Privacy Policy

Last updated: September 24, 2026. KidSift is operated by SandboxQA LLC. Questions, or a request to delete your data: hello@kidsift.ai.

This policy covers the KidSift service at kidsift.ai and app.kidsift.ai. Plain version first: KidSift reads the school and activity mail in the inbox you connect, and turns it into a daily plan for your children. We do not sell your data, we do not advertise to you, and we do not use your mail to train AI models.

What KidSift does with your mailbox

When you connect an inbox, KidSift signs in as you and reads it. The connection is opened read-only, so your unread mail stays unread: KidSift never replies, moves, deletes, or marks anything as read.

KidSift never sends from your mailbox. Your daily summary and your reminders come from KidSift's own address, hello@kidsift.ai, to you and the people you choose — so nothing we do ever appears in your Sent folder, and a message from us is always plainly from us. We write to nobody you have not added.

Google's IMAP access is granted through a single broad permission (`https://mail.google.com/`) that is worded as full access, because Google does not offer a narrower one for IMAP. The permission we are granted is wider than the use we make of it: KidSift only ever reads. You can withdraw it at any time in Setup, or from your Google Account's security settings.

Each daily run looks at recent mail — roughly the last day, a little more on Mondays. It is not a search of your whole mailbox.

What we store

We do not keep a copy of your mailbox. What we keep is what the plan is made of:

• Your account — email address, sign-in token, plan and subscription status, time zone.
• Your family — the children you add, their schools, teachers, activities, and the people you share with.
• What we derived from your mail — event titles, dates, times, locations, pack lists, schoolwork, reminders, and daily summaries.
• Identifiers of mail already processed, so the same message is not handled twice.
• Operational records — when runs happened, whether they succeeded, and errors.
• Delivery state — which reminders were sent, and web-push subscriptions if you enable lock-screen alerts.
• What you capture — the text of a flyer you photograph, paste, or forward to your capture address when one is set up (up to 2,000 characters, kept), and images KidSift takes from school mail to show your school's logo.

Message bodies fetched during a daily run are held only in memory for the length of that run and are not written to our disks. What you hand us on purpose is kept: see capture, below.

Where it lives, and who can reach it

Your family's data is stored on servers we operate in Microsoft Azure, in the central United States (Iowa). Each family's data is stored separately, and every request is scoped to a single family. Credentials — mailbox tokens, API keys — are stored in Azure Key Vault, or in access-restricted files on the server where that migration is not yet finished. Connections use TLS.

Inside SandboxQA, access is limited to the people who operate the service, and used only to keep it running or to answer a support request from you.

Who else touches it

We use a small number of processors, each for one job:

• Microsoft Azure — hosting and storage.
• Google, Microsoft, Yahoo, Apple — whichever mail provider you connect, to read your mail and send your summary.
• Google (Gemini) or OpenAI — to turn school mail into events and summaries. Relevant message text is sent to the provider to do this. We use these providers only under terms that do not permit training on your data; where a tier does not offer that, we do not use it. KidSift can also run in a local-only mode with no cloud AI at all.
• Stripe — subscriptions and payment. Stripe handles your card; we never see or store card numbers.
• Twilio — text-message reminders, if you turn them on.

We do not sell, rent, or share your personal information, and we do not disclose it to advertisers or data brokers. We may disclose information if the law requires it.

Google user data

KidSift's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely: data from your Google account is used only to provide the features described here, is never sold, is never used for advertising, is not used to train generalized AI models, and is not read by a human except with your permission, for security, to comply with the law, or where the data is aggregated and anonymized.

Your children

KidSift is for parents and guardians, not for children. We do not knowingly collect information directly from a child, and children do not have accounts. The information about your children that KidSift holds is information you gave us, or that we derived from mail already sent to you — their name, school, grade, teacher, activities, and the dates that matter to your week. It is used to build your plan and for nothing else.

Keeping it, and getting rid of it

We keep your data while your account exists. If you cancel, we keep it for 30 days so you can come back, then delete it.

You can ask us to delete everything at any time by emailing hello@kidsift.ai. We remove your account, your family's data, and your stored credentials within 30 days, and confirm when it is done. Disconnecting your inbox in Setup stops KidSift reading your mail immediately, without deleting your account.

One honest exception: encrypted backups taken before you left are not edited. They are not used to run the service and nobody reads them to look you up, but they are the one place your data outlives those 30 days. Each backup is deleted 60 days after it is written and is unrecoverable 30 days after that, so nothing survives more than 90 days from the night it was taken.

You can also ask us for a copy of what we hold, or for a correction.

Text messages

The program is KidSift SMS Reminders, operated by SandboxQA LLC. Nobody is signed up by somebody else: a parent invites a caregiver by email, and that person enters their own mobile number and agrees on a KidSift page before anything is sent to it. The messages are transactional reminders about your children's events, never marketing. Message frequency varies — typically 0–2 messages per event, and some weeks none. Message and data rates may apply. Reply HELP for help, or STOP to cancel.

We do not sell, rent, or share mobile phone numbers, SMS opt-in data, or consent records with third parties or affiliates for marketing or promotional purposes. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. A number reaches one place only — Twilio, our delivery provider — and only so a message can be delivered to it. It is never sent to an AI provider, an advertiser, or a data broker.

The consent record keeps the email address an invitation went to, the mobile number that was entered, when consent was given, and the exact wording that was on screen — that last part is what shows later what somebody actually agreed to. See the SMS opt-in details.

Cookies

KidSift sets a cookie to keep you signed in, and stores a little data in your browser to remember things like which child you were looking at. We do not use advertising or cross-site tracking cookies.

Changes

If we change this policy we will update the date at the top, and tell you in the app if the change is significant.