Privacy policy

1. Who we are

muddl is a UK-focused family organisation product. The website is at muddl.co and the muddl app is at app.muddl.co. For the purposes of this Privacy Policy, muddl, we, us and our refer to this project. muddl is operated by Oliver Tuck in the UK. You can contact us about privacy matters at hello@muddl.co.

This Privacy Policy explains how we collect, use and protect personal information when you use the muddl.co website and the muddl app. We treat the website and the app as one product, so this policy covers both.

2. What information we collect

Account information

When you create a muddl account, we collect your email address and basic account details. If you sign in with Google or Apple, that provider shares your email address and basic profile information with us, such as your name. If you use Apple’s Hide My Email, we receive a private relay address instead of your personal email address.

Family and calendar content

We store the information you add to muddl, such as family member names, events, routines and reminders. This includes information you choose to add about your children, such as first names and routine or schedule entries. If you choose a local authority area, we store that selection to show school term dates and local weather. This is an area you pick, not your device location, and you can change it at any time.

School dates

If you use school dates, we store the school you choose for each child, the school years it applies to, and dates you add, change or confirm. These details are visible to permitted members of your muddl. Choosing a school is optional and does not change your saved local authority or weather location.

Photos you submit with Add from photo

If you subscribe to muddl+, family owners and editors can use the Add from photo feature to photograph or upload an item such as a party invitation, school email or letter, or activity poster, so muddl can suggest the event details for you. This is entirely optional, and nothing is processed unless you actively submit a photo. The photo is downscaled in your browser and sent over an encrypted connection, via our servers, to OpenAI for analysis, together with the first names of the children on your account, so the event can be matched to the right child, and the current date. No other account data is sent. Photos may incidentally contain personal information, including children’s information such as a name on an invitation. We never store the photo, in our database or anywhere else. It is processed transiently and discarded. The extracted event details are saved only if you confirm them, as normal calendar entries.

Payment information

If you subscribe to muddl+ on the web, payments are handled by Stripe. If you subscribe in the iOS app, payments are handled by Apple through the App Store. We do not store your full payment card details, and Apple does not share them with us. We keep records of your subscription, such as your plan and payment status and, for App Store purchases, the transaction identifiers Apple provides so we can unlock muddl+ for your family.

Information collected automatically

When you visit muddl.co or use the muddl app, we may collect limited technical information such as:

• your browser type and version;
• device type;
• approximate location based on IP address;
• pages visited;
• referring website or source, where available;
• time and date of your visit;
• cookie consent choices; and
• basic security and server logs.

Notifications

If you turn on booking reminders in the muddl app, your device gives us a notification token — an identifier Apple uses to deliver messages to that device. We store it against your account, along with basic technical details such as the platform and app version, so we can send the reminders you and your family have set. We also store your reminder preference for each muddl (all bookings, only bookings assigned to you, or off). We do not use notification tokens for advertising, profiling or tracking, and we do not read any other device identifier. If you never turn notifications on, no token is stored.

Analytics information

If you accept non-essential cookies, we may use Mouseflow to understand how visitors use muddl.co. Mouseflow may collect interaction data such as clicks, scrolling, page movement and page navigation, which we use to improve the website experience. Mouseflow is only loaded if you accept non-essential cookies. We do not use Mouseflow for advertising or retargeting. We aim to configure analytics tools in a privacy-conscious way, including masking typed inputs where available and avoiding the deliberate collection of sensitive information through analytics.

3. What we do not collect

There are some things we deliberately avoid:

• children’s dates of birth;
• your device location, because weather and term dates use your chosen local authority area;
• your full payment card details, because Stripe or Apple handles these;
• medical or special category information, because we do not ask for it; and
• information collected from children directly, because children do not have their own muddl accounts.

We do not sell your personal information or use it for third-party advertising.

4. How we use your information

We use your information to:

• provide your muddl account and run the muddl service;
• show your family’s calendar, routines and reminders;
• send booking reminders to the devices where you have turned notifications on;
• take payments for muddl+ and manage your subscription;
• send service emails, such as family invitation emails;
• send product updates about muddl, where you have opted in;
• manage your consent and unsubscribe choices;
• operate, maintain and secure the website and the app;
• understand how muddl is used and improve it;
• prevent misuse, spam, fraud or abuse; and
• comply with legal obligations.

We do not sell your personal information.

5. Our lawful bases for using your information

Under UK data protection law, we need a lawful basis to use personal information. We rely on the following:

You can withdraw your consent to product update emails at any time by using the unsubscribe link in our emails or by contacting us.

6. Who processes information for us

We use carefully selected service providers to operate, secure and improve muddl. Some of these providers process personal information on our behalf, only where needed to provide their services.

These include providers of:

• cloud hosting, data storage and backend infrastructure;
• account authentication and security;
• payment processing;
• service and product emails;
• analytics and session recording, where you have consented;
• delivering notifications to your devices; and
• AI photo analysis for the Add from photo feature, when you use it.

When you purchase muddl+ on the web, Stripe processes your payment and related transaction information. muddl does not receive or store your full card details. When you purchase muddl+ through the App Store, Apple processes your payment; we receive subscription records from Apple, such as transaction identifiers and renewal status, which we use to unlock and manage muddl+.

When you choose to sign in with Google or Apple, that provider processes the information needed to authenticate your account.

When you use booking reminders in the iOS app, Apple Inc. delivers them through the Apple Push Notification service. Apple receives the notification token for your device and the content of the reminder so it can deliver the message. The message contains the booking’s title, its date and time, and internal reference identifiers — not your name, email address or other account details.

When you use Add from photo, OpenAI, L.L.C. (US) processes the photo you submit, solely to extract event details on our behalf. Under OpenAI’s API data commitments, this data is not used to train or improve OpenAI’s models, and is retained for up to 30 days for abuse monitoring, unless longer retention is required by law. You can read more on OpenAI’s data controls page .

For school date checks, Firecrawl processes public school pages and documents, and OpenAI processes public page text and school details to identify dates. We do not send child names, child identifiers, family identifiers or your family’s changes to either service for these checks. We request that OpenAI does not store the generated response. These services use their standard account data controls; this is not a promise of zero data retention. Opening a school source link takes you to that website, whose own privacy policy applies.

Our service providers are required to protect personal information and may only process it in accordance with their contractual and legal obligations.

We may also disclose personal information where required by law, to prevent fraud or abuse, to protect our rights or the safety of others, or as part of a sale, restructuring or transfer of the business.

7. International transfers

Some of our service providers may process personal information outside the UK. Where personal information is transferred outside the UK, we aim to use appropriate safeguards, such as:

• UK adequacy regulations;
• standard contractual clauses or equivalent transfer terms;
• data processing agreements; and
• provider security and privacy commitments.

Our Supabase database is hosted in West Europe, London, UK.

When you use Add from photo, the photo you submit is processed by OpenAI in the United States under the safeguards above.

Booking reminders are delivered through Apple’s push notification service, which operates internationally, under the safeguards above.

8. How long we keep information

School links, dates you add or change, and confirmations are kept with your family data. Ending a school assignment keeps its earlier school years and related changes as history; changes linked to that school stop applying where the assignment no longer applies. A subscription ending does not delete these records. Deleting a child removes their school links and child-specific dates. Deleting a muddl removes its family school records. Shared public school dates and supporting public source material are separate from those family records; deleting your family does not delete dates used by other families.

We only keep personal information for as long as we need it. In practice:

• account, family and calendar information is kept while your account is active. If you delete your account, this information is deleted from our database and the deletion is permanent. Before you delete, the app confirms what will be deleted and, where applicable, how your muddl can be transferred to another family member;
• photos submitted to Add from photo are not stored by muddl at all. They are processed transiently and discarded. Event details you confirm are kept as normal family and calendar information under the rules above;
• notification tokens are kept while you stay signed in on that device. They are deleted when you sign out, when you delete your account, and automatically when Apple tells us a device no longer accepts notifications;
• subscription and payment records may be kept for longer where tax and accounting rules require it;
• product update email preferences are kept until you unsubscribe or ask us to delete them;
• unsubscribe records may be kept for longer where needed to make sure we do not email you again by mistake;
• cookie consent choices may be stored for up to 12 months, unless you reset or delete them sooner;
• website security logs are kept only for as long as needed for security, troubleshooting and legal reasons; and
• Mouseflow analytics data is kept according to our Mouseflow settings and subscription limits, and only for as long as needed to improve the site.

If you contact us directly, we may keep the message for as long as needed to respond and keep a reasonable record of the request.

9. Your rights

Under UK data protection law, you may have rights to:

• access the personal information we hold about you;
• correct inaccurate information;
• ask us to delete your information;
• object to or restrict certain uses of your information;
• withdraw consent where we rely on consent;
• request a copy of your information in a portable format, where applicable.

To exercise your rights, contact us using the email address above. If you are unhappy with how we handle a privacy concern, you can also contact the UK Information Commissioner’s Office.

10. Children’s information

muddl is for adults. Parents, carers and guardians use muddl to organise family life, and children do not create their own accounts. Account holders can add information about their children, such as first names and routine or schedule entries. We use this information only to provide the service, and we ask you to add only what you need. You can remove it at any time by editing or deleting entries, deleting your account, or contacting us. If you have concerns about a child’s information, contact us.

11. Marketing and service messages

We send service emails that are needed to run muddl, such as family invitation emails. These are not marketing. If you have opted in, we also send product updates about muddl. We do not send unrelated third-party marketing. You can unsubscribe from product updates at any time using the unsubscribe link in our emails or by contacting us.

Booking reminders are service messages too. They are sent only because you or someone in your muddl set a reminder, and we never use notifications for marketing. You can change what you receive in the app under Settings → Notifications, or turn notifications off entirely in your device settings.

12. Cookies and similar technologies

We use cookies and similar technologies to make the website work, remember your cookie choices, and, if you consent, understand how the site is used. For more information, see our Cookie Policy.

13. Security

We use technical and organisational measures designed to protect personal information. These may include access controls, secure hosting, encrypted connections, database permissions and limiting access to people or services that need it. No online service is completely secure, so we cannot guarantee absolute security.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. If we make material changes, we will take reasonable steps to make them clear, such as updating this page or contacting you where appropriate.