Privacy Policy

Who we are

Hale is a family assistant you reach by iMessage or text message. It finds activities for your kids, reminds you before registration opens, watches for open spots, can join a family group chat, and answers parenting questions. Today Hale does not book or register on your behalf. If we later offer a feature that acts on your instruction (for example, completing a sign-up), it will only act after you confirm that specific action, and we will update this policy first. You (a parent or legal guardian) text the number and tell Hale about your children. There is no account you must create, though you may sign in to the web app, and you may optionally connect tools you already use. Hale is operated by Village Hale Technologies Inc., a corporation incorporated in Ontario, Canada (corporation no. 1001656484), which is the organization responsible for your family’s data under PIPEDA; see How to reach us. Our Terms of Service govern your use of Hale; this policy governs your family’s data.

What we collect, and where it comes from

We collect only what we need to run Hale for your family. It reaches us four ways, and the difference matters — most of it you typed, and none of it was bought.

What you give us. The things you tell Hale, in a text or in the web app:

• Your contact details. The phone number you text from, which is also how you sign in to the web app with a one-time code. Plus basic preferences such as language and time zone.
• Your children’s profiles. Each child’s first name (and last name if you add it), date of birth, and — only if you choose to share them — gender and other optional details such as interests. Hale uses date of birth to derive each child’s stage (newborn, toddler, child, or teenager).
• Care and activity logs. The day-to-day entries you record — feeds, naps, diapers, milestones, and growth measurements.
• Hale conversations. The questions you ask Hale and its answers.
• Group chats. If you add Hale to a group chat, or ask Hale to start one, Hale receives the messages in that chat, including messages from other members (a co-parent, a grandparent, a caregiver) and their phone numbers. Hale uses them only to help that family, and only for the purposes in this policy. Please add Hale only to chats whose members you have told about Hale. Hale introduces itself when it joins, and a member can reply STOP to stop Hale writing to them in that chat. A member who is not a Hale user can ask us at privacy@villagehale.com to access or delete their messages.
• Coarse location only. If you opt in to local discovery, we store a coarse area — your city, province, country, and at most a postal code or forward-sortation area. We never store your precise street address or your child’s location. The full address you may type into the address box is used only to derive that coarse area and is not retained.
• Village endorsements. When you endorse a local activity, we record that your family endorsed it so we can show an aggregate count (“loved by several families near you”). We never reveal which family endorsed what.

What comes from services you connect. If you connect a tool (such as email or calendar), we store an encrypted authorization token and the minimum metadata needed to sync, plus the entries that tool records into your family’s timeline. You control which integrations are connected and can disconnect them. When a flight, hotel or rental confirmation in a connected mailbox shows that your children are travelling with you, what we keep is the destination city and the dates only; we never store the message, the confirmation number, or what the trip cost.

PIPEDA asks for the purpose to be identified before the collection, and that is per-source and per-use rather than one paragraph. So, for each thing you can connect:

• Gmail (optional). What is read: the subject, the sender, the first line, and the time it arrived. When a message looks like it carries a date your family has to be somewhere, that message is opened. Why: to notice the date and offer to put it on your week. What is never read: anything you have not connected, and any message that does not look like a family date.
• Calendar (optional). What is read: an event’s title, its notes, start, end, place, and whether it was cancelled or moved. Why: so a change to your week reaches you as a text rather than as a surprise.
• Google Drive (optional). What is read: a file’s name, its type, when it was last modified, and a link to open it. Hale does not read the contents of the file. Why: so Hale can find a file you ask about, such as a permission form.
• How it went. What is stored: your one-line answer to Hale’s evening question, for thirty days, readable only by you and never shown to another family.

By default Hale asks Google for read-only access to Gmail (gmail.readonly), Calendar (calendar.readonly), and Drive (drive.readonly), plus your basic profile (your name). For some accounts, Hale may also ask for permission to create email drafts (gmail.compose; it never sends them) and to add or change calendar events (calendar.events). Hale asks for these separately and uses them only when you ask. It never deletes your email, it never asks for permission to send email as you, and Drive stays read-only.

What Hale works out for itself. A structured memory of facts and patterns Hale infers from your family’s activity — for example, a stated preference — so it can be more helpful over time. Inferred information about your family is your family’s personal information too, and everything in this policy applies to it.

What is collected automatically. Every action Hale takes produces an immutable audit record (see Your rights), and we keep limited technical information such as your IP address and browser type for security and to honour your access requests, plus the coarse product-usage events described under Sub-processors. On the public website, Google Ads measures a visit only after the visitor taps Accept in the cookie banner, so we can tell whether an advertisement led them there. If they choose No thanks, or make no choice, that measurement does not run. It does not include family data. We do not buy personal information about your family from data brokers, and we do not collect it from social media or other public sources.

Why we use it, and the consent we rely on

PIPEDA asks an organization to identify its purposes before it collects anything, so here they are — the whole list:

• Running Hale for your family. Understanding what is happening in your family’s day, answering your questions, drafting suggestions, finding genuinely useful local things to do, and keeping an accurate record of what Hale did.
• Keeping your family’s data safe. Recognising you, protecting accounts and the service against abuse, and maintaining the audit record that lets us show you exactly what happened.
• Making Hale better. Understanding which parts of the product work and which fail, and finding and fixing errors.
• Meeting our obligations. Complying with the law, responding to lawful requests, enforcing our Terms of Service, and protecting a child or another person from harm.
• Travel briefs. Noticing, from a flight, hotel or rental confirmation in a mailbox you connected, that your children are going somewhere with you — so that about a week before you go, Hale can text you a couple of things that are on for them where you are going. We read the confirmation for the destination and the dates and for whether a child is on the booking, and nothing else.
• Measuring our advertisements. Understanding whether an ad led a visitor to the marketing site. This is about the advertisement and the visit, not about your family.

That is all of them. We do not sell your data, we do not use your children’s data for advertising, and Hale shows no advertising.

The consent we rely on. Everything above rests on your consent, and PIPEDA asks that it be meaningful consent — that you understand what you are agreeing to, in language you can actually read, before you agree. So we ask plainly at the start, and separately again for each purpose that deserves its own answer: connecting an integration, sending your context to our AI provider, processing data across borders, letting Hale watch and text you unprompted, sharing a slice of your week with a caregiver you name, letting a tool you connect read from Hale, being introduced to another household, and unlocking any automated action. We record each consent — what was asked, the words you answered in, the version of this policy, and the time — so the choice is verifiable afterwards, and you can withdraw it at any time (see Your rights and Your choices).

Children’s data

Hale is built around children’s information, and we apply heightened protection to it. Information you share about your child is part of your family’s information. You provide it as their parent or guardian, and you can correct or delete it at any time. A child’s data is processed on your authority and for your family’s benefit. Optional and sensitive fields — such as gender — are exactly that: optional, and stored only if you provide them. Messages sent in a multi-family group chat are visible to the members of that chat. Nothing from one family’s private data — an inbox, a calendar, or a one-to-one text — is shown to another family unless that parent opts in to share it.

Hale is for parents and guardians. A child does not have a Hale account. We do not knowingly collect information directly from a child. The exception is a family group chat Hale is part of: Hale receives the messages a child sends there, the same as any other member’s messages, and those messages are visible to everyone in the chat. Hale does not knowingly collect more from that child than the messages already in the chat and the information you provide.

Teen privacy (children 13 and older)

As children grow, their privacy matters more. For a child aged 13 or older, raw content Hale would show a parent on its own surfaces — the actual text of a message or post Hale observes — is redacted from parents by default. Parents see only a category or short summary. That is the web app, and the texts, email, calendar feeds, exports, and connected tools Hale sends. A group chat is different: messages in a chat Hale is part of, including a child’s, are visible to the members of that chat. Hale does not hide them from the people already in it. When Hale writes into that chat, it does not name a child aged 13 or older, or that child’s events.

A parent can ask to see it. Asking reveals nothing on its own: we record what was asked for and the reason given, tell the teen, and open the content only if the teen agrees. Access is limited to the kind of content that was asked for, lasts at most seven days, and can be closed at any time by either of you. Every step — the request, the teen’s answer, the expiry, and any closure — is written to your family’s record.

There is one exception in this policy: a credible risk of harm, where relevant content may be opened without waiting for the teen to agree. Because it skips their agreement it is held to the strictest limits — at most 24 hours, a written reason on the record, and the teen is always told.

Two limits worth stating plainly, because they describe Hale as it is today rather than as we intend it.

First, access is only ever in-app. Even with an open grant, nothing widens what appears in an email, a text message, a calendar feed, a data export, or anything Hale shares with a connected tool — those always stay redacted.

Second, and more importantly: a child’s record holds no contact details, and a teen has no Hale account. A phone number that appears because someone is in a group chat is not used to tell a teen about a privacy request. Since telling the teen is a condition of opening anything, no request can be granted yet — a request is recorded, the notification we owe the teen is recorded as still outstanding, and the default redaction above continues to apply unchanged. The same is true of the safety exception: it is policy, not a button, and it stays unavailable until a teen can actually be told. You can see the pending state and the outstanding notification on any request in Settings. We will not enable either path before a teen can be reached.

AI and automated processing

Hale uses AI providers, including Anthropic, to write its replies and reminders. Anthropic is called directly. Some requests are routed through Vercel AI Gateway, which may send them to another model provider. The relevant parts of your conversation and family context are sent to the provider that generates the reply.

Hale does not take any action in the outside world for you, such as registering, paying, or sending an email in your name, unless you have confirmed that specific action. You are the decision-maker for those actions.

Stated the way Quebec’s Law 25 asks us to state it: No decision about your family is made by automated processing alone. We do not profile your family for advertising, and we do not use your family’s data to train AI models.

Who your family’s data is shared with

Nothing about your family is shared by default. There are six kinds of recipient, and four of them exist only because you asked for them.

• Service providers who run Hale for us. A small, named set — the database, the AI models, hosting, email and text delivery, analytics and observability. Each receives only what that service needs, under contractual safeguards. They are listed one by one in Sub-processors.
• A caregiver you name. If you invite a grandparent, a nanny or a babysitter, Hale texts them only the slice of your week that the role you chose covers, on the number you gave, and only after they have agreed to be texted. Your authorization is recorded as its own consent, and you can end it.
• A tool you connect. If you authorize an AI assistant or another tool to read from Hale, it receives only the scopes you selected — and what it reads is re-rendered at the moment of the read to the strictest standard we apply anywhere: a teen’s content removed on their age as of that moment, health and sensitive items generalized, locations dropped. You can revoke the authorization at any time.
• Another household, in an introduction. Hale can offer to introduce your family to another local family around an activity. Nothing crosses until both households have said yes to that specific introduction, and what crosses is exactly four things: a parent’s first name, an email address, the stage of a child (never a name or a date of birth), and the activity that anchored the match. The introduction is written to your family’s record with those fields named, so you can always see what was disclosed.
• Other members of a group chat you add Hale to. Hale’s replies in a group are visible to everyone in it.
• Where the law requires it. To authorities and in legal process where we are required or permitted to, to protect a child or another person from serious harm, and to our professional advisers — legal advisers, accountants, insurers — in the course of their work for us. If Hale is ever acquired, merged, or reorganized, your family’s data may transfer with the business; this policy keeps applying to it, and we will tell you.

Sub-processors and cross-border processing

We rely on a small set of trusted service providers to run Hale. We share with each only what that service needs, under contractual safeguards:

• Supabase — our primary database. Hale’s main database is hosted in Canada. This is where your family’s core data lives.
• Anthropic — AI processing (the Claude models that write replies and reminders). Called directly. Processed in the United States.
• Vercel AI Gateway — routes some AI requests, which may be handled by another model provider, including DeepSeek. Processed in the United States or another country, depending on the provider that handles the request.
• Google Maps / Places — address autocomplete and public-venue lookup. Only coarse-area and public-venue queries are sent; your precise home address is never sent.
• Vercel — application hosting and content delivery, plus Web Analytics and Speed Insights. The content-delivery network is global. Vercel Web Analytics is cookieless — it sets no cookies and builds no cross-site profile. Vercel Speed Insights runs on the public website without a consent choice. Vercel documents that measurement as anonymous: it is not tied to a visitor or an IP address, and it does not store information that would reconstruct a browsing session or identify someone. A data point includes the page, the browser and device, the country, and a web vital.
• PostHog — product analytics, session replay, and error tracking. Event data is coarse and non-identifying (no child data, no message content) — we capture only a few key product steps. Session replay is on so we can understand and fix problems, but every typed value (names, dates of birth, email, address) and all personal data shown on screen — child names and ages, care logs, and Hale conversations — is masked before the recording leaves your browser. Product analytics and session replay are kept for 30 days. Error tracking captures unhandled errors (a stack trace, not your data) so we can fix them. Autocapture stays off, and we identify you by an opaque account id, never your name or email. Processed in the United States. On the public website, PostHog analytics and session replay load only after the visitor taps Accept in the cookie banner. If they choose No thanks, or make no choice, neither loads. Visitors can change that choice at any time with Cookie settings in the site footer. On the marketing site, PostHog is configured to write nothing to your device.
• Google Ads — advertising measurement on the marketing site (villagehale.com) only. Google’s gtag (AW-18412881223) records that a visitor reached a landing page after seeing an advertisement. It may set advertising cookies on that visit. On the public website it loads only after the visitor taps Accept in the cookie banner. If they choose No thanks, or make no choice, it does not load. Visitors can change that choice at any time with Cookie settings in the site footer. It does not run on the product app, does not receive family data, message content, or children’s information, and Hale still shows no advertising. Processed in the United States.
• Linq — delivery of iMessage and SMS. The content of those messages passes through Linq; see Text messages.
• Langfuse — AI observability, so we can monitor and debug Hale. A teen’s raw content and contact details (emails, phone numbers, postal codes, and precise addresses) are masked before any data is sent to this service.

Hale’s main database is hosted in Canada. Some service providers listed in this policy — for example hosting, AI model providers, and analytics — may process data outside Canada, mainly in the United States. We ask for your consent to that cross-border processing, and we put appropriate contractual safeguards in place with these providers. Because some processing occurs outside Quebec and Canada, that data may be accessible to authorities in those jurisdictions under their laws.

Google API Services User Data Policy

Hale’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

1. We use Google user data only to provide and improve the features you see in Hale.
2. We do not use Google user data to train generalized or machine-learning models.
3. We do not use Google user data for advertising, and we do not sell it.
4. We do not transfer Google user data to others, except as needed to provide those features, for security, to comply with the law, or with your consent.
5. No person reads Google user data unless you ask us to, it is needed for security, the law requires it, or the data is aggregated and used for internal operations.

Text messages (iMessage and SMS)

Whether Hale reaches you by iMessage or SMS, your messages pass through our messaging provider, Linq, and, for SMS, your mobile carrier. Treat them as not end-to-end encrypted between you and Hale. Anyone holding the phone can read the thread. That is how these channels work; we cannot change it, so we tell you plainly and we write to it.

Because the channel is open, the strictest limits we apply anywhere apply to what we put into a text message:

• a health or appointment reminder names the task, never the condition — “Sam’s appointment Thursday at 4”, never what it is for;
• for a child aged 13 or older, nothing they wrote goes out over text — only a category or a short summary, as described in Teen privacy;
• anything recorded as sensitive is generalized before it is sent — the time survives, the subject does not;
• messages are short by design, one idea each, so there is less in transit to begin with.

Your phone number is encrypted where we store it and matched through a keyed hash, so we can recognise your family without keeping a readable list of numbers. Your consent to receive messages is recorded in the words you used to give it, and you can end it at any time: reply STOP to any message and we stop, immediately, until you ask us to start again. Standard message and data rates from your carrier apply.

If you would rather not use text for a particular request, the web app is available, and you can email us at privacy@villagehale.com.

Data residency, retention, and security

Where data is stored. Hale’s main database is hosted in Canada. Some service providers listed in this policy — for example hosting, AI model providers, and analytics — may process data outside Canada, mainly in the United States. The named providers are in Sub-processors.

Retention. We keep your family’s information only as long as we need it. Your profile, your children’s profiles, and what Hale remembers about your family are kept while you use Hale, and deleted within 30 days of you asking us to delete them. You can ask from the web app, or by emailing privacy@villagehale.com.

Message content, including messages from other members of a group chat Hale is in and from people who are not Hale users, is deleted or redacted 12 months after it was sent, and sooner if you or they ask. Your answer to Hale’s evening question is kept for thirty days. Disconnecting Gmail, Calendar, or Drive stops Hale reading that account. The details already saved from it are deleted when your account is deleted, and message content within them is deleted or redacted on the same 12-month schedule.

We keep a record of your consents and approvals, without the text of the messages, until your account is deleted. If you pay for Hale, we keep the billing records tax law requires. Anyone who is not a Hale user but whose messages Hale received can ask us to delete them. In deciding how long to keep anything, we weigh how sensitive it is, what we still genuinely need it for, the harm that holding it could cause, and any legal requirement to keep it.

Security. Access to your data is isolated per family at the database level (row-level security), data is encrypted in transit, and integration tokens are encrypted before they are stored. We log every action Hale takes so it can always be reviewed. No system is completely secure and we will not pretend otherwise; if a breach ever creates a real risk of significant harm to your family, we will report it to the Office of the Privacy Commissioner of Canada — and, where Law 25 applies, to the Commission d’accès à l’information du Québec — and tell you, as those laws require.

Your rights

Under PIPEDA and Quebec’s Law 25, you have the right to:

• Access the personal information we hold about your family. Because every action Hale takes is recorded in an immutable audit log, we can show you what happened and when.
• Correct information that is inaccurate or incomplete.
• Delete your data and close your account.
• Withdraw consent at any time, including consent to AI processing, cross-border processing, a specific integration, or any automated action.
• Port your data — receive a copy in a structured, commonly used format.
• Complain. If you are not satisfied with how we handle your data, you may contact the Office of the Privacy Commissioner of Canada, or, in Quebec, the Commission d’accès à l’information du Québec.

To exercise any of these rights, contact us at the address in How to reach us.

Your choices

Those are the rights the law gives you. These are the switches in the product, and none of them requires writing to us:

• Stop the texts. Reply STOP to any message and the messages stop, immediately, until you ask us to start again.
• Stop the email. Every non-essential email carries a working unsubscribe link; see Email and electronic messages.
• Stop the introductions. Tell Hale, in your own words, that you do not want introductions. Hale will stop looking for a match for your family and will not raise it again.
• Disconnect a tool. Any integration you connected can be disconnected, and any tool you authorized to read from Hale can have that authorization revoked.
• Skip the address. Coarse location is opt-in — local discovery is the only thing that needs it, and Hale works without it.
• Decline to tell us something. Optional fields are optional. Some of Hale gets less useful without them, and none of Hale stops working.
• Cookies on the public website. On villagehale.com, Google Ads and PostHog (analytics and session replay) load only after the visitor taps Accept in the cookie banner. If they choose No thanks, or make no choice, neither loads. Visitors can change their choice at any time with Cookie settings in the site footer. Vercel Speed Insights runs without that choice. Vercel documents it as anonymous performance data: it is not tied to a visitor or an IP address, and it does not store information that would reconstruct a browsing session or identify someone. Strictly necessary storage, such as the theme and language choice, needs no consent. Google Ads may set advertising cookies only after Accept. Blocking third-party scripts in your browser also stops that measurement and does not affect Hale over text. The product app does not load this tag.

Other sites and services

Hale points you at things other people run — a city’s registration page, a program, a venue. Those sites are not ours and this policy does not cover them; what they collect when you arrive is governed by their own privacy practices, which are worth reading before you register. The same is true of any tool you connect to Hale.

Email and electronic messages (CASL)

We send you email that is necessary to run your account — such as security notices and the weekly brief and other updates you ask Hale to prepare. If we ever send commercial electronic messages, we do so only with your consent, we identify ourselves, and every such message includes a clear, working way to unsubscribe. You can opt out of non-essential messages at any time without affecting your account.

Changes to this policy

We may update this policy as Hale evolves. When we make a material change, we will update the date at the top and, where appropriate, ask for your renewed consent. The version you agreed to is recorded with your consent.

How to reach us

Our Privacy Officer, the person in charge of the protection of personal information under Quebec’s Law 25, is Anzhe Dong, Founder. For any privacy question, or to exercise your rights, email privacy@villagehale.com or write to: Privacy Officer, Village Hale Technologies Inc., 13394 Tenth Line, Georgetown, ON L7G 4S8, Canada.