School Buddy

Privacy Policy

Last updated

On this page

Effective: September 28, 2026 (previous version effective May 19, 2026)

A note from the founder. I built School Buddy because I was drowning in school emails about my own kids. I know you're trusting me with your inbox, and I take that seriously. This policy is written in plain language so you can actually read it. If anything here isn't clear, email me at julie@theschoolbuddy.ai and I'll answer personally.

If you want the short version, read our promise. The legal version is below.

1. Who we are

School Buddy ("we," "us," or "the Service") is operated by Julie McLelland, a sole proprietor based in Houston, Texas. You can reach us at:

  • Email: julie@theschoolbuddy.ai
  • Address: Available on request to verified subscribers (we are a small operation; we do not publish a residential address)

We are the data controller for the personal information described in this policy.

2. What this Service does

School Buddy connects to your Gmail account with your permission, reads your incoming emails to find school, team and club messages, sends you a weekly summary by text message, WhatsApp or email, answers questions you text us about your children's school and activity schedule, and (optionally) creates Google Calendar events for dates and deadlines we find — only after you confirm each one. That is the entire purpose of the Service.

3. Information we collect

We collect only what we need to deliver the Service. Specifically:

Information you give us:

  • Your name and email address (to identify your account).
  • Your mobile phone number (to deliver the weekly summary by text message or WhatsApp).
  • Your timezone, how you want to hear from us (text message, WhatsApp or email), your preferred day and time for the weekly summary, and whether you want heads-ups between summaries.
  • Your family profile: your children's first names and nicknames, grades, schools and teachers, and their activities, teams and coaches, plus where your school mail comes from (for example, the senders you check off or a Gmail label you pick). We use it only to find and sort your family's messages.
  • Your payment information, processed by our payment processor — we never see or store your card details ourselves.

Information we access via Google with your permission:

  • The content of your Gmail messages, accessed under the gmail.readonly OAuth scope. We do not read sent mail, drafts, or any folder you keep private — we read the inbox the way Gmail itself presents it.
  • Your Google Calendar, accessed under the https://www.googleapis.com/auth/calendar.events scope, only to create events you have approved, and to update events School Buddy itself created when you ask us to. We do not read, modify, or delete events we did not create.

Information from pages school emails link to:

  • Some school emails put the details on a web page ("see the field trip details here"). When an email we are processing points to a page like that, we may fetch that one page — only public pages, without your cookies or login — and treat its text the same way as the email's. We decide which link to follow using the link and the words around it; we never follow unsubscribe, social media, or advertising links.

Your conversations with School Buddy:

  • The text messages you send us and our replies, so follow-up questions ("add both dates") have context. In the School Buddy app we don't store your questions (each is answered with the few before it on your screen), and we keep our answers for 30 days.

Information we collect when you use the Service:

  • Basic technical logs (IP address, browser type, request timestamps) for security and debugging. Retained 30 days.
  • Audit records of every Gmail read we perform on your behalf — visible to you in Settings.
  • Processing records that show how each email moved through School Buddy (for example, "fetched", "3 items found", "calendar event created"). These contain counts, timestamps, and internal identifiers — never the content of your emails.

We do not use cookies for advertising or tracking. We use a single session cookie for keeping you signed in.

4. How we use your information

We use your information only to:

  1. Authenticate you and operate your account.
  2. Read your Gmail to identify school, team and club messages.
  3. Find events, deadlines, and announcements in those messages (see Section 6).
  4. Send you the weekly summary, and heads-ups if you've turned them on, by text message, WhatsApp or email.
  5. Create Google Calendar events you have asked us to create.
  6. Charge your subscription through our payment processor.
  7. Send you essential service emails (receipts, security notices, major changes to this policy). You cannot opt out of these because they are required for the Service to function — but they are infrequent.

We do not use your information for advertising. We do not sell or rent your information to anyone, ever. We do not use your information or the content of your emails to train anything.

School Buddy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We process your information based on:

  • Your consent, granted when you connect your Gmail account.
  • Performance of a contract, where processing is necessary to deliver the Service you have paid for.
  • Legitimate interest, for security logging and abuse prevention.

You can withdraw your consent at any time by disconnecting your Gmail account or deleting your account in Settings.

6. How School Buddy reads your email

To find events and deadlines in your email, and to answer the questions you text us, School Buddy uses software, some of it run for us by an email-processing service provider. Specifically:

  • We send the text of each email we process — and, when the email links to a page with the details, the text of that one page. Attachments are never sent.
  • When you text us a question, we send your question, recent messages in the conversation, and the stored school information needed to answer it.
  • For each item it finds, the service returns the short passage of the email it came from. We check in our own code that the passage really appears in the email before we keep it.
  • Before sending, we run a pattern-based redaction pass that removes any visible Social Security numbers, full credit card numbers, and bank account numbers.
  • Our email-processing provider's terms prohibit them from training on this data. They retain it for at most 30 days for abuse monitoring and then delete it.
  • We never send sender names, recipient names, or your personal identifiers to the email-processing provider unless they are part of the email body itself.

7. Who we share information with

We share information only with Google and with the following kinds of service providers, and only as needed to operate the Service.

  • Google receives the OAuth tokens it issued, sent back to it, so we can read Gmail and write to Calendar with your permission.
  • Email processing receives the text of school emails and the pages they link to, your text questions, and the school information needed to answer them — to find events, dates, and to-dos, and to answer your questions.
  • Text-message delivery receives your phone number and the text of our messages — to deliver text messages and WhatsApp messages.
  • Notification services (Apple, Google and your browser's push service), which carry encrypted notifications to your device — a short line about one item, never the text of your email.
  • Email delivery receives your email address and the weekly summary — to deliver it if you choose email.
  • Payment processing receives your name, email, and payment method — to process the subscription.
  • Database hosting stores all account and email data, encrypted — to store your account.
  • Web hosting handles web traffic and account data — to run our website.
  • DNS and network security sees web traffic metadata — for DNS, content delivery, and security.
  • Error monitoring receives error logs (no email content) — to find and fix bugs.
  • Backup storage holds encrypted backups — for disaster recovery.

We do not share your information with anyone else. We do not sell or rent it. We do not participate in advertising data exchanges.

If we are ever compelled to disclose information by a valid legal order, we will notify you unless legally prohibited from doing so.

8. How long we keep your information

  • Email text: at most 30 days. When we process a school email we keep an encrypted copy of its readable text — and of any linked page we fetched for it — so School Buddy can show you where information came from. After 30 days that copy is permanently deleted. We never store attachments.
  • Source excerpts: for each event, deadline, or to-do we find, we keep the one short passage it came from (at most 280 characters), so School Buddy can tell you why it believes something after the email text itself is deleted. Excerpts are kept with that item while your account is active.
  • Extracted events, to-dos, and summary history: kept while your account is active so you can review past summaries and ask about them.
  • Your family profile: kept while your account is active. You can change it in Settings at any time.
  • Text conversations with School Buddy: kept while your account is active.
  • Processing records (no email content): kept while your account is active.
  • Account details (name, email, phone): kept while your account is active.
  • OAuth tokens: kept while your account is active. Encrypted at rest.
  • Audit logs: 90 days.
  • Backups: 30-day rolling retention.

When you use "Delete everything" in Settings, we delete your account and everything in it within 30 days, except limited records we are required to keep for tax or fraud-prevention purposes.

9. Your rights

Regardless of where you live, you have the right to:

  • Access the information we hold about you. Email us and we will send you an export within 30 days.
  • Correct information that is wrong. Most fields you can edit yourself in Settings.
  • Delete your account and all associated data. You can do this in Settings with "Delete everything", or by emailing us.
  • Export your data in a portable format (JSON).
  • Revoke Google access at any time at myaccount.google.com/permissions. Doing so will stop the Service from working, but won't cancel your subscription on its own — please cancel separately in Settings.

If you live in California, you also have the rights described in the California Consumer Privacy Act (CCPA), including the right to know, delete, correct, and opt out of "sale" of personal information. We do not sell your information. To exercise these rights, email us.

If you live in the EU, UK, or EEA, you have the rights described in the GDPR, including the right to lodge a complaint with your local supervisory authority. Our service is not currently directed at users in these regions, but if you choose to use it from one of them, these rights apply.

10. Security

We protect your data with:

  • TLS encryption in transit for everything.
  • Encryption at rest for all OAuth tokens and all stored email and page text (column-level encryption using a server-side key).
  • Encrypted nightly database backups.
  • Strict access controls — only the founder has production database access.
  • Two-factor authentication on every administrative account.
  • Regular review of access logs and an audit log of every Gmail read.

No system is perfectly secure. If a security incident affects your data, we will notify you by email within 72 hours of discovering it, along with what we know about the incident and what you should do.

11. Children's privacy

School Buddy is for parents and guardians of school-age children. The Service is not directed at children, and we do not knowingly collect information from anyone under 13. School emails, and the family profile you give us, inevitably contain information about children — that information is processed solely to deliver the Service to the parent, and is subject to the same retention and security rules as all other data. If you believe we have collected information from a child contrary to this policy, email us and we will delete it immediately.

12. International transfers

Our infrastructure is hosted in the United States. If you access the Service from outside the US, your information will be transferred to and processed in the US.

13. Changes to this policy

If we make material changes to this policy, we will email you at least 14 days before the changes take effect. Minor changes (typos, clarifications) we will post here and update the date at the top of this page.

14. Contact

For any privacy question, request, or complaint:

We will acknowledge within 5 business days and respond fully within 30 days.