How we protect your family
School messages carry your children's names, classes, health notes and plans. This page explains, in plain English, what YellowBag does with them.
The short version
- We never ask for access to your email inbox. Your family gets its own YellowBag address instead.
- Your family's plan is stored in London. Only people you invite can see it.
- School emails and questions to Ask are deleted after 30 days.
- Calendar is optional. If you turn it on, we only see when you're busy, never what it is.
- No ads. We never sell your data, and we don't train AI on it.
- You can export everything, or delete your account or whole family, from Settings in the app.
Collect the least we can
First names are enough. We never ask for your child's sex or pronouns.
Delete on a timer
School emails and questions to Ask are deleted after 30 days.
No ads, no selling
We never sell your data or show ads.
Yours to take or delete
Export everything, or delete your account or whole family, in the app.
Security at a glance
What we've built to keep your family's information safe, in plain English.
No inbox access, ever
We never connect to Gmail or Outlook, so there are no inbox keys to steal. Apps that read your Gmail need Google's paid security review. We don't, because we never ask.
Encrypted everywhere
Your data is encrypted while it travels and while it's stored, with AES-256 encrypted storage.
Separate encryption for your messages
School messages and Ask chats are encrypted again with a separate key, on top of encrypted storage, so a copy of our database on its own can't be read. YellowBag can still read them to build your plan, so this isn't end-to-end encryption.
Each family walled off
Every family's data is kept apart in the database itself, and hundreds of automated tests check it on every change.
No passwords to leak
Sign in with a code we email you. There are no guest accounts, and a PIN locks the app on your phone.
Fake emails stopped
Every email is checked against the sender's SPF, DKIM and DMARC records. Spoofed or unknown senders are held for you to approve, never added on their own.
Deleted on a timer
School messages and Ask chats after 30 days, calendar busy times every night, and unconfirmed launch sign-ups after 7 days.
Busy times, never details
Only the start and end of busy times leave your phone, and only you see them unless you choose to share.
Logs without your messages
Our logs record what happened, never what your messages say.
Who we are
YellowBag is run by TRDSPC Labs Ltd, which is responsible for your data.
YellowBag is made by Third Space Labs, a trading name of TRDSPC Labs Ltd, registered in England and Wales with company number 16943234. Our registered office is 86-90 Paul Street, London, EC2A 4NE.
Under data protection law, TRDSPC Labs Ltd is the controller of the personal data described on this page.
Why we don't ask for your inbox
Reading your inbox would give us far more than school mail. So each family gets its own YellowBag address instead.
Our first plan was to connect to Gmail or Outlook and look for emails from school. We dropped it before launch, because it meant holding more of your life than we need.
Connecting your inbox would mean
- Access to every email you've ever received, not just school mail. Gmail has no narrower option.
- Long-lived keys to your inbox, stored on our servers. A breach could expose your whole mailbox.
- Far more personal data passing through us than we need.
A family address means
- We only see email sent or forwarded to your family's address.
- Nothing else in your inbox is ever seen, and there are no inbox keys to steal.
- You can replace the address at any time if it ends up in the wrong hands.
How your family address works
Give the address to school, or forward emails to it. Nothing reaches your plan from a sender you haven't trusted.
- Each family gets its own address ending in @family.yellowbag.school to give to school, or to forward emails to.
- Email from your child's school, or from senders you've trusted, goes on your plan.
- Email from anyone new waits for you to trust or block the sender. We never add it to your plan on our own.
- Email that fails standard sender checks is held with a warning and never forwarded to you.
- Password reset and login code emails, for example from your school's payment or parent app, are passed straight to you if they pass sender checks, and never stored or read by our AI. Ones that fail sender checks are dropped.
- You can also get a copy of each school email in your own inbox. Turn it off any time in Settings.
Calendar: busy times only
YellowBag can check your calendar for clashes without ever seeing what's in it.
On your phone
Work calendar
Dentist check-up
Thursday, 3:00pm to 4:00pm
Notes: bring Sam's forms
Stays on your phone. YellowBag never sees it.
What YellowBag gets
Busy
Thursday, 3:00pm to 4:00pm
Only the start and end. No title, place, people, notes, or which calendar it came from.
- Calendar is off until you turn it on.
- The app reads the calendars already on your phone, like Google, iCloud, Outlook or work, on the phone itself. It sends us only the start and end of your busy times for the next 14 days.
- Our database has no space to store anything else, and it refuses anything else we're sent.
- By default, only you can see your busy times. If you turn on “Share when I'm busy with my family”, the parents and carers in your family see only that you're busy, never what it is. Turning it off hides them again straight away.
- Past busy times are deleted every night. Turning calendar off deletes all of them.
What we keep, and for how long
The least we need to run your family's plan. School emails and Ask questions go after 30 days.
- Your account
- Your email and display name. A PIN lock stays on your phone.
- Your family
- Family name, children's first names or nicknames, school or nursery, class or year, school start and end times, and an optional photo.
- School emails sent to your family address
- The full text and attachments are deleted after 30 days, and kept longer only while something they added is still coming up. We keep a short summary and what it added to your plan.
- Screenshots, PDFs and messages you paste in
- Same as school emails. Deleted after 30 days, or later only while something they added is still coming up. Files are private to your family.
- Your plan
- Events, tasks and reminders, who added or was assigned them, and a history of moves and cancellations.
- Questions to Ask
- Private to you, and deleted after 30 days.
- Calendar busy times
- Only if you turn calendar on. Past busy times are deleted every night, and turning calendar off deletes them all.
- Notifications
- Your phone's push address. It's turned off automatically when a phone stops accepting notifications.
- Launch updates
- If you ask to hear when YellowBag launches, we keep only your email address and when you signed up. We email you once to confirm; if you don't confirm, we delete it after 7 days. Once confirmed, we keep it only to tell you when YellowBag is ready, and every email has a link that deletes it straight away.
- Invites
- Only a scrambled (hashed) version of the link, plus the invited email if you invited by email. Invites expire after 7 days.
How we use AI
AI finds the dates and tasks in a message. When it isn't sure, it asks you instead of guessing.
- Our AI only reads messages you share with YellowBag or that arrive from senders you trust.
- It adds clear, dated items for you automatically, and asks you to check anything it isn't sure about.
- We use OpenAI. Data sent to OpenAI's API isn't used to train its models.
Who can see your family's plan
Only the people you invite, and only with the role you give them.
- Owner
- Everything, including removing people and changing settings.
- Parent
- Manage the plan, approve what YellowBag found and invite carers.
- Carer
- See the plan, tick things off, mark tasks done and take a reminder or school run for themselves. Carers can't add or change items, invite people or change settings.
- Invite someone with a link or by email. Invite links are single-use, expire after 7 days and can be cancelled.
- When someone leaves or is removed, they lose access straight away. Their notifications and Ask chats for your family are deleted, and tasks assigned to them go back to unassigned.
How we keep it secure
Your family's data is encrypted, private to your family, and kept out of our logs.
- Sign in is with a code we email you. There are no passwords to leak, and no guest accounts.
- Data is encrypted in transit and at rest by our hosting and email providers.
- Every family's data is walled off at the database level, so one family can never read another's. We check this with automated tests on every change.
- Screenshots and school PDFs are stored privately and are only available to members of your family.
- Our system logs record what happened (IDs, counts and errors), not the content of your messages.
This website
No cookies, and nothing stored on your device. We only count visits.
- This website doesn't use cookies or store anything on your device, so there's no cookie banner to click through.
- We count page visits with Cloudflare Web Analytics. It doesn't use cookies or follow you to other websites, and it shows us totals, like how many people visited a page, not who you are.
- If you ask to hear when YellowBag launches, we keep your email address as described under Launch updates above.
What we never do
Some things are off the table, whatever happens.
- Read your personal inbox
- See the details of your calendar events
- Ask for your child's sex or pronouns
- Sell your data
- Show ads
- Train AI on your family's data
Companies that help run YellowBag
Your family's plan is stored in London. Trusted providers that deliver email and power our AI process some data in the US.
| Company | What they do | Where |
|---|---|---|
| Supabase | Hosts our database, files and serversLondon, UK | London, UK |
| Cloudflare | Hosts this website and counts visits to it, without cookiesUnited States | United States |
| OpenAI | Reads school messages to find dates, and answers Ask questions. Data sent to its API isn't used for trainingUnited States | United States |
| Resend | Sends and receives email, including school email to your family addressUnited States, covered by the EU-US Data Privacy Framework and standard contractual clauses | United States, covered by the EU-US Data Privacy Framework and standard contractual clauses |
| Expo, Apple and Google | Deliver push notifications. A notification can include an item's name and a child's first nameUnited States | United States |
Where a provider handles data outside the UK, the transfer is protected by the UK International Data Transfer Addendum or EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework (UK Extension).
You're in control
It's your family's information. Take it with you or delete it, whenever you like.
In the app, under Settings, you can:
- Export all of your family's data.
- Delete your account, or your whole family.
- Turn calendar sharing on or off.
- Turn each type of notification on or off.