Every household app asks for the same thing: your email, your bills, your children's names, your calendar. Most of them then hold all of it in one place, under your name, and write you a privacy policy about how much they care. We took the other route — the product is built so that most of what you would worry about, we simply never have. This page is the whole of it, in plain words.
Not values on a wall. Each one is a decision already taken in the code, and each one costs us something — which is the only reason to believe it.
GiGi asks for a postcode, and sends the weather service the outward half only — “SW1A”, an area of thousands of addresses, never “SW1A 1AA”, which is a doorstep. When GiGi searches your inbox it asks Google or Microsoft for subject lines and senders only, using an API mode that cannot return a message body — not fetched and discarded, never requested. The cheap version of both features would have been to take everything and filter later. We don't, because data you never held cannot leak.
Your bills, digests, calendar and history are stored against a random identifier. The only place your email address and password exist is a separate identity vault. A dump of the content store is a pile of household admin belonging to nobody in particular. That is a deliberately awkward way to build software, and it is the single most valuable thing on this page.
GiGi reads, ranks and proposes. It has no ability to send an email, reply to a teacher, cancel a contract, move money or book anything. Every one of those is a human tap in the app, and a school scan is explicit about it: the scan reads and plans, showing you what it would create and the exact sentence it read each value from, and writes nothing at all until you tick the ones you want.
Every household has a live log of everything GiGi did with their data: every email received, every analysis, every outbound lookup, with timestamps, the purpose, and the lawful basis. Each entry hashes the one before it, so the log is verifiably append-only — we cannot quietly edit our own history. It is in the app under Your data, and it includes the deletion of your account, which is the last thing written before there is nothing left to write about.
The right-hand column is the more important one. It is a list of things GiGi could plausibly have asked for and does not.
An email is needed to sign up: it is proven with a code, it is how you log in, and it is where a link to a new password goes if you forget yours. It lives in the identity vault, apart from your household’s admin, which is kept against a random id. Two-step login (a code from an authenticator app) can be turned on under You & GiGi; its secret is sealed to you.
Anyone can write “we respect your privacy”. Here is where each claim actually lives.
The default way in is a forwarding address of your own. No account access, no OAuth, no scopes — GiGi sees the emails you chose to send it and has no idea the rest exist. Connecting Gmail or Outlook is an option on top of that, not the price of entry, and it is read-only: the grant GiGi asks for cannot send, delete, label or modify anything. For Outlook that is Microsoft's Mail.Read and Calendars.Read (GiGi never asks for an event's notes or attachments), never a permission that can write or send.
Forwarding can also run by itself without connecting anything: a filter you make in Gmail, Outlook or iCloud sends only the senders you pick to your GiGi address. GiGi guides you through it and, until you have, suggests it in your morning now and then (“Not now” waits two weeks). She never sees the filter; she keeps only that you said it is set up, and in which of the three.
They are separate functions, with separate entries in your log. A search asks Google or Microsoft for headers under an allow-list — sender, subject, date — and is the only thing GiGi does on its own initiative. Reading a message body and its PDF invoice happens when you tick it, and is logged as what it is. We keep those apart in the code precisely so that “GiGi only read subject lines” stays a fact we can prove rather than a habit we might drift out of.
If you connect Google or Outlook, you can bring your own calendars into GiGi so the household's week is in one place. It goes one way: GiGi reads, and has no ability to add, move or delete anything in your calendar — there is no code in the product that could. You pick which calendars, one at a time, and none are read until you do; a Google account carries holidays, birthdays and whatever anyone has ever shared with it, and importing all of that would be the opposite of what GiGi is for. Turn a calendar off and everything imported from it is deleted here, not hidden.
GiGi's own family calendar is a different thing: it lives in GiGi. When you ask her to put something in it (“add the dentist on Thursday at 3pm”), she reads your words on our server, by rules and with no AI, adds it, says it back and offers an Undo. Nothing goes to Google or Outlook, and your trust log says an event was added and on which day, never what it was called.
Note that mail and calendar are separate permissions. Connecting one does not grant the other, which is why GiGi asks again rather than quietly widening what an existing connection can reach.
You can also add a calendar by its link, such as a school's schedule. Such a link works like a key, so it is kept encrypted and only the name of the site it points to is shown. GiGi reads it about twice a day and sends nothing back. Remove it and everything read from it is deleted.
Extraction sends one email at a time to Claude, Anthropic's model. During the beta it runs in whichever of Anthropic's regions has room, which may be outside the EU; nothing is kept there, and it moves to an EU region as soon as one is offered. The model is not asked to transcribe a number; it is asked to find where the number is and quote the source text, and our own code re-reads the value out of that quote. It is why every figure in GiGi can show you the sentence it came from. Nothing you forward is used to train anyone's model.
Each adult in a household forwards to their own GiGi address. The email itself (or one they ticked for GiGi to read in their connected Gmail or Outlook), with any PDF it carried, is kept in that adult's GiGi inbox, encrypted with a key bound to them, so they can see what GiGi made of it and correct it — nobody else in the household can open it, and neither can a copied database row. It is deleted after 30 days, or 90 if they choose, and sooner whenever they delete it. What GiGi read out of it is shared with the household unless they mark it as only theirs. When they teach GiGi a sender, the rule keeps the words that stand before each value, never a value.
After you correct how GiGi read an email, it may ask, at most once a week, whether you would share that one email with the GiGi team, so GiGi learns to read that kind better. Only if you tap “Share this email”: its sender, subject, date and words (not its PDFs) are then sealed to the GiGi team, who can read that one email to mark the right reading, and every time they open it is written to an audit log. Nothing else of yours goes with it. You see it under You & GiGi → Privacy, can take it back there at any time (it is deleted at once), and it is deleted after twelve months in any case.
GiGi's features are switched on per household. A new one may be tried first by a small group of households who were invited and said yes; you are always told you are in such a group, see what each early feature reads, turn each on yourself, and can leave at any time. We can also pause a feature for everyone at once if it misbehaves: what it made stays, and nothing is deleted.
An adult can add GiGi to the family's Telegram group. From then on Telegram delivers each new message there to GiGi, never the history, never another chat. GiGi reads it on our server and drops it unless it carries a date, a pick-up or something to pack. Then GiGi keeps that one message, sealed, as a suggestion for the adults, until someone decides or 14 days pass. Another family's child is never looked for. A message GiGi can't read on its own may go, alone, to GiGi's AI. Everyone in the chat is told when GiGi joins: it posts one introduction. After that it writes only to ask about a plan for one of the children it could not read (“Which day is that for Ellie?”), as a reply, at most three times a day. What the question is about is kept sealed until someone answers, or for two days. And, only if your household turns on “Post your choice” (it is off until you do), GiGi can post a trip, day out or thing to buy you chose: where it is, the price as GiGi found it and where to book it, never a promo code or a child's name. GiGi shows you the exact words first and posts only when you tap Post it, once per choice. Remove GiGi from the group, or in the app, and it stops.
If you connect an inbox, Gmail or Outlook, the refresh token is encrypted and stored in a cookie in your own browser, not in our database. We cannot read your mail while you are not there, and a breach of our infrastructure does not hand anyone your mailbox. The honest trade-off: it also means GiGi cannot check your inbox overnight on your behalf, only when you ask. We think that is the right side of the trade.
There is one exception, and it is yours to make. To spot that nobody is free for the school run before the morning digest, an adult can let GiGi keep a separate, calendar-only Google permission on our server. It covers reading calendars and nothing else — a permission that includes Gmail is refused and revoked — it is encrypted with a key bound to that adult, and turning it off revokes it at Google and deletes it here. Outlook works the same way, through a separate Microsoft app that is only ever asked for calendars, so the permission we keep cannot read mail (one that can is refused). Microsoft has no way for us to revoke a single permission for a personal account, so turning it off deletes our only copy, and you can remove GiGi at Microsoft too under account.microsoft.com → Privacy → Apps and services.
Your browser never talks to the weather service. Our server asks, on behalf of a postal district, with a coordinate pair rounded to about a kilometre — so no IP address of yours is exposed either. The service has no account and no API key, and receives nothing that identifies a household.
Wherever you live, an adult can tap “Use my location” to say where home is. The browser asks your permission, then hands our server your position once, with your phone's time zone so the morning comes at seven where you are. In the UK we round it to about 100 metres, ask postcodes.io (UK open data) which postal district it is in, keep only that district, like “SW1A”, and drop the position. Anywhere else we round it to a tenth of a degree, a square of about 10 km shared by many homes, and keep only that: it is what the weather service is sent, and what a day out is searched near. No other service is told it, so GiGi does not look up a place name for it. Your privacy log says when it was used. GiGi never asks again on its own, never follows where you go, and the weather stays the weather at home until someone changes it.
What we keep and for how long, at a glance. Tap one for why we have it and the lawful basis under UK GDPR and the EU GDPR, written the way you would say it out loud.
Class lists, “well done to”, quoted replies from other parents. This is the part of GiGi we are most careful about, and the part where instructing an AI to behave would not have been good enough.
The rule is enforced in code, not in a prompt. An instruction to a model is a mitigation; it is not a guarantee, and it fails silently. So GiGi is built so that the failure cannot happen:
The only names GiGi ever looks for are the children you entered. A name it does not already know is a name it cannot record. And because every value GiGi keeps carries the sentence it was read from, any sentence naming a child who is not in your household is dropped whole — on the AI path and the deterministic path alike. Nothing about them is stored, summarised or counted beyond a number: “3 mentions of other children ignored”, shown to you so you can see the rule working.
Personal parent-to-parent messages are ignored outright. GiGi is looking for a form to sign, a kit bag to pack and a date to put in a calendar — not for a conversation.
GiGi is a service for adults running a household. It is not directed at children, and children do not have accounts. A teen can be added as a member with a limited view — no finances, no approvals — at the household owner's choice.
Household help — a nanny, a carer, a cleaner, a grandparent — can be given a login of their own. They see only the next few days of the children the owner ticks for them, the school's own days if the owner shares them, and what an adult hands them. Never a bill, an adult's calendar or anyone's mail, and they receive no digest. The owner can change or remove what they see at any time.
Some households will have GiGi through an employer. GiGi Club is the part that comes with that: your milestones, a friendly leaderboard, and your company's combined totals. The Club tab is in the app now, with your milestones and the two switches below, both off. No employer has joined yet, so nothing about you is shown to anyone at work. This is how it works when yours does, and nothing is shared until you say so.
Two switches, both off until you turn them on. “Show me on the leaderboard” and “Count my household in the company total”. They are separate, so you can be in one and not the other, and you can turn either off at any time in GiGi Club. Turned off, you leave the leaderboard at once and are left out of every total after that.
The leaderboard shows colleagues who have switched it on your first name, the initial of your surname, and how many tasks you handled this month. Never what the tasks were, never money saved or time, and nothing about your children, your bills or your mail.
The company total adds your household's count of tasks handled, and what you saved on switches you approved, to the numbers of everyone else who said yes. A total is only shown once at least ten households are in it, so no one household can be picked out of it.
Your employer sees only those totals, and only if they choose to show them to staff. Never a name, a household, or one person's savings or activity, and never who is on the leaderboard or who is in the total. Your milestones are yours alone: nobody at work sees them.
The complete list — not the ones we think are interesting. This is generated from the running system, so it is what this deployment actually has switched on, and the same list appears inside the app. Tap one for exactly what it receives.
Gmail is Google's, and Google is not EU-resident. That is why connecting an inbox is optional rather than required, why the default route into GiGi is a forwarding address that needs no account access at all, and why it is listed here whether or not you have ever used it. Transfers rely on the standard contractual clauses and Google's Data Processing Addendum. Disconnect at any time and the grant is revoked at Google, not merely forgotten by us. Outlook is Microsoft's, and your mail stays wherever Microsoft keeps your account, which may be outside the EU; it is optional on the same terms, and covered by Microsoft's Data Protection Addendum.
A right that needs a support ticket is a right on paper. These are buttons in the app, and they work immediately.
One tap removes your household, your bills, your digests, your calendar items and your children's details, and clears the identity vault entry that links them to a login. The deletion itself is the final entry in your log, so the record of it exists for exactly as long as you can still read the log. Backups roll off within 30 days. We do not keep a “deleted” copy for analytics, because there are no analytics on your content.
You can complain to us at contact@getgigiapp.com, and to your data protection authority — in the UK the Information Commissioner's Office, and in the EU your national supervisory authority. You do not need to go through us first.
Material changes are announced in the app and in your morning digest before they take effect, with the version and date at the top of this page updated. We will not quietly widen what GiGi collects and tell you in a footer.
A real person reads contact@getgigiapp.com, and “why do you need that?” is a question we like getting. If the answer is that we don't need it, we will stop collecting it.
Already using GiGi? Everything on this page is visible in your own account under Your data.