Privacy

Effective 20 September 2026.

Rapport holds the shared picture of a household, a friend group or a team, and lets each member’s own AI read and write it. That means we hold ordinary domestic detail, so this page is specific about what is kept, who can reach it, and how to get it back or get rid of it. The operator is named in the terms. Everything runs in the United States, on Amazon Web Services in us-east-1, behind Cloudflare.

What we store about you

Your email address and name, from the Google account you sign in with. We never see your Google password.
The groups you belong to, your role in each, and who invited you. An invite link is stored as a one-way hash, so the link itself is not sitting in our database.
What you and your group put in: shared facts and notes, documents and every version of them, the Kitchen — what is in the fridge, freezer and pantry, meal plans, the shopping list — and an activity feed that records each change, who made it, and what the row looked like before and after.
Anything you save privately. It is stored the same way and marked as yours, and it is returned only to you.
Which AI clients you have connected — the name the client registered under, when it connected, and its access token. You can see the list and cut any of them off from your account page.
When you connect an outside account, such as a supermarket, we store what kind it is, the label you gave it, which shop you picked, whether it is working, and the keys that account gave us — never your password for it, which we never see. Those keys are stored encrypted, and the encryption key is held separately, in AWS Systems Manager Parameter Store, and is never in the database. A database backup therefore contains nothing usable. Disconnecting deletes our copy of the keys outright.
When you add an MCP server of your own as a source, we store its address, the name you gave it, the name it reports for itself, the names and descriptions of the tools it offers, whether it is working, and — if it needs one — the token you gave us, encrypted the same way. We do not keep what it returns: a reply goes to the AI that asked and is not written down. When a member of a group you shared it with uses it, the group’s activity records who asked and which tool, never the answer.
Which groups you have granted that connection to. Taking a grant back is immediate; we keep the fact that it once existed and when it ended, because “what could the group see in March” is a question this kind of product gets asked.
If you pay, your Stripe customer id and subscription status. Card details are held by Stripe; we never see your card.

Who can see it

A group sees what its members have shared with it, and nothing else. A second group you are in sees nothing the first one does. Anything you save privately is only ever returned to you, and that is enforced by the database itself — every read runs as you, under row-level security, rather than relying on each query to remember a filter. Your AI reaches Rapport through the same door with the same limits, so a connected Claude or ChatGPT can reach exactly what you can reach and nothing more.

We can reach your data as operators of the service. We look at it when you ask us for help, or when we have to investigate abuse or a fault, and that access is logged. We do not read it otherwise, and nobody outside the company has an account on the machine.

Our own website

Signing in sets one session cookie. That is the only cookie we set, and it is essential to being signed in.
We use Mixpanel for product analytics — page views, and actions such as creating a group or saving something. Once you sign in these are tied to your user id and your email address. Mixpanel’s identifier lives in your browser’s local storage, and its requests go through our own domain. There is no session replay, and we never record the text of anything you save.
We use Sentry to collect error reports when something breaks. Cookies, request bodies, authorisation headers, invite tokens and IP addresses are stripped before an event leaves the server. The contents of a memory, a note or a document are never in an error report to begin with.

Email

We send sign-in links, email verification, password resets, and group invitations. That is the whole list. There is no newsletter and no marketing mail, and — deliberately — no per-event mail: somebody adding milk to the list goes to the activity feed, never to your inbox. Mail goes out through Amazon SES; an address that bounces or reports us as spam is suppressed permanently, and that suppression record stores a one-way keyed hash of the address rather than the address.

Who else is involved

These companies process data on our behalf, each for the one purpose stated:

Amazon Web Services — hosting, backups, credential storage and email delivery.
Cloudflare — DNS and content delivery in front of the site.
Google — sign-in, if you use it. They learn that you signed in to Rapport.
Stripe — payments and invoices, when you pay.
Mixpanel — product analytics on the website, as above.
Sentry — error reports from the website and our server.
Better Stack — our server logs, held for three days there and thirty days in our own storage, and the external probe that measures whether the site is up.
Kroger — only if you or somebody in your group connects a Kroger account. We send them what you are pricing and the store you chose, and, when you ask us to, the items you want in your own cart. We never send them your Rapport data, and they never send us your purchase history.
Servers you add yourself as sources — only what you, or a member of a group you shared the source with, ask them through an AI: the name of one of their tools and its arguments. Nothing else of yours goes to them, and where they are and who runs them is your choice, not ours.

Anthropic and OpenAI are not on that list, and the direction matters. We do not send your data to a model. Your own Claude or ChatGPT calls us, under your own subscription, and what it then does with what it read is governed by your agreement with them.

We do not sell data, share it with advertisers, or use it to train anything.

How long we keep it

Your account, your groups and their contents are kept while the account exists. History is the point of the product: an edited document keeps its earlier versions, and a memory you replace is superseded rather than erased.
Server logs are held for three days in Better Stack and thirty days in our own storage.
Security records in the audit log — an account created, an address suppressed, an account closed — are kept for one year, and a background job on our server deletes them once they are older than that. They carry internal ids and a one-way keyed hash of an email address, never the address itself, and the hash cannot be turned back into it.
On the free tier, activity and history older than 30 days are not shown. A paid group keeps the lot.

Getting your data, and getting rid of it

Both are buttons on your account page. Download my data gives you a JSON file with everything you can see; Delete everything removes your account, your private memories, notes and reminders, your connections and grants, and your analytics profile, at once rather than within 30 days. No form, no retention offer.

Deleting takes you out of your groups on the way — and a group whose last member leaves is deleted with everything in it. Two things will stop it until you deal with them, and the page says which: a group you still pay for (cancel it from the billing portal first), and a group where you are the only owner and other people are still in it (make someone else an owner, which the same screen offers).

Two honest exceptions. First, what you contributed to a group’s documents stays with the group, with your name taken off the history — the other members are still working on them, and tearing the text out would leave holes in their own edits. The same is true of the activity feed and of who put what in the Kitchen. Your memories and notes go with you, including the ones you wrote into a group. Second, Stripe records we are required to keep for tax and accounting are kept for as long as the law requires.

You can also cut off a single AI client at any time from your account page, which revokes its token and its consent together; it has to be authorised again from scratch.

If you are in the EU, the UK or California, those laws give you these rights by name. We honour them for everyone.

Children

You must be 13 or older to have a Rapport account, and 18 or older to pay for one. Children can be named in a group — on a chore, on a meal, on the list — without having a login or an account, and a name is all that is stored about them. If you believe a child under 13 has created an account, email us and we will remove it.

Security

Everything travels over HTTPS, and the server accepts connections only through Cloudflare.
Every query runs as the person making it, under database row-level security, so tenancy is the database’s answer rather than something each query has to remember.
The keys to a connected outside account are encrypted (AES-256-GCM) before they are stored, and the encryption key lives in AWS Systems Manager Parameter Store, never in the database. Whoever holds a copy of the database holds nothing they can use.
An AI client holds its own revocable token. It never holds your password.
Backups are encrypted and kept in our own storage in the same region.

No system is perfect. If you find a way to see something you should not, email us and we will fix it and tell you what we did.

Changes

We update this page when what we do changes, in the same release as the change itself. A change that matters — a new company on the list above, a new kind of data — is emailed to account owners before it takes effect.

Contact

[email protected]. A person reads it.