This is the binding document. If you would rather read the short, plain-language version first, that lives at fred.family/privacy.
01. Introduction
Fred (“Fred”, “we”, “us”) is a family coordination assistant that helps parents stay organised. We also run the website fred.family. This policy explains what we collect, why we collect it, who we share it with, and your choices.
Data controller: Product Impact Consulting BV Terschellingstraat 33, 1025 RA Amsterdam KVK: 90557840 Contact: mail@fred.family
02. What We Collect
We collect the information you share with Fred, technical service data, and optional website analytics with your consent as described below. We do not scrape, buy, or infer data about you from third-party sources.
Account information
When you sign up via fred.family, we collect the following for both parents in the household:
- Name and email address: to create and manage your account.
- Home address: to provide location-based features such as finding locally provided services such as waste collection dates.
- Children’s names and dates of birth: provided by you during onboarding to personalise Fred’s coordination features. You confirm that you are the legal parent or guardian of each child whose information you provide.
Information about the other parent
When the first parent sets up Fred, they provide the name and email address of the second parent so we can send an invitation. We use this only to send the invitation and set up the shared household account. The second parent’s account only becomes active once they have accepted the Terms of Service.
Shared visibility within your household
Fred is a shared household tool. Calendar entries, messages sent to Fred in the shared group, and coordination information are visible to both parents in the household. Do not share information with Fred that you do not want the other parent to see.
Messages and content
Fred receives and processes:
- Chat messages you send to Fred.
- Voice messages, which are transcribed; the audio file is not retained after transcription.
- Images you share with Fred, which are processed to extract relevant information. Images are not stored after processing.
- Emails you forward to your personal Fred email address (body, sender, subject line, and attachments relevant to family scheduling).
Calendar data
If you delegate your Google Calendar to Fred, we receive read access via calendar sharing; Fred schedules by creating events in its own calendar and inviting you.
Children’s information
You provide your children’s names and dates of birth during onboarding. In the course of using Fred, you may share additional information about your children — such as school name and extracurricular activities — via forwarded emails, calendar entries, or direct messages to Fred. We do not collect any of this information from children directly.
Usage data
We collect basic technical data about how Fred is used — such as message timestamps, feature interactions, and error reports — to keep the service running and improve it. This data is not used for advertising or profiling.
Website analytics and your choice
When optional website analytics is enabled, we use PostHog EU only after you choose Accept analytics. We count public page visits, early-access button clicks, and waitlist submission attempts to understand and improve the website. A submission attempt is not a confirmed signup. The legal basis is your consent (GDPR Article 6(1)(a)). Ignoring the choice or selecting Decline sends no website analytics to PostHog; you can still use the website and forms.
Events include a random visitor ID, the public page path and language, event time, consent notice version and time, and button placement where applicable. This ID is pseudonymous personal data, not anonymous data. We do not send form answers, names, email addresses, account or family IDs, URL query strings or fragments, or referrers. We do not join these IDs to app accounts, record sessions, or automatically capture interactions or errors. Network requests necessarily expose your connecting IP address to the receiving service.
We store your choice and its date in the necessary localStorage preference fred.website-consent for 180 days. Only after acceptance, the PostHog SDK’s first-party ph_fred_website cookie stores the random ID and browser session state until that grant expires, for at most 180 days. Activity does not extend it. The SDK also uses sessionStorage for temporary session state and a fred.website.sdk-consent cookie to mirror your choice. If browser storage is blocked, a choice and ID may last only for the current document. Expiry or a new notice version requires a new choice.
Open Cookie settings on any instrumented public page and select Decline to withdraw consent in one action. Withdrawal stops new event collection and removes the website visitor ID. SDK requests started before withdrawal may finish or retry, and received events cannot be recalled; withdrawing does not affect the lawfulness of earlier processing. Reaccepting creates a fresh ID. Your rights and our contact details below also apply to this data.
PostHog processes website analytics in its EU cloud. We enable collection only after verifying the processing agreement, IP-discard controls, and retention of no more than 12 months, after which events are deleted or fully anonymised. The cookie choice governs optional website analytics; existing Tally questionnaire and Google Apps Script waitlist requests are separate and still operate when analytics is declined.
03. How and Why We Use Your Data
We use your data only to run Fred for you. The table below sets out each purpose and its legal basis under GDPR Article 6.
| Purpose | What we use | Legal basis |
|---|---|---|
| Improve the public website with optional analytics | Pseudonymous website events | Consent (Art. 6(1)(a)) |
| Create and manage your account | Name, email address | Contract (Art. 6(1)(b)) |
| Provide location-based features | Home address | Contract (Art. 6(1)(b)) |
| Understand your messages and reply | Chat messages, forwarded emails, calendar data | Contract (Art. 6(1)(b)) |
| Manage your calendar invites, reminders, and briefings | Calendar data, children’s information, message content | Contract (Art. 6(1)(b)) |
| Keep the service secure and monitor errors | Usage data, error logs | Legitimate interest (Art. 6(1)(f)) |
| Meet legal and accounting obligations | Billing records, account data | Legal obligation (Art. 6(1)(c)) |
| Deliver coordination features involving your children | Children’s names, dates of birth, and information you share about them | Contract with you as parents (Art. 6(1)(b)) — this data is always provided by parents, never collected from children |
| Send you product updates and onboarding emails | Name, email address | Consent (Art. 6(1)(a)) — you can unsubscribe at any time |
We do not use your data for advertising, to build profiles for third parties, or to train AI models.
04. Artificial Intelligence and Google Data
How Fred uses AI
Fred uses AI models hosted exclusively in the European Union to generate replies and help coordinate your family’s activities. Your data does not leave the European Union for AI processing and is never used to train AI models.
Voice transcription
Voice messages you send to Fred are transcribed using AI models hosted exclusively in the European Union. The original audio file is deleted immediately after transcription.
Image processing
Images you forward to Fred are processed using AI models hosted exclusively in the European Union to extract relevant text and information. Images are not stored after processing.
Google Calendar
Fred works with your calendar through Google Calendar’s built-in sharing feature — you never connect your Google account to Fred or grant Fred any permissions on it. You share your calendar with your household’s Fred address with read access. Fred uses this only to check availability and detect scheduling conflicts.
Fred never creates, edits, or deletes anything in your own calendar. When Fred schedules something, it creates the event in a calendar owned by Fred and shared with you. By subscribing to the shared calendar, you see all events also in your calendar UI.
Fred never accesses your Gmail or any other part of your Google account. Emails you forward to your Fred address are received in a dedicated mailbox that is part of Fred’s own infrastructure — not yours.
Google API Services User Data Policy (Limited Use)
Fred’s use of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements. In line with those requirements, we apply the following commitments to your calendar data and any other Google user data we receive:
- We use it only to provide and improve the user-facing features described in this policy — checking availability and detecting conflicts.
- We do not transfer it to anyone else, except to the processors listed in Section 05 as necessary to provide these features, to comply with applicable law, or as part of a merger or acquisition — in which case we will notify you in advance.
- We do not use or transfer it for advertising or to build user profiles.
- We do not use it to train generalised AI or machine-learning models.
- We do not allow humans to read it except with your explicit permission, where strictly necessary for security investigations or legal compliance, or in anonymised form for internal operations.
- You can revoke Fred’s access at any time by removing the Fred address from your calendar’s sharing settings (Google Calendar → Settings → Share with specific people).
Storage of Google data: Emails you forward to your Fred address are received and stored in a dedicated Gmail account. Events created by Fred are stored in a Google Calendar. Both are part of Fred’s infrastructure and are subject to the retention periods in Section 06.
05. Who We Share Data With
We do not sell your personal data. We share it only with the processors listed below, and only so they can perform a specific service on our behalf. Each processor is bound by a Data Processing Agreement.
| Provider or service category | Purpose | Location |
|---|---|---|
| PostHog (EU cloud) | Optional website analytics with consent | EU |
| Vercel | Website hosting | EU |
| Logto | Accounts, sign-in and onboarding | EU |
| Google (Calendar & Gmail) | Calendar and email integration | EU |
| Tally | Anonymous waitlist questionnaire | EU |
| Cloud hosting and AI infrastructure providers | Hosting Fred, its database and AI models | EU |
| Sentry | Error monitoring | EU |
| Brevo and cloud email delivery providers | Transactional and notification emails | EU |
| Langfuse (self-hosted) | Internal AI quality logs | EU |
We may also disclose data where legally required by a court order or regulatory authority, or in connection with a business sale or merger — in which case we will notify you in advance.
06. Storage, Transfers, and Retention
Where your data lives
Fred stores your family’s data on servers located in the EU. We carefully select processors that also store data within the EU whenever possible. Where a processor operates outside the EU, transfers rely on Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework.
How long we keep it
We retain your personal data for as long as your account is active. Upon request, we delete all associated personal data within 30 days and send you written confirmation. Billing and legal records are retained for 7 years as required by Dutch law; this data is not used for any other purpose.
Voice audio and images are deleted immediately after processing and are never stored.
Logs and technical data
Usage data, error reports (Sentry), and internal AI-quality logs (Langfuse) are retained for a maximum of 12 months, after which they are deleted or fully anonymised. Pseudonymised logs are treated as personal data until anonymised.
Email attachments
Emails you forward to Fred, including attachments, are retained under the same retention rules as your other account data.
Deleting your data
To delete your data, email mail@fred.family. We will erase your personal data within 30 days and send you written confirmation. Backups are fully purged within 90 days. We retain billing records for 7 years as required by law; this data is not used for any other purpose.
07. Security
We take the security of your family’s data seriously. Our approach is built around EU data residency, closed-by-default infrastructure, and strict isolation between households.
- Encryption of all data in transit (TLS) and at rest.
- Household isolation. Personal data is stored and accessed on a strictly per-household basis. Technical controls at the data storage layer ensure that no household can access the personal data of another household.
- Restricted infrastructure access. Fred’s servers are not directly accessible from the public internet. All external access is routed through a secure, authenticated network tunnel, limiting the attack surface and reducing the risk of unauthorised access.
- Strict internal access controls: only authorised team members with a legitimate need can access personal data.
- Error monitoring via Sentry to detect and respond to issues quickly.
No system is 100% secure. If we become aware of a security incident affecting your personal data, we will notify you and the relevant supervisory authority as required by law, without undue delay.
08. Your Rights
As a resident of the EU, you have the following rights in relation to your personal data. To exercise any of them, contact mail@fred.family. We will respond within 30 days. For complex requests we may extend this by up to two further months; if so, we will tell you within the first month and explain why.
- Access: request a copy of the personal data Fred holds about you.
- Rectification: ask us to correct inaccurate or incomplete data.
- Erasure: ask us to delete your personal data (see Section 06).
- Restriction: ask us to pause processing of your data in certain circumstances.
- Portability: receive your data in a structured, machine-readable format.
- Object: object to processing based on legitimate interest, including for direct marketing.
- Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
If you believe Fred has not handled your data correctly, you have the right to lodge a complaint with the Dutch data protection authority:
Autoriteit Persoonsgegevens (AP) www.autoriteitpersoonsgegevens.nl Tel: +31 (0)70 888 85 00
09. Children
Fred is for parents and guardians. Children do not use Fred directly and should not interact with it.
When you share information about your children — their name, school, birthday, or activities — you confirm that you are their legal parent or guardian and that you are entitled to share that information with us. We use it solely to deliver the coordination service and apply the same protections as to all personal data in Fred.
We do not knowingly collect personal data directly from children. If you believe a child has shared data with Fred without parental authorisation, please contact mail@fred.family immediately and we will delete it.
10. Changes to This Policy
We may update this policy from time to time. When we do, we will update the date at the top of this page. For material changes, we will notify you by email before the change takes effect.
Questions?
We’re parents too. Email mail@fred.family and a real person will reply.
Product Impact Consulting BV · Terschellingstraat 33, 1025 RA Amsterdam · KVK 90557840