Privacy Policy

Effective September 17, 2026

KidSync helps adults discover activities and organize family plans. KidSync is operated by Nando Labs LLC ("we", "us"). This policy explains the information the website and Chrome extension handle and your choices.

Information we handle

We handle the account and contact details you provide, family membership and invitations, trusted-driver details, notification preferences, saved activities, registration details, calendars, tasks and planning notes. Child profiles can include first and last name, full birthdate, current and rising grade, interests, planning preferences, optional address and contact details, gender, allergies, medical conditions, medications, dietary needs, special needs and medical notes. You can also add profile photos and upload immunization records or insurance cards for registration reference.

We record the adult permission statement you submit, its notice version and time. We also handle support messages, calendar connection credentials, billing identifiers and status, and operational records used to sign you in, limit abuse, prevent duplicate actions, and track delivery and deletion. Stripe handles payment details through its checkout and billing portal. KidSync stores related customer and subscription identifiers and processing records, not full card numbers.

Children and family access

KidSync accounts are for adults. Child information is entered by adults managing family plans. The permission statement records your attestation that you are authorized to provide it; it does not independently verify guardianship. Access depends on family membership, role and the sharing choices you make. Invited family members and people given access to a shared list or calendar can see the information made available through that feature. Review free text before sharing, including names or health information you may have entered.

You can edit or remove a child profile or request account deletion in Settings. Some shared plans remain for other family members. The account-deletion status page shows progress and completion. Our Data Retention Policy explains related records and copies that can remain.

Activity scanning and AI

When you choose to scan an activity page, the extension lets you review and edit the captured text before sending it to KidSync and Anthropic to suggest activity details. This transfer happens before you save an activity. You can enter details manually without using the scanner.

Automatic capture skips form fields, hidden content and editable areas, but visible page text can still contain personal information. Remove information you do not want to send before confirming the scan. The scanning request does not automatically retrieve child profiles, health fields, photos or uploaded documents. Text you choose to submit can nevertheless contain personal or health information. KidSync removes the source address's query and fragment before sending it to Anthropic; the original source address can remain in the reviewed activity and be saved with it.

Registration assistance and browser storage

The extension can display the family and child profile you select, including optional health notes, photos and document references. It checks current access before copying details, downloading a document or filling a form. Profile reference details are held in the popup's memory rather than a persistent profile store.

You review supported parent and child fields before filling them into a provider's form. The extension does not automatically fill health or medical fields, submit registration forms, or select consent choices. A provider can read values placed in its page before you submit its form. Details you explicitly copy go to your clipboard; downloaded files remain on your device. Review the provider's practices before sharing them.

The extension stores your sign-in session and calendar-save retry details in browser storage. Calendar retry details can include family and child identifiers, activity name, schedule, location and notes. Favorites retry storage contains a request identifier and a hash of the save choices. These records help recover interrupted requests without duplicate saves. Signing out clears the stored session and these retry records. It does not remove activities already saved to KidSync, clipboard contents or files you downloaded. Deleting an account does not remotely wipe every installed browser.

Saved activities and sharing

Calendar and Favorites saves store the structured details and source address you review. Saving an outside activity to Favorites does not automatically publish it in the public catalog. A separate activity submission sends reviewed activity details to administrators for possible catalog publication. Shared Favorites links can disclose saved activity details to people who receive them. Review the saved text and source address before sharing.

Service providers and connected features

Vercel provides KidSync website hosting and Supabase provides database, authentication and file storage. Anthropic processes the page text you approve for activity scanning. We use these services to provide the extension's features. Service requests can also create operational records used for authentication, abuse prevention, troubleshooting and reliability.

KidSync's separate website features use service providers for payments, connected calendars, activity information and message delivery. Information you save through the extension can be used by the calendar, sharing and reminder features you choose. Dedicated child health profile fields are not automatically inserted into activity scans, calendar exports or reminders, but personal information entered in event titles, notes, locations or other free text can be included.

Connected Google Calendar and data protection

When you connect Google Calendar, KidSync requests only the Google scopes needed for the calendar features you choose: permission to see, create, change and delete events on calendars you own, and your email address to label the connection. KidSync uses this access solely to import your events into your family calendar and, if you enable it, to place KidSync events on your Google Calendar. We do not use Google Calendar data for advertising, do not sell it, do not share it with people or services other than those needed to provide the feature, and no human reads it except with your permission, for security, to comply with law, or in aggregated, anonymized form for internal operations.

KidSync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data, whether raw, aggregated or derived, is never used to create, train or improve foundational or generalized machine learning or artificial intelligence models. The AI-assisted activity scanning described above operates only on public activity page text you choose to submit; it never receives Google Calendar data.

How we protect sensitive data: all connections use encrypted transport (HTTPS/TLS); Google access and refresh tokens are stored encrypted at rest in a dedicated secrets vault, separate from application tables, and are readable only by server-side code, never by browsers or client applications; child profiles, health fields, calendar data and uploaded documents are stored in an access-controlled database in the United States with row-level security so that each family can reach only its own records; administrator access is role-based and logged; production secrets are held in the hosting provider's encrypted configuration. You can disconnect Google Calendar at any time from Settings, which revokes KidSync's token with Google and deletes the stored credentials, and you can delete your account, which removes your family's data on the schedule in the Data Retention Policy.

Our uses and your choices

We use information to provide the features you choose, manage access and billing, respond to support requests, protect the service and maintain reliable records of actions. We do not sell personal information, show advertisements, share information with advertisers, or use family information to train AI models. We use extension data only to provide or improve its described features, protect the service, or meet applicable legal obligations. Transfers to service providers are limited to those purposes. We do not use extension data for creditworthiness or lending decisions.

Connections use encrypted transport and access controls restrict account and family information. You can view and edit your information, manage sharing and connected calendars, change notification preferences, export calendar information, cancel membership or request deletion. Contact support@nandolabs.com for assistance.

Changes

If this policy changes in a meaningful way, we will note the new effective date here and email account holders before the change takes effect.