Privacy
Last updated 3 September 2026. Draft — not yet reviewed by a solicitor.
Weekabout is the trading name of Ben Whalley, based in the United Kingdom. Ben Whalley is the data controller for personal information processed through Weekabout.
You can contact me about privacy or your personal information at privacy@weekabout.com.
Parents using Weekabout for their own family are not responsible for administering each other's data-protection rights. Send requests to us and we will respond. If an organisation provides Weekabout as part of its own service, it may have separate responsibilities and must explain them to you.
- Your email address, if you provide one, and a name you choose. We do not ask for your surname.
- Your children's first names or nicknames only. We do not ask for their surnames, dates of birth, schools, photographs or addresses.
- The shared calendar: nights with each parent, events, suggestions, decisions and the record of when changes were made.
- Your settings and service records, including notification preferences, calendar-sync entitlement, sync and viewing-link tokens, and the dates on which your account and devices were created or last used.
- Authentication and security information, including session cookies, security tokens, device names and platforms, push-notification tokens and IP addresses used temporarily for rate limiting.
- Email and notification delivery records. An App Store receipt is checked when you buy calendar sync but is not retained by Weekabout.
- Usage statistics as anonymous counts of page, API and sync use by day and broad device type. They are not linked to an account, session or IP address.
We do not collect location data.
A parent may give us information about another parent or a child when creating, inviting someone to, or managing a calendar. This may include a chosen name, an email address, a child's first name and calendar entries concerning them. In those cases the information comes from that parent.
Where data-protection law requires it, we provide or link to this notice when we first contact someone whose information we received from another person and no later than one month after receiving it. You can ask us what we hold about you and where it came from.
We use information to provide the shared calendar; create accounts and sign you in; send invitations, notifications and essential service messages; respond to support requests; secure the service and prevent misuse; verify purchases and provide paid features; and meet binding legal, tax and accounting requirements.
We use anonymous aggregate counts to understand whether pages and features are being used. We do not use personal information for advertising or marketing.
| Purpose | Lawful basis |
|---|---|
| Providing your account and calendar, authentication, necessary messages, support, purchases and paid features | Contract: the processing is necessary to provide the service you ask for (UK GDPR Article 6(1)(b)) |
| Children's information and information about an invited parent who has not yet created an account | Legitimate interests: providing one reliable shared calendar for coordinating children's care (Article 6(1)(f)) |
| Security, rate limiting, preventing misuse and investigating incidents | Legitimate interests: protecting users and operating a secure service (Article 6(1)(f)) |
| Tax and accounting records, and responding to a binding legal requirement | Legal obligation, where the law requires the processing (Article 6(1)(c)) |
Where we rely on legitimate interests, we consider whether the use is necessary and proportionate and balance it against the rights of the people concerned. We give particular weight to children's interests. You can object to this processing by contacting us.
- An active calendar and its shared record are kept while either parent is using them.
- If neither parent opens a calendar for 24 months, we remove it from the active service. We warn account holders after 21 and 23 months and offer an export first.
- Sent notifications are kept for 30 days. Sign-in links work for 30 minutes and are removed within 7 days. Invitation links work for 30 days; their spoken codes work for 7 days, and expired invitation records are removed within 45 days.
- Expired web sessions and short-lived security rate-limit records are removed automatically. Device credentials remain until the device is signed out or the account is deleted.
- Anonymous aggregate usage counts may be kept indefinitely because they contain no information about an identifiable person.
When a calendar is deleted from the active service, we keep a recoverable copy for 30 days in case the deletion was a mistake. We then delete the active copy permanently. Backup copies rotate out within a further 30 days and are not used except to restore the service after a failure.
Either parent can take a full copy of the shared calendar and its record at any time.
Deleting your account disables it and removes your email address, chosen name, sign-in links, device and push tokens, sync and viewing-link tokens, notification settings and pending notifications.
Each calendar is then handled separately. If another parent is still using a calendar, you leave it but its shared nights, events and history remain for them. Your name is removed and the record shows a former-member marker. Event titles and the record of agreed changes remain because they are also personal information belonging to the other parent and children.
If nobody else is using a calendar, deleting your account also removes that calendar from the service, subject to the 30-day recovery period and backup rotation described above. Contact us if you want to exercise an erasure right that is not covered by the account-deletion control.
A child's first name, care schedule and ordinary event information are personal information. They are not special-category information merely because they concern a child.
An event title such as “Dentist” records an appointment but does not necessarily reveal a health condition. “Mosque” records an event or place but does not necessarily reveal anyone's religious belief. We do not use titles to infer health, religion or another protected characteristic.
Please do not enter diagnoses, treatment details, religious beliefs or other sensitive details. A short practical title is enough. If someone enters such information, the service stores and displays it as part of the shared calendar, but we do not use it for search, profiling, advertising, analytics or automated decisions.
The other people on your calendar and anyone given a viewing link can see calendar information. Ben Whalley may access information where necessary to provide support, investigate a security incident or comply with the law.
We use suppliers for hosting, transactional email, App Store purchases and push notifications. Our supplier and processor list explains what each one receives, where it processes information, international transfers and safeguards. We do not sell personal information, run advertising or use third-party tracking.
You can ask for a copy of your information, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. Both parents can export the whole calendar at any time without asking us.
Where information concerns both of you, we may need to withhold parts that are personal to the other parent. We will say when we have done that.
Write to privacy@weekabout.com. If we get it wrong you can complain to the Information Commissioner's Office at ico.org.uk.
Children do not have accounts. An older child may be given a read-only link to the calendar. Children have rights over their own personal information and may contact us themselves if they are able to understand and exercise those rights.
We do not use your personal information to make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
The service may carry out routine calendar actions according to the settings and choices of the people using it. It does not score, rank or evaluate parents or children, and it does not make legal decisions about care arrangements.
The website uses a session cookie to identify your signed-in account between visits and a security cookie to protect forms and account actions against forgery. These first-party cookies are strictly necessary to provide and secure the service. We do not use advertising, analytics or tracking cookies.
You can remove the cookies through your browser, but doing so will sign you out or prevent parts of the service from working.
Connections to Weekabout are encrypted. We use access controls, revocable credentials, data minimisation and backups to protect information. The main service and database are hosted in France. Some information handled by Apple may be processed outside the UK and EEA, as explained in our supplier list.
If we discover a personal-data breach, we investigate, contain and document it. We notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours when the breach is likely to risk people's rights and freedoms. If it is likely to create a high risk, we also tell the affected people without undue delay and explain what happened, what we have done and what they can do.