Privacy Policy

Information you add

Dearest stores the family-space name, member display names, plans, tasks, notes, optional locations, selected place addresses and coordinates, dates, and assignments. Photos you attach to a note, event, or list item are stored with that item and can be viewed by members of the family space. Dearest preserves embedded image metadata when it prepares an uploaded photo. Depending on the original file, that metadata can include capture time, device information, descriptions, color profiles, and precise location coordinates. PDFs you upload are stored with the family space before they are processed, so the original remains available if reading or plan creation fails. Photos and pasted text used for an AI import are processed to prepare its reviewable draft. A source photo is kept with the resulting item only when that attachment appears in the draft you approve. If you forward an email to Dearest's shared planning address, Dearest temporarily stores its subject, readable text, and attachment names while making a reviewable draft. A valid email address is required to create a family space. Members who join through a shared family link can join without providing an email address; a personal email invitation uses the address to which it was sent. Dearest also stores an email address when you verify it or request a login link. Expired, used, and revoked invitation records are removed on a rolling basis.

When you type at least three characters in a location field, Dearest may send that location search text through its server to the configured search provider, currently Photon by Komoot or Geoapify, so it can suggest addresses and public places from OpenStreetMap data. When available, the search may also use a coarse area hint, rounded to roughly one kilometer, from a previously selected schedule or list location. Item titles, notes, account cookies, and your browser IP address are not forwarded with the search. Choosing a result stores its formatted address, coordinates, provider, and provider identifier with the item. You can always keep a location as free-form text instead.

Trip photos and maps are enabled by default and can be turned off on each device in Settings. When enabled, Dearest may look up an itinerary item's optional location on English Wikipedia and Wikimedia Commons. Only that location field is used for the lookup, never the item title or notes. Dearest screens out text that resembles a home or street address, contact detail, school, clinic, or another private or ambiguous place. This reduces disclosure risk but cannot classify every place perfectly. A place selected from location search uses its saved coordinates on the map; its saved formatted address and coordinates are not part of the Wikimedia lookup. Matching article coordinates, image source, author, and license details may be cached with the item. On the web, opening the map loads tiles from OpenStreetMap; those requests reveal your IP address, the viewed map area, and Dearest as the referring site to the OpenStreetMap Foundation.

Please do not add highly sensitive information such as financial account numbers, government identification numbers, passwords, or medical records.

The iPhone app keeps its sign-in cookie in a private App Group so the app, its Share Extension, and its widgets can access the family space you signed in to. The Share Extension can keep selected photos and a reviewable draft in a protected on-device inbox until you import or delete them. The agenda widget keeps a minimal last-good schedule snapshot on the device so it can remain useful offline. These records stay inside the app's private storage and are scoped to the matching family and member. Signing out clears the private sign-in cookie; queued shares can be deleted from the app.

If you enable iPhone notifications, Dearest stores the Apple push token, time zone, app and build versions, and notification preferences needed to deliver and troubleshoot those alerts. When you use the microphone in Ask Dearest, Apple's Speech framework turns audio into a draft transcript. Dearest requires on-device recognition when the iPhone supports it; otherwise iOS may use Apple's speech service. Dearest does not send or store the raw microphone audio on its servers. The transcript is sent as Ask text only if you choose to submit it.

How the information is used

We use the information to provide the planner, keep family members in sync, create requested AI drafts, answer questions from saved plans, prepare changes you explicitly ask to add, send recovery and welcome links, and send optional Sunday summaries or day-of reminders you choose in Settings. AI-proposed plans, imports, and changes are not saved until you confirm them. Email preferences are off until you turn them on. Note photos are not sent to an AI service unless you separately choose to use that photo in an AI-powered import.

Service providers

Dearest uses Vercel for hosting and performance measurement, Supabase for the database, Replicate for requested AI processing, and Resend for transactional email. Wikimedia provides optional public-place articles, map coordinates, and freely reusable photos for trip items; loading a thumbnail requests it from Wikimedia. Photon by Komoot or Geoapify provides optional location suggestions using OpenStreetMap data. The OpenStreetMap Foundation provides optional web map tiles. Apple provides push notification delivery, the iOS Speech framework, map tiles in the iPhone app, and Apple Maps for places you choose to open. The first four providers process data on our behalf. Apple handles notification delivery and optional speech or map requests under its terms; Wikimedia, Komoot, Geoapify, and OpenStreetMap handle their optional requests under their own terms.

We do not sell family planner data or use it for targeted advertising.

When smart comment suggestions are enabled for a member, Dearest may send that member's new plan comment and limited planning context to Replicate to suggest an action. Members can turn this off for their future comments in Settings.

Sharing and access

Anyone with an active family invite link can join that family space and view or change its contents. Personal email invitations expire after seven days and work once. Calendar subscriptions use a separate private link. Family owners can replace the shared family link from settings. Share private links carefully.

The shared planning address accepts messages only from email addresses already verified by a family member. Dearest emails the sender a confirmation link before processing the message; if an address belongs to more than one family space, the sender also chooses the destination. Forwarded messages become drafts and are not added to a family plan until a member approves them.

A view-only plan or note link can include attached photos. People who receive the link may be able to download a photo and inspect its embedded metadata, including location coordinates when the original photo contains them. Review photos before sharing and send private links only to people you trust.

Retention and control

Family data, including comments on plans, events, notes, and items, plus their replies and reactions, remains stored until a family owner deletes the family space. Deleted comment text is removed while a tombstone remains in the shared comments. Reactions and poll choices show each family member's name to the family and are included in the family export; deleting a poll removes its options and votes. A note photo is removed when its note or the family space is deleted. An uploaded PDF is removed when the family space is deleted. Owners can export planner data and permanently delete the space from Settings; the export lists note photos and saved PDFs with signed-in download paths rather than embedding the files. Other members can delete their own membership from Settings without deleting the shared family plans. Used and expired recovery tokens are removed on a rolling basis. The stored source text for a forwarded email is discarded when its draft is approved or dismissed. Shared-inbox routing records are removed on a rolling basis. Cached Wikimedia matches are replaced when the item location changes and are removed when the itinerary item or family space is deleted. Notification registrations are removed when a membership or family space is deleted; Dearest also removes stale and invalid device registrations on a rolling basis.

Account deletion

You can initiate deletion in the iPhone app or on the web without contacting support. Family-space owners can permanently delete the entire family space. Other members can delete their membership and access while the shared family plans remain available to the family. See the account-deletion instructions for the exact steps and what each option removes.

Children

Dearest is intended for adults organizing family life and is not directed to children under 13. Adults should decide what information about family members is appropriate to add.

Contact

Questions or privacy requests can be sent to hello@dearest.co.