App privacy policy

Last updated: 4 October 2026

Barely is operated by Windhill Limited, the controller of information handled by the app. Contact hello@barely.co for privacy questions or requests. This policy covers the Barely app. The website waitlist has its own privacy notice.

What we collect and why

• Your account: email address, display name, email verification and AI permission records, sign-in sessions and family membership. These let you sign in securely and share with the parents you invite.
• Your family: children’s first names, required current school years, school names and matching details. Older family profiles may retain an optional age you previously supplied. You must be an adult authorised to provide and use this information. Barely is for parents, not child account holders.
• School information: notices, homework, timetables, fixtures, team sheets and other records from services you connect. Some records may contain personal or sensitive information. Only connect information you have permission to use. You can disconnect in Settings.
• School access: sign-in session cookies are retained in a separate encrypted school-connection store. SchoolPost and MySchoolPortal passwords are entered on their own pages. If you supply a School Sport team-sheet password, it is retained encrypted in that same separate store. These credentials are not sent to AI providers.
• Conversations: questions, replies and private AI conversation memory. Parents granted access to the family’s children can see its shared conversation, including earlier messages. Invitations and child-access settings control sharing.
• Before signing in: family setup answers stay in a private draft on your iPhone, expire after 24 hours and are removed after your verified account saves the family setup. These fixed setup questions do not use AI.
• School availability alerts: if your school is not supported, you can opt into an email alert, an app notification, or both without creating an account. We store your requested school names and towns, your chosen email and/or notification token, an anonymous installation identifier and consent records separately from family accounts. We use these only to notify you when those schools become supported, not for marketing or AI. You can stop alerts in this flow; email alerts also include an unsubscribe link. Registrations expire after 365 days. Recovery revokes restored registrations and requires a fresh opt-in rather than reviving withdrawn alerts.
• Optional features: notification device tokens and preferences; voice audio and transcripts if voice is enabled and you choose to use it. Your microphone is used only when you start voice. Barely does not retain raw voice audio; transcripts are retained as conversation history.
• Subscriptions and TestFlight access: Apple handles payment; Barely does not receive your card or bank details. We verify Apple’s signed purchase records, product and transaction identifiers, entitlement, expiry and renewal status. A random account token links a purchase to the subscribing family. This enables family access, restores, refunds and fraud prevention. For automatic free TestFlight access, we verify Apple’s signed app transaction and its device verification identifier. We retain one-way device and proof identifiers linked to your account to prevent reuse by another account; raw app proofs and device identifiers are not retained. These verification records remain until account deletion. Short-lived beta access is renewed while you use TestFlight and is removed on sign-out, expiry or recovery.
• Optional usage analytics: if you enable “Help improve Barely”, PostHog Cloud EU receives fixed screen and feature-use categories, event times, app version/build and a random identifier held only in memory for that app session. This helps us improve setup and understand which features are useful. We do not link analytics to your Barely account or send names, email addresses, child or school details, messages, documents, sign-in links, credentials or notification tokens. We do not record your screen or interactions automatically. Analytics is off by default and separate from AI permission. Change your choice in Settings; turning it off drops unsent events and stops new collection. Signing out or deleting your account also turns it off. The random identifier changes when you restart the app or change the analytics choice; your choice is saved only on this phone. Events already received by PostHog are not recalled by turning collection off.
• Technical information: limited crash/error diagnostics through Sentry, and content-free AI request/token accounting. Error reports exclude conversation text, school records, children’s details, email addresses and sign-in credentials. We do not use advertising identifiers, advertising tracking or session replay.

AI processing and your choice

With your explicit permission, relevant messages, conversation history, family details and school information are sent to Anthropic and/or OpenAI to produce replies and enabled school updates. OpenAI also processes microphone audio and conversation context when live voice is available and you use it. AI can make mistakes; check important information with the school. Barely does not make school consent, booking or payment decisions for you.

You can agree or withdraw in the app’s AI sharing settings. Shared-family AI requires permission from each parent whose information is used. If a family reply or voice session is running, wait for it to finish before withdrawing. Once saved, withdrawal stops future requests requiring that permission; it cannot recall information already processed. If you decline, you can manage or cancel an Apple subscription, sign out or delete your account without enabling AI.

Service providers and international processing

We use Hetzner for hosting, Cloudflare for secure delivery and sign-in/invitation emails, Apple for subscription payments and verification, push notifications and optional public-place weather information, Sentry for diagnostics, PostHog Cloud EU for optional usage analytics, and Backblaze for encrypted backups. AI providers process information as described above. Analytics uses PostHog’s EU hosting region in Germany; service-provider processing and support may occur outside the UK or EU. Applicable provider agreements and transfer safeguards govern that processing. Contact us for details of the safeguards applicable to your information.

School services receive your direct sign-in and authorised retrieval requests. We do not connect to your personal email inbox, sell your personal information or share it for third-party advertising. We may disclose information where required by law or necessary to protect the service and its users.

Legal bases

We process account and requested service information to provide Barely, and use legitimate interests to secure the service, prevent abuse, diagnose failures and maintain recovery backups. Explicit permission controls the AI sharing described above, optional usage analytics and optional device permissions. Legal obligations may require limited retention or disclosure. Do not provide sensitive information without the necessary authority and lawful basis.

Retention and deletion

Active account, family and conversation data is kept while needed to provide your account. Sign-in links and codes expire after ten minutes. School sessions and imported records are removed when you disconnect; existing conversation text may still refer to them.

Choose Settings → Delete account to initiate permanent deletion in the app. We require recent email verification. Deleting the family owner’s account also removes their families, children, connections and conversations for all members. Deleting another parent removes their account and connections, and conversations containing their messages, including the associated AI memory. Other parents retain their own accounts. The app explains this before you confirm. If a reply is running, wait until it finishes and try again.

Sign-ins are revoked and active database records are removed when deletion succeeds. Private AI-memory cleanup is retried if temporarily unavailable. Encrypted recovery backups can retain older copies under the backup retention schedule (14 daily, 8 weekly and 6 monthly snapshots; separately retained release-rollback snapshots). These copies are restricted to recovery and are not used by the active app. A separate erasure journal retains opaque account and conversation identifiers so deletion can be reapplied before restored data is put back into service. Recovery stays offline if complete erasure history cannot be established. Provider-held processing records follow the relevant provider’s retention terms.

Account deletion does not cancel an Apple subscription. Use Manage or cancel in Barely or your Apple Account’s subscription settings. Deletion removes the family association from our purchase ledger. We retain minimal Apple transaction identifiers, product, expiry and status, an opaque deleted-family identifier and one-way token digests to process later refunds, prevent duplicate claims and allow an explicit restore into a fresh family. These records cannot recreate deleted children, conversations or school connections. The purchase ledger is preserved separately from application rollback; recovery stays offline if its history is incomplete.

Your rights and contact

Depending on the circumstances, you can request access, correction, deletion, restriction, portability or object to processing, and withdraw consent where it is used. Email hello@barely.co; we may need to verify your identity. You can complain to the UK Information Commissioner’s Office at ico.org.uk or your local supervisory authority.

We will update this policy when practices change and ask again before materially different AI sharing. Barely is independent and is not operated or endorsed by a school or school-service provider.