Privacy Policy
What RabbL is
RabbL is an application a household uses to keep a shared shopping list, a to-do list, a calendar, local tide and weather information, and a shared photo pool it can order prints from. It was built for one family and is being tried by others.
Anyone may create a household and become its first member. Each household’s lists, calendar, photographs and meals belong to that household. What another household can see is set out under Other households below. RabbL is not sold, carries no subscription, and shows no advertising.
Who is responsible for your data
RabbL is made by Socraates Technologies Ltd. The data controller’s full legal name and address are being confirmed and will be added here. Until then, write to the contact address at the top of this page.
The ICO. As of 10 October 2026, RabbL has not yet started the Information Commissioner’s Office data protection fee self-assessment. Its outcome, or a registration number, will be added here.
What data RabbL holds
- Content you enter: shopping list items, tasks, calendar entries, photographs, meal plans, recipes, and the messages you send in RabbL.
- Where you are: your household’s town, which RabbL asks for when a household is set up. A full delivery address is asked for only if you order prints.
- Who you are: a display name and an email address for each grown-up, and a colour.
- A mobile number, if you add one. It is optional. RabbL keeps it only after you have proved it is yours by entering a code sent to it by text message.
- Devices: an identifier for each paired phone or wall display.
There is no password. You sign in with a single-use link sent to your own email address, or with Continue with Apple or Continue with Google. Apple and Google only prove to RabbL that the email address is yours. RabbL keeps no Apple or Google token or identifier, and it ends the session Apple issues at once. If you use Apple’s Hide My Email, the relay address Apple gives is the one your household holds. What your device keeps afterwards is a token stored in the operating system’s secure storage.
Google user data
If you choose to connect a Google calendar, RabbL requests one read-only permission:
https://www.googleapis.com/auth/calendar.events.readonly— to read events.
It is read-only. It permits no change to your Google account. RabbL cannot create, change, delete or respond to events, because it does not request the permission that would let it.
RabbL connects the primary calendar of the account you sign in with, and no other. It does not list your other calendars, and it does not request the permission that would let it — so if you keep a separate work calendar on the same account, RabbL cannot see it.
An honest limit on “read-only”. Google does not offer per-calendar permissions. The permission you grant technically allows RabbL to read events on any calendar in your account, not only the primary one it actually reads. What restricts it is RabbL’s own code, not a boundary Google enforces. RabbL stores events only from the calendar you connected, and deletes them when you disconnect — but you are trusting the application for that part, and you should know which part that is.
How it is used. To display your existing commitments alongside the household’s own calendar, so that each parent can see when the other is already committed.
How it is stored. Event start and end times, whether an event is all-day, its status, and its title are stored in the application’s database, hosted in the United Kingdom. The credential Google issues is encrypted at rest. Access tokens are not stored.
Who can see it. Only the members of your own household, and not equally: the titles of events from a connected calendar are visible only to the person who connected it, unless that person explicitly chooses to share them. Everyone else sees the same blocks of time marked only as Busy, with no title. This is deliberate — the feature exists so a parent can see when their partner is committed without seeing what they are doing.
How it is deleted. Disconnecting a calendar deletes its stored events immediately. Revoking RabbL’s access from your Google account stops all further access.
How it is not used. Google user data is never sold, never shared with any third party, never used for advertising, never used to train any machine-learning model, and never transferred to anyone except as required by law.
Diagnostics
The app can send a diagnostic report when a fault is investigated. These reports carry numbers, identifiers and timestamps only — never the contents of your lists, calendar entries, photographs, or any credential.
App usage analytics
The Android and iPhone apps tell Google Firebase Analytics which screen of the app is open — for example Calendar or Shopping — each time it changes. Firebase also records when the app is first opened, when a session starts and how long it is used, and when the app or the phone’s operating system is updated, and it identifies the installation by a random app instance identifier.
Nothing sent names you or your household. No name, email address, household, list item, calendar entry, photograph or anything you type is sent, and RabbL sets no user identifier. The advertising identifier is not collected, and the data is not used for advertising or shared for tracking. It tells us which parts of the app are used, so we know what to improve. The kitchen-wall and web versions of RabbL send nothing to Firebase.
Other households
RabbL lets households that know each other connect, chat, and share what they are going to.
- Being found. Anyone who has a grown-up’s email address or mobile number — typed in, or in their phone’s contacts — can see that the grown-up’s household is on RabbL, the household’s name and that grown-up’s name. Only an email address that has been used to sign in, and a mobile number that has been proved, can be found this way.
- Your contacts. If you choose to look for people you know, the app turns each email address and phone number in your contacts into a one-way code (a hash) on your phone and sends those codes to RabbL, which compares them with the addresses and numbers that can be found and returns the households that match. The codes are not stored or logged. A hash of a phone number is not secret, because every possible number can be tried, so RabbL treats these codes as personal data and discards them as soon as they are compared.
- Invitations. If you invite someone who is not on RabbL, RabbL keeps a one-way hash of their email address or number until they join or 30 days pass, so that their household can be connected to yours when they sign up. An invitation link shows the person who opens it the inviter’s first name, the household’s name, its town and its colour. If a grown-up adds another grown-up to their own household, RabbL emails that person an invitation.
- Once connected. A household you connect with sees your household’s name and the names of its grown-ups. They see the messages and photographs you send in a chat they are part of, and the events you tell them about, including who from your household is going. Your lists, calendar, meals and photo pool are never shown to another household.
Third parties
RabbL uses hosting and infrastructure providers to run the service, a transactional email provider to send sign-in links, and a print service to fulfil photo print orders you place. Twilio Verify sends the text message that proves a mobile number, and receives the number for that purpose. Apple and Google sign you in if you choose Continue with Apple or Continue with Google. Where a feature reads a recipe from a photograph or turns speech into text, a machine-learning provider processes that one input under a zero-retention arrangement. These providers process data on your household’s behalf and for no other purpose. Google Firebase Analytics receives the app usage described above.
No advertising service is used, and there is no advertising, and no tracking across other companies’ apps or websites.
Children
A household can add children as members so that entries can be about them. A child member is a name and a colour created by a parent; children do not sign in and are not contacted. A parent may add a child’s birthday from the child’s page in Settings. It is optional and can be cleared, and the app asks for it nowhere else.
Your choices
You can disconnect a linked calendar at any time from within the app, revoke RabbL’s access from your Google account at myaccount.google.com/permissions, remove your mobile number in Settings, or delete your whole household from within the app (Settings → Delete household), or ask for it to be deleted by contacting the address at the top of this page. A deleted household is erased within 30 days, together with every message it sent and its chats with other households; rabbl.family/delete-account says exactly what is removed and the one anonymous print-order record that is kept.
Changes
Material changes to this policy will be reflected in the “last updated” date above, and its full history is kept in the application’s source repository.
10 October 2026: the town asked at setup; a child’s optional birthday; the optional mobile number and Twilio Verify; Continue with Apple and Google; the new section Other households (being found, contacts, invitations, connected households); deleting the household in the app; who is responsible, and the ICO position. The sentence saying no member of one household can see anything belonging to another was withdrawn: since chat between households, it was not true.