Data Protection

Your Family’s Information Is Protected

Your family’s information is never sold, never used for advertising, and never used to train AI models. It stays private to your household, encrypted, and under your control.

SOFE holds some of the most personal information a family has: school messages, children’s details, schedules, health notes, and plans. This policy explains how we protect it. For what we collect and who can see it, see our Privacy Policy.

1. Never Used to Train AI Models

Sprout and Otis use AI models from providers such as Anthropic, OpenAI, Google, xAI, and Perplexity. We connect to them only through their paid API services, never through their consumer apps.

• Your family’s information is never used to train AI models, ours or anyone else’s.
• Provider terms for these APIs do not allow them to use your data to train their models.
• We send only what each request needs, and providers keep request data briefly, if at all, under their API terms.
• Your information is never shared with other SOFE households.

2. Privacy Built Into How SOFE Works

• Nicknames for AI: set a nickname for anyone in your household and our AI assistants only ever see the nickname. The real first name stays out of every AI request.
• No birth dates sent to AI: an exact date of birth is never sent to an AI model. The assistant gets an approximate age only when it helps.
• Only the sources you approve: Sprout follows the school and activity senders you choose, plus anything you forward to SOFE.
• You decide who sees what: household members see information based on the role and permissions you set. Experts see only the details you approve, and you can take access back at any time.

3. Each Household Is Kept Separate

• Every household has its own logically isolated workspace.
• Access controls keep one household’s information from being visible to any other.
• Access to your household’s data is logged.

4. Encryption

• In transit: TLS 1.2 or higher for all connections, including requests to AI providers.
• At rest: AES-256 encryption for stored data and backups.

5. Who at SOFE Can See Your Information

SOFE staff do not look at your family’s content unless you ask us to (for example, in a support request), it is needed to keep the Services secure, or the law requires it.

6. Connected Accounts

• Google (Gmail): read-only access (the gmail.readonly scope), used to process messages from the senders you approve and messages you forward, so SOFE can create deadlines, events, tasks, reminders, and summaries and link back to the original email. Never used for advertising, never sold, and never used to train AI models.
• Microsoft (Outlook): read-only access to email and calendar data, used the same way and protected the same way.

SOFE’s use of Google API data complies with the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect any account at any time in settings, and data from that account is deleted within 30 days.

7. Security Assessments

• CASA: SOFE completed an independent Cloud Application Security Assessment (CASA Tier 2) with TAC Security in 2026, an assessor authorized under the App Defense Alliance program that Google uses for apps with access to sensitive user data.
• SOC 2 infrastructure: SOFE runs on Vercel (hosting) and Supabase (database), which maintain SOC 2 reports.
• Multi-factor authentication is available for every account.

8. You Control Retention

Your household’s information stays in SOFE until you delete it. You can delete individual items, a household member, a connected account’s data, or your whole account. Deleted data is permanently removed from our systems within 30 days, including backups, except for records we must keep by law, such as billing records. See our Data Deletion Policy.

9. Export Anytime

Your family’s information belongs to your family. You can request a complete export at any time in standard, machine-readable formats (such as JSON or CSV). Export requests are typically completed within 5 business days. There is no lock-in.

Plain-English Summary

Your family’s information is:

• Yours
• Private to your household
• Encrypted
• Never used to train AI
• Never sold or used for ads
• Exportable and deletable anytime

Questions?

If you have questions about how we protect your family’s information, contact us:

Related Policies

• Privacy Policy: what we collect, how we use it, and your rights
• Terms of Service: your agreement with SOFE
• Stewardship: how SOFE is governed for the long term