Sidebar privacy notice

Version 2026-10-26 · Effective October 26, 2026

Sidebar is a shared record between two parents. This notice says what it keeps, who sees it, who handles it for us, and what happens when you delete it. Phynk LLC, a California company, makes Sidebar and is responsible for your information.

Sidebar shares accounts with Exhibit A, which has its own notice. Our websites are covered by the websites' notice. Sidebar is for adults in the United States.

A shared record

Sidebar works differently from most messaging apps, on purpose:

Messages can't be edited or deleted. What you send stays as you sent it, for both of you.
Seen times are always shown. When you open a message, the other parent sees when, and it's part of the record.
The other parent keeps the shared thread, even if you delete your account.
Either parent can copy the thread into their own Exhibit A case. If a parent has an Exhibit A case, everything sent in Sidebar can be copied into it as it's sent, Seen times included. The other parent isn't told. Both parents have the same option.

What we collect, and where it comes from

Your account

Your email address, name and password. We keep the password only as a one-way hash, never the password itself.
Your second sign-in step: an authenticator app (we keep its secret encrypted) or a US or Canadian phone number we text codes to. Backup codes are kept only as hashes.
Your phones: the device name, type and when it was last used. A phone's sign-in lapses after 90 days without use.
Your settings.

What you and the other parent put in

Names each of you shows in Sidebar, and the invitation that connected you.
Messages and reactions, and when each was sent and seen.
Files: photos, videos, voice notes and PDFs. Your phone removes location details from photos and videos before they're uploaded.
Your children's first names and birthdays (see Children's information).
Schedules and holidays, requests to change them, and the answers.
Events and to-dos, shared with the other parent or marked Just me (private to you).
Orders and school calendars you upload. These are private to you.
Events Sidebar's AI finds in photos, PDFs, text and email you give it, for you to confirm.
Your calendar email address: each parent gets an address to forward email to, such as a school newsletter. We keep the emails sent to it so Sidebar can find events in them.

What's never stored

Typing: when you're typing, the other parent is told live, but it's never stored. You can turn it off.
Messages in their send pause stay on your phone until the pause ends. Nothing reaches us before then.

Google Calendar, if you connect it

Sidebar creates its own calendar in your Google account and keeps it up to date. It can reach only calendars Sidebar created, not the rest of your Google Calendar. We keep the access token encrypted until you disconnect.

From how you use Sidebar

An access log: which account did what, to which item (by ID), and when, with a keyed hash of your IP address rather than the address itself. We use your IP address in memory to limit repeated attempts, and don't store it.
AI cost records: how much AI work was used, without its content.
Analytics and session replay through PostHog (see Analytics and session replay).

On your phone

Sidebar keeps a copy of your thread on your phone so it opens quickly. Its messages database is encrypted. Photos and videos cached on the phone are kept in the app's private storage. Both are removed when you sign out.

Children's information

Sidebar is for parents, not children. You must be 18 or older to have an account, and children can't use it.
A parent enters their children's first names and birthdays so Sidebar can show the schedule, holidays and events. Children's details can also appear in messages, photos and files the parents share.
We use children's information only to run Sidebar for their parents. We don't sell it, use it for advertising, or use it to train AI models.
If you think a child has made an account, tell us at privacy@phynk.com and we'll delete it.

How we use it

We use your information to:

run Sidebar: deliver messages and files, keep the schedule and calendars, and find events for you to confirm;
copy the thread into your own Exhibit A case, if you've turned that on;
keep your Google Calendar up to date, if you connected it;
sign you in and keep your account secure, including sending sign-in codes and emails about your account;
find and fix problems, and make Sidebar easier to use;
keep Sidebar and its users safe, and meet our legal obligations.

We don't sell your information, we don't use it for advertising, and we don't use your content to train AI models.

AI

Sidebar uses AI models to find events and to-dos in the photos, PDFs, text, school calendars and emails you give it, and to answer the questions you ask in Ask. That content is sent to these providers so they can do that work, under their business API terms:

Anthropic: reading photos, PDFs, orders, school calendars and messages to find events. It also searches the web for your children's school calendars, using the school's name. When you ask a question in Ask, it reads your question and what Sidebar looks up to answer it: the thread, the schedule, the calendars and, if you linked them, your own Exhibit A cases.
OpenAI: building a search index of your thread's messages, and of what Ask searches for, so Ask can find messages by what they mean. Both parents' messages are indexed, because the thread is shared. If you linked your own Exhibit A cases, Ask searches them through Exhibit A's search indexes, which OpenAI builds from their messages, order passages, captions, transcripts and questions.
If you copy your thread into your own Exhibit A case, Exhibit A's AI services read it there too, as the Exhibit A privacy notice describes.

What the AI finds is a suggestion. Nothing goes on the shared calendar until a parent confirms it. Your questions in Ask, and their answers, are yours: the other parent never sees them.

The other parent

The other parent sees everything in your shared thread: messages, reactions, files, Seen times, the shared schedule and changes to it, shared events and to-dos, and your answers to their requests. They don't see what you've marked Just me, the orders and calendars you upload, or your calendar email.

Your Exhibit A case, and your lawyer

If either parent copies the thread into their Exhibit A case, it's handled under Exhibit A's notice, and that parent may share it with their lawyer.

Companies that run parts of Sidebar for us

They handle your information only to provide their service to us:

Google Cloud: hosting and our database (in Oregon, US).
Cloudflare: our websites, network protection, file storage (in western North America), and sending and receiving email, including email to your calendar address.
Anthropic: the AI service above.
OpenAI: the search index above.
Twilio: texting sign-in codes, if you chose that (your phone number and the code only). We may move this to Telnyx, which would get the same.
PostHog (US): analytics, error reports and session replay.
Google Calendar: only if you connect it.

When the law requires it

We'll disclose information if the law requires it, such as a valid subpoena or court order, or if it's needed to protect someone from serious harm. Unless the law or a court forbids it, we'll tell you first so you can object or speak to your lawyer.

If Phynk changes hands

If another company takes over Sidebar, your information would go with it, under the promises in this notice.

We don't share your information with anyone else.

Analytics and session replay

We use PostHog to see how Sidebar is used, find errors, and watch recordings of sessions to see what's confusing. Once you sign in, PostHog links this to your account by its ID, your name and your email, so we can help if something went wrong for you.

Recordings show what's on your screen, including your thread, messages and photos; password, email and phone fields are hidden. Only staff who work on Sidebar can watch them, and only to fix and improve it.

How long we keep it, and deleting it

Until you delete it. We keep your account and what's in it until you delete your account.
30 days to undo. When you delete your account, it's hidden at once. For 30 days you can sign in again to bring it back. After that, it's removed for good.
What the other parent keeps. The shared thread stays with the other parent: messages, the schedule and changes to it, with your name on your part. Your Just me items are deleted. Requests waiting for an answer close as not answered.
Copies in Exhibit A stay in whichever parent's case they were copied to, under that case's rules.
Backups. Our database backups rotate out over about 30 more days, so deleted information can stay in a backup that long before it's gone.
What we keep after deletion: AI cost records (without content), and the access log (account IDs, what was done and to which item (by ID), times and hashed IP addresses), which we keep for security.
Short-lived things: invitations expire after 14 days, sign-in and reset codes within 30 minutes, texted codes within 10. Files that were never sent are removed after a day, and files that arrived by email after a week.

Security

Each file has its own encryption key. Secrets and access tokens are encrypted. Passwords, codes and IP addresses are kept only as hashes.
Signing in takes two steps.
On your phone, the messages database is encrypted, and photos and videos cached there are kept in the app's private storage. Both are removed when you sign out.
Our database is on a private network, and connections to it are encrypted.

No system is perfectly secure. We don't scan files for viruses, so take care opening files you didn't make. If we learn of a breach that affects you, we'll tell you as the law requires.

Your choices and rights

Typing: turn off showing the other parent when you're typing.
Google Calendar: disconnect at any time.
See and correct: you can see your information in Sidebar and change your account details and settings there. Messages can't be changed. For anything else, ask us.
Delete: delete your account in Sidebar, or ask us to. The shared thread stays with the other parent, as explained above.
A copy: ask us and we'll send you a copy of your information.

Write to privacy@phynk.com. We'll check it's really you before we act on a request.

California residents

If you live in California, the California Consumer Privacy Act gives you the rights below. This section uses the law's terms.

What we collected in the last 12 months

Identifiers: name, email address, phone number, account ID, device names, your calendar email address, and a hashed IP address.
Customer records (Cal. Civ. Code § 1798.80(e)): name, email address, phone number.
Characteristics of protected classifications: children's birthdays, and family status.
Internet or other electronic network activity: how you use Sidebar, sign-ins, Seen times, the access log, and session replay recordings of your screen.
Audio, electronic and visual information: photos, videos and voice notes. Location is removed from photos and videos on your phone before upload.
Inferences: events and to-dos Sidebar's AI suggests.
Anything else in your messages and files, such as information about health, school or money, if you or the other parent send it.

Sensitive personal information we collect: your account sign-in (email and password); the contents of your messages and the email sent to your calendar address; and any sensitive details in them, such as health information. We use sensitive personal information only to provide Sidebar to you and for the other purposes the law allows, not to infer things about you.

Sources: you; the other parent; email sent to your calendar address; Google Calendar, if you connect it; public school calendars on the web; and Sidebar itself, which suggests events.

Purposes: those in How we use it.

Disclosures: we disclose each category to the service providers in Who we share it with, for the business purposes described there; your shared thread goes to the other parent.

No sale or sharing. We don't sell your personal information or share it for cross-context behavioral advertising, and haven't in the last 12 months. We don't knowingly sell or share the personal information of anyone under 16.

Retention: as in How long we keep it, for every category: until you delete your account, plus 30 days to undo, plus about 30 days for backups; the shared thread stays with the other parent, and cost records and the access log are kept after that.

Your California rights

Know and access: ask what we've collected about you, where it came from, why, and who we disclosed it to, and get a copy.
Delete: ask us to delete it, subject to the law's exceptions. Because the thread is a shared record, deleting your account doesn't remove it from the other parent's side.
Correct: ask us to correct anything that's wrong. Sent messages stay as they were sent, but you can send a correction in the thread.
Limit: ask us to limit our use of sensitive personal information. We already use it only to provide Sidebar.
Opt out of sale or sharing: we don't sell or share, so there's nothing to opt out of.
No discrimination: we won't treat you differently for using any of these rights.

Making a request: email privacy@phynk.com. We'll confirm we got it within 10 business days and answer within 45 days, or tell you if we need longer, as the law allows. We'll verify your identity, usually by asking you to confirm from the email address on your account.

Authorized agents: someone you authorize can make a request for you. We'll ask for your signed permission and may ask you to confirm your identity with us directly.

Changes and contact

Each version of this notice has a version number. This one is Version 2026-10-26. If we make a change that matters, we'll tell you by email or in Sidebar before it takes effect.

Privacy questions and requests: privacy@phynk.com. Anything else: support@phynk.com. Both reach a person. Our Terms of Service also apply.

Version 2026-10-26. Effective October 26, 2026. Last updated October 26, 2026.