is deleted. If you delete your account, who did the scan or wrote the name disappears from both.
Emergency cards: as long as the person is in the family (the card of someone who leaves the family or deletes the account is deleted at that moment) or as long as the family exists; fields can be emptied at any time. The copy on the phone is deleted when you sign out, delete the account or leave the family. They are in the “Download your data” file.
Health things: like all things to do (above): as long as the family exists or until you delete them; withdrawing consent does not delete them, you delete them. The history of the health consent (given, withdrawn, when, version and language of the text) stays until you delete the account, as proof of consent.
Beta requests (point 3): 12 months from the request, then we delete them automatically; earlier, if you use the link to delete it. The encrypted count of requests per IP address and email: 24 hours. [TO BE VERIFIED with the lawyer: 12 months, or until the end of the beta.]
Carpools with other families (point 3): as long as your family is in the carpool; when it leaves, your surname, seats and your children's names disappear from it, and the last family to leave deletes it. Past legs of a carpool (who drove, the swap requests) are deleted 4 weeks after their day; a one-off ride, with the children's names, a week after its day. Your own turns stay among your things to do. A carpool invite is valid for 14 days; once expired we keep its code 30 more days only to tell whoever opens the link «Invite no longer valid», then delete it.
«Give a month» (point 3): the referral rows stay as long as the inviting family exists (they are its reward ledger and stop the same account from redeeming twice); if the new family is deleted, the row stays with no link to that family; if the account that used the code is deleted, the row loses that link; the reward rows are deleted with their family. Deleting the inviting family deletes its referrals. The history of phones for the anti-abuse checks (same phone): 400 days from the last time we saw the notification code, then we delete it automatically; at once, when you delete the account.
Account: until you delete it.
Approved email senders: until an admin removes them or the family is deleted. If you delete your account, who approved them disappears from the ones you approved.
Subscription on the website (point 3): its state and dates stay as long as the family exists and are deleted with it; Stripe's notifications follow the payments rule below.
Payments and refunds for the “Founding family” plan and the subscription on the website (point 3): they stay even after the family is deleted, because they are needed for accounting and tax; from that moment they are no longer linked to the family, but keep the purchase code and the Stripe codes. [TO BE VERIFIED with the accountant: for how long they must be kept, then automatic deletion.]
Trial period: for each account we keep that it has already used a trial period (type and date), to grant only one; it stays if the family is deleted, and is deleted when you delete the account.
Export files: 24 hours.
Error reports (Sentry): [TO BE VERIFIED: 30 days on Sentry's free plan; confirm with the plan chosen], then Sentry deletes them.
Log of notifications: 60 days. Notifications that were delivered, or that we could not deliver after every attempt, are deleted automatically 60 days later; before that we count, for internal statistics, how many notifications of each type went out or failed in that week, without people, families or titles. A notification still to be sent stays until it is delivered or abandoned. We delete them sooner if you delete the family or the account; until then you find them in the “Download your data” file.
Log of calls to the assistant: [TO BE VERIFIED: there is no automatic expiry yet; they must be deleted with the family or the account. Decide a maximum period.]
Provider backups: [TO BE VERIFIED: how long in Supabase backups; deleted data may remain in backups for a limited period.]

8. Your rights

You have the right to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability), object and withdraw consent (Articles 15 to 21 of the GDPR). In Insieme:

Download your data: in “Your data” you prepare a .zip file with everything you see: the family, the members, the people, the things to do, who handed a thing to whom, who said thanks to whom, the reminders, the things deleted in the last 30 days (marked as such), the statistical data of things deleted for good in which you appear (only yours, without text), the messages sent and the attachments (up to 50 MiB), the notifications we sent you, the problem reports you sent, the list of calls to the assistant with provider and model, the history of consents, the family's plan with the trial period and the payments, the school shifts, the household chores (who is in each rotation and the skipped days), the recurring things, the lists, the dishes and the menu, the household expiry dates, the useful numbers, the subscriptions and the approved email senders (if you are an admin). In the file there is a README that explains each section. The link is valid for 15 minutes.
Delete your account: in “Your data”, by typing DELETE. We delete your account, your email, your name and the reports you sent. The things to do you added stay with the family, without your name. If you were the only admin, another adult in the family becomes one (whoever has been in it longest). A family is never deleted unless you choose it: if you would be the last adult (only teens with their own account or children's cards would remain) or the only person in the family, you cannot delete just your account. You can first invite another adult, who takes your place, or choose “Delete the family too”: before that we show you what will be deleted (the family, the things to do and the lists, the attachments, the teens' family space, the children's cards) and offer you to download your data. The teens keep their accounts, without a family. If you pay for the subscription on the website, before deleting the account we stop its renewal and remove from your Stripe customer the email, the name, the phone, the address, the VAT number or tax code entered at payment and our codes (of the family and of the account): the customer is not deleted, because deleting it would end at once the period the family has already paid for. Stripe keeps the receipts and invoices already issued and the payments already made, with the details they carried at the time (for example email, name and address), because tax law requires keeping them. [TO BE VERIFIED with the accountant: how long Stripe keeps them.]
Delete the family: admins can do it, by typing the family name. It deletes for everyone the things to do, reminders, messages and attachments. What remains are the payments, for tax obligations, and, for each adult, the fact of having already used a trial period, no longer linked to the family, which is deleted when that person deletes their own account (point 7).
Turn off automatic reading: in “Your data” an admin turns it off (and on again) for the whole family. When it is off, no message is read by the assistant; things added by hand work as always. All members see whether it is on.
Turn off error reports: in “Your data” → “Send error reports”, for your phone, at any time. When off, we send nothing.
Withdraw consent to the use of messages to improve reading (admin only), to notifications and to the calendar, from the settings.
Delete your beta request: when you send the form you get a personal link (an address of our server with beta-signup?remove= and your code); opening it deletes the request at once, without an account. If you lost it, send the form again with the same email: you get the same link. The answer is the same whether or not the request existed, so nobody can find out whether an email is on the list.
For everything else (rectification, restriction, objection) write to [PRIVACY CONTACT EMAIL]. We reply within one month.

If you think the processing breaches the law, you can lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country.

9. Security

Data travels encrypted. The database is protected by row-level rules: one family cannot read another's data. Files are kept in a private store. The sign-in code is single-use. On the phone the session is encrypted. The assistant cannot change anything by itself: its answers are checked against a schema and confirmed by a person. Use of the assistant has monthly limits per family and a global spending cap. No measure is perfect: if we become aware of a personal data breach we will report it as required by law. We have a draft impact assessment (DPIA) for health data. [TO BE VERIFIED: breach notification procedure; review of the DPIA with the lawyer before the beta.]

10. Transfers outside the European Union

We prefer providers that process data in the European Union. Sentry keeps error reports in its EU region (Frankfurt), but is based in the United States. Where a provider (for example Expo, Apple, Google, Sentry) is outside the EU or is based outside the EU, the transfer relies on an adequacy decision or on standard contractual clauses. [TO BE VERIFIED case by case.] This also applies to Google as the assistant's provider (section 5): requests may be processed outside the European Union. [TO BE VERIFIED: which Google company signs the contract, where the requests are processed and which transfer safeguard applies.]

11. Changes

If we change this policy in a significant way, we will ask you to accept it again the next time you open the app. The version accepted and the date remain recorded.