Back to About

Maxie's Privacy Promise

(Plain-English Version)

Hey there, fellow parent! We know you've got enough on your plate without worrying what happens to your data. Here's the short version of our privacy policy.

1. Your family's stuff stays your family's stuff.

We never sell your data. Ever.
We only collect what we need to make Maxie work for you.

2. We work with a small group of trusted helpers

We use a handful of secure services to keep your calendars ticking. They act on our instructions and only process the data needed to do their job, nothing more.

3. You're the boss of your data

Want a copy? Want us to stop using it? Just ask. We'll get it sorted, usually within a few days.

4. We guard your info like it's our own

Everything's encrypted, locked down, and watched over with security checks. We design Maxie so families can share with each other but never by accident with anyone else. Your children are precious and so is their data. We take care of it.

5. If it's gone, it's gone

Close your account and your personal data is wiped within 30 days (backups go within 35 days). We'll only keep the bare legal bits if we have to.

Need to chat about privacy? Email — we're real humans, and we'll reply.

Full, detailed policy lives just below.

Privacy Policy

1. Who We Are

Maxie ("we", "us", "our") is a privacy-first family calendar app designed for parents and carers. We're based in the United Kingdom and operate globally.

Controller (UK/EU/Canada): Noodle Labs Ltd (trading as Maxie)

Contact email: privacy@maxie.family

Postal address: Noodle Labs Ltd, 3rd Floor, 3 Hill Street, New Town, Edinburgh, EH2 3JP

Privacy Officer: E. Gordon

Supervisory authority (UK): Information Commissioner's Office, ico.org.uk

2. Who Can Use Maxie

Maxie is designed for parents — it's adult use only. You must be 18 years or older to create an account. We do not knowingly collect personal information from children under 18. If you believe we have collected information from someone under 18, please contact us so we can delete it.

3. What Data We Collect

We only collect what's needed to make Maxie work for you:

Data Category Examples Purpose
Account Info Name, email address Create and manage your account
Family Info (optional) Names, birthdays of family members Calendar events & reminders
Event Details Event title, date, time, location, prep tasks, uploaded files Populate your calendar
Device Info Browser type, IP address Security & troubleshooting
Third-Party Integration Data Google Calendar events, account identifiers (if linked) Sync and manage external calendars
Support Communications Emails, chat transcripts Resolve support queries

We do not intentionally collect special category data (such as health information). If you choose to include this, we process it only to provide the requested feature and rely on your explicit consent.

4. How We Use Your Data (Purposes & Legal Bases – UK/EU)

Purpose Legal Basis
Provide Maxie services (calendar, reminders, file storage, sync) Contract
Secure your account and prevent fraud Legitimate interests
AI event creation ("Tell Maxie AI") Contract; Explicit consent if special-category data is included
AI image parsing ("Upload a file") Contract; Explicit consent if special-category data is included
Improve and troubleshoot the service Legitimate interests
Send service messages (reminders, updates) Contract
Send marketing emails (if opted-in) Consent or soft opt-in

5. Who We Share Data With

We only share your data with trusted providers acting on our instructions:

  • Supabase – hosting, database, authentication, file storage
  • OpenAI – AI text and image event processing (see Section 9)
  • Google APIs – calendar sync when connected (see Section 8); push notification delivery via Firebase Cloud Messaging (FCM)
  • Resend – email delivery for invites, reminders, notifications
  • RevenueCat – subscription management and billing infrastructure
  • Stripe – web payment processing
  • Amplitude – product analytics and usage insights
  • Sentry – error monitoring and crash reporting
  • Anthropic (Claude) – AI-assisted internal product analysis and development tooling. User data shared for this purpose is limited to pseudonymised identifiers and aggregate engagement data. Not used for end-user-facing features.
  • Lovable – application infrastructure provider. Where AI requests are routed via Lovable's gateway, Google (Gemini API) may act as a sub-processor for those specific requests.

We do not sell or share your data for advertising purposes.

6. International Transfers

We store data in the UK/EU where possible. Where data is transferred internationally:

  • US providers certified under the EU-US Data Privacy Framework / UK-US Data Bridge are covered by that adequacy decision.
  • For others, we use Standard Contractual Clauses + UK Addendum/IDTA and conduct transfer risk assessments.
  • For NZ residents, we ensure comparable safeguards under IPP 12.

7. Your Rights

UK/EU: Access, rectify, erase, restrict, port data, object to processing, withdraw consent, complain to the ICO/EU authority.

USA (CA + others): Know/access, delete, correct, data portability, appeal decisions. We do not sell/share personal data or use sensitive personal information for additional purposes.

Australia: Access/correction, complaint to OAIC, details on cross-border disclosure.

New Zealand: Access/correction, complaint to the Privacy Commissioner.

Canada (PIPEDA & Québec Law 25): Access/correction, complain to the OPC or Québec CAI, transparency on automated decision-making (we do not use solely automated decisions with legal/significant effects).

8. Google API Disclosure

Maxie's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • Scope: read/write Google Calendar events for sync.
  • No secondary use, no unauthorised transfers, minimal retention.

9. OpenAI (AI Processing)

When you use "Tell Maxie AI" or AI-powered features:

  • The information you provide (such as event details or uploaded images) is sent to OpenAI for processing
  • OpenAI acts as a data processor on our behalf under its Data Processing Addendum
  • OpenAI does not use API data to train its models by default
  • Data may be retained briefly for abuse monitoring before deletion

We minimise the data sent and only share what is needed to provide the feature. We never use your family's data to train AI models.

10. Marketing vs Service Emails

  • Service emails (e.g., reminders, invites) are essential to providing Maxie.
  • Marketing emails are only sent with your consent or under a "soft opt-in" and can be unsubscribed from at any time.

11. Cookies & Analytics

If we use non-essential cookies/SDKs, we will request your consent (UK/EU). Essential cookies are used for security and login.

12. Retention Schedule

Data Type Retention
Account info Life of account + 24 months
Calendar content Until deleted or account closure
Audit logs 90 days
Backups 35 days
Support tickets 24 months
Marketing consent records 6 years

13. Security

We use encryption in transit and at rest, Row-Level Security, signed URL access for files, and strict access controls.

14. Changes to This Notice

We may update this notice and will notify you by email or in-app for significant changes.

15. How to Contact Us

Email: privacy@maxie.family

Postal: Noodle Labs Ltd, 3rd Floor, 3 Hill Street, New Town, Edinburgh, EH2 3JP

Complaints:

  • UK – ico.org.uk
  • EU – Your national data protection authority
  • Australia – oaic.gov.au
  • NZ – privacy.org.nz
  • Canada – priv.gc.ca / quebec.ca/en/government/departments-and-agencies/cai

Date of last update: 2nd May 2026