Every household app asks for the same thing: your email, your bills, your children's names, your calendar. Most of them then hold all of it in one place, under your name, and write you a privacy policy about how much they care. We took the other route — the product is built so that most of what you would worry about, we simply never have. This page is the whole of it, in plain words.
Not values on a wall. Each one is a decision already taken in the code, and each one costs us something — which is the only reason to believe it.
GiGi asks for a postcode, and sends the weather service the outward half only — “SW1A”, an area of thousands of addresses, never “SW1A 1AA”, which is a doorstep. When GiGi searches your inbox it asks Google for subject lines and senders only, using an API mode that cannot return a message body — not fetched and discarded, never requested. The cheap version of both features would have been to take everything and filter later. We don't, because data you never held cannot leak.
Your bills, digests, calendar and history are stored against a random identifier. The only place your email address, password and recovery code exist is a separate identity vault. A dump of the content store is a pile of household admin belonging to nobody in particular. That is a deliberately awkward way to build software, and it is the single most valuable thing on this page.
GiGi reads, ranks and proposes. It has no ability to send an email, reply to a teacher, cancel a contract, move money or book anything. Every one of those is a human tap in the app, and a school scan is explicit about it: the scan reads and plans, showing you what it would create and the exact sentence it read each value from, and writes nothing at all until you tick the ones you want.
Every household has a live log of everything GiGi did with their data: every email received, every analysis, every outbound lookup, with timestamps, the purpose, and the lawful basis. Each entry hashes the one before it, so the log is verifiably append-only — we cannot quietly edit our own history. It is in the app under Your data, and it includes the deletion of your account, which is the last thing written before there is nothing left to write about.
The right-hand column is the more important one. It is a list of things GiGi could plausibly have asked for and does not.
Sign up with no email at all and we hand you a one-time recovery code instead. Then the identity vault holds a hash of a code we have never seen, and the content store holds household admin against a random id. We would have no way to tell you apart from anyone else, which is rather the point.
Anyone can write “we respect your privacy”. Here is where each claim actually lives.
The default way in is a forwarding address of your own. No account access, no OAuth, no scopes — GiGi sees the emails you chose to send it and has no idea the rest exist. Connecting Gmail is an option on top of that, not the price of entry, and it is read-only: the grant GiGi asks for cannot send, delete, label or modify anything.
They are separate functions, with separate entries in your log. A search asks Google for headers under an allow-list — sender, subject, date — and is the only thing GiGi does on its own initiative. Reading a message body and its PDF invoice happens when you press Import, and is logged as what it is. We keep those apart in the code precisely so that “GiGi only read subject lines” stays a fact we can prove rather than a habit we might drift out of.
If you connect Google, you can bring your own calendars into GiGi so the household's week is in one place. It goes one way: GiGi reads, and has no ability to add, move or delete anything in your calendar — there is no code in the product that could. You pick which calendars, one at a time, and none are read until you do; a Google account carries holidays, birthdays and whatever anyone has ever shared with it, and importing all of that would be the opposite of what GiGi is for. Turn a calendar off and everything imported from it is deleted here, not hidden.
Note that mail and calendar are separate permissions. Connecting one does not grant the other, which is why GiGi asks again rather than quietly widening what an existing connection can reach.
Extraction sends one email at a time to Claude, Anthropic's model. During the beta it runs in whichever of Anthropic's regions has room, which may be outside the EU; nothing is kept there, and it moves to an EU region as soon as one is offered. The model is not asked to transcribe a number; it is asked to find where the number is and quote the source text, and our own code re-reads the value out of that quote. It is why every figure in GiGi can show you the sentence it came from. Nothing you forward is used to train anyone's model.
Each adult in a household forwards to their own GiGi address. The email itself (or one they ticked for GiGi to read in their connected Gmail) is kept in that adult's GiGi inbox, encrypted with a key bound to them, so they can see what GiGi made of it and correct it — nobody else in the household can open it, and neither can a copied database row. It is deleted after 30 days, or 90 if they choose, and sooner whenever they delete it. What GiGi read out of it is shared with the household unless they mark it as only theirs. When they teach GiGi a sender, the rule keeps the words that stand before each value, never a value.
An adult can add GiGi to the family's Telegram group. From then on Telegram delivers each new message there to GiGi, never the history, never another chat. GiGi reads it on our server and drops it unless it carries a date, a pick-up or something to pack. Then GiGi keeps that one message, sealed, as a suggestion for the adults, until someone decides or 14 days pass. Another family's child is never looked for. A message GiGi can't read on its own may go, alone, to GiGi's AI. Everyone in the chat is told when GiGi joins: it posts one introduction. After that it writes only to ask about a plan for one of the children it could not read (“Which day is that for Ellie?”), as a reply, at most three times a day. What the question is about is kept sealed until someone answers, or for two days. Remove GiGi from the group, or in the app, and it stops.
If you connect an inbox, the refresh token is encrypted and stored in a cookie in your own browser, not in our database. We cannot read your mail while you are not there, and a breach of our infrastructure does not hand anyone your mailbox. The honest trade-off: it also means GiGi cannot check your inbox overnight on your behalf, only when you ask. We think that is the right side of the trade.
There is one exception, and it is yours to make. To spot that nobody is free for the school run before the morning digest, an adult can let GiGi keep a separate, calendar-only Google permission on our server. It covers reading calendars and nothing else — a permission that includes Gmail is refused and revoked — it is encrypted with a key bound to that adult, and turning it off revokes it at Google and deletes it here.
Your browser never talks to the weather service. Our server asks, on behalf of a postal district, with a coordinate pair rounded to about a kilometre — so no IP address of yours is exposed either. The service has no account and no API key, and receives nothing that identifies a household.
The lawful basis under UK GDPR and the EU GDPR, written the way you would say it out loud.
| What | Why we have it | Lawful basis | Kept for |
|---|---|---|---|
| Household profile | Market, currency, timezone and postal area decide what a renewal date means, when your digest arrives, and what the weather is doing at eight in the morning. | Contract — this is the service | Until you delete your account |
| Bills you confirm | Provider, amount, period and renewal date, plus the quote each was read from, so GiGi can warn you before a contract rolls over. | Contract | Until you delete the bill or the account |
| Emails you forward, or tick in Gmail | Read into structured fields, which are shared with your household unless you mark them as only yours. The email itself is kept sealed in your own GiGi inbox, encrypted with a key bound to you, so you can see what GiGi made of it; nobody else in the household can open it. | Contract | 30 days, or 90 if you choose, then deleted. You can delete one sooner |
| Rules you teach GiGi | The sender’s domain and the few words that stand before each value, never a value, so the next email from that sender is read your way without AI. | Contract | Until you delete the rule or leave the household |
| Gmail connection | An encrypted refresh token, held in a cookie in your browser rather than on our server, so GiGi can search headers when you ask. | Consent — optional, revocable | Until you disconnect; Google expires it weekly during the beta |
| Google calendars you tick | The title, date, time and location of events in a window around today, copied in so your own commitments sit alongside the rest of the household. One way: GiGi reads and never writes. | Consent — optional, per calendar, revocable | Until you untick the calendar or disconnect, then deleted |
| Overnight calendar access | Only if you turn it on: a calendar-only Google permission, sealed on our server, so GiGi can compare the adults’ calendars before the morning digest. Never Gmail. Busy times are kept as times and whose, never a meeting’s title. | Consent — optional, revocable | Until you turn it off, which also revokes it at Google |
| The Telegram family chat | Only if an adult adds GiGi to the family’s Telegram group: new messages are read on our server, and one that carries a date, a pick-up or something to pack is kept, sealed, as a suggestion. The first names of people who write, so an adult can say who is who. Counts of what was read, never what was said. | Consent — optional, revocable | A suggestion until someone decides or 14 days pass; names and counts until GiGi is removed |
| Children you add | A first name, optionally a year group and a passport expiry — so a school letter can be matched to the right child and a trip checked against a passport. | Contract, at the parent’s instruction | Until you remove the child or the account |
| Calendar items | School dates, renewals and trips, each carrying the sentence it was read from so a wrong date is correctable rather than mysterious. | Contract | Until deleted |
| Login credentials | An email and a password hash, or only a hash of a recovery code. Held in a separate identity vault, linked to your content by an opaque id. | Contract | Until account deletion |
| Processing log | The plain-language record of everything GiGi did with your data. Hash-chained, so it is verifiably append-only. | Legal obligation — accountability | For the life of the account, deleted with it |
| Product analytics | Counts of events like “a digest was opened”, against a household id. No content, no cross-site tracking, no third-party SDK. | Legitimate interest — making the product work | Aggregated, deleted with the account |
| Abuse counters | A keyed hash of the network address a sign-up, login, waitlist or contact post came from, and a count. It is what stops a script making a thousand accounts. Never the address itself, never linked to a household, and not readable back to a person even by us. | Legitimate interest — keeping the service usable for everyone | The counting window, then swept within a day |
| Session cookie | One first-party, strictly necessary cookie carrying an opaque signed token. It is what keeps you logged in. | Strictly necessary — no consent banner required | 30 days, or until you log out |
Class lists, “well done to”, quoted replies from other parents. This is the part of GiGi we are most careful about, and the part where instructing an AI to behave would not have been good enough.
The rule is enforced in code, not in a prompt. An instruction to a model is a mitigation; it is not a guarantee, and it fails silently. So GiGi is built so that the failure cannot happen:
The only names GiGi ever looks for are the children you entered. A name it does not already know is a name it cannot record. And because every value GiGi keeps carries the sentence it was read from, any sentence naming a child who is not in your household is dropped whole — on the AI path and the deterministic path alike. Nothing about them is stored, summarised or counted beyond a number: “3 mentions of other children ignored”, shown to you so you can see the rule working.
Personal parent-to-parent messages are ignored outright. GiGi is looking for a form to sign, a kit bag to pack and a date to put in a calendar — not for a conversation.
GiGi is a service for adults running a household. It is not directed at children, and children do not have accounts. A teen can be added as a member with a limited view — no finances, no approvals — at the household owner's choice.
The complete list — not the ones we think are interesting. This is generated from the running system, so it is what this deployment actually has switched on, and the same list appears inside the app.
Gmail is Google's, and Google is not EU-resident. That is why connecting an inbox is optional rather than required, why the default route into GiGi is a forwarding address that needs no account access at all, and why it is listed here whether or not you have ever used it. Transfers rely on the standard contractual clauses and Google's Data Processing Addendum. Disconnect at any time and the grant is revoked at Google, not merely forgotten by us.
A right that needs a support ticket is a right on paper. These are buttons in the app, and they work immediately.
One tap removes your household, your bills, your digests, your calendar items and your children's details, and clears the identity vault entry that links them to a login. The deletion itself is the final entry in your log, so the record of it exists for exactly as long as you can still read the log. Backups roll off within 30 days. We do not keep a “deleted” copy for analytics, because there are no analytics on your content.
You can complain to us at privacy@getgigiapp.com, and to your data protection authority — in the UK the Information Commissioner's Office, and in the EU your national supervisory authority. You do not need to go through us first.
Material changes are announced in the app and in your morning digest before they take effect, with the version and date at the top of this page updated. We will not quietly widen what GiGi collects and tell you in a footer.
A real person reads privacy@getgigiapp.com, and “why do you need that?” is a question we like getting. If the answer is that we don't need it, we will stop collecting it.
Already using GiGi? Everything on this page is visible in your own account under Your data.