Last updated: April 2026
1. The Short Version
Because we are a strictly ethical, independent company, our stance on your family's privacy is absolute. We do not have venture capital investors demanding we monetize your life.
- We never sell your data to advertisers.
- We absolutely never use your private schedules, photos, or messages to train global AI models.
- We only process the messages you explicitly forward to us in WhatsApp, and only for the purpose of adding them to your calendar.
2. What Data We Collect
To make Toucan work seamlessly, we collect the bare minimum:
- Your phone number (encrypted): We never store your raw phone number. Instead, we use a hybrid privacy architecture: your number is stored as a salted SHA-256 hash for lookups, encrypted with AES-256-GCM for recovery when needed (e.g. sending you a message), and masked (e.g. +44 •••• ••12) for display. No plaintext phone number ever touches our database.
- The messages, images, and PDFs you forward us: When you forward a school flyer, party invite, sports fixture, or PDF document to our WhatsApp number, we temporarily process the content so our AI can extract the dates, times, and locations. The original media is not permanently stored.
- Your children's names: If you choose to add your children via WhatsApp, we store their first names so events can be tagged to the right family member.
- Authorised sender numbers (encrypted): You can authorise other family members (e.g. a partner or grandparent) to forward events on your behalf. Their phone numbers are stored using the same hybrid encryption architecture — hashed, encrypted, and masked. We never store raw phone numbers for any user.
3. How We Use AI Securely
We use third-party AI providers (Googles' Gemini) to read the messy screenshots and text messages you send us. However, we use enterprise API agreements with these providers.
This means your family's data is sent via a secure, encrypted connection purely for processing the event, and is automatically deleted. Under our agreements, your data is zero-retention and is strictly opted-out of being used to train their global AI models.
4. Data Sharing
We do not sell your data. We share data only with:
- Infrastructure providers — for secure hosting, database management, and authentication.
- AI providers — for image and text analysis (with zero-retention policies enforced).
5. Your ICS Calendar Feed
Toucan provides a private ICS feed URL so you can subscribe to your family calendar in Google Calendar, Apple Calendar, or any other app. This URL is unique to your account — anyone with the link can view your events. You can regenerate or revoke this link at any time by messaging us on WhatsApp.
6. Deleting Your Data
You own your data. If you decide Toucan isn't for you, you can delete your account at any time by messaging "DELETE" to our WhatsApp number.
When you do, we permanently wipe your phone number, children's names, authorised senders, calendar events, and all message history from our servers.
7. Security
We take a defence-in-depth approach to protecting your family's data:
- Encryption in transit: All communication is secured with TLS.
- Encryption at rest: Phone numbers are encrypted using AES-256-GCM with dedicated encryption keys, separate from the database. Even if the database were compromised, phone numbers remain unreadable without the encryption key.
- Salted hashing: Phone lookups use salted SHA-256 hashes, meaning we can verify identity without ever decrypting the number.
- Row-Level Security: Every database table enforces strict access controls, ensuring only you can access your family's information.
- Message idempotency: Each incoming message is deduplicated to prevent accidental double-processing if WhatsApp retries delivery.
8. Contact Us
We are real people building this for our own families. If you have any questions about how your data is handled, you don't have to talk to a robot. You can email us directly at: help@asktoucan.com