Privacy Policy

Account and Login Information, including your email address, password, password hash, account status, invitation information, terms and privacy-policy acceptance records, and records of the date, time, and version of consents. We use this information to create and secure your account, authenticate you, provide access to your Circle, record required agreements and consents, and prevent unauthorized access.

Profile Information, including your first name, role in the Circle, avatar, and date of birth. We use this information to display your profile within your Circle, apply age and participation rules, personalize the Services, and help members understand who is participating without exposing your date of birth.

Circle Information, including your Circle membership, invitations, relationships within the Circle, Circle settings, and records of which adults may invite or authorize members. We use this information to create and administer your Circle, deliver invitations, apply member permissions, and keep family-level features operating correctly.

Tap In Information, including your daily mood selected from five levels from “Rough” to “Great” and topics selected from a fixed list, such as “Health / energy” and “Friends.” Tap In information is Consumer Health Data. We use this information, after separate consent, to show you your own Tap In history and My Pulse reflections and to calculate non-identifying family-level counts. We do not use Tap In information for advertising, profiling, or to make decisions that produce legal or similarly significant effects.

Sharing and Interaction Information, including Family Signals (“Celebrate,” “Listen,” “Space,” and “Help”), moments, mood words, fixed-phrase responses, Family Guess participation and answers, shared goals and the free-text titles and milestones you enter, and connection requests. We use this information to provide the interaction you select, show shared items to the intended Circle members, support Family Guess and shared goals, and deliver connection requests. You choose whether to share an eligible item each time.

Guardian Authorization and Consent Records, including an adult’s stated relationship to a teen, date-of-birth accuracy attestation, authorization selections, the applicable wording version, the date and time of authorization, and separate Consumer Health Data consent. We use this information to confirm the authorization pathway for teens, maintain a record of consent, apply teen permissions, and honor withdrawal requests.

Communications and Support Information, including messages you send to us, support requests, account-related correspondence, and information needed to respond to you. We use this information to answer questions, provide support, address safety or access concerns, administer the Services, and communicate service, security, and legal notices.

Feedback, Survey and Research Information, including ratings, survey responses, interviews, and other feedback you choose to provide. We use this information to understand and improve FamilyBeats, evaluate features, and conduct internal research. Participation is optional and requires separate consent where the activity is a survey, interview, recording, or other research activity. For a teen, both the teen and the parent or legal guardian must consent.

Subscription and Transaction Information, if paid plans are offered, including subscription selection, billing status, transaction identifiers, and limited payment information received from a payment processor or app store. We use this information to process adult-only subscriptions, provide paid features, administer renewals and cancellations, prevent fraud, and maintain tax and accounting records. We do not see or store full payment-card numbers. Teens are not charged and are not shown paid offers.

Marketing Preferences, including your opt-in status and email preferences. We use this information to send optional FamilyBeats marketing communications to adults who have affirmatively opted in, to honor unsubscribe requests, and to keep evidence of those choices. We do not market to teens, and marketing consent is separate from the Terms of Use, Privacy Policy, and Consumer Health Data consent.

Information Collected Automatically, including device and browser type, IP address, page address, date and time of access, hosting and application logs, occasionally including raw error text, sign-in cookies, and security counters such as failed sign-in attempts. For permitted browser push notifications, we process subscription endpoints, associated keys or identifiers and delivery information. Apple, Google or Mozilla delivery services are involved depending on the browser and platform, as described in Sections III and V. If we later offer a native mobile app, its device and notification-token processing will be disclosed before collection. We do not collect precise geolocation, contacts, photos, or device advertising identifiers. We use this information to authenticate users, keep the Services secure, troubleshoot errors, understand basic service operations, and respond to support or legal requests.

Other Circle Members. An adult may add you or a teen to a Circle and provide your first name, role, date of birth, email address, or invitation information. We use this information to send invitations, administer the Circle, apply age and authorization rules, and provide the Services.

Service Providers. A payment processor or app store may provide subscription status, transaction identifiers, or limited billing information. We use this information to administer adult subscriptions and comply with billing, tax, and accounting obligations. We do not receive or store full card numbers.

With Your Direction. We may receive information when you direct another person or service to provide it to us, such as when you ask us to respond to a support request or to process a privacy-rights request. Third-party sign-in is not currently offered. We do not obtain personal information from social-media platforms, data brokers, business partners for their own purposes, or other broad public sources.

Fulfill the reason the information was provided, including creating and maintaining your account, administering your Circle, and delivering the Services and features you request;

Verify your identity, age, authorization, and entitlement to the Services when you join, sign in, contact us, or exercise a privacy right;

Provide Tap Ins, My Pulse reflections, Family Signals, moments, mood words, fixed-phrase responses, Family Guess, goals, connection requests, and weekly “Last week together” summaries;

Communicate with you about your account, Circle activity you have elected to receive, support, security, legal notices, and material changes to this Policy;

Invite you to provide optional feedback, surveys, or research input, using separate consent where required and never requiring a teen to participate without both guardian and teen agreement;

Send optional marketing communications to adults only when they have separately opted in, and honor one-click unsubscribe requests; we do not market to teens or use their information for advertising;

Administer, maintain, and personalize the Services, including remembering your settings and keeping private information private by default;

Process adult-only subscriptions and transactions, where offered, through our payment processor or app-store provider;

Provide customer support, respond to privacy requests, and investigate access, safety, or technical concerns;

Identify and improve the Services, including by reviewing family-level counts and de-identified or aggregated information that does not name a person;

Generate the weekly “Last week together” summary and other family-level counts from all Tap Ins, including private Tap Ins, without naming anyone;

Test, enhance, update, and monitor the Services, diagnose or fix technology problems, and review hosting error information;

Help maintain the safety, security, and integrity of the Services, Circles, technology assets, and business;

Enforce our Terms of Use and other applicable terms, resolve disputes, carry out our obligations, enforce our rights, and protect users and third parties;

Prevent, investigate, or provide notice of fraud, abuse, security incidents, or unlawful or criminal activity;

Comply with contractual, legal, tax, accounting, regulatory, and other applicable obligations and requirements;

Fulfill any other purpose disclosed to you when we collect the information or for which you separately consent; and

Use personal information for another lawful purpose only where permitted by applicable law and consistent with this Policy. We do not use Tap In data for advertising, profiling, or to make decisions that produce legal or similarly significant effects.

Within Your Circle. FamilyBeats is private by default. The following visibility rules apply:

Private. Your Tap In mood, topics, Tap In history, and My Pulse reflections are visible only to you. Your parent, guardian, grandparent, and other Circle members cannot see your private Tap Ins merely because they are in your Circle.

Shared by Choice. You may choose, each time, to share a fixed Family Signal, moment, or mood word. Only the Circle members identified by the sharing screen will see the item, and FamilyBeats does not share a Tap In on your behalf.

Seen by Some. A fixed-phrase response to another member’s shared item is shown to the person who shared that item. A Family Guess round and the information shown during the round are visible to the members participating in that round, subject to the feature’s display rules; individual guesses are not otherwise published.

Seen by All. Your first name, role, and avatar are visible to Circle members. A goal you suggest or join, including the free-text title and milestones you enter, may be visible to the Circle. Do not include information in a goal title or milestone that you would not want your Circle to read.

Counts. Family-level counts and the weekly “Last week together” summary are derived from all Tap Ins, including private Tap Ins, but never name anyone or reveal a person’s mood, topic, or history. Counts are hidden until at least three Circle members are active. We may also display non-identifying goal-progress counts. After withdrawal or deletion, existing historical participation totals may remain only where they cannot reasonably be linked to an individual or reveal their participation or health information. We do not retain individual contribution links for such totals. We suppress or recompute small-group counts where context or comparison could identify an individual. A three-active-member threshold alone is not a guarantee of anonymity; withdrawn data is not used to produce new identifiable insights.

Service Providers. We disclose personal information to service providers that process it solely on our behalf and subject to applicable contractual restrictions. Railway’s published DPA is available; its execution for our account has not yet been confirmed. These providers may include Railway for hosting; a payment processor; email-delivery providers if later used; and Apple or Google app stores if a mobile application or in-app purchase is offered. We do not authorize these providers to sell the information or use it for their own advertising. Browser push notifications require your browser or device permission. Depending on the browser and platform, Apple, Google or Mozilla delivery services route notifications and may process a push-subscription endpoint, associated subscription keys or identifiers, technical delivery information and the notification payload sent to that endpoint. This delivery is distinct from downloading an app from an app store. Notification permission does not itself authorize health-data collection, Circle sharing, marketing or future AI features. Private Tap In moods, topics and My Pulse reflections are not disclosed through notifications. Notification alerts may be visible on a shared device or lock screen; use your browser and device controls to manage permission and display.

Room for Tomorrow Personnel. Authorized Room for Tomorrow personnel may access personal information only as needed to operate, secure, support, maintain, or improve FamilyBeats, respond to a request, or comply with law. Founder or operator access is limited, subject to confidentiality obligations. Railway logs administrative workspace activity; not every access to personal information has been verified as logged.

Business Transfers. We may disclose personal information in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction. Any successor or transferee will be required to honor this Policy and the protections applicable to Consumer Health Data, and we will provide notice to users before or promptly after the transfer as required by law.

Legal Obligations and Rights: We may disclose personal information to legal advisors, courts, regulators, law enforcement, or other third parties:

in connection with the establishment, exercise, or defense of legal claims;

to comply with laws or to respond to lawful requests, legal process, subpoenas, or court orders;

to protect our rights and property and the rights and property of others, including to enforce our agreements and policies;

to detect, suppress, or prevent fraud, abuse, or security incidents;

to protect the health and safety of us and others; or as otherwise required by applicable law.

With Your Consent. We may disclose personal information to a person or third party at your direction or with your consent. We will not use a teen’s testimonial, quote, image, or story publicly without separate consent from both the teen and the teen’s parent or legal guardian. We do not disclose Consumer Health Data to a third party for a new purpose without the separate consent required by applicable law.

Cookie details: fp_session; first-party, strictly necessary authentication cookie; purpose: maintain user login sessions; maximum duration: 30 days, subject to earlier logout or expiration. Blocking or deleting it may prevent sign-in or end a session. We will update these disclosures and obtain any required consent before introducing non-essential tracking.

Sharing Choices. FamilyBeats asks you each time before sharing an eligible Family Signal, moment, or mood word. You may decline to share. Your private Tap Ins and My Pulse reflections remain private unless the product expressly tells you otherwise and you choose to share.

Device Permissions. The current web application asks for browser push permission. You may grant, deny or withdraw it through your browser or device settings. Any future native mobile permissions will be disclosed separately. FamilyBeats does not require contacts, photos, precise location, or advertising identifiers.

Email Communications Preferences. You can stop optional marketing emails by clicking the one-click unsubscribe link in the message. You cannot unsubscribe from service-related communications such as account verification, security notices, transaction confirmations, legal notices, or messages needed to provide the Services.

Push Notifications. You can stop browser push notifications through your browser or device notification settings and any FamilyBeats control made available. Denying notification permission does not withdraw health-data consent or request account deletion; those choices remain separately available. Notifications are optional and are not used to disclose private Tap In moods, topics or My Pulse reflections. A Circle-activity alert is not a safety or emergency-monitoring alert.

Deleting Your Account.

Email privacy@roomfortomorrow.com from your account email address to request deletion. We will verify the request using secure account or email verification, including a one-time code where needed, and proportionate verification of any representative’s legal authority. We aim to acknowledge the request within 2 business days and delete live account data within 7 days after verification.

Existing backup copies expire under the lifecycle described in the Privacy Policy, rather than being individually edited. Backup retention is measured from backup creation, not from verification of a deletion request. Legacy monthly backups expire on their existing schedule. These backup periods are separate from live-system deletion and the retention of logs and consent/request records; they are not an overall deadline for erasing every retained record. Infrastructure logs and narrowly retained consent/request records follow their separate schedules. We will explain the action taken and any remaining backup retention when responding to the request. Hosting logs follow the retention described in Section VI.

Teens may request deletion of their own accounts without parent or guardian permission. Requests on a teen’s behalf require verification of the requester’s identity and legal authority, not solely the original authorizer’s email address. Deletion removes the account, member profile, and sign-in records; Tap Ins and shares; responses the person gave and responses others left on their shares; Family Guess entries and the rounds about them; connection requests; unused pending invitations; saved AI insights, if any. Authorization and consent records are retained while the teen’s account exists plus 3 years solely as proof of authorization and consent, under Section VI.

Goal titles and milestones a teen authored are deleted with the teen’s account, and an adult’s are deleted on request. We cannot delete the last adult admin of a Circle while other members remain; another adult must remain or the other members must be deleted first, and deleting the last member also deletes the Circle.

We keep a request log recording the dates a request was received, verified, and completed for 24 months, with no Tap In content. You may use authenticated account controls made available in FamilyBeats or email privacy@roomfortomorrow.com. We verify identity and, for a representative, legal authority using information reasonably necessary for the request. An authenticated in-app action may provide verification; an additional code is used where needed for security. A teen may act for themselves without guardian approval. During the private pilot, authorized Room for Tomorrow personnel handle privacy requests, appeals, guardian verification and re-authorization through a documented email-based process. You do not need an automated in-app workflow to submit a request. The product enforces the applicable access restrictions while personnel record and carry out the verified decision. General support may direct a privacy request to privacy@roomfortomorrow.com without requiring you to submit it again. We record receipt, verification, the decision, action and response, and explain any refusal and the available appeal process. A completion response identifies what was deleted and explains any narrowly retained records or backup copies; it does not state that every retained copy has been erased if permitted copies remain. An eligible authorizing adult must be at least 18 and be the teen’s parent or legal guardian with current legal authority to authorize participation. We consider relevant custody or guardianship restrictions; Circle-admin or grandparent status alone is insufficient. We ordinarily use the recorded relationship and authority attestation with secure account or email verification, and request additional evidence reasonably necessary where authority is unclear or disputed. Possession of an email account or a prior consent record alone does not resolve a genuine dispute over current legal authority. We record the verification method, outcome and authority basis alongside the consent. We do not routinely retain full identity documents or court records; where supporting evidence is needed, we seek relevant redacted information and retain it only as long as reasonably necessary. Consent and authorization evidence follows the consent-record schedule, while request-handling logs follow the separate 24-month schedule; neither is used to retain Tap In content.

A parent or legal guardian with verified legal authority may act on the teen’s behalf even if not the original authorizer. Circle-admin or grandparent status alone is insufficient; relevant custody restrictions are respected. Authorization does not itself give access to private Tap Ins. Deletion of Tap In health data also removes replies linked to deleted health items where needed to remove their context, and deletes or regenerates identifiable insights derived from that information. Unrelated content belonging to other members is not automatically deleted. AI-derived insights are addressed only if an AI feature is subsequently introduced under the required separate consents. This includes copies that remain in shared goals; removing only the author’s name is not sufficient where the text remains personal information. Whole-account deletion removes the departing member’s own replies, including replies they left on another member’s shares, as described in the account-deletion provisions. Withdrawal or deletion of Tap In health data alone removes replies that contain or are linked to the affected health information where needed to remove that context; it does not automatically delete the member’s unrelated replies or other members’ independent content. Identifiable Circle text or other derivatives based on deleted health information are deleted or regenerated without the withdrawn information. AI-generated Circle text is a prospective case only: AI remains off and this language does not authorize enabling it without the required separate disclosures and consents.

Withdrawing Consent.

You may withdraw separate consent, including Consumer Health Data consent, by emailing privacy@roomfortomorrow.com. Withdrawal stops the affected collection or feature. For Tap Ins, we will stop collecting further Tap In information and delete existing Consumer Health Data under this Policy and the Consumer Health Data Privacy Policy.

A guardian may withdraw authorization for a teen; the teen’s account will be paused within 1 business day after verification and deleted 30 days after the pause unless another eligible parent or legal guardian re-authorizes the teen, subject to the separate record-retention periods in Section VI. These deadlines concern live systems; existing backup copies expire under the separate backup lifecycle in the Privacy Policy. Withdrawal of Tap In health-data consent stops further collection and sharing of the affected information. After verification, we initiate deletion of existing identifiable Tap In moods and topics, related shared health items and identifiable derivatives under the disclosed deletion schedule; no second deletion request is required. This does not itself delete your whole account. The 30-day guardian re-authorization window applies to withdrawal of authorization to use FamilyBeats, not to withdrawal of Tap In health-data consent. To restart Tap In collection after withdrawal, a teen and an eligible parent or legal guardian must each give fresh, separate affirmative consent to the current disclosures. Neither person’s renewed consent overrides the other’s refusal. New consent records include the actor, scope, date, time and wording version and are appended without erasing withdrawal history. Collection resumes only after all required consents are valid. Renewed consent does not restore deleted Tap Ins from backups or automatically republish hidden shares; sharing requires a fresh choice. During the pilot, re-authorization may be completed through privacy@roomfortomorrow.com with supervised verification and recorded affirmative agreements. The teen remains signed out and unable to sign in until current guardian authority and all required guardian and teen agreements are valid. Re-authorization must be completed within the 30-day window; merely sending an inquiry does not extend it. If it is not completed in time, live account data is deleted at the end of the window under the disclosed policy, with backups and limited records following their separate schedules. A teen’s refusal cannot be overridden by a guardian’s request to resume participation.

Retention Schedule.

Account, profile, Circle, Tap In, Sharing and Interaction Information: while the account is active; inactive accounts are deleted after 24 months of inactivity following at least 30 days’ notice.

Paused teen accounts: the 30-day re-authorization window remains as described in Section VII; live data is deleted at its end if no eligible adult re-authorizes. Backup copies then expire separately. Daily volume backups are retained for 6 days and weekly volume backups for 27 days from creation. New monthly backups are disabled. Previously created monthly backups may remain until their scheduled expiration. Information deleted from live systems may remain in existing backups until those backups expire. Backups are retained for reliability and disaster recovery, not ordinary account use. If a backup is restored, we will reapply applicable deletions before resuming ordinary processing. Backup storage locations have not yet been independently confirmed.

Railway Pro provides 30-day infrastructure log history for application/deployment logs, HTTP network logs and workspace audit logs. Network logs include request timestamps, HTTP methods, URL paths, response status codes and request durations; URL paths may contain invitation identifiers. Workspace audit logs record administrative events, including SSH authentication and backup creation. These logs support reliability, security and troubleshooting, not advertising or behavioral profiling. This infrastructure history is distinct from application records and their retention schedules; all application-level logging and retention mechanisms have not yet been verified.

Subscription and transaction records: up to 7 years where needed for tax or accounting purposes. Guardian authorization, Teen Privacy Notice acknowledgment, and other consent records for a teen: while the teen’s account exists plus 3 years, solely as proof of authorization and consent. Other consent records: while the relevant account exists plus 3 years.

Deletion-request logs: 24 months and no Tap In content. Marketing consent and unsubscribe records: as long as marketing occurs plus 3 years.

Feedback and survey information: 12 months unless a separately disclosed research period applies. Count-only reports: 12 months after the applicable pilot ends or sooner.

During the pilot, each family’s free evaluation lasts 14 days, and an adult must affirmatively opt in to continue (for a teen, the guardian confirms and the teen agrees) after a reminder sent at least 7 days before day 14. If a family does not respond, we retain its data unused for a 90-day recovery period and then delete it from live systems within 30 days, with existing backups expiring separately; if a family declines, we delete its data from live systems within 30 days, with existing backups expiring separately. Other pilot-specific rules are in Section 4 of the consolidated Terms of Use. During the pilot, reminders and continuation choices may be communicated and recorded by email through a supervised process. If an adult wants to continue but the teen declines, the teen does not continue: access and further collection are stopped, and the teen’s live data is deleted within the disclosed 30-day pilot-decline period unless the teen requests earlier deletion under the 7-day verified-request target. Eligible adults and other participating members may continue their own use; the teen’s refusal does not require deleting unrelated family information or closing the entire Circle. For nonresponding families, access is suspended during the 90-day recovery period except as needed to exercise privacy rights or request recovery. Information is retained unused, with no new Tap Ins, sharing or ordinary processing. Recovery requires a documented affirmative continuation decision and, for a teen, both current guardian authorization and the teen’s agreement; silence or the adult’s decision alone is insufficient.

When information is no longer needed, we delete it or de-identify it. If deletion from a backup is not immediately possible, the backup is encrypted, isolated from further processing, and allowed to expire under the daily 6-day and weekly 27-day lifecycle, with legacy monthly copies expiring on their existing schedule. A deletion request does not require us to delete information we must retain by law, but retained information will be isolated and used only for the required purpose. Before we enable any new data category, including AI, written notes, analytics, or future native mobile push tokens, we will review and update this Policy before collection or use begins, and we review this Policy at least annually.

Teen Rights. A teen may use FamilyBeats subject to the authorization rules, request access or deletion of the teen’s own account, withdraw the teen’s separate agreement, and ask questions about the Teen Privacy Notice.

Guardian Rights and Limits. A parent or legal guardian may withdraw authorization or request deletion of the teen’s account, but authorization does not give the guardian access to the teen’s private Tap Ins or My Pulse. The guardian may receive service and safety notices required by law or needed to administer the authorization.

Turning 18. When a teen turns 18, we will ask them to accept the Terms of Use as an adult, and the account may continue subject to the adult terms then in effect. The former guardian’s access does not expand automatically. Consent and authorization records are retained under Section VI, and the user may update profile information, withdraw consent, or request deletion.

Paused Teens. If the authorizing adult withdraws authorization, leaves the Circle, or has their account deleted, we pause the teen’s account, sign out active sessions, and prevent sign-in. We notify Circle adults as appropriate. The teen’s live account and data are deleted when the 30-day re-authorization window ends unless another eligible parent or legal guardian re-authorizes the teen. The authorization record (the departed adult’s stated relationship, wording version, date, and former account identifier, with no name or email) is retained as proof of authorization and consent while the teen’s account exists plus 3 years under Section VI, with the link to the departed adult cleared, and re-authorization adds a new record without overwriting prior history. These deadlines concern live systems; existing backup copies expire under the separate backup lifecycle in the Privacy Policy.

Teen Safety and Visibility. Family-level counts may include a teen’s private Tap Ins, but counts never name a teen or reveal a teen’s mood, topic, or history and remain hidden until at least three Circle members are active. Goal titles and milestones a teen authors are visible to the Circle while active and are deleted with the teen’s account, subject to the deletion schedule.

Optional Teen Features. We will not enable written notes, AI-assisted features, or product analytics for a teen unless the parent or legal guardian and the teen separately receive the required disclosures and opt in. No teen information is currently sent to an AI service.

Under-13 Discovery and COPPA. Because FamilyBeats is limited to users ages 13 and older and is not directed to children under 13, the Children’s Online Privacy Protection Act is not intended to apply to ordinary FamilyBeats use. We nevertheless follow the under-13 suspension and deletion protocol above if we learn of an under-13 account.

Teen Communications. Service, security, legal, and account communications may be sent to the teen or the adult as needed. We do not send promotional marketing or paid offers to teens.

Guardian and Teen Support. Questions about a teen’s privacy, authorization, or deletion may be sent to privacy@roomfortomorrow.com. We may verify the requester and will use information provided in connection with the request only to process it.

We do not knowingly sell, share for targeted advertising, or otherwise commercially exploit personal information of teens or children under 13.

FamilyBeats treats Tap In moods, Tap In topics, shared mood words and Family Signals, My Pulse reflections, and information derived from Tap Ins as Consumer Health Data because it may reveal physical, mental, or emotional wellbeing.

We do not collect precise location, biometric data, medical records, diagnoses, or treatment information. Written notes are currently off. Our separate Consumer Health Data Privacy Policy supplements this Policy, applies to every FamilyBeats participant in the United States, and is written to meet laws such as Washington’s My Health My Data Act, Nevada’s consumer health data law, and Connecticut’s consumer health data provisions. It explains the categories, sources, purposes, consent, sharing, rights, and deletion rules that apply to this information. If this Privacy Policy conflicts with that policy regarding Consumer Health Data, the Consumer Health Data Privacy Policy controls.

We collect Consumer Health Data only after separate consent.

Adults consent for themselves.

For teens, the parent or legal guardian consents and the teen separately agrees.

Each consent is separate from your acceptance of the Terms of Use and this Privacy Policy and is recorded with its date, time, and version.

We use Consumer Health Data only to show you your Tap In history and My Pulse page, to show your Circle only what you choose to share, to calculate family-level counts that never identify anyone, to produce count-only internal reports, and to keep the Services secure and respond to your requests; we do not use it for advertising, profiling, or sale.

We do not sell Consumer Health Data or share it except with processors described in this Policy, currently Railway for hosting; its DPA execution is being confirmed. Additional processors will be disclosed and bound by required written restrictions before receiving consumer health data.

Requests to access, delete, or withdraw consent cover live data, backups, and processors subject to the timelines below.

We do not currently use any AI service to analyze your data. If we introduce one, we will send Consumer Health Data to an AI provider only after your separate opt-in consent naming the provider and the purpose, and only under a written agreement that bars the provider from using the data to train any model and limits retention to what is necessary to provide the feature. If we add another processor that will receive Consumer Health Data, we will name it in this Policy before using it.

You may confirm whether we collect, share, or sell your Consumer Health Data, obtain a list of the third parties and processors with which we have shared it (currently “Railway”) and how to contact them, and appeal if we decline a request by replying with “Appeal” in the subject line; we will respond within 45 days, and if you are not satisfied you may contact your state Attorney General. We respond to requests within 30 days after verification; deletion from live systems and expiration of backup copies are separate processes described in Sections V and VI.

We may disclose information if required by law, such as a valid subpoena or court order, and where the law allows we will tell the affected person first. We will notify you before making a material change to our handling of Consumer Health Data and will ask for your consent again before collecting or using it in a materially different way.

We maintain administrative, technical, and physical safeguards appropriate to the nature of FamilyBeats information. These include salted password hashing; HTTPS and HSTS; the HttpOnly, Secure, SameSite=Lax fp_session authentication cookie; server-enforced separation between Circles; access controls and confidentiality obligations; Railway workspace audit logging for administrative activity; Railway persistent volumes and volume backups which Railway states use AES-256 encryption at rest with Railway-managed keys; security headers; monitoring for failed sign-in attempts; and procedures for deletion, age screening, consent withdrawal, and incident response. GitHub stores our code but not user data. We self-host fonts. Railway hosts the Services. Its published DPA describes processor restrictions; applicability and execution for our account are being confirmed.

We review and limit access to personal information based on role and need, and we use logging and operational controls to investigate inappropriate access. No method of transmission or storage is completely secure. You should use a unique password, protect your sign-in information, and contact us promptly at privacy@roomfortomorrow.com if you believe your account or information has been compromised.

Security Incidents. We assess suspected incidents within 24 hours, contain them, preserve relevant records, document the incident and our decisions, and determine whether notice is required. If an incident affects your personal information, we will notify affected individuals and, for teens, their parent or legal guardian, and regulators as required by applicable law and without unreasonable delay. We will assess applicable state breach-notification requirements and the FTC Health Breach Notification Rule where relevant.

Privacy inquiries, rights requests, deletion, consent withdrawal and concerns about personal-data security: privacy@roomfortomorrow.com.

General customer support: support@roomfortomorrow.com.

Neither address is an emergency service.

Right of access. You may have the right to obtain confirmation of whether we process your personal information, the categories and purposes of processing, retention information, categories of recipients, and a copy of the personal information we hold about you.

confirmation of whether, and where, we are processing your personal information;

information about the categories of personal information we process, our purposes, and how we determine retention periods;

information about the categories of recipients with whom we may share your personal information; and

a copy of the personal information we hold about you.

Right of portability. You may have the right, in certain circumstances, to receive a copy of personal information you provided in a structured, commonly used, machine-readable format or request that it be transferred to another person.

Right to correction. You may have the right to request correction of inaccurate or incomplete personal information.

Right to deletion. You may have the right, in some circumstances, to request deletion or erasure of personal information, including Consumer Health Data, subject to legal exceptions.

Right to restriction. You may have the right, in some circumstances, to limit the purposes for which we process personal information, including sensitive personal information.

Right to opt out of selling, sharing, and targeted advertising. You may have this right where applicable. FamilyBeats does not sell personal information, share it for cross-context behavioral advertising, or engage in targeted advertising, including with respect to minors.

Right to control automated decision-making and profiling. You may have the right to request that we not use automated decision-making or profiling for certain purposes. We do not use Tap In data for profiling or for decisions that produce legal or similarly significant effects.

Right to withdraw consent. If you have provided consent, you may have the right to withdraw it. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to appeal. If we decline to act on a request, you may have the right to appeal. If an appeal is denied, you may have the right to submit a complaint to your state attorney general using the links below.

California Residents: You may contact the California Attorney General.

Washington Residents: You may contact the Washington Attorney General.

Nevada Residents: You may contact the Nevada Attorney General.

Colorado and Connecticut Residents: You may contact the respective Attorney General in Colorado and Connecticut .

Montana, Oregon, and Texas Residents: You may contact the respective Attorney General’s office in Montana, Oregon and Texas.

Utah and Virginia Residents: In Utah, privacy complaints go to the Division of Consumer Protection, and Virginia Residents may contact the Attorney General.

Right to nondiscrimination. You have the right not to receive retaliatory or discriminatory treatment in connection with exercising the rights described above. We will not deny goods or services, charge different prices, or provide a different level or quality of service because you exercised a privacy right, except as permitted by law.

Use the cookie controls described in Section IV to manage first-party cookies. A Global Privacy Control signal is sent through a supporting browser or browser extension; or

Email us at privacy@roomfortomorrow.com to make an access, correction, portability, deletion, restriction, consent-withdrawal, or appeal request.

Identifiers, such as your name, email address, account identifier, invitation identifier, and online identifiers.

California Customer Records, such as your email address and other contact information you provide for account or support purposes.

Characteristics of protected classifications under state or federal law, such as age and date of birth. We do not require gender, race, ethnicity, or other protected-classification information for FamilyBeats.

Commercial information, such as subscription selection, transaction identifiers, billing status, and purchasing history if paid plans are offered.

Internet or other electronic network information, such as IP address, browser and device information, page address, sign-in cookie information, security counters, and hosting logs.

Geolocation data. We do not intentionally collect precise geolocation. An IP address or hosting log may permit an approximate location to be inferred, subject to the service provider’s logging practices.

Sensitive Personal Information, including account login credentials, Consumer Health Data such as mental or emotional wellbeing self-reports in Tap Ins, and personal information of consumers under 16 where applicable.

Other personal information, including Circle information, sharing and interaction information, goal titles and milestones, guardian authorization records, communications, support requests, feedback, and survey information.

Inferences. We do not create individual profiles or inferences beyond non-identifying family-level counts derived from Tap Ins.

Consumer Health Data is treated as Sensitive Personal Information for purposes of these disclosures. We do not use or disclose it beyond the purposes permitted by this Policy and applicable law.

service providers and processors, including Railway for hosting, browser push delivery services provided by Apple, Google or Mozilla depending on the browser or platform, and any future email-delivery providers, payment processors or app stores, subject to applicable contractual restrictions, with Railway DPA execution being confirmed;

authorized Room for Tomorrow personnel and professional advisors who need access for operations, security, support, compliance, or legal purposes;

courts, regulators, law enforcement, and other recipients when required or permitted for legal obligations, claims, rights protection, fraud prevention, or safety;

other persons or entities at your direction or with your consent;

a successor or transaction counterparty in a merger, acquisition, reorganization, financing, bankruptcy, or sale of assets, subject to Section III; and

no ad network, marketing provider, data broker, social network, or business partner receiving information for its own advertising or commercial purposes.

Retention by category. Identifiers, account and profile information, Circle information, Tap In and other Consumer Health Data, sharing and interaction information, and consent records are retained as described in Section VI.

Subscription and transaction information may be retained for up to 7 years where needed for tax or accounting purposes.

Hosting logs and deletion-request logs are retained under the separate periods described in Section VI and do not authorize advertising or sale.