Family MCP privacy policy

Last updated 20 October 2026.

Who we are

Family MCP is operated by Zenith Consulting Services Pty Ltd (ABN 29 918 988 901), based in Brisbane, Australia. We handle personal information in line with the Australian Privacy Principles. For any privacy question, email james@zenithconsultingservices.com.au.

What we collect

• Sign-in details: each family member's email address and name. We create sign-ins only for adult family members.
• Family records: what family members ask Family MCP to keep, such as activities, to-dos, birthdays, people and notes. These can include details about family members, including children, entered by their parents.
• Change history: every change to the family's records, with who made it and when, so a change can be undone.
• Google connection: the email address of the Google account the family connects, and an encrypted Google sign-in (refresh token).

What Google data Family MCP uses, and why

Each family connects its own Google account. Family MCP uses it only to answer that family's own requests:

• Gmail: it reads emails to answer questions such as "did the school email us?", and creates drafts. It never sends email; a person sends drafts from Gmail.
• Google Calendar: it reads events and adds, changes or removes them when a family member asks and confirms. It reads the list of calendar names so a family member can choose a calendar by name.
• Google Drive: it can find and read files in the connected account's Drive when a family member asks. It cannot change or delete them. It can write only to files it created itself, in a folder of its own.
• Google Photos: it sees only the photos a family member picks in the Google Photos picker.
• The account's email address, to know which Google account is connected.

How it is used

To answer a request, the relevant data passes through the AI assistant the family uses (Claude, by Anthropic, or ChatGPT, by OpenAI), under the family's own terms with that provider. Family MCP does not keep copies of emails, events or files beyond what a family member asks it to save as a family record.

Google API Services User Data Policy

Family MCP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is used only to provide the features described above. It is not used for advertising, not sold, not used to train AI or machine learning models, and not read by people except with the family's permission, for security, or to comply with the law, as that policy allows.

Where it is stored

The family's records and the encrypted Google sign-in are stored with Amazon Web Services in Sydney, Australia (ap-southeast-2). Emails, events and files stay in the family's Google account.

Security

• Each family's data is kept separate by row-level security in the database, so one family cannot see another family's data.
• The Google refresh token is encrypted with AWS Key Management Service. Only the Family MCP server can decrypt it.
• Sign-in needs a password and an authenticator app. Traffic is encrypted in transit and the database is encrypted at rest.
• Email, calendar and file content is never written to logs.

Sharing

We do not sell or rent personal information, and there are no ads. Data is shared only with the family's own AI assistant as described above, with Amazon Web Services as our hosting provider, and with Google to carry out the family's requests. We disclose personal information only if the law requires us to.

Retention and deletion

• Family records and their change history are kept while the family uses Family MCP.
• A previewed change waits on the server for at most one day.
• A family member can disconnect Google at any time by asking Family MCP to disconnect Google, or by removing Family MCP in the Google account's security settings under third-party connections. Disconnecting revokes access and deletes the stored Google sign-in.
• To remove a family member or a whole family, email james@zenithconsultingservices.com.au. We sign them out and disable their sign-in, and on request we delete the family's data.

Your rights

Under the Australian Privacy Act 1988 you can ask to see the personal information we hold about you and ask us to correct it. Email james@zenithconsultingservices.com.au and we will respond within 30 days. If you are unhappy with how we have handled your information, you can complain to the Office of the Australian Information Commissioner.

Contact

Zenith Consulting Services Pty Ltd (ABN 29 918 988 901), Brisbane, Australia. james@zenithconsultingservices.com.au

Changes

We will post any changes here with a new date. If we start collecting anything new, we will update this page first.

Family MCP home | Terms of use