Privacy Policy

Who is responsible

Swing Labs Group Pty Ltd
ACN 703 319 859 · ABN 60 703 319 859
Office D144, Level 1, 888 Brunswick Street, New Farm QLD 4005 AUSTRALIA
contact@butlerhousehold.com

Swing Labs Group Pty Ltd ("we", "us") operates Butler: Household Assistant ("Butler"). We handle personal information in line with the Australian Privacy Principles. This policy explains what stays on your device, what leaves it, who receives it and the choices you have.

The short version

Your household lives on your iPhone or iPad, and we cannot see it. Information leaves your device only when you use Butler AI, which stays off until you allow it; when we check that your subscription is active; or when you choose to share or export something. We do not sell personal information, show advertising or track you across other apps.

What stays on your device

Butler keeps the household information you choose to enter: your name, family members' names and optional ages, household helpers and contacts, plans, tasks, shopping, meals, bills, notes, your conversations with Butler and imported files. This can include sensitive information, such as health appointments or documents about children. Only add what you need and are entitled to share, particularly about children, household helpers or another adult.

On a new installation, Butler encrypts your household records and imported documents on the device with a key protected by the device. Some copies sit outside that protection: files you export or share, the original file in the app you chose it from and any temporary copy kept by the document picker, notification previews on your lock screen, and your device's own backups. If the device key is lost, encrypted data cannot be recovered, so keep an export if you need a separate copy. Your household does not sync between devices.

If you add a Butler widget to your Home Screen, Butler shares a small summary with it on your device: how many things are on today and the times of the timed ones. The widget never shows titles, names, notes or places, and the summary does not leave your device.

What we receive

We do not operate user accounts and we cannot access the household stored on your device. We receive only:
- what you send to Butler AI, described below;
- an anonymous app identifier created by Butler and your subscription status, to confirm that your device has an active trial or subscription;
- technical request data, such as time, size and error codes, needed to run and protect the service.

Butler AI and your permission

Butler AI is off until you allow it. Before anything is sent, Butler shows you what will be sent and who receives it, and asks for your permission. Without it, Butler still answers simple requests on your device without sending anything. You can turn Butler AI off at any time in Settings, and Butler's other features keep working.

When Butler AI is on, each message you send travels over an encrypted connection to our server, hosted by Fly.io in Sydney, Australia, and then to our AI provider, OpenAI, in the United States and other countries, which writes the reply. We send your message, up to eight recent messages and a short index of your household: first names, helper roles, plan titles, dates and references. Phone numbers, ages, saved locations and notes are not included automatically, but anything you type in a message or a title is sent. A PDF or photo is sent in full, and only when you attach it and send it.

If a message or file contains health information about you or a family member, you choose to send it to OpenAI so that Butler can answer your request. If it concerns another adult, send it only with their agreement. Do not send passwords, payment card details, identity documents or records you are not entitled to share. Instructions hidden inside a file cannot change your household: every suggestion waits for your confirmation.

Butler only suggests changes such as plans, tasks or reminders, and nothing changes until you confirm it. We do not use computer programs to make decisions that could significantly affect your rights or interests.

Who receives information

• OpenAI OpCo, LLC receives Butler AI requests to write replies and processes them in the United States and other countries.
• Fly.io hosts our server in Sydney, Australia.
• Fly.io, Inc. keeps our server's technical logs in the United States for about 7 days. These logs contain no message or file content, names or identifiers.
• RevenueCat, Inc., in the United States, receives your anonymous app identifier, your App Store purchase records and basic device information (device type, operating system, language and currency) to confirm your subscription.
• Apple processes payments through the App Store under its own privacy policy. We never receive your payment card details.
• Anyone you choose to share a snapshot, a list or an export with.

We disclose personal information to recipients overseas, mainly in the United States, when you use Butler AI and when we check your subscription. OpenAI may also process requests in other countries through its own service providers. We take reasonable steps, including contractual commitments about purpose, security, confidentiality and deletion, so that these recipients handle personal information consistently with the Australian Privacy Principles. We will update this policy, and ask for your permission again in the app, before we change AI provider.

How long information is kept

Our server keeps an encrypted copy of each reply for about 30 minutes, so a failed request can be retried without being charged twice. Daily usage counts are kept for up to 35 days, monthly cost totals for about 400 days and connection records for up to 7 days. These records contain no message or file content. Files are processed in memory and never saved on our server. Daily backups of the server's database, which contain no message or file content other than encrypted replies awaiting a retry, are kept for 5 days.

OpenAI does not use API requests to train its models. It may keep them for up to 30 days to monitor abuse and safety, or longer where the law requires or a safety review is needed. We ask it not to store replies, and files are sent with each request rather than uploaded to its file storage. This is not end-to-end encryption: the provider receives the content it needs to answer.

On your device, information stays until you delete it. A removed document stays in Recently deleted, with its file, until you delete it permanently.

Security

We use encrypted connections, encrypt your household on the device and encrypt cached replies on our server. Our server is configured so that message content, files, names and access keys are not written to its logs. These measures have not been independently certified, and no system is completely secure.

Sharing, export and deletion

Settings can export your household as a JSON file. The export is not encrypted and lists documents without their contents, so treat it as private. Sharing a document creates a temporary copy for the person you choose; Butler tries to remove its own copy afterwards but cannot take back a copy someone has received.

Deleting your household in Settings removes its records and documents from this device and turns off Butler AI. It does not cancel your App Store subscription, and it cannot erase exports, files held by other apps, device backups or copies already held by our providers. Export and deletion are always available, whether or not you subscribe. The fictional sample household is stored separately and never sends reminders.

Usage counts and support

Optional usage counts and correction reports stay on this device, separately for each household. Daily counts are kept for 90 days and up to 100 correction reports are kept. Reports store a reason and local references, never the text of a reply. You can turn counts off or erase them in Settings, and sharing a summary is up to you. Help prepares an email that you can read before sending; nothing from your household is attached automatically.

No advertising, tracking or sale

We do not sell or rent personal information, we do not use it for advertising, and Butler contains no advertising or cross-app tracking software.

Children

Butler is designed for adults managing a household. It does not offer accounts for children and is not directed at children. Family profiles are records you create, not accounts.

Data breaches

If we become aware of a data breach involving information we hold that is likely to cause serious harm, we will promptly assess it, take steps to contain it, and notify the people affected and, where required, the Office of the Australian Information Commissioner.

Your rights and complaints

You can view, correct and delete your household at any time in the app. For questions, access or correction requests about information we hold, email contact@butlerhousehold.com. We aim to respond within 30 days and may ask for reasonable proof of identity first. We cannot access information that exists only on your device.

To make a privacy complaint, email contact@butlerhousehold.com. We will acknowledge it within 7 days and give you a written response within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you live outside Australia, privacy laws where you live may give you additional rights, and nothing in this policy limits them.

Changes to this policy

We will update this policy when our practices change and show the new version above. Before a material change applies, such as a new AI provider, a new kind of recipient or a new purpose, we will tell you in the app and, where required, ask for your permission again.