Last updated:
July 31, 2026
Privacy, in plain English
Your family’s data is not our business model.
We do not sell your data.
We do not use your family’s schedules, messages, photos, health details, or children’s conversations for advertising.
We do not use your family’s personal information to train general-purpose AI models.
Your family’s information is not public. Only people you authorize and the providers needed to run and protect Andi can access it, except when law or safety requires otherwise.
Parents approve and control child accounts, including who can access them.
The full notice below explains what we collect, why we need it, and when it may be disclosed.
Andi AI, Inc. (“Andi,” “we,” “our,” or “us”) provides a family coordination and AI companion service. This Privacy Notice explains how we collect, use, disclose, and protect personal information when you use our website at andi.ai, our mobile application, and related services (collectively, the “Services”).
Andi is built around adult-owned family accounts. A child does not create an independent Andi account. A parent or legal guardian creates or invites the child, approves the child’s access, and retains control over the child’s account and information.
1. Scope and Updates
This Privacy Notice applies to personal information processed through the Services. It does not apply to a third-party service that you choose to connect to Andi, such as a calendar provider, before that information reaches Andi.
We may update this Privacy Notice as our Services or legal obligations change. If a change is material, we will provide notice through the Services, by email, or by another appropriate method before the change takes effect when required by law. The “Last Updated” date shows when this version was revised.
2. Who May Use Andi
Only an adult who is at least 18 years old may create and own an Andi family account. A child may use Andi only through a parent-controlled child account. The parent or legal guardian:
creates the child’s profile or sends the invitation that allows the child to join;
approves activation of the child’s access;
controls the child’s permissions, connected features, and family sharing;
can review and correct the child’s profile and information;
can revoke the child’s access and request deletion of the child’s information; and
remains responsible for the child’s use of Andi.
A child cannot independently register for Andi, accept our Terms of Service, invite a caregiver, connect an external service, or change the family’s permissions. Caregivers and other adults may receive limited access only when invited by an authorized adult and only within the permissions that adult grants.
3. Personal Information We Collect
The information we collect depends on the features your family chooses to use.
Adult account and authentication information may include name, email address, phone number, profile photo, age or date-of-birth confirmation, sign-in provider identifiers, one-time verification codes, authentication events, roles, family membership, invitations, and permissions. Andi currently uses passwordless sign-in and does not ask you to create an Andi password.
Family and child profile information may include names, nicknames, pronouns, dates of birth, ages, relationships, school and grade, activities, routines, schedules, preferences, allergies, dietary restrictions, medical notes, accessibility needs, emergency contacts, household and care information, caregiver relationships, child permissions, and parental approval records.
Family content and communications may include prompts, messages, AI responses, family chat, feedback, family memory, summaries, preferences, inferences, tasks, goals, reminders, nudges, calendars, events, locations, attendees, care instructions, photos, images, documents, attachments, email content, voice input, audio sent during a voice session, transcripts, text summaries, support messages, bug and safety reports, and records of actions. Andi does not currently store raw realtime voice recordings on its own servers. Audio is transmitted to speech and AI providers to conduct the session; we may store transcripts, conversation turns, summaries, tool actions, safety events, and usage records.
Device, usage, and location information may include device type, operating system, app version, language, network information, app identifiers, push tokens, IP address, browser type, access time, feature and interaction events, sessions, diagnostics, crash and performance data, general location inferred from IP, and precise location, contacts, photos, camera, or microphone access only when you enable a feature and grant device permission.
Connected services and subscription information may include Google Calendar or Microsoft Outlook event data, attendees, descriptions, locations, availability, and connection tokens. We may receive purchase status, product, entitlement, renewal, and transaction identifiers from an app marketplace and our subscription provider, but not full payment-card numbers.
We may also receive information about you from another authorized family member, caregiver, connected service, communications provider, or someone who sends content to Andi. The adult family owner is responsible for having authority to provide information and invite other people.
4. Google Workspace API Data
When an authorized adult chooses to connect Google Calendar, Andi accesses the adult’s Google account email and data from the adult’s primary calendar needed to provide the connection. This may include event identifiers, titles, descriptions, dates and times, all-day status, locations, availability and visibility, organizer information, the connected user’s attendance response, recurrence information, conferencing and event links, attachment links, external event identifiers and URLs, and OAuth tokens.
Andi uses this data only to sync and display Google Calendar events in Andi; create, update, or delete calendar events when the connected user directs Andi to do so; answer the user’s schedule questions; detect scheduling conflicts; and provide calendar reminders, summaries, and other visible family-scheduling features.
Andi does not use, retain, transfer, or disclose Google Workspace API data, including raw data and data derived from it, to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. Where AI processing is needed to provide a calendar feature, a service provider may process Google Workspace API data only on Andi’s behalf to provide or support the personalized, user-facing feature for the user or family that connected the calendar. Neither Andi nor its service providers may use that data to train generalized or non-personalized models.
Andi does not use Google Workspace API data for advertising, marketing, data brokerage, credit or lending decisions, or analytics unrelated to the connected user-facing features. We disclose it only to service providers needed to provide, improve, or secure the connected user-facing features, with the connected user’s consent; when necessary for security purposes; when required by applicable law or legal process; or as part of a merger, acquisition, or sale of assets after obtaining the user’s explicit prior consent. We do not allow humans to read Google Workspace API data unless the user has provided documented, explicit consent to review specific data; access is necessary for security purposes; access is required by applicable law or legal process; or the data is aggregated and anonymized and used for lawful internal operations. The broader uses described elsewhere in this Privacy Notice do not apply to Google Workspace API data when they conflict with this section.
5. How We Use Personal Information
We use personal information to:
create and secure adult-owned family accounts and parent-controlled child accounts;
provide family memory, conversations, voice features, calendars, tasks, reminders, nudges, caregiver handoffs, and connected services;
personalize Andi to the family;
give the parent or guardian visibility into and control over a child’s account and information;
process invitations, verify contact information, manage subscriptions, and send service communications;
provide support and respond to privacy requests;
detect and prevent fraud, abuse, security incidents, harmful content, and violations;
monitor reliability and understand feature use;
improve and evaluate the Services using privacy-protective testing and analysis;
comply with law and protect safety and rights; and
send product news or marketing to adults where permitted.
We do not direct behavioral advertising to children. Google Workspace API data is governed by the narrower uses and restrictions in Section 4. It is excluded from any use listed in this section that would conflict with Section 4.
6. AI and Voice Processing
AI is central to Andi. We use AI to respond to requests, create family-specific memory and summaries, identify relevant context, support voice conversations, suggest actions, and apply safety safeguards.
We do not use a family’s personal information, including a child’s conversations, to train general-purpose AI models or for advertising. AI, speech, and observability providers process information on our behalf to operate, secure, and evaluate the Services. Their processing may include prompts, responses, transcripts, technical metadata, and safety signals. Their processing of Google Workspace API data is subject to the narrower restrictions in Section 4.
AI can be inaccurate or incomplete. Parents should review important outputs and should not rely on Andi as a substitute for medical, legal, emergency, or other professional advice.
7. How We Disclose Personal Information
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We may disclose information in the circumstances described below.
7.1 Within the Family and to Authorized Caregivers
Family information is available to authorized family members based on their role. A parent or family owner decides whether to invite a caregiver and what the caregiver may access through Care Share. The parent can change or revoke that access.
7.2 Service Providers
We use service providers to operate Andi. Depending on the feature, these may include:
• AI, speech, and AI observability: OpenAI, Deepgram, and Braintrust;
• cloud, databases, media, and app infrastructure: Amazon Web Services, MongoDB Atlas, Redis-hosting providers, Imgix, and Expo;
• reliability and product analytics: Sentry and PostHog;
• identity, messaging, and email: Apple, Google, Microsoft, Twilio, and Resend;
• subscriptions: Apple, Google, and RevenueCat; and
• document processing: LlamaCloud, where enabled.
These providers receive the information needed to perform services for Andi. We configure and direct providers to use personal information for the Services, security, support, and legal compliance, not for their own advertising. Processing of Google Workspace API data is additionally restricted by Section 4.
7.3 Connected Services
When an authorized adult connects or directs Andi to interact with a third-party service, we disclose information needed to complete that request. The third party’s own terms and privacy notice apply to its processing.
7.4 Legal, Safety, and Business Events
We may disclose information when reasonably necessary to comply with law or legal process; protect a child or another person’s safety; investigate fraud, abuse, or security incidents; enforce our agreements; or protect Andi’s rights. Information may also transfer as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate protections and notice where required. A transfer of Google Workspace API data as part of a merger, acquisition, or sale of assets is subject to the user’s explicit prior consent as described in Section 4.
7.5 With Adult Direction or Consent
We may disclose information for another purpose when an authorized adult directs us to do so or provides consent, subject to the additional restrictions for Google Workspace API data in Section 4.
8. Parent Control of Child Accounts
The parent or legal guardian who owns or approves a child’s account retains control over it. Subject to identity verification and applicable law, the parent may:
• review the categories and specific pieces of information collected from the child;
• review the child’s profile, saved memory, conversations, and connected information available through the Services;
• correct information;
• change permissions or revoke the child’s access;
• refuse or withdraw consent to further collection;
• request deletion of the child’s information; and
• ask us not to disclose the child’s information except where necessary to operate the child-requested feature.
The child cannot override these controls.
9. Children’s Privacy and Parental Consent
Andi is a family service that may process personal information from children, including children under 13 in the United States. We apply the Children’s Online Privacy Protection Act (“COPPA”) where it applies.
Before activating access for a child or allowing the child to submit personal information, Andi requires the parent or legal guardian to create or approve the parent-controlled child account. Where COPPA or another law requires verifiable parental consent, we provide direct notice to the parent and use a method reasonably designed to verify that the person giving consent is the child’s parent or legal guardian.
We do not condition a child’s participation on providing more personal information than is reasonably necessary for the feature. We do not sell children’s personal information or use it for targeted advertising.
If we learn that a child provided personal information without the required parent approval or consent, we will suspend the child’s access, stop further collection, and delete the information as required by law. A parent or guardian can contact privacy@andi.ai to exercise these controls.
10. Privacy Choices and Rights
Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information; restrict or object to certain processing; withdraw consent; or appeal a privacy decision.
You can update adult and child profiles; manage notifications and device permissions; disconnect Google Calendar or Microsoft Outlook; change or revoke Care Share access; unsubscribe from adult marketing; and request privacy assistance at privacy@andi.ai.
We may verify your identity and authority before completing a request. For a child request, we also verify that the requester is the authorized parent or legal guardian. We will not discriminate against you for exercising a privacy right.
11. Retention and Deletion
We retain personal information only as long as reasonably necessary for the purpose collected, to provide the Services, and to meet legal, safety, security, accounting, and compliance obligations.
In general:
• account, family, child, conversation, memory, calendar, task, caregiver, and connected-service information is retained while the relevant account or family workspace is active;
• child information is deleted when the authorized parent deletes the child’s profile or completes a verified deletion request, subject to limited exceptions;
• raw realtime voice audio is not stored by Andi on its own servers, while transcripts and related records follow family-account retention settings;
• diagnostic, security, support, and safety records are generally retained for up to 30 days, unless a specific issue or legal obligation requires a longer period;
• subscription and transaction records may be retained for accounting, tax, disputes, and marketplace obligations; and
• parental notice, consent, and approval records may be retained to document compliance and protect the child.
When deletion is complete in active systems, limited copies may remain in encrypted backups for up to 30 days before they are automatically deleted. Backup copies are isolated from ordinary use and are restored only for disaster recovery, security, or legal requirements. If a backup is restored, we reapply completed deletion requests before returning the restored data to ordinary use. Deleting an adult login or leaving a family does not necessarily delete a family workspace another authorized adult continues to own. The family owner can use the family-deletion process or contact privacy@andi.ai.
12. Security
We use technical and organizational measures designed to protect personal information, including encryption in transit and at rest, role-based access controls, authentication safeguards, logging, and monitoring. We limit access to people and providers who need the information to operate and protect the Services.
No security measure is perfect. If we identify a security incident involving personal information, we will investigate and provide notice as required by law.
13. International Data Transfers
Andi is based in the United States, and our providers may process information in the United States and other countries. Those countries may have different privacy laws. Where required, we use appropriate safeguards for cross-border transfers.
14. U.S. State Privacy Rights
Residents of certain U.S. states may have additional rights under state privacy laws. These may include rights to know, access, correct, delete, or obtain a copy of personal information, and to opt out of certain sales, sharing, targeted advertising, or profiling. Andi does not sell personal information or share it for cross-context behavioral advertising. To submit a request or appeal a decision, contact privacy@andi.ai. We will respond as required by applicable law.
15. Contact Us
For privacy questions or requests, including requests about a child account, contact: Andi AI, Inc., 525 South White Street, Wake Forest, NC 27587, United States. Email: privacy@andi.ai. Website: https://andi.ai