In short: your family’s calendar, to-dos, notes and letters are encrypted on your phones before anything is synced, so we can’t read them. Letters are read by Anthropic’s AI using your own API key, only when you ask. There are no ads, no analytics and nothing is sold.
TribePlan is run by Silvano Cacchione, trading as TribePlan, an individual based in the United Kingdom, who is the data controller for the small amount of personal data the service handles. Contact: [email protected].
Everything you see in the app lives on your phone: calendar events, to-dos, knowledge, the original photos and PDFs of letters, chat history, and settings such as the child’s name, school and your family picture. Secrets (encryption keys, your Anthropic API key, an app PIN if you set one) are kept in the phone’s secure keychain and are not included in device backups to other phones.
Like other app data on iPhone, the app’s files may be included in your own iCloud or computer backups, under Apple’s terms.
To share a calendar between your family’s phones, each phone sends end-to-end encrypted copies of its records to our sync server. The server cannot decrypt them. It stores:
It does not store names, email addresses, phone numbers or the content of anything you write. There are no accounts or passwords.
Connections reach the server through Cloudflare, which handles the internet connection and can see technical details such as your IP address and when requests are made, but not the encrypted content. Our server keeps IP addresses briefly in memory to limit misuse, and does not log them to disk.
When you ask TribePlan to read a letter or use the chat, your phone sends that letter or question, with the relevant calendar details, directly to Anthropic using your own Anthropic API key. This does not pass through our server. Anthropic processes it under its own terms and privacy policy, and the usage is billed to the Anthropic account the key belongs to. If you share your key with your family, it travels to their phones end-to-end encrypted.
| Service | What it receives | Why |
|---|---|---|
| MET Norway | A rounded location for your town (about 1 km) | Weather forecast |
| postcodes.io | The town name or postcode area you type | Finding the location for the weather |
| GOV.UK | A request for the public bank holiday list | Showing bank holidays |
| Apple (TestFlight) | Crash reports and feedback you choose to send | Testing the app |
| Cloudflare | Connection details for sync and email to our support address | Running the service |
We use no advertising, analytics or tracking tools.
TribePlan is used by parents and carers. It holds what they choose to enter about their children, such as a name, school and school events. That information stays on the family’s phones and is encrypted when synced. The app is not intended for use by children.
We process the limited data our server holds because it is necessary to provide the service you asked for (performance of a contract), and to keep the service secure (legitimate interests).
Under UK data protection law you can ask for access to, correction of or deletion of your personal data, object to processing, and complain to the Information Commissioner’s Office (ico.org.uk). Because the server can’t read your family’s content, most of these are exercised directly in the app; for anything else, email [email protected].
Our sync server is in the United Kingdom. Cloudflare and Anthropic may process data in other countries under their own safeguards.
If this policy changes, we’ll update the date above and, for significant changes, mention it in the app. See also our terms of use.