Privacy Policy

The Short Version

Lunch Note passes notes inside your family, so it has to store them: your names, the notes, photos and drawings you send, and what's needed to sign you in and deliver them. That's all. Only the people a note is for can see it. There are no ads, no third-party analytics, no tracking, and we never sell or share anything. Grown-ups' devices can send us anonymous usage and crash reports (below), and you can turn that off. When you delete something, it's really deleted.

What We Collect

For grown-ups and parents:

• Sign-in: your email address, if you sign in with a one-time email code, or the anonymous identifier Sign in with Apple gives us (and the email Apple shares, which can be a private relay address). We don't use passwords.
• Your name and color, as you enter them, and your family's name.
• The notes you send: their text, photos and drawings, their paper and ink, when they were sent or scheduled, reactions, and whether a note on a line has been seen.
• Your devices: each device's name, a public key it makes for signing in, and its push notification and widget push tokens, so notes can reach it.

For kids, see Children's Privacy below. We don't collect contacts, location, or anything about how you use your phone. Photos have their location and other EXIF data stripped on your device before upload, and again on our servers.

Who Can See What

• A note line is visible to exactly two people: the grown-up and the kid on it. No one else in the family can read it, including other parents. Parents can see that a line exists (who and who), never what's on it.
• The Fridge is visible to everyone in your family.
• Your name and role are visible to the members of your family.
• Nobody outside your family can see anything, or find or contact anyone in it. There's no search, no directory and no public profile. The only way in is an invite from a parent.
• Photos and drawings are only reachable through private links tied to one person and one note, which expire after 24 hours.

How We Use It

Only to run Lunch Note: to sign you in, deliver notes to the right people at the right time, and show them in the app and on your widgets. We don't rank, recommend or analyze notes or people, and we don't use anything for advertising. The only numbers we keep about the service are counts that aren't tied to any person.

Where It's Stored

Lunch Note's servers run on Cloudflare: Workers and Durable Objects run the service, D1 holds accounts and devices, and R2 holds photos and drawings. Cloudflare stores this data in the United States and serves it from its global network. Notifications are delivered through Apple's Push Notification service, and email sign-in codes are sent through our email provider, Resend. These providers process data only to provide their service to us. We don't send your data to anyone else.

How Long We Keep It

We keep your notes, photos and drawings until someone deletes them, and your account until you delete it. A photo or drawing that was uploaded but never sent is deleted after 24 hours.

Deleting Your Data

You can delete, at any time and from the app:

• A note: its author can delete it; on a line either person can; on the Fridge a parent can.
• A line (parents): deletes every note on it for both people.
• A member (parents): removing a kid or a grown-up deletes everything they have, including every line they were on.
• Your account: Settings › Delete account removes you from the family and deletes your lines, notes and files.
• Your family (parents): Settings › Delete family deletes every member, line, note, photo and drawing.

Deleting really deletes: the data is removed from our database and the files from storage, and an hourly sweep finishes anything left half done. You can also email us to ask for your data to be deleted or for a copy of it.

No Ads, No Tracking

Lunch Note shows no ads and contains no third-party analytics, ad SDKs, tracking pixels or third-party SDKs of any kind. We don't track you across apps or websites, and we never sell or share your information.

Anonymous Usage and Crash Reports

To fix bugs, Lunch Note sends anonymous reports to our own server (run by Idle Fusion on Cloudflare): crash and error reports, and, from grown-ups' devices, which screens and features are used (for example "a photo note was sent" or "the Night theme was chosen"). These reports contain the app and iOS version and a random id that changes every time the app starts. They never contain names, note text, photos, drawings, email addresses, invite or pairing codes, or anything that identifies you or your family, and they aren't linked to your account. A kid's device only ever sends crash and error reports, never usage. A grown-up can turn this off in Settings under "Share anonymous usage", which also deletes anything not yet sent. Our server uses your IP address only to limit how often reports can be sent, and doesn't store it.

Children's Privacy

Lunch Note is made for families, and kids use it with their parents' permission. A kid's account can only be created by a parent: the parent adds the kid in the app and pairs the kid's device from their own phone. By creating the account and pairing the device, the parent consents to Lunch Note storing the information below. Kids have no email, password or Apple sign-in, and can't sign up on their own.

A kid's account holds only:

• a first name or nickname, a color and an age band (under 8, 8 to 12, or 13 and up), chosen by the parent;
• the notes, photos and drawings the kid sends, and their reactions;
• their device's name, sign-in key and push notification tokens.

Kids can't be found or contacted by anyone outside their family, and can't invite anyone. They can only write on their own note lines, which a parent opens, and on the Fridge if a parent allows it. A parent can see and change a kid's settings (photos, the Fridge, quiet hours, pause) and can remove the kid at any time, which deletes everything the kid has: their lines, notes, photos and drawings.

When a kid sends a photo, it's checked on their device by Apple's Sensitive Content Analysis where it's available. If a photo is flagged, it isn't sent and never leaves the device; we never see it.

Parents can ask us to review or delete their kid's information, or to stop collecting it, by emailing support@idlefusion.com. We'll confirm you're the kid's parent before acting.

Changes to This Policy

If this policy changes, we'll update this page with the new effective date, and tell you in the app before any change that affects data we already hold.

Contact

Questions or requests about your privacy or your kid's: support@idlefusion.com.