Privacy policy

1. Who we are

muddl is a UK-focused family organisation product. The website is at muddl.co and the muddl app is at app.muddl.co. For the purposes of this Privacy Policy, muddl, we, us and our refer to this project. muddl is operated by Oliver Tuck in the UK. You can contact us about privacy matters at hello@muddl.co.

This Privacy Policy explains how we collect, use and protect personal information when you use the muddl.co website and the muddl app. We treat the website and the app as one product, so this policy covers both.

2. What information we collect

Account information

When you create a muddl account, we collect your email address and basic account details. If you sign in with Google, Google shares your email address and basic profile information with us, such as your name.

Family and calendar content

We store the information you add to muddl, such as family member names, events, routines and reminders. This includes information you choose to add about your children, such as first names and routine or schedule entries. If you choose a local authority area, we store that selection to show school term dates and local weather. This is an area you pick, not your device location, and you can change it at any time.

Photos you submit with Add from photo

If you subscribe to muddl+, family owners and editors can use the Add from photo feature to photograph or upload an item such as a party invitation, school email or letter, or activity poster, so muddl can suggest the event details for you. This is entirely optional, and nothing is processed unless you actively submit a photo. The photo is downscaled in your browser and sent over an encrypted connection, via our servers, to OpenAI for analysis, together with the first names of the children on your account, so the event can be matched to the right child, and the current date. No other account data is sent. Photos may incidentally contain personal information, including children’s information such as a name on an invitation. We never store the photo, in our database or anywhere else. It is processed transiently and discarded. The extracted event details are saved only if you confirm them, as normal calendar entries.

Payment information

If you subscribe to muddl+, payments are handled by Stripe. We do not store your full payment card details. We keep records of your subscription, such as your plan and payment status.

Information collected automatically

When you visit muddl.co or use the muddl app, we may collect limited technical information such as:

• your browser type and version;
• device type;
• approximate location based on IP address;
• pages visited;
• referring website or source, where available;
• time and date of your visit;
• cookie consent choices; and
• basic security and server logs.

Analytics information

If you accept non-essential cookies, we may use Mouseflow to understand how visitors use muddl.co. Mouseflow may collect interaction data such as clicks, scrolling, page movement and page navigation, which we use to improve the website experience. Mouseflow is only loaded if you accept non-essential cookies. We do not use Mouseflow for advertising or retargeting. We aim to configure analytics tools in a privacy-conscious way, including masking typed inputs where available and avoiding the deliberate collection of sensitive information through analytics.

3. What we do not collect

There are some things we deliberately avoid:

• children’s dates of birth;
• school names, because term dates are based on the local authority area you choose, not individual schools;
• your device location, because weather and term dates use your chosen local authority area;
• your full payment card details, because Stripe handles these;
• medical or special category information, because we do not ask for it; and
• information collected from children directly, because children do not have their own muddl accounts.

We do not sell your personal information or use it for third-party advertising.

4. How we use your information

We use your information to:

• provide your muddl account and run the muddl service;
• show your family’s calendar, routines and reminders;
• take payments for muddl+ and manage your subscription;
• send service emails, such as family invitation emails;
• send product updates about muddl, where you have opted in;
• manage your consent and unsubscribe choices;
• operate, maintain and secure the website and the app;
• understand how muddl is used and improve it;
• prevent misuse, spam, fraud or abuse; and
• comply with legal obligations.

We do not sell your personal information.

5. Our lawful bases for using your information

Under UK data protection law, we need a lawful basis to use personal information. We rely on the following:

You can withdraw your consent to product update emails at any time by using the unsubscribe link in our emails or by contacting us.

6. Who processes information for us

We use carefully selected service providers to operate, secure and improve muddl. Some of these providers process personal information on our behalf, only where needed to provide their services.

These include providers of:

• cloud hosting, data storage and backend infrastructure;
• account authentication and security;
• payment processing;
• service and product emails;
• analytics and session recording, where you have consented; and
• AI photo analysis for the Add from photo feature, when you use it.

When you purchase muddl+, Stripe processes your payment and related transaction information. muddl does not receive or store your full card details.

When you choose to sign in with Google, Google processes the information needed to authenticate your account.

When you use Add from photo, OpenAI, L.L.C. (US) processes the photo you submit, solely to extract event details on our behalf. Under OpenAI’s API data commitments, this data is not used to train or improve OpenAI’s models, and is retained for up to 30 days for abuse monitoring, unless longer retention is required by law. You can read more on OpenAI’s data controls page .

Our service providers are required to protect personal information and may only process it in accordance with their contractual and legal obligations.

We may also disclose personal information where required by law, to prevent fraud or abuse, to protect our rights or the safety of others, or as part of a sale, restructuring or transfer of the business.

7. International transfers

Some of our service providers may process personal information outside the UK. Where personal information is transferred outside the UK, we aim to use appropriate safeguards, such as:

• UK adequacy regulations;
• standard contractual clauses or equivalent transfer terms;
• data processing agreements; and
• provider security and privacy commitments.

Our Supabase database is hosted in West Europe, London, UK.

When you use Add from photo, the photo you submit is processed by OpenAI in the United States under the safeguards above.

8. How long we keep information

We only keep personal information for as long as we need it. In practice:

• account, family and calendar information is kept while your account is active. If you delete your account, this information is deleted from our database and the deletion is permanent. Before you delete, the app confirms what will be deleted and, where applicable, how your muddl can be transferred to another family member;
• photos submitted to Add from photo are not stored by muddl at all. They are processed transiently and discarded. Event details you confirm are kept as normal family and calendar information under the rules above;
• subscription and payment records may be kept for longer where tax and accounting rules require it;
• product update email preferences are kept until you unsubscribe or ask us to delete them;
• unsubscribe records may be kept for longer where needed to make sure we do not email you again by mistake;
• cookie consent choices may be stored for up to 12 months, unless you reset or delete them sooner;
• website security logs are kept only for as long as needed for security, troubleshooting and legal reasons; and
• Mouseflow analytics data is kept according to our Mouseflow settings and subscription limits, and only for as long as needed to improve the site.

If you contact us directly, we may keep the message for as long as needed to respond and keep a reasonable record of the request.

9. Your rights

Under UK data protection law, you may have rights to:

• access the personal information we hold about you;
• correct inaccurate information;
• ask us to delete your information;
• object to or restrict certain uses of your information;
• withdraw consent where we rely on consent;
• request a copy of your information in a portable format, where applicable.

To exercise your rights, contact us using the email address above. If you are unhappy with how we handle a privacy concern, you can also contact the UK Information Commissioner’s Office.

10. Children’s information

muddl is for adults. Parents, carers and guardians use muddl to organise family life, and children do not create their own accounts. Account holders can add information about their children, such as first names and routine or schedule entries. We use this information only to provide the service, and we ask you to add only what you need. You can remove it at any time by editing or deleting entries, deleting your account, or contacting us. If you have concerns about a child’s information, contact us.

11. Marketing emails

We send service emails that are needed to run muddl, such as family invitation emails. These are not marketing. If you have opted in, we also send product updates about muddl. We do not send unrelated third-party marketing. You can unsubscribe from product updates at any time using the unsubscribe link in our emails or by contacting us.

12. Cookies and similar technologies

We use cookies and similar technologies to make the website work, remember your cookie choices, and, if you consent, understand how the site is used. For more information, see our Cookie Policy.

13. Security

We use technical and organisational measures designed to protect personal information. These may include access controls, secure hosting, encrypted connections, database permissions and limiting access to people or services that need it. No online service is completely secure, so we cannot guarantee absolute security.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. If we make material changes, we will take reasonable steps to make them clear, such as updating this page or contacting you where appropriate.