Tutti privacy policy

Effective: 25 September 2026

Tutti is a family organiser: a shared calendar, lists, meals, health check-ups, document expiry dates and reminders, with a family assistant you can chat with. Families use it to keep track of the everyday things that are easy to forget.

That means you trust us with personal information about your family, including your children. This page explains, in plain language, what Tutti collects, what it does with it, who else is involved in handling it, and how you can delete it.

Tutti is run by Youssef Merhi, based in the United Arab Emirates (“we”, “us”). For anything in this policy, contact us at privacy@tutti.family.

The short version

Your family’s information is visible to your family, and to no other family.
We do not sell your information, show you ads or use tracking or analytics tools.
When you chat with the family assistant, the conversation and the family information it needs are sent to Anthropic, the company that makes the Claude AI model, so it can write a reply. Anthropic does not train its models on this data, and it deletes it within 30 days.
You can delete your account yourself, in the app, at any time.
This website sets no cookies of its own and runs no analytics. If you join the waitlist, we use your email only to tell you about Tutti.

What we collect

Your account

Your email address and a password. The password is stored only in scrambled (hashed) form by our login provider. We cannot read it.
The name you go by in the app, and your notification preferences.
If you allow notifications, a push token: an address for your phone that lets us send it notifications.

What your family puts into Tutti

Everything in Tutti is entered by your family, by typing it in or by asking the assistant to add it. Depending on what you use, this can include:

People in the family, including children, pets and household staff: names, how they are related to the family, their photo, and their colour in the app.
Personal details about family members: date of birth, school and school year, allergies and vaccination notes, and the date of the last GP visit.
Health check-ups: appointments (such as a dentist or a paediatrician) and notes from the visits.
Documents: the type of document (for example, a passport) and its expiry date. Tutti does not store the document itself or its number.
Calendar and daily life: events, children’s activities and homework, household to-dos, reminders, shopping lists, meal plans, food expiry dates, and your family’s collections (things to watch, read, try or visit).
Places, such as a school or a clinic: names, addresses, contact details, and notes like parking or gate instructions.
Photos you choose from your phone: a family picture, pictures of people, and pictures attached to items.
The family chat: the messages family members send to each other and to the assistant, and the assistant’s replies.
The assistant’s notes: short facts the assistant has been told to remember (“Sami is allergic to peanuts”) and things it has been asked to follow up on.

Records we keep to run the service

Assistant usage: for each family, how much AI processing each request used, how many web searches it made, and what that cost. These records contain no message text. We use them to enforce each family’s monthly limit.
Error reports: when the app hits an error, it saves a technical report (the error message, where in the code it happened, your phone’s platform, and, if you were signed in, your account ID) so we can fix it. An error report can contain part of what was on screen when the error happened.
An activity record of important family changes, such as who became the family’s head.
App update checks: when the app checks for an update, Expo (which delivers updates) receives a random ID for your copy of the app, so it can send the right update. We do not link that ID to your account.

What we do not collect

Tutti does not collect your location, your contacts, your phone’s advertising identifier, or your browsing. It contains no analytics, advertising or tracking software. Google Play’s data safety section lists our error reports under “Analytics”, because Google counts fixing crashes as analytics. We use them only to fix errors.

How we use it

To run Tutti for your family. We show your family its calendar, lists, reminders and so on, and send the notifications you have switched on.
To run the family assistant (see the next section).
To keep Tutti working and secure, including fixing errors and enforcing limits.
To contact you about your account, for example with a password reset email.

We do not use your information for advertising, and we do not sell it or share it for anyone else’s marketing.

If the GDPR applies to you, our legal basis is that we need this information to provide the service you asked for (a contract). For error reports and security, it is our legitimate interest in keeping the service working. For the health details you choose to add, it is your explicit consent, which you give by adding them and can withdraw by deleting them.

The family assistant and Anthropic

Each family names its own assistant. It is powered by Claude, an AI model made by Anthropic, PBC.

What is sent to Anthropic. When someone in your family writes to the assistant, we send Anthropic:

the message;
the last 20 messages of your family chat, for context;
the names and roles of the people in your family;
the notes the assistant keeps for your family, and those the person writing has kept for themselves (“just me” notes);
whatever the assistant looks up to answer: for example, if you ask when the next dentist appointment is, the family’s check-ups.

Each morning, the assistant also writes your family’s morning brief. For that we send Anthropic that day’s calendar, reminders, birthdays and items that are due.

The assistant only ever works with one family’s information at a time. Along with each request we send Anthropic an anonymous code for the family, which contains no names and no email addresses. It lets Anthropic apply its safety checks to one family without affecting others.

What Anthropic does with it. Anthropic processes this data on our behalf, as our processor, under its commercial terms. According to Anthropic’s published policies, as of 25 September 2026:

It does not train its AI models on data sent through its API, unless the customer gives express permission. We have not given it.
It deletes the data within 30 days. The exception is a request that its automated safety systems flag as violating its usage policy. Anthropic may then keep that request and its reply for up to 2 years, and its safety scores for up to 7 years.

Anthropic is based in the United States and processes data there.

Web searches. The assistant can search the web, for opening hours or a public holiday, for example. It writes the search itself, based on what you asked. It is instructed never to search for your family’s own details, but a search can reflect what you asked about. Anthropic runs these searches.

Private items and “just me” notes stay out of the family chat. The family chat is read by every family member, so the assistant in the chat does not read or mention anything marked Private. “Just me” notes are visible only to the person who made them. The assistant uses them only when that person is the one asking, and it is instructed not to repeat them where the rest of the family can see.

The assistant can make mistakes. Check anything important, especially anything about health, against the original source.

Who can see what inside your family

Your family’s information is visible only to your family. This is enforced by the database itself, not just by the app. Another family cannot see it, and neither can the assistant when it is working for another family.
The family head manages the family: who is in it and which role each person has.
Adults and children with their own login are family members. They see everything the family shares, and the family chat.
Private items. Calendar items, activities, check-ups, documents, to-dos, reminders, homework and collections can be marked Private. A Private item is hidden from the rest of the family. Only you see it, plus any staff member you assign it to or share it with. The morning brief and other family messages leave it out, and a notification about it goes only to you.
Household staff (a housekeeper, a driver or a chef) see much less than family members. They see:
- who is in the family (names, relationships and photos);
- the family’s saved places;
- the shopping list and the meal plan;
- only the items they are assigned to or that a family member chose to share with them, such as a calendar event, a check-up appointment, a to-do or a reminder. For example, a driver taking a child to the dentist sees that appointment.
Staff never see notes from health visits, documents, birthdays or other personal details, the family chat, or the assistant’s notes.
Notifications can show up to 180 characters of an item’s text, such as a reminder’s title, on the lock screen of the phone it is sent to.

Children

Tutti is a tool for parents and carers to organise family life. Most children in Tutti never use it themselves: they are people their parents keep track of.

A family head can invite a child aged 13 or older to have their own login, and confirms the child’s age when they do. That child is then a family member in the app, as described above. Younger children do not get a login: they stay on the family list, and their parents keep track of them.

Tutti is not meant for children to sign up on their own. If you believe a child under 13 has a login, or that a child created an account without a parent’s involvement, contact us at privacy@tutti.family and we will delete it.

This website and the waitlist

This section is about tutti.family, the website. Everything above is about the Tutti app.

No cookies of our own, no analytics. The website sets no cookies of its own and runs no analytics, advertising or tracking code.
Hosting. The website is hosted by Cloudflare. Like any web host, Cloudflare handles your IP address and your browser’s technical details to deliver the page and to protect the site from attacks.
The security check. The waitlist form uses Cloudflare Turnstile to tell people from bots. To do that it collects your IP address, your browser’s technical fingerprint (its TLS fingerprint and User-Agent) and which website the check is for. It does not read what you type into the form. Cloudflare also uses those signals itself to improve its bot detection, as described in its Turnstile privacy addendum.
What the waitlist keeps. If you join, we keep your email address, your first name if you give it, the language of the page you signed up on, and when you agreed to hear from us. It is stored with Cloudflare in the European Union, separately from the app’s database.
What we use it for. Only to email you about early access to Tutti. If the GDPR applies to you, our legal basis is your consent, which you give by ticking the box.
How long we keep it. Until we invite you to Tutti or you ask to leave the list, whichever comes first. Then we delete it.
Leaving the list. Every email we send has an unsubscribe link, or you can email privacy@tutti.family.

The companies that help run Tutti

We use a small number of service providers. Each handles your information only to provide its part of the service.

Provider	What it does	Where
Supabase	Stores Tutti’s database and photos, and handles logins and account emails	European Union (Paris, France)
Railway	Runs the assistant service and the scheduled messages	European Union (EU West)
Anthropic	The AI model behind the assistant, and its web search	United States
Expo	Delivers notifications to phones, and delivers app updates	United States
Apple and Google	Deliver notifications to iPhones and Android phones	Worldwide
Cloudflare	Hosts this website, runs its security check, and stores the waitlist	Worldwide network; the waitlist is stored in the European Union

Tapping an address in Tutti opens it in Apple Maps or Google Maps, whose own privacy policies then apply.

When information is transferred out of the EU or your country, as it is to Anthropic and Expo, we rely on those providers’ contractual safeguards for international transfers.

People who work on Tutti. The people who run Tutti can technically access the database. We do this only to keep the service working, to investigate a problem you report, or when the law requires it. We never browse family information out of curiosity or for any other purpose.

Legal requests. We disclose information to authorities only when the law requires us to.

How we protect it

Each family’s information is walled off at the database level. Every request is checked against who is signed in and which family they belong to. That includes requests the assistant makes on your behalf, which run with the permissions of the family member who asked.
All data travels encrypted (TLS), and our providers encrypt stored data.
Your login is kept in your phone’s secure storage (iOS Keychain or Android Keystore).
Photos are private. The app shows them through links that stop working after an hour.

No system is perfectly secure. If a breach affects your information, we will tell you and the relevant authorities as the law requires.

How long we keep it

While you use Tutti, your family’s information stays until someone in the family deletes it. Tutti does not delete things on its own schedule.
Invite codes stop working after 7 days.
When you delete something, it is removed from the live database straight away, and any photo attached to it within about a minute. When you delete your account, your photos are also removed within minutes. Deleted information can remain in our daily backups for up to 7 days, until those backups expire.
Service logs can contain short extracts of family information, such as the start of a message the assistant handled. They are kept for up to 30 days.
Anthropic deletes what we send it within 30 days, except as described above.
Assistant usage records are kept as long as your family exists.
The waitlist keeps your entry until we invite you or you ask to leave (see “This website and the waitlist”).

Deleting your account

You can delete your account yourself, in the app: Settings → Delete my account. If you have not joined a family yet, the same button is on the welcome screen. Before you confirm, the app tells you exactly what will happen to your family.

When you delete your account:

Your login and email address are deleted.
You are removed from your family, with everything about you: your profile, photo, birthday, school and health details, your check-ups and documents, the places and reminders that are yours, the chat messages you sent, and everything you marked Private.
Things you added for the whole family stay, such as a shared event or an item on the shopping list, but without your name on them. The family asked for those, and they are still using them.
If you are the family’s only head, the adult who joined the family earliest becomes head. If there is no other adult, the whole family is deleted, including everyone else’s access and all of its information and photos. The app warns you before you confirm.
A child’s account is the one exception. When a child with their own login deletes their account, their login, their chat messages and their Private items are deleted. The family’s records about them, such as their check-ups, vaccinations and school, stay with the family, because their parents keep them. A family head can delete the child’s profile from the family at any time.

If you cannot use the app, email privacy@tutti.family from the address you signed up with, and we will delete your account within 30 days. More detail is on tutti.family/delete-account.

Your rights

You can ask us to:

give you a copy of the information we hold about you;
correct it (you can also correct most of it yourself in the app);
delete it (see above);
restrict or object to how we use it.

Email privacy@tutti.family and we will reply within 30 days. We may ask you to confirm the request from the email address on the account, so that we only ever hand information to its owner.

You also have the right to complain to your data-protection authority.

Changes to this policy

If we change what we collect or who we share it with, we will update this page and change the date at the top. For significant changes, we will also tell you in the app before they take effect.

Contact

Youssef Merhi · privacy@tutti.family · tutti.family