How your family’s information is kept

Bell & Whistle is a calendar for parents. It holds what a family puts into it so that the parents, and the helpers they choose, can see the same week. This page says what that is, who can see it, and how to take it back.

What’s kept

• Your name and the email addresses you sign in with. If you use Face ID, Touch ID or Windows Hello, only a public key is kept; your face and fingerprint never leave your device.
• What you add about your family: children’s first names, grades and schools, the people who help, their phone numbers, events, pickups, to-dos, payments you track, activities and places.
• School calendar links you add, and what those calendars contain.
• The phones and computers you turned notifications on for, so they can be reached.

Addresses, meeting points, notes, phone numbers and health documents are stored encrypted (AES-256), with a key kept apart from the database, so a copy of the database alone doesn’t show where anyone will be.

Children don’t sign in and nothing is collected from them. Everything about a child is entered by their parent.

Optional reading practice: after a parent allows speech processing for a child, a recording is sent to OpenAI to make a transcript. Bell & Whistle does not save the recording. The transcript is stored encrypted; practice results are visible to that child’s family and class teachers. A parent can stop new speech processing and delete saved results from Reading practice. Adults can also enter the words heard without sending a recording.

Reading your school email

If a parent saves a remembered email rule, we keep the exact sender address, subject phrase and selected children until a parent forgets it or the family is deleted. The address and phrase are encrypted in storage. Family parents can see and change these rules in Settings → Remember who email is for, and they are included in the family’s data download. A rule does not retain the original email or grant access to a mailbox.

If you choose to, you can let Bell & Whistle read the emails your children’s schools, teachers and coaches send you, so you don’t have to type your family in. This only happens when you tap Connect and allow it in Google’s or Microsoft’s own sign-in window, or, for Yahoo, AOL and iCloud, paste an app password you made for it in that account. You can also get your own forwarding address and forward school emails to it; those emails pass through our email provider, Resend, are read the same way, and aren’t kept.

• What it asks for: read-only access to your mailbox (Gmail: “View your email messages and settings”; Outlook: “Read your mail”). It can’t send, delete, move or change anything.
• What it reads: when you connect, it looks only at the senders and subject lines of the last six months of inbox and sent mail that has school words in it or comes from school, sign-up, team and lunch services (like SignUpGenius, TeamSnap or Choicelunch), to pick out your children’s schools, teachers, coaches and activities. Then it reads in full, with up to two PDF attachments each, only the messages from those senders or that you sent to them, and once more back to August 1, when the school year began. After that, it checks every 30 minutes: new mail with school words in it has its sender and subject line looked at, so a new teacher or coach is noticed, and only messages from your family’s school senders are read in full.
• Finding a child’s school: if you add a child without a school, it searches each mailbox connected in your family once for that child’s name (and a hint, if you give one), reads up to 25 matching messages from each, from the last 13 months (in Gmail, leaving out Promotions and Social), and uses them only to find that child’s school. The school it finds is added and you’re told.
• Ask: when you ask something about your school mail, Ask searches only the mailboxes you connected yourself for a few words, opens up to 15 matching messages in each from the last eight months, and uses only those from your family’s schools, teachers, coaches and school services. The others are dropped at once, never kept or sent anywhere.
• What it keeps: only what it found for you to check: your children’s first names and grades, their schools, activities, and upcoming dates, forms and payments. The first time, nothing is added until you tap Add. After that, new dates, to-dos and payments are added as they arrive, marked with the email they came from, and you get a notification; delete anything you don’t want and it won’t come back. When Grades is on for your family, grades and attendance that a school system such as Gradelink emails you are kept too, on each child’s Grades page: seen only by the parents and stored encrypted. The emails themselves are not stored, and sign-in, password and verification-code emails are skipped and never sent to the AI.
• Access: to check again later, Bell & Whistle keeps Google’s or Microsoft’s permission for that mailbox, locked with a key that isn’t stored with it. It’s used only for these checks. Stop them any time in Settings → School email: the permission is deleted here and no more mail is read, and Google’s is handed back to Google as well (an Outlook connection stays listed in your Microsoft account until you remove it there). For Yahoo, AOL and iCloud, the app password you made is kept the same way and deleted when you stop. You can also remove access at myaccount.google.com/permissions, account.microsoft.com, or by deleting the app password in your Yahoo, AOL or Apple account, and deleting your account removes it too.
• Who processes it: those senders and subject lines, the school messages, and the messages a search for a child’s name finds, are sent to Anthropic’s Claude only to find those details. Anthropic doesn’t keep them to train its models.
• Never: your email data is not sold, not used for advertising, not used to train AI models, and not shared with anyone else. No one at Bell & Whistle reads it, unless you ask for help with it or the law requires it.

Bell & Whistle’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Class quizzes keep submitted answers, scores and teacher feedback. Written responses wait for teacher review. Families see their own children’s results, and current class teachers can review them. Review changes are kept in a history. Deleting the child or family removes their quiz results and reviews.

Google Classroom

• What it asks for: if a parent chooses to, they sign in with a child’s school Google account and allow Bell & Whistle to see that child’s classes and their own coursework and grades (Google: “View your Google Classroom classes” and “View your course work and grades”), plus the account’s email address. It can’t post, turn in, change or delete anything in Classroom.
• What it keeps: each assignment’s title, class and due day joins that child’s Homework; work the child turned in is ticked off; work past its due day and not turned in, and grades the teacher hands back, are shown to the parents and sent to them as a notification once. The class names are kept to show what’s connected. Nothing else from Classroom is stored, and none of it is sent to an AI.
• Access: Google’s permission is kept, locked with a key that isn’t stored with it, and used only to check again every 30 minutes. Disconnect any time on the Google Classroom page: the permission is handed back to Google and deleted here. Homework and grades already added stay until you delete them. Deleting your account or your family removes the permission too.
• Schoology and Canvas: Schoology and Canvas also offer calendar feeds: a parent pastes the child’s calendar link. The link is stored encrypted and read every few hours for each assignment’s title, class and due day, which join that child’s Homework. Disconnect it on the Classwork page and the link is deleted here.
• Never: Classroom data is not sold, not used for advertising, not used to train AI models, and not shared with anyone else.

We keep source assignment identifiers, a school-account fingerprint and links to retained homework and grades so reconnecting does not duplicate them. Source records contain no access token and are removed when the child or family is deleted.

Canvas school connection

Where a school approves a direct Canvas connection, a parent can sign in at Canvas and choose a linked student account. Bell & Whistle reads classes, assignments, submission status, missing work and published grades. It collects no school password and changes nothing in Canvas. The permission is stored encrypted and used to check about every 30 minutes. Account identifiers and the selected student identify the connection.

Assignments join the child’s Homework under the family’s sharing settings; grades are shown only to parents. The connection itself sends no Canvas records to an AI. Disconnect on Classwork to stop checks and delete the local permission and connection snapshot. Imported homework and grades remain until deleted. Deleting the connecting parent’s account, the child or the family also removes the connection. Bell & Whistle asks Canvas to revoke access; if Canvas is unavailable, you can also remove the permission in your Canvas account. Source identifiers stay with imported records so reconnecting does not duplicate them.

Messages, photos and posts

• Family chats, class and team chats, direct messages, voice messages, photos and PDFs are kept so the people in that chat can see them. Message text, photos and files are stored encrypted.
• If someone in a chat doesn’t have notifications on, they get the message by email (they can turn this off in Settings). A reply to that email is posted back into the chat; our email provider, Resend, carries these emails.
• Messages written in another language are translated for each reader by Anthropic’s Claude. Answers from Ask, and the morning brief written from your school mail, are made the same way. Nothing is used to train AI models.
• Read chats for plans is off until a grown-up in the family turns it on, and the family chat says so when they do. Then new messages in your family chat (never a child’s own chats) are read by Anthropic’s Claude for school, sports, the children’s lessons and family errands such as “pick up pizzas”; what it finds goes on the family calendar and to-do list, marked with the message it came from, and the family’s other grown-ups get a notification. Anyone in the family can undo it, and turning it off stops the reading at once. Voice messages are first written out by OpenAI’s speech-to-text, which doesn’t keep them.
• A school’s or teacher’s forms and permission slips: your answers and typed signature are seen only by whoever asked and the class’s teachers.
• A daycare’s or preschool’s daily report (meals, naps, bottles, diapers, activities, photos and short videos), drop-off and pick-up times with who did it and their typed signature, and the drop-off health check: seen only by your family and the class’s teachers. A pick-up PIN is kept only as a scrambled code.
• Health records you add for daycare or preschool (allergies, emergency notes, medicine permissions and doses, incident reports) and teachers’ observations of your child’s learning: seen only by your family and the class’s teachers, and stored encrypted.
• Applications to a school or daycare (your answers, documents, signatures and the enrollment packet): seen only by your family and that school’s staff, and stored encrypted.
• Tuition and fees paid in the app go to the school through its payment provider (Stripe). We keep the bill and the receipt, never your full card or bank number, and never hold the money.

Subscriptions

Bell & Whistle Plus is bought through the App Store, Google Play or, on the website, Stripe. They handle the payment; we receive only whether your family’s subscription is active and when it renews, never your card. Cancel in your App Store or Google Play subscription settings, or in Menu → Plan on the website.

Who sees it

• The parents in your family, and the helpers a parent adds. Helpers such as grandparents see the calendar and pickups, not payments.
• On a class page, the other families see your family’s name and what you post there, nothing else.
• No one else. Nothing is sold, shared with advertisers or used for ads.

What your school can see

A school, daycare, club or coach on Bell & Whistle sees only what you send them, and the children you enrolled with them:

• Each child’s name and grade or class, and the parents’ names and contact details you gave them (or that they already hold).
• What you send them: forms and permission slips you sign, RSVPs and sign-ups, absence notes, payments to them, messages to their staff, documents you choose to share, and check-ins at their front desk.

They never see your family’s calendar or to-dos, anything read from your email, your other schools, teams or activities, your wallet, health records or documents you didn’t share, your family chat, two-home arrangements, the assistant, your places, or your devices and sign-ins.

If you add a mobile number for texts, they don’t see it either: their texts and calls come from Bell & Whistle, and your replies reach them in the app.

Services it relies on

• Hosting and the database: Railway, in the United States.
• Weather: Open-Meteo receives only your town’s location, never names.
• Addresses and drive times: Photon (OpenStreetMap search) and OSRM receive only what you type in an address field and the places of your pickups, never names.
• Your home address, only if you add it: kept encrypted, seen only by your family, and used for one thing, how long the drive is from home. Use my location asks your phone once, when you tap it.
• Departure alerts are a separate opt-in for grown-ups. Your chosen phone sends its latest location, including in the background in the updated phone app, to estimate when to leave for your assigned pickups. We keep one encrypted position, clear it within 11 minutes, and keep no location history. Family members cannot see it. Routing services receive the coordinates needed to estimate your drive. Turn it off in Settings, or sign out to end it.
• The typefaces come from Google Fonts, which sees a request from your device, as any website would, but nothing about your family.
• Notifications travel encrypted through Apple’s or Google’s push service; they can’t read them.
• If you paste a school email into Add, or connect your email, the text is read by Anthropic’s Claude to find the dates. Only those messages are sent.
• Google, Microsoft, Yahoo, AOL or Apple, only if you choose to connect your email with them.
• Texts and calls: Twilio, only to a mobile number you added and confirmed for texts. Reply STOP to any text, or remove the number in Settings, and they stop.

Cookies

One cookie keeps you signed in on this device. There are no tracking or advertising cookies.

The app keeps copies of information and media you have opened on this device so you can view them offline. Signing out removes these copies. New information and changes need an internet connection.

Taking it back

• Download a copy: Family, Settings, Download a copy.
• Delete your account: Family, Settings, Delete my account. If nobody else runs your family, the whole family is deleted with it. More about deleting your account
• Remove a person, child or event at any time; it’s gone from everyone’s view straight away.
• Deleted data leaves our backups within 31 days (daily copies) and within 13 months (monthly copies).

Questions

Write to eshkadov@gmail.com.