Data & Security
1. Our Promise to You
At Maxie, we treat your family's information like it's our own: safe, private, and handled with care.
We build security into every part of Maxie so you can focus on family life, not worry about data leaks.
🔍 2. How We Process Data
We collect and process personal data only for purposes that keep Maxie running smoothly:
- Managing family events, tasks, and reminders
- Syncing with connected calendars (like Google Calendar)
- Sending you notifications and updates
Our legal basis under UK GDPR:
- Contract – for the data we need to deliver Maxie's core features
- Consent – for optional features like birthdays or connected calendar data
- Legitimate Interests – for things like security monitoring and app performance improvements
🤝 3. Our Trusted Service Providers (Subprocessors)
We work with a small set of vetted providers, bound by contracts to handle data securely and only for Maxie's purposes:
| Provider | Purpose | Location & Safeguards |
|---|---|---|
| Supabase | Hosting & database | UK (London) – strong encryption |
| Google APIs | Calendar sync, notifications, place search and weather | Global – SCCs or adequacy decisions |
| Google (Gemini API) | Reading text from uploaded photos and scans | US – SCCs or adequacy decisions |
| Google document preview | Displaying PDF and Office files you open, via a temporary link | Global – SCCs or adequacy decisions |
| Anthropic (Claude) | AI event creation and answers; internal product analysis (pseudonymised) | US – SCCs or adequacy decisions |
| OpenAI | Embeddings and some AI text and image processing | US – Standard Contractual Clauses (SCCs) |
| Resend | Email delivery | US – SCCs |
| Amplitude | Product analytics (consent-based) | US |
| Sentry | Error monitoring and crash reporting | EU (Germany) |
| RevenueCat | Subscription management | US |
| Stripe | Web payment processing (card details go to Stripe, not Maxie) | Global |
| Firebase Cloud Messaging (Google) | Push notification delivery | Global |
| Lovable | Serves the Maxie web app (no family data is stored there) | See Privacy Notice |
🛡 4. Security Measures
We follow a "security by design" approach:
- Encryption – Data is encrypted at rest and in transit
- Row-Level Security (RLS) – Ensures only your family members see your data
- Access Controls – Strict limits on who can access what, with audit logs
- Private File Storage – Files are stored in secure buckets with signed URLs for temporary access
- No Public Exposure – Child-related information is never public by default
🌍 5. Data Transfers Outside the UK/EU
Our main database and file storage are in the UK (London). When we work with providers that may process data outside the UK (like Anthropic, OpenAI, Google or Resend), we rely on UK adequacy regulations where they apply, or on the ICO's International Data Transfer Agreement or UK Addendum, to make sure your data gets the same legal protection it would here. See section 6 of our Privacy Policy for details.
📬 6. Contact Us
Questions about our security or data handling?
Email privacy@maxie.family. We're happy to explain how we keep your data safe.