Privacy Policy

Who we are

24/7 Mom is a personal AI assistant for parents and caregivers, operated by Batoom LLC (“we”, “us”, “24/7 Mom”). This policy explains what data we collect when you use the 24/7 Mom mobile app and web demo, why we collect it, how we use and share it, how long we keep it, and what choices you have.

What this policy covers

This policy covers your use of the 24/7 Mom mobile app (iOS, Android) and the 24/7 Mom web app. It does not cover third-party services you choose to connect (Google, your school’s Canvas/LMS, Instacart, your Crossmint wallet, and health/fitness sources you connect — Apple Health, Oura, WHOOP) — those services have their own privacy policies, which we link to under “Sub-processors” below.

Data we collect

We collect data from three sources: (1) what you tell us when you sign up and onboard, (2) what flows in from third-party services you choose to connect, and (3) what’s generated as you use the app. Each category is listed below.

1. Account data (source: Clerk authentication)

When you create a 24/7 Mom account we receive from Clerk: your email address, your name (from Google profile if you sign in with Google, or as you type it), your Clerk user ID, and authentication state (sign-in events, session tokens). We do not receive your Google password.

2. Onboarding & household data (source: you, in the app)

During onboarding and in Settings you can provide: your name, mailing/shipping address, household composition (spouse/partner name and food preferences if you choose to add a partner), and information about your children (names, ages, sizes, allergies, food preferences, school information). You provide this data on behalf of your household members; see “Children’s data” below.

3. Connected Google data (source: your Google account, with your consent)

If you connect Google in Settings, we request the following OAuth scopes. Each is requested only to power a specific user-facing feature:

We request a single Gmail scope, gmail.modify, which covers all of the above. We do not request full-mailbox access (https://mail.google.com/) or any scope that permanently deletes mail. We do not request access to Google Drive, Contacts, YouTube, Photos, Search history, or any other Google product, and we do not request the userinfo.profile scope (we never read your Google profile name, picture, or other profile fields).

4. Connected Canvas/LMS data (source: school portal, per-kid)

If you connect Canvas or another supported LMS provider for a specific child, we receive: course list, assignment titles, due dates, and grades for that child. This is minor data — see “Children’s data” below.

5. In-app generated data

• Chat messages — what you send the agent and what it replies
• Agent memory (“gbrain”) — facts the agent learns about your household, stored as a personal knowledge graph in your dedicated server-side workspace
• Extracted events, reminders, and proactive notes — derived from your email and chat
• Email reply drafts — proposed replies awaiting your approval
• Email classifications and skip patterns — short-lived operational signals (retained 90 days) that decide what to surface vs. ignore
• Sender memory and sender trust — long-running learned context per sender (retained while your account is active)
• Pantry inventory and shopping history — items you’ve marked in your pantry, your shopping lists, and remembered product preferences
• Audit logs — every action the agent takes on your behalf in Gmail or Google Calendar
• Usage events — model and token counts for cost accounting
• Content reports — if you report an agent message you find objectionable, we store the reported message text and any reason you provide so our team can review it and act on it

6. Device data

When you enable push notifications: your Expo push token and the timezone reported by your device (used to deliver the 7am Morning Brief in your local time).

7. Financial data

When you make a purchase through 24/7 Mom we receive and store: the order details, the merchant (Crossmint, Instacart, etc.), the status, and a record of the transaction. Stablecoin payment records (USDC-on-blockchain transactions handled by Crossmint) include on-chain transaction identifiers. We do not receive or store your credit-card number, bank-account details, or wallet private keys.

8. Connected health & fitness data (source: Apple Health, Oura, or WHOOP — with your explicit consent)

If you connect a health or fitness source in Settings, we read the metrics you authorize — steps and activity, sleep, heart rate and heart-rate variability, and workouts. On iOS this uses Apple HealthKit and is read on-device only after you grant permission for each category in Apple’s system Health prompt; Oura and WHOOP data is read from their APIs using a token you authorize. We use this data solely to show your in-app health trends and to personalize your daily brief. We never use health or fitness data for advertising, and we never share it with third parties for marketing. You can disconnect any source at any time in Settings, and this data is deleted when you disconnect the source or delete your account.

How we use each category

We use your data only to provide and improve user-facing features that are prominent in the 24/7 Mom app. We do not sell your data. We do not use it for advertising. We do not transfer it to third parties for any purpose other than operating the service or as required by law.

Google API Services User Data Policy — “Limited Use”

Our handling of data obtained from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements reproduced verbatim below:

Limited Use: Your use of data obtained via the product’s specified scopes must comply with the below requirements. These requirements apply to the raw data obtained from the scopes and data aggregated, anonymized, or derived from them.

• Limit your use of data to providing or improving user-facing features that are prominent in the requesting application’s user interface;
• Transfers of data are not allowed, except:
  • To provide or improve your appropriate access or user-facing features that are visible and prominent in the requesting application’s user interface and only with the user’s consent;
  • For security purposes (for example, investigating abuse);
  • To comply with applicable laws; or,
  • As part of a merger, acquisition, or sale of assets of the developer after obtaining explicit prior consent from the user.
• Don’t allow humans to read the data, unless:
  • You first obtained the user’s affirmative agreement to view specific messages, files, or other data, with the limited exception of use cases approved by Google under additional terms applicable to the Nest Device Access program;
  • It is necessary for security purposes (for example, investigating a bug or abuse);
  • It is necessary to comply with applicable law; or
  • The data (including derivations) is aggregated and used for internal operations in accordance with applicable privacy and other jurisdictional legal requirements.

All other transfers, uses, or sales of user data are prohibited, including:

• Transferring or selling user data to third parties like advertising platforms, data brokers, or any information resellers.
• Transferring, selling, or using user data for serving ads, including retargeting, personalized or interest-based advertising.
• Transferring, selling, or using user data to determine credit-worthiness or for lending purposes.

You must ensure that your employees, agents, contractors, and successors comply with this Google API Services User Data Policy.

Sub-processors

We rely on the following sub-processors to operate the service. Each receives only the categories of data necessary for its function.

Data retention

We keep different categories of data for different periods. The windows below are what will apply in the published policy.

When you delete your account, all of the above categories are removed from our systems within the deletion cascade described under “Your rights” below.

Retention exception for data export requests: If you have requested a data export within the past 30 days, automated retention deletion is paused for your account until that window closes. Account deletion (which removes all your data immediately) is not affected by this exception.

Your rights

You have the right to:

• Access and export your data — via Settings → Export my data, you can download a machine-readable JSON bundle of every row associated with your account (profile, kids, chat history, events, orders, health metrics, audit logs, etc.). Token and credential fields are stripped from the bundle for safety. This satisfies both your right of access and your right to data portability.
• Delete your account and all associated data — via Settings → Delete account. The cascade revokes external OAuth tokens (Google), removes your agent container and all of its memory, deletes every database row referencing your account, and deletes your Clerk identity.
• Correct inaccurate data — edit your profile in Settings, edit kid records, or contact arnav@247mom.ai.
• Withdraw consent for a connected service at any time — Settings → Disconnect Google / Canvas. Disconnecting revokes the OAuth grant where the provider supports a revoke endpoint and nulls the local credential.

Consents we record at onboarding

When you sign up we record explicit, versioned grants for each of the following. The version is captured alongside the grant so that if the underlying document changes we will re-prompt you for a fresh acknowledgement:

• Acceptance of these Terms of Service
• Acknowledgement of this Privacy Policy
• Your representation that you are 18 years of age or older
• Parental authority and authorization to provide children’s information — required only if you add one or more children to your household
• Household-member authorization to provide partner information — required only if you choose to add a partner

These consent records persist while your account is active and are included in any data export you request.

Children’s data

The 24/7 Mom app is designed for and directed to adult parents and caregivers, not children. We do not knowingly collect personal information directly from children under 13. Information about children (names, ages, school data via LMS, schedules) is provided by the account-holding parent or caregiver, who represents that they have legal authority to provide this information. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information. Parents can review, request deletion of, or refuse further collection of their children’s information at any time via the in-app account deletion flow or by contacting arnav@247mom.ai.

Health data

24/7 Mom collects health-related information from two sources, both only with your involvement: (1) information you enter yourself during onboarding or in Settings — your children’s allergies and your household’s dietary preferences — which we use to filter agent suggestions (meals, shopping lists, recipes) so they respect your family’s safety constraints; and (2) health and fitness metrics from a source you explicitly connect — Apple Health, Oura, or WHOOP — as described under “Connected health & fitness data” above (steps and activity, sleep, heart rate and heart-rate variability, and workouts), which we use to show your in-app health trends and personalize your daily brief.

24/7 Mom is not a medical device. Nothing the agent says about your or your family’s health constitutes a medical diagnosis or medical advice. We are not a HIPAA-covered entity; the health, fitness, dietary, and allergy data you choose to share with us is consumer health information, not Protected Health Information under HIPAA in this context. All of it is encrypted in transit (TLS) and at rest (Supabase managed storage), is never used for advertising and never shared with third parties for marketing, and is removed when you disconnect the source, delete the corresponding record (e.g., a child profile), or delete your account.

Security

• In transit: All traffic between the app, our API, Supabase, and third-party services is encrypted with TLS.
• At rest: All data in our Supabase database is encrypted at rest. Per-user OAuth tokens are stored as part of the user record and cleared on disconnect.
• Database access control: Row-Level Security (RLS) on every Supabase table denies all direct client reads. Application access goes through our authenticated API only.
• Admin access: Operator access to the admin dashboard is gated by Clerk authentication and a per-user allowlist. Destructive operations require a shared secret plus a typed confirmation phrase.
• Agent isolation: Each user’s agent runs in a dedicated containerized workspace; one user cannot read another user’s memory or chat.
• Breach notification: If a data breach occurs that affects your personal information, we will notify you and the relevant regulators as required by applicable law.

Where your data is stored and processed

Your data is stored and processed in the United States. Our database is hosted on Supabase in the us-east-1 region (North Virginia). Our application servers are hosted on Hostinger in Boston, United States. At this time we do not transfer or process user data outside the United States. If we add infrastructure in other regions in the future, we will update this policy and notify users in advance.

California privacy rights

California residents have additional rights including the right to know what personal information we collect, the right to delete, the right to correct, the right to opt out of sale or sharing (we do not sell or share personal information for cross-context behavioral advertising), and the right to non-discrimination. Exercise these rights via arnav@247mom.ai or the in-app account deletion flow.

Future integrations

The Apple Health, Oura, and WHOOP integrations described above are now available; you are asked to grant explicit consent (and, on iOS, per-category Apple Health permission) before any health or fitness data is collected from these sources. If we add further data integrations in the future, we will update this Privacy Policy with the applicable data categories, retention windows, and sub-processor handling before that integration ships.

Changes to this policy

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top and, for material changes, notify you via the app and/or by email at the address on file. The current version of this policy is always available at batoom-legal.netlify.app/privacy-policy. Prior versions are available on request at arnav@247mom.ai.

Contact

For privacy questions, data requests, or to report a concern:

This Privacy Policy is effective June 4, 2026 and was last updated July 8, 2026.