Privacy Policy
Last updated: 4 July 2026
1. Who we are
Canopy (“we”, “us”, “our”) is a family organisation application operated by Chrysalis Works Ltd, a company registered in England and Wales. We are the data controller for all personal data processed through the Canopy service.
Registered office: Suite A, 82A James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE, United Kingdom
Contact: hello@canopy-app.app
We are registered with the Information Commissioner’s Office (ICO) as required under the UK GDPR and the Data Protection Act 2018.
This policy applies to all users of Canopy, wherever you are located, including in the United Kingdom, the European Union and Ireland, Australia, the United States, and New Zealand. It is written primarily around the UK GDPR; Section 11 below sets out additional rights that may apply depending on where you live.
2. What data we collect
We collect the following categories of personal data:
Account data
Email address, password (stored as a one-way hash), display name, and two-factor authentication status.
Contact and notification data
Phone number (optional, used for SMS notifications), push notification token (optional, used for in-app alerts), and additional email addresses you register for FamilyFeed.
Family and children’s data
Children’s names, dates of birth, and parenting schedule. This may include information about children under 18, entered by a parent or guardian.
Special category data (medical information)
Where you choose to use the Medical section of the Info Bank, we store health information including GP and dentist details, blood type, allergies, and medications. This is special category data under UK/EU GDPR (and sensitive personal information under equivalent laws elsewhere) and is processed only with your explicit consent.
Content you create
Calendar events, notice board posts, direct messages, shared expenses, Info Bank entries (school, personal, contact, and account details), and uploaded documents.
FamilyFeed email content
When you forward emails to familyfeed@canopy-app.app, the content of those emails is processed by AI to extract calendar events and notices. This feature is designed for school newsletters and similar administrative communications — it is not intended to process medical or clinical information. See section 7 for full details.
Technical data
Authentication session tokens and error logs used to operate and maintain the service. We do not use analytics trackers or advertising identifiers.
Consent records
Records of when you gave explicit consent for special category data processing and FamilyFeed AI processing, including timestamp.
3. Lawful basis for processing
| Processing activity | Lawful basis |
|---|---|
| Core app features (calendar, notice board, messaging, schedule) | Performance of contract |
| Account authentication and security | Performance of contract / Legitimate interests |
| Push notifications and SMS alerts | Legitimate interests (you can opt out at any time) |
| Medical information (Info Bank — Medical section) | Explicit consent (UK/EU GDPR Art. 9(2)(a)) |
| FamilyFeed AI email processing | Explicit consent |
| Subscription management | Performance of contract |
| Compliance with legal obligations | Legal obligation |
4. How we use your data
- To provide and operate the Canopy service, including syncing family data between accounts
- To send push notifications and SMS alerts you have enabled
- To process emails forwarded to FamilyFeed and extract calendar events using AI
- To generate exports you request (data download, court-ready PDF records)
- To manage your subscription via the App Store or Google Play
- To investigate and resolve technical issues
We do not sell your data. We do not use your data for advertising. We do not profile you for marketing purposes.
5. Who we share data with
We share data only with the following service providers, and only as strictly necessary to operate the service. All are engaged as data processors under appropriate agreements.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and file storage | USA (EU region available) |
| Anthropic | AI processing of FamilyFeed emails (event extraction only) | USA |
| Telnyx | SMS notifications | USA |
| Resend | Transactional email (invite emails, 2FA codes) | USA |
| Railway | Application hosting | USA |
| Cloudflare | DNS, email routing, and edge processing | USA / Global |
| RevenueCat | Subscription management (Apple IAP / Google Play) | USA |
| Apple / Google | In-app purchase processing and app distribution | USA / Global |
6. International data transfers
Several of our service providers are based in the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR. We have signed Data Processing Agreements (DPAs) with each of our processors, incorporating Standard Contractual Clauses (SCCs) and/or the UK International Data Transfer Addendum (IDTA) where required.
Resend is certified under the EU-US Data Privacy Framework (UK Extension), which provides an additional legal basis for UK–US email data transfers.
FamilyFeed email content sent to Anthropic for AI processing is used solely for the purpose of extracting events and is not retained by Anthropic beyond the processing window, in accordance with their Data Processing Addendum. Anthropic will not use your data to train AI models.
7. FamilyFeed — AI email processing
FamilyFeed allows you to forward emails (such as school newsletters) to familyfeed@canopy-app.app. When an email is received from a registered address, its content is sent to Anthropic’s Claude AI to extract calendar events, dates, and notices.
Before you can use this feature, we ask for your explicit consent to this AI processing. You can withdraw consent at any time by removing your forwarding addresses in Settings — this will prevent further emails from being processed. It does not affect events already created.
Email content is processed in real time and is not used to train AI models. Only emails from addresses you have registered are processed; all others are silently discarded.
8. Children’s data
Canopy is designed for use by adults (18+) to manage information about their children. Children do not create accounts. All children’s personal data is entered by a parent or guardian and is accessible only to verified members of that family.
Medical information about children (GP details, allergies, medications) is special category data. We obtain explicit consent from the parent entering this data before it is stored.
9. Data retention
- Active accounts: data is retained for as long as your account is active.
- Account deletion: when you delete your account, your personal data and all associated family data (if you are the last parent) is deleted immediately and permanently. This includes all files stored in the document vault.
- If the other parent remains: your membership is removed but family data (calendar, notices, etc.) created collaboratively remains accessible to the remaining parent.
- Backups: deleted data may persist in encrypted database backups for up to 30 days before being permanently purged.
10. Your rights
Under UK GDPR you have the following rights:
Right of access
Request a copy of all personal data we hold about you. Use the “Download my data” button in Settings → Account, or email us.
Right to rectification
Correct inaccurate data directly in the app, or contact us if you need our assistance.
Right to erasure
Delete your account and all associated data using “Delete my account” in Settings → Account. Deletion is immediate and permanent.
Right to data portability
Export all your data in a structured format using “Download my data” in Settings → Account.
Right to withdraw consent
Where processing is based on your consent (medical data, FamilyFeed AI), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.
Right to object
Object to processing based on legitimate interests by contacting us at hello@canopy-app.app.
Right to lodge a complaint
If you believe we have not handled your data correctly, you may complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
11. Additional rights depending on where you live
Canopy is operated by a UK company and this policy is written primarily around the UK GDPR. Depending on where you live, you may have additional or different statutory rights, summarised below. These are in addition to, not instead of, the rights in Section 10.
European Union / Ireland
If you are located in the EU or Ireland, your personal data is processed under the EU General Data Protection Regulation (EU GDPR), which affords equivalent rights to those in Section 10. You may lodge a complaint with your national supervisory authority instead of, or as well as, the ICO — for Ireland, this is the Data Protection Commission (DPC), dataprotection.ie.
Australia
If you are located in Australia, your personal information is also handled in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), to the extent that Act applies to our processing. You may complain to the Office of the Australian Information Commissioner (OAIC), oaic.gov.au, if you believe we have not handled your personal information in accordance with the APPs.
United States (including California)
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to request deletion, the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA/CPRA, and we do not use personal information for cross-context behavioural advertising. To exercise any of these rights, contact us at hello@canopy-app.app; we will not discriminate against you for exercising them.
New Zealand
If you are located in New Zealand, your personal information is also handled in accordance with the Information Privacy Principles under the Privacy Act 2020. You may complain to the Office of the Privacy Commissioner (OPC), privacy.org.nz, if you believe we have not handled your personal information in accordance with that Act.
12. Security
We implement appropriate technical and organisational security measures including:
- Passwords stored as one-way hashes (never in plain text)
- Optional two-factor authentication (email-based)
- Row-level security ensuring each family can only access their own data
- Encrypted storage for documents and files
- HTTPS for all data in transit
- Child account passwords stored using Supabase Vault encryption
In the event of a personal data breach, we follow a documented incident response procedure. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.
No system is completely secure. If you become aware of any security issue, please contact us immediately at hello@canopy-app.app.
13. Cookies
The Canopy app uses session cookies for authentication only — these are essential to keep you logged in and cannot be disabled. We do not use advertising cookies, tracking pixels, or third-party analytics.
This marketing website (mycanopymail.com) does not use any tracking or advertising cookies.
14. Changes to this policy
We will notify active subscribers of any material changes to this policy by email at least 14 days before they take effect. The current version is always available at this URL. Continued use of the service after changes take effect constitutes acceptance.
15. Contact us
For any questions about this policy or to exercise your rights:
Chrysalis Works Ltd (trading as Canopy)
Suite A, 82A James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE
Email: hello@canopy-app.app
We aim to respond to all requests within 14 days and will always respond within the statutory 30-day period.