Privacy Policy

Last updated: October 14, 2026

Magic Quilt helps families keep track of their week. To do that, Patch has to read your calendars and some of your mail. This policy says what we collect, why, who handles it, how long we keep it, and how to delete it.

The short version, in plain words: Who can see your data.

The short version

  • We do not sell your data, show you ads, or track you across other apps and websites.
  • Outside your household, your data goes only to the companies named in this policy (and only so they can run part of Magic Quilt for us), to people you choose to share with, such as the families in your carpool, and to AI apps you connect yourself.
  • Nobody at Magic Quilt can open your household through our support tools unless you turn on support access.
  • You can download your data or delete your account at any time. Deleting removes your household from our database right away.

What we collect, and why

Each kind of data below says what it is, how we get it, why we need it, who handles it, how long we keep it, and how to delete it. We do not collect your location, photos, health data, payment details, or your phone's contacts.

Your account and how you sign in

What
Your name and email address. If you sign in with Apple, Google or Microsoft, also the account ID that service gives us. A sign-in cookie on your device keeps you signed in.
How we get it
You type it, or the sign-in service sends it to us when you choose it.
Why
To create your account, sign you in, and send the emails you ask for, such as sign-in links and your Week Ahead email.
Who handles it
Apple, Google or Microsoft, whichever you sign in with. Postmark sends our email, with SendGrid as a backup if Postmark is unavailable. Railway runs our servers and database.
How long we keep it
While your account is open.
How to delete it
Delete your account (see "Deleting your data").

Your household's information

What
The people in your household and the details you add about them (names, roles, email addresses, phone numbers, and children's grades and birthdays), plus events, tasks, meals, notebook entries, school schedules, trips and carpools.
How we get it
You enter it, Patch saves it when you tell it to, or it comes from a calendar or service you connect (for example Google Calendar, Microsoft Outlook, TeamSnap, or a calendar link). If a service needs a password, we store that password encrypted.
Why
To show your family's week, send your Week Ahead email and notifications, and let Patch answer questions about it.
Who handles it
Railway stores it. Anthropic and OpenAI process it when Patch reads it to answer you (see "The AI that reads for Patch"). Postmark or SendGrid carries it when it appears in an email to you. Families you invite to a carpool see that carpool's schedule and members.
How long we keep it
While your account is open. Disconnecting a calendar stops new syncing.
How to delete it
Remove items you added, in the app or by asking Patch, disconnect a calendar in Setup under Connections, or delete your account.

Contacts

What
The address book you keep in Magic Quilt: names, email addresses, phone numbers and street addresses for people like coaches, teachers and other parents. We never read your phone's contacts.
How we get it
You add them, import a contact file, sync them from your Microsoft account if you choose, or Patch saves one from a message or a conversation.
Why
So Patch and your Week Ahead can tell you who is who, and how to reach them.
Who handles it
Railway stores them. Anthropic and OpenAI process them when Patch looks one up to answer you.
How long we keep it
While your account is open.
How to delete it
Delete a contact in the app, or delete your account.

Email you connect or forward

What
Messages from a mailbox you connect, emails you forward to Patch, and the reading choice you made when you connected the mailbox (which choice, who chose it, when, and which version of the explanation you saw).
How we get it
Patch reads a connected mailbox only after you choose how it may read it, and only in the Inbox. If you choose the first look, Patch reads only the sender, subject and date of the last 4 weeks of mail, and opens a message only when its sender or subject names one of your children, schools or clubs. The first look runs on our own servers and nothing from it is sent to an AI company. Patch can never send, change or delete anything in your mailbox.
Why
To find dates, tasks and changes in school, club and team mail, so you do not have to.
Who handles it
Microsoft or Google, who hold your mailbox. Postmark receives emails you forward to us. Anthropic reads email text to find dates and tasks (see "The AI that reads for Patch"). Railway stores what we keep.
How long we keep it
The first look: until you answer, or 7 days. The text of an email Patch read: until you have answered every suggestion from it, and 30 days at most. A copy of an email you forward: 30 days, or 90 days if something went wrong processing it, so we can fix it. The dates and tasks Patch found, and each email's sender, subject, date and a link back to it: while your account is open. Messages with nothing useful are not saved; we keep only a short note that we checked them.
How to delete it
Turn reading off for a mailbox in Setup under Connections, use "Clear email history" in Setup under Data & privacy, or delete your account.

Things you share to Magic Quilt

What
A link, some text or a PDF you send to Magic Quilt from another app with the Share button. We do not accept photos or videos.
How we get it
Only when you tap Share and choose Magic Quilt.
Why
So Patch can turn it into events or tasks in your review queue.
Who handles it
Railway stores it. Anthropic reads it to find dates and tasks.
How long we keep it
While your account is open.
How to delete it
Delete your account.

What you say to Patch

What
Your conversations with Patch, in the app or through an AI app you connect.
How we get it
You type or say it to Patch.
Why
So Patch can answer you and remember what you told it.
Who handles it
Anthropic and OpenAI process it (see "The AI that reads for Patch"). Railway stores it.
How long we keep it
While your account is open.
How to delete it
Delete your account.

AI apps you connect to Patch

What
If you connect Claude, ChatGPT or another assistant to Patch, we keep a record of the connection and of the requests it makes.
How we get it
You connect it yourself, from that app.
Why
So the assistant you chose can read and update your household through Patch.
Who handles it
What that assistant asks for goes to the company that runs it, under your own account and terms with that company, not ours.
How long we keep it
Until you disconnect it, or delete your account.
How to delete it
Disconnect it in Setup, or ask Patch to.

Push notifications

What
Your device's notification token, so we can reach that device.
How we get it
Only after you allow notifications on your iPhone.
Why
To tell you when plans for your family change.
Who handles it
Apple's Push Notification service delivers each notification. Railway stores the token.
How long we keep it
While your account is open. Signing out of the app on a device stops notifications to it.
How to delete it
Turn notifications off in the app or in your iPhone's settings, or delete your account.

Help requests and bug reports

What
What you write to us, the page you were on, and basic browser details if you use the in-app bug report.
How we get it
Only when you send a bug report or email us.
Why
To help you and fix problems.
Who handles it
Railway stores bug reports. Email to us is held by our email provider.
How long we keep it
Bug reports: while your account is open. Emails: as long as we need them to help you.
How to delete it
Delete your account, or ask us at the address below.

How you use Magic Quilt

What
Which screens you open and which features you use, with your device type. On our public pages (the home page, invitations and our policies), Google Analytics also counts visits.
How we get it
Recorded automatically while you use the app or website.
Why
To learn which features help families and which do not. Never for advertising.
Who handles it
Our own records are stored by Railway and are linked to your household. Google Analytics processes public-page visits and is not linked to your account.
How long we keep it
Our own records: while your account is open; after you delete your account we keep them only with your household replaced by a random code. Google Analytics: under its own retention settings.
How to delete it
Delete your account.

Crash and performance reports

What
Error details and timing from the app when something goes wrong or runs slowly. We remove email addresses and phone numbers first, and we do not attach your name or account.
How we get it
Sent automatically when an error happens, and for a sample of page loads.
Why
To find and fix bugs.
Who handles it
Sentry.
How long we keep it
Under Sentry's retention terms; these reports are not linked to your account.
How to delete it
Because they are not linked to you, we cannot pick yours out. Ask us if you have a concern.

Technical logs

What
Your IP address and request details, in our server logs.
How we get it
Recorded automatically by our hosting providers when your device connects.
Why
To keep the service running and secure. We do not use them to work out where you are.
Who handles it
Railway and Vercel.
How long we keep it
Under our hosting providers' log retention.
How to delete it
They expire on their own.

Who handles your data for us

These companies process data for us so Magic Quilt can work. We give each one only what it needs for its job. We use each company's standard terms; we have no special agreement with any of them. You can review each company's data processing terms on its own website, linked below. When we checked them (October 14, 2026), each said the company may use the data only to provide its service to us, must keep it confidential and secure, must hold the companies it relies on to the same rules, and must delete it when our contract ends. Their terms can change, so their own pages are the source of truth.

Services you use with your own account

Apple, Google and Microsoft are not working for us when you sign in with them or connect a calendar, mailbox or contacts. You are using your own account with that company, under your own terms with them, and we receive only what you allow. You can cancel our access in your account settings there at any time. Apple also delivers our push notifications to your iPhone, under Apple's developer terms with us.

Google Analytics

Google Analytics counts visits to our public pages (the home page, invitations and our policies). It does not receive your household's information and is not linked to your account. Google handles this visit data under its own terms; see how Google uses data from sites that use its services.

The AI that reads for Patch

Patch uses AI from two companies. Anthropic (Claude) handles most of what Patch reads and writes, including the emails it reads. OpenAI handles some request parsing. What goes to them includes your calendar, your notebook and what you say to Patch, not only mail.

We use their standard business terms. We have no special agreement with either company, and their terms can change, so their own pages are the source of truth: Anthropic's terms, how long Anthropic keeps data, and how OpenAI handles data.

When we last checked (October 13, 2026), those terms said that neither company trains its AI on what we send, and that each keeps it for up to 30 days and then deletes it, unless it is flagged for breaking their rules (Anthropic may then keep it up to 2 years) or the law requires them to keep it longer.

What we control: before an email goes to the AI, we replace email addresses, phone numbers and street addresses with placeholders. Names stay, so Patch can tell which child something is for. We delete our copy of an email's text once you have answered its suggestions, and after 30 days in any case.

People at Magic Quilt

Our support tools cannot open your household unless someone in your household turns on support access. It is off until you turn it on. It ends by itself after 3 days, or up to 14 if you choose, and you can turn it off at any time. We email every adult on the account when it is turned on, and again the first time someone looks. Even with access on, support cannot change or delete anything, see your passwords or sign in as you. Every look through our support tools is listed in Setup under Data & privacy, with who and when.

In an emergency we can open a household without your switch. That look is still listed, marked "Magic Quilt emergency access".

Support access controls our support tools, which is how anyone at Magic Quilt looks at a household day to day. It does not control our database itself: the people who run our servers could reach the database to fix an outage.

How we use your notification feedback

Today, nothing from your household is combined with other families' data. If we start learning across families, for example which kinds of changes families want to hear about right away, we will use only counts (never your messages, events, names or children's information), we will describe it in this policy before it starts, and we will learn only from data collected after that. You will be able to opt out.

Deleting your data

You can delete your account in Setup, under Danger zone. This deletes your household's account and its data for every member of the household, and removes it from our database right away. We also ask Google, Microsoft and TeamSnap to cancel our access to your accounts there. You can download a copy of your data first, in Setup under Data & privacy.

A few things stay after you delete your account:

  • Backups. Copies of our database kept for disaster recovery still hold your data until those backups expire. Backups are kept for a short, rolling period and then deleted automatically.
  • Usage records. Records of how the app was used are kept with your household replaced by a random code, so they no longer point to you.
  • The list of who looked. The record of any look by Magic Quilt at your household is kept for 2 years, so a family that has left can still ask about it. It holds who looked and when, not your household's data.
  • Copies at the companies we use. Data already sent to the companies above is deleted on their own schedules (for the AI companies, see their pages linked above).
  • Totals already counted. Deleting your account stops your household from adding to anything we learn across families from then on. Totals already calculated before you deleted are not recalculated.

You can also cancel Magic Quilt's access in your Google or Microsoft account settings at any time, and we will stop reading new data from that account straight away.

Children

Magic Quilt is for parents and other adults who run a household. Parents add information about their children, such as names, grades, birthdays and schedules, and it is handled like the rest of your household's data in this policy. If a parent adds a child's email address, that child can receive the family's Week Ahead email.

How we protect your data

All data travels over encrypted connections (HTTPS). Your Google and Microsoft sign-in tokens, and any passwords you give us for a connected service, are encrypted before we store them. Patch's servers have to read your data to work, so most of it is stored in a form our systems can read. Access to our systems is limited to the people who run them.

Data from Google

Magic Quilt's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use data from Google only to provide Magic Quilt's household features, and not for any other purpose.

Changes to this policy

We update this policy when our practices change. The date at the top shows when it last changed.

Contact

If you have questions, or want us to delete something for you, contact us at hello@getmagicquilt.com

← Back to Home