Applies to the Capture app, including Nourish and Concierge, which live inside it. Last updated 4 October 2026. This is separate from the Methods and Mode website privacy policy, which covers methodsandmode.com.
While we’re in testing. Capture is being used by a small invited group before its public release. This describes what the app does today, and we update it here as that changes.
1. The short version
Capture holds the things you would otherwise have to remember, which means we hold details about your family. We collect what the app needs and nothing extra, we do not sell any of it, and there is no analytics, advertising or tracking code in the app. What Capture keeps on your phone — what each person always packs, their snacks and their on-the-go activities — stays there and never reaches us. What you tell Nourish to keep out of someone’s food does reach us, because a meal suggestion that has not seen it is not safe to follow. Neither feature asks why any more: an allergy, a belief and a plain dislike are one list, and no reason is recorded in either place — though what is on a list can still say something about a person. Much of what you enter is shared with your household — section 6 says exactly what.
2. What we collect
Your account. Your email address, your display name, and a scrambled version of your password. A child invited by a parent signs in with a username the parent chooses; we generate a placeholder address for them at a domain that does not exist and never send anything to it. If you sign in with Apple, the identifier Apple gives us and, where Apple gives us one, a token that lets us disconnect you later — section 8 says what happens when we do not hold it.
Your household. The names, ages and colors of the people you add, your household name and last names, your home ZIP code with the town and map point it stands for, and how your children’s screens are set up, including the routines and chores they complete. Birthdates, if you add them, so ages stay current on their own. If you hide an event imported from a calendar, we note which one so it stays hidden on your other devices — for Apple, that note includes the event’s title and start time. One copy of all this is kept for the household to share.
What you capture. Reminders and events you create by speaking, typing or photographing — titles, dates, times, places, descriptions, who they belong to. A photo is read and not kept on our servers; your phone keeps its own copy. Bills and subscriptions: amounts, due dates, who issued them, any notes. We never ask for card or bank numbers and there is no field for them. Notes are free text and stored as you write them, and notes saved before 21 September 2026 may still hold an account’s last four digits, which you can delete on the bill. Business cards you scan, including the details printed on them; the photo stays on your phone. For bills and cards, who you chose to share them with. School schedules.
Packing lists. Where you are going, for how many nights, who is coming by first name, and the items — kept for the household so any of you can tick things off. The packing list is not offered in the app right now; it is hidden while we rework it, and lists already made are kept and come back with it.
Concierge. The places, event pages and shops you follow, the names, ages and interests of your household, the ZIP code you search around, plans you make and activities you set aside, hours you correct, and products you ask us to watch. For parents, the places, family list, ZIP code and plans belong to the household; the shops you follow, products you watch and trips you save stay yours. Someone joining a shared trip by link gives only a family name, a number of adults, and an age band per child — and your own family is described to the others the same way, by band, never by exact age.
Nourish. Per person: first name, age, whether they are a child, the things to be left out of their food and whether each one may be served on the side, whether they avoid spice, favorite foods, snacks, and the few foods they will always eat. We do not ask why something is left out, and we keep no reason for it — an allergy, a religious rule, a conviction and a plain dislike are one list, because a kitchen only needs to know what to keep off the plate. For the household: diets, dislikes, cuisines, your planning and shopping days, and notes on suggestions you liked or turned down, which you can see and remove in Nourish settings. Guests you cook for, with names, visit dates, the same list of things to leave out of their food, and anything else you choose to note about them. Your pantry, saved recipes, meal plans, prep lists, and menus for occasions including who brings what. All of it is held for the household as a whole, in a database of its own.
Google Calendar, if you connect it. A token your devices use to reach your calendars, your Google email address, and the access level you granted; your phone also keeps the account name so it can show you which one is connected.
That access is not read-only. Capture asks Google for three permissions — reading your calendars, adding and changing events on them, and managing a separate “Capture” calendar it can create — and the sign-in library adds three more, so Google’s screen asks for six, and Google also hands us your name, profile and email. If you turn on sending captures to a calendar, your phone adds each timed event (title, description, place, start, end) to the one calendar you pick and updates it when the capture changes. It never deletes anything. The permission covers adding and changing events on all of your calendars, not only the one you pick. We kept it that way so you can send a capture to the calendar your family already uses rather than one only Capture can see — but that is what you are granting.
Your phone’s calendar. Same if you send captures to an Apple calendar: the app adds and updates events in the one you pick, on the phone. Those events never reach our servers.
Your device. Each installation invents a random identifier and sends it with every request so we can tell devices apart. If you capture something before you have an account, we keep it with a count to limit free reading, and clear it out after 90 days.
Not your location. The weather uses the ZIP code you type. Nothing in the app asks any device where it is.
3. What stays on your phone
What each person always packs — the free-text list of things they should never travel without, and the notes on their snacks and on-the-go activities — never leave your device. The app strips them before every save, and overwrites any older copy it finds on our servers without them. What keeps them off our servers is the app, not our database design. This used to be four fields with medical names: a box headed “Care notes”, one for medications, and a set of “Individual needs”. None of that was ever needed to help you pack — if it goes in the bag, it goes in the list — so as of 4 October 2026 it is one list of things, with no reason attached: the app does not ask why something matters and does not record it. Anything already written is carried into that one list on your phone, and nothing is deleted. With those names gone, Capture holds nothing labelled medical about anyone, on our servers or on your phone. None of these fields are being asked for at the moment, because they fed the packing list, which is hidden while we rework it.
Because they exist only on your device, they cannot be recovered if you lose it, and will not appear when you sign in somewhere new. It also means signing out would destroy them — so when a different account signs in on a shared device, the previous account’s notes are set aside there, out of sight, and handed back if that account returns. A device holds them for up to five accounts; a sixth pushes out the oldest. A tablet passed between families can be holding another family’s notes, unseen, with no time limit, and closing any account on it clears the whole set — including another account’s only copy. One consequence of hiding these fields, which we would rather say plainly: while they are hidden there is no screen that shows them, so anything written before cannot be read, changed or deleted in the app. It is still on that phone, still never sent to us. Closing your account on a device clears it, and it comes back when the packing list does — or write to us and we will talk you through reaching it.
But Nourish is different. What you tell it to leave out of someone’s food, and the food preferences you enter there, are stored for your household on our servers and sent to OpenAI when it suggests meals. Since 4 October 2026 we no longer record why: the list does not say whether something is an allergy, a belief or a dislike, and the app does not ask. That is deliberate, and it is not a promise of privacy — a list of what someone cannot eat can still reveal something about their health. If you would rather we did not hold that about a person, the way to do that is not to enter it in Nourish.
Screen passcodes are no longer sent to us as digits: the app scrambles each one on the device and strips the digits from everything it saves. Codes set before that change did travel as digits, and each is replaced the first time its device saves again. A passcode a parent sets for a child is shared with the other parents so the screen opens from either phone; a grown-up’s own is not. A four-digit code can be worked out from the scrambled version by trying all ten thousand, so the lockout on the device is the real protection.
4. What we send to OpenAI
Everything in this section goes to OpenAI and to nobody else; the one other place words leave the app is dictation, in section 6. OpenAI does not use what we send to train its models. A photo passes through to be read and is never stored by us.
Captures. The text you typed or spoke, or the photo you took, with the first names of your household and your last name so it is filed to the right person. Photos of bills, business cards and school calendars are read the same way.
Concierge. The ages and interests of your household but not their names; the ZIP code you are searching with its town and nearest city; the names of places you already follow; and for Sales Radar, the stores you follow and the product links you are watching. These searches use OpenAI’s web search. Photos of an opening-hours sign or an events calendar are sent to be read. For a trip: where you set out from, where you are going, your dates, and who is traveling with ages and interests — children described by age band when several families plan together.
Nourish. Everything in the food profile described in section 2 — every person’s name, age, what is to be left out of their food and whether it may be served on the side, and their food preferences; your household’s diets and dislikes, what the app learned from suggestions you liked and turned down, any guest’s details, your pantry, and your saved and planned meals. No reason for leaving something out is sent, because none is kept. Photos of a shelf or recipe are sent to be read. To judge what kind of evening it is, the app reads your calendar on the phone and sends one word — busy, open, entertaining or traveling — never the events. A guest you add has agreed to none of this, so enter only what you would be comfortable writing down on their behalf — and since 4 October 2026 what you ask us to leave out of a guest’s food is sent as firmly as it is for anyone in your household, rather than as a preference.
Children’s reading voice. The short phrase to be read aloud.
We never send what stays on your phone — what each person always packs, their snacks and their on-the-go activities, described in section 3 — to OpenAI or to anyone else. Nor a screen passcode: the scrambled version reaches us and the other parents only, as section 3 describes.
5. Children
Capture is for parents and caregivers to use on behalf of a household. A parent creates the household and enters what they choose about their children, and may give a child their own sign-in and screen.
For each child we hold a first name, age or birthdate, display color, and their screen setup, including the routines and chores they complete. These are kept once for the whole household, so every parent sees and can change the same details. A child’s first name, their age and interests, and — if a parent adds them in Nourish — the things to be left out of their food and their food preferences go to OpenAI as described in section 4. We do not record why a child’s food is restricted, and the app does not ask.
A child’s sign-in comes from a parent’s invitation, and which screen it opens is set by that invitation, not by the name on the account. What a child adds to their own list is seen by their parents. A parent can see and delete everything held about their children from Settings, and download it within the limits in section 8. Creating an account by accepting an invitation does not ask the person to confirm their age, because the parent who sent it has already decided who it is for.
6. Who else sees your data
We do not sell your data or share it for advertising, and there are no analytics, advertising or crash-reporting tools in the app. Our providers: OpenAI for the features above; Neon and Render to store and serve the data; Resend for account emails; Expo for app updates, whose update check carries a random installation identifier; Apple and Google where you connect them, and for turning speech into text when you dictate — so a dictated phrase may be sent to Apple or Google to be transcribed; Open-Meteo for weather, which receives your ZIP code’s map point and your phone’s network address; a public ZIP code lookup, which receives a ZIP code and the network address of whoever asks; Google Fonts, which supplies typefaces on our web pages and sees the network address of anyone who opens one — including the Concierge tab, which is a web page inside the app; and the public pages of places you follow, which our server asks for so it can read their hours and events — they learn that a page was requested and nothing about you.
The other people in your household. What you save for a household is shared with it. Every reminder and event reaches the other members’ phones, and anything marked done is done for everyone. Everyone sees the family’s names and colors and your home ZIP code — a profile photo stays on the phone that added it. The household’s own name and your last names go to the grown-ups, as do each member’s sign-in address; a child’s or teen’s account is not shown those. Parents, and only parents, see and can change the children’s ages, birthdates, profiles, screen setups and passcodes, and share one set of Concierge places, hours, plans and family list. A caregiver or other adult is never sent the children’s ages, profiles or screen setups; our server withholds them. A child with their own sign-in sees what is for them and what is for the whole family. Two limits work differently and we would rather say so: our server sends every household reminder to every member’s phone — an adult member’s, and a child’s or teen’s own device — and it is the app on that phone that hides the ones not meant for them. The limits above are the server’s; these two are the app’s. School schedules, packing lists and the Nourish kitchen belong to the household, and hidden calendar events are shared between parents only.
Bills and cards. A bill stays private unless you tag it Family, which shows it to the other parents in any household you share with them, or name a grown-up to show it to; they can mark it paid and nothing else. A named share is matched on the name that person uses in the app, and a grown-up can change their own name, so keep the names in your household distinct. The reminder a bill sets for you is an ordinary reminder, and one edited after it is made can pick up your household, putting its title and amount on their phones — leave a bill’s reminder off if you would rather it left no trace. A scanned card stays private unless you share it, one at a time, with your grown-ups or named grown-ups; its photo is never shared and only you can change or delete it. Children never see another person’s bills or cards, and anyone who leaves the household stops seeing what you shared. Tapping Add to Contacts on a card asks your phone’s permission and hands the details to your own address book, from where they may sync to iCloud or Google.
Shared reminder links. The whole reminder as the app holds it — title, date, time and end time, place, description, whose it is, any repeat — is packed into the link itself, scrambled for the address bar but not encrypted. Anyone holding the link can read all of it without an account, including the messaging app that draws a preview. We store nothing for it.
Reminders ring on the phone of each person who can see them, scheduled by that phone from its own copy, so their contents never pass through a notification service.
7. How long we keep it
We keep what you create until you delete it or close your account. Sign-in sessions expire 30 days after you last use the app, including sessions started by accepting an invitation; those issued before 21 September 2026 were given 90 days and keep it until they expire. Family invitations expire after 7 days, shared trip invitation links after 30 days, and email confirmation links after 24 hours — though once a family has joined a trip, the link they hold keeps working. Search results are cached briefly and refreshed. When a grown-up closes their account, their first name stays in the household’s record, with the date, so every phone knows to remove them.
8. Getting a copy, and deleting
You can download what our servers hold for your account from Settings: your account and settings, what you captured, your bills and cards, your household’s shopping list and packing lists, school schedules, Concierge places and plans, trips, and who is in your household with their colors and your home ZIP code. Parents also get the household’s shared record — the children’s profiles, birthdates and screen settings. For a caregiver, another adult or a child, that record is left out and the file says so.
Nourish is in the file as of 30 September 2026 — the food profile, guests, the pantry, your recipes, meal plans and prep lists. The kitchen belongs to the household and every grown-up in it gets the whole thing, which is what the app shows them. A child’s or teen’s account does not have Nourish, so their file says the kitchen was left out and why. The file still leaves out reminders, cards and school schedules another member saved, even ones you can see. Your household’s shopping list comes in full, including rows someone else added. Packing lists come as the lists themselves; the items on a list somebody else created are in their copy, not yours.
You can delete any single item, clear one part of the app — your Capture, Concierge or Nourish data — while keeping the others, or close your account. Two of those reach other people. Clearing Concierge as a parent clears the household’s places and plans for the other parents. Clearing Capture removes, for everyone, the bills and cards you shared, every school schedule you last saved and every packing list you created, plus the shopping-list rows you added. Because the Nourish kitchen belongs to the household, clearing it only empties it when nobody else is left; otherwise nothing is deleted and the app says so.
Closing your account removes your profile and settings, your captures, bills, scanned cards, the schedules you saved, and your own Concierge data and trips. Some of that was visible to your household and goes with you: reminders you filed to the family, cards and bills you shared, schedules you last saved. It disconnects Google Calendar by revoking the token with Google. If you signed in with Apple we ask Apple to revoke that too; where we do not hold the token to do so, you can remove Capture yourself in your Apple ID settings.
What belongs to the household survives while someone is still in it — the shopping list, packing lists, the parents’ Concierge, the Nourish kitchen — kept without your name on it and deleted when the last member leaves. If you are the only parent in a household others are still in, you will need to invite another parent or remove everyone else before closing your account. A child’s account is closed by their parent.
9. Security
Data is encrypted in transit. Passwords are stored only as scrambled values, as are password-reset and email-change links, which are short-lived. Sign-in, sign-up and invitation attempts are rate-limited against the network they come from; every feature using OpenAI is rate-limited against your account, not the network it comes from. A capture made before you have an account is the one exception — there is no account yet, so it is counted against the device and the network instead.
Two credentials have to be held in usable form rather than scrambled: the Google Calendar token, because your devices need it to reach your calendar, and — if you signed in with Apple — the token Apple requires us to keep so we can disconnect you when you close your account. Both are revoked at that point, and neither is ever included in a download.
10. Contact
Questions, or a request about your data: care@methodsandmode.com.