Private family-activity planning

Privacy Policy

This policy explains the information Chudoly handles while operating its invitation-only family-activity planning service. It describes the current implementation; it is not a promise that Chudoly satisfies every law in every location. The owner should obtain legal review before expanding availability, changing data uses, or inviting families in additional jurisdictions.

Effective July 19, 2026

Who provides information

Parents and other invited adult caregivers provide information about themselves and children. Chudoly is not intended for children to register for or use independently. Adults should provide only information reasonably needed for family-activity planning and should not enter a home address or unnecessary medical detail.

Information and why it is collected

• Parent email and first name: to receive an access request, send and verify invitations, identify the adult’s private profile, communicate about access or privacy requests, and support the service.
• Child first name, age, and interests: to match activities to each child’s age and interests.
• ZIP code: to estimate general travel context. Chudoly asks for a five-digit ZIP code, not a home street address. When server-side routing is configured, Chudoly sends the ZIP code and a public venue address to Google Maps Platform to calculate an approximate drive time. Separately, an adult may allow the optional browser-based Google Maps Adventure Map to display completed adventures.
• Planning constraints: the form sends the selected children, selected date or date range, ZIP code, maximum drive, and per-person budget to Chudoly's protected recommendation API to build the current result. Raw child identifiers, ZIP code, date, budget, and drive selections are not saved in product-learning records; Chudoly retains only the selected-child count, result count, and opaque activity identifiers needed to measure results and validate later interactions.
• Optional AI ranking signals: after Chudoly's server applies verification, date, age, drive, and saved-preference rules, it may send OpenAI up to 20 ephemeral activity tokens with bounded public activity evidence and minimized aggregate fit signals. Those signals may include the selected-child count, whether published age guidance fits everyone, the number and labels of interest matches, and which preference categories differ. Chudoly does not send OpenAI child or parent names, child or activity database identifiers, raw profiles, ZIP codes, street addresses, or the adult's account identifier.
• Family preferences: an adult may save a ZIP code, maximum drive, budget, and preferred days. These defaults are used to help find and rank activities, and an adult can temporarily change the drive-time or budget limit for a particular outing without changing the saved defaults.
• Family adventure records: when an adult saves, plans, completes, favorites, rates, or requests a reminder for an activity, Chudoly stores the source-confirmed activity name and identifier, relationship status, optional reminder and completion dates, reminder status, optional 1–5 rating, selected child attendees, broad activity categories, and limited location context. Completed adventures support the private family timeline, badge and collection progress, and future recommendation context. Badges are calculated for the family and are not child scores or rankings.
• Newsletter preferences and delivery records: Chudoly stores whether an adult explicitly opted in, weekly frequency, delivery day, time zone, consent and unsubscribe times, and edition delivery metadata. Edition records contain only the week, status, attempts, and up to five opaque activity identifiers, not rendered child or profile details.
• First-party product-learning records: Chudoly records recommendation counts and structured interactions such as an activity being shown, an official link click, save, planning-to-go, calendar addition, reminder request, attendance, share, not-for-us reason, or incorrect-information category. Records are bound to the signed-in adult on the server and may reference an opaque recommendation run, newsletter edition, or activity identifier. The tracker does not accept free-text feedback.
• Invitations, account-access roles, status, expiration, and revocation records: to enforce private access.
• Access requests: Chudoly stores the submitted first name, email address, request status, review metadata, and notification timestamp so the team can review requests and respond.
• Security and operational records: request metadata, rate-limit records, authentication events, source failures, and service logs may be processed to prevent abuse, diagnose failures, and protect the service.
• Parent-submitted place or event observations: to review possible family activities. These remain separate from source-confirmed public facts unless Chudoly rechecks them.
• Provider and public listing requests: correction, cancellation, removal, claim, permission, and access requests may include the listing, corrected value or requested scope, name, work email, organization relationship, supporting URL, explanation, optional private evidence attachment, consent choice, verification method, case status, resolution, and audit history. Public lookup records use a keyed request fingerprint for rate limiting rather than exposing a public catalog export.
• Organization management accounts: Chudoly stores the manager's name, authenticated email identity, authority-reviewed claims, organization memberships and venue-specific roles, colleagues invited, change proposals, event/feed submissions, content permissions, reconfirmation history, and basic aggregate listing analytics.

How information is used

Chudoly uses information to operate the invitation-only service, authenticate members, save and retrieve profiles and defaults, generate and optionally rerank family-activity options, maintain a private family adventure history, calculate family badge progress, use favorites and completed categories to improve recommendations, deliver a weekly digest only to adults who opted in, deliver a one-time event reminder only after an adult requests it, maintain security, troubleshoot, respond to adults, and learn whether recommendations create value. Product-learning records are first-party operational measurements, not third-party analytics. Chudoly does not sell personal information and does not use it for advertising, behavioral profiling, cross-site tracking, session replay, or marketing-cookie targeting.

Provider request information is used to verify authority, review and correct factual listings, suppress or remove content, stop source access, manage permissions, prevent duplicate claims and abuse, communicate about the request, and preserve an auditable decision history. Provider access is separate from family accounts and does not reveal family profiles, recommendations, saved activities, or private engagement histories.

Service providers

• Supabase provides authentication, PostgreSQL data storage, row-level security, and invitation functions.
• Vercel hosts the website, routing middleware, and protected server functions.
• Resend may deliver authentication, invitation, explicitly requested weekly recommendations, and one-time event reminders requested for a specific plan. Chudoly does not add tracking pixels and requires provider open tracking and link rewriting to remain disabled.
• Cloudflare provides Turnstile abuse prevention on invitation and returning sign-in flows.
• Google Maps Platform may calculate an approximate ZIP-to-venue drive time. Chudoly sends a five-digit ZIP code and the public activity address from its server; it does not send a home street address or child profile. After an adult allows Functional technologies, the Family Adventures page may also connect directly to Google to render an interactive map of completed adventures. Google handles those requests under the Google Terms of Service and Google Privacy Policy.
• OpenAI may rerank a bounded allowlist of source-confirmed activities when server-side AI ranking is enabled. Requests use ephemeral activity tokens, minimized aggregate fit signals, a keyed one-way safety identifier instead of an account identifier, store: false, and explicit prompt-cache mode with no cache breakpoints. Deterministic rules and server validation remain authoritative, and OpenAI does not receive direct access to Chudoly's database.

These providers process information for Chudoly under their own service terms and privacy documentation. Their infrastructure and support operations may process data in locations different from the family’s location.

Sharing

Information is shared with service providers as needed to operate Chudoly and may be disclosed when reasonably necessary to protect users, investigate abuse, comply with a valid legal request, or complete a business reorganization. Child profiles and family adventure histories are private to the parent account that created them. Raw product-learning records are service-only. Administrators receive aggregate metrics rather than individual-family histories, and activity-demand rows are hidden until at least five different families were shown the activity.

Retention and deletion

Access cookies expire with the account grant and can be ended earlier on a browser. Account grants have expiration, disabling, and revocation fields. Chudoly deletes raw first-party product-learning events, associated recommendation runs, and newsletter edition metadata after 180 days; administrator invitation-rate records after 30 days; returning-sign-in rate records after 24 hours; pending or denied access requests after 90 days; and approved or fulfilled access requests after 180 days. Parent and child profiles, family adventure history and attendee snapshots, favorites, family and newsletter preferences, observations, and related account records otherwise remain until an authenticated account-deletion request or the announced service-closure process, subject to documented security or legal exceptions. Deleting the Auth account cascades to family adventures and attendees, family preferences, newsletter preferences, editions, recommendation runs, and raw product-learning records.

Historical venue claims, access grants, decisions, transfers, revocations, and rollback records are preserved after management access ends so Chudoly can resolve disputes and prevent accidental re-authorization. Private evidence is access-restricted and should be minimized and redacted. Its production retention period remains a release-blocking decision in Chudoly’s retention register; claimants may request review or deletion where applicable, subject to necessary security, dispute, and legal records.

OpenAI requests set store: false, which disables stored response application state but does not by itself enable Zero Data Retention. Chudoly's reranking requests also disable the implicit prompt-cache breakpoint and define no explicit breakpoint, so those requests do not use prompt caching. The Production project uses OpenAI's standard abuse-monitoring treatment, under which minimized request or response content may be retained in abuse-monitoring logs for up to 30 days, or longer when legally required by the provider. Other provider logs, safety processing, suppression records, and backups may persist for their configured periods before deletion cycles complete.

Chudoly has implemented a daily service-role-only operation for the fixed internal periods above. The owner must deploy and verify the first hosted run before broader release. Provider logs, backups, support copies, and aggregate reports remain subject to separate documented controls and legal/provider review.

Adult access, correction, and deletion requests

An invited parent or caregiver may change family and newsletter preferences from the Account menu, unsubscribe there, or use the signed one-click unsubscribe link in a newsletter without signing in. They may ask to access, correct, or delete the parent information they provided and child information they manage by emailing hello@chudoly.com from the invited address. Chudoly may need to verify identity and authority over the profile. Clearing browser storage, unsubscribing, or ending a private session does not delete server-side profiles or revoke account access.

Providers may use the provider-access area or email providers@chudoly.com to correct, claim, restrict, or request removal of a listing. Chudoly retains request and audit history when a listing is suppressed unless deletion is required by applicable policy or law.

Security

Chudoly uses invitation-only confirmed-email access, signed HttpOnly cookies, active account-grant checks, row-level security, owner-bound edits, expiration and revocation controls, Turnstile, and restricted server-side secrets. No system can guarantee absolute security; adults should avoid submitting unnecessary sensitive details.

Changes and contact

This policy may change as the service changes. Material changes should be reflected by updating the effective date and, where appropriate, notifying invited adults. Questions and privacy requests can be sent to hello@chudoly.com.

See the Cookie and browser storage notice for the current device-storage inventory and controls.