How we handle school mail

School mail can include a child’s name, health notes, and family details. You choose what reaches us by forwarding it, or by CCing your Parent Brief address. This page is the same promise we show at sign-up. Last updated October 20, 2026.

What we collect

Your name and email, from Google sign-in or a magic link.
School mail you forward or CC to your private address on in.parent-brief.com, plus the brief we write from it.
Children’s first names, and which sender you file under which child.
Billing status from Stripe. Card numbers stay at Stripe. We do not store them.

Mail sent to an address that is not a household we know is dropped. We do not create an account from it, and we do not keep it.

Google sign-in

Continue with Google asks only for your name, email address, and basic profile (openid, email, and profile). That signs you in. It does not open your inbox. We do not request permission to read Gmail.

A magic link is the same idea: identity, not mailbox access. We do not see or store your Google password or your email password.

If you connected Gmail to Parent Brief in the past, you can disconnect in Settings and revoke Parent Brief under Google Account → Security → Third-party access. Disconnecting deletes the Google tokens we stored. We do not offer that mailbox connection during setup.

Who we share data with

We do not sell school mail or Google account data, and we do not use either for advertising. A co-parent sees the brief only if you invite them onto the household. Otherwise we share data with these processors, only so the product can run:

Supabase stores the account, forwarded mail, briefs, and settings.
Resend receives mail you forward and sends the morning brief and short confirmation emails.
OpenAI receives the school mail you sent us so it can be summarized into the brief.
Stripe handles payment. We send Stripe your account email and the plan you pick, not the body of school mail.
Vercel hosts the app.
Google is used for sign-in only, as described above.

Use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements. We use that data to sign you in and to run the feature you asked for. We do not transfer it to others except the processors above, and we do not use it to serve ads.

How we protect it

The site is served over HTTPS. Mail in transit uses TLS.
Production data is limited to the service. Parents only see their own household.
If a Google token is stored, it is encrypted with AES-256-GCM before it is written down.
Inbound mail is accepted only when the webhook signature checks out. Sign-in links and session cookies are signed.
We never ask for your mailbox password.

How long we keep it

We keep your account, the mail you forwarded, and your briefs while the account is open, so the morning brief and the archive still work. We do not keep a separate copy of mail we dropped as unknown.

You can delete a single brief in the app, and remove a child’s name in Settings. Canceling a paid plan stops future charges. It does not by itself delete the account.

To delete the household, email brief@parent-brief.com from the address on the account and ask us to delete it. We delete the account, children’s names, forwarded mail, briefs, and any stored tokens. Stripe may keep billing records where tax or fraud rules require it.

Forwarding

We never open Gmail, Outlook, or Apple Mail to collect school mail. A private address on in.parent-brief.com receives only what you send there. A co-parent can use the same address without an account. When a school email lands, we email you a short confirmation. Gmail’s own forwarding-confirmation message is stored so we can show you the code, and it is not turned into a brief.