Privacy Policy

What Carol knows about your mum or dad, and what she cannot know.

Last updated 13 October 2026

1. Who we are (APP 1)

Privaproof Pty Ltd, trading as Carol Says, ABN 57 699 856 794 (“we”, “us”), makes Carol: an iPhone app that speaks reminders and family messages aloud to an older person, and a web console their family uses to set it up.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We do this whether or not the Act strictly requires it of a business our size. It costs us little and we would rather not argue about the edges of an exemption when the people involved are somebody’s parents.

2. Whose information this is

The person Carol speaks to is usually not the person who bought her. An adult child buys Carol, sets her up and receives a weekly note. Their parent uses her. The parent has no account, no password and nothing to log into.

So we do not ask that person to agree to anything they have not been told out loud. On the first day, with their family in the room, Carol says:

I only ever say what your family types. I’ll never ask you for money, or for a number, or to ring anyone but them. That green button is the only thing you need. Press it when you’ve heard me.

Then, with the phone in their own hands, Carol asks them aloud whether their family may see which days they answered. We record the date and their answer. And they can see, on their own phone, exactly what their family sees.

Who agrees. The family only sees which days were answered if your parent agrees, on their own phone. If they cannot make that decision, even with help, someone legally authorised to decide for them, such as a guardian or an enduring attorney, can agree instead; we record that person’s name and the basis of their authority. Buying Carol, or being family, is not that authority. Agreement can be withdrawn at any time: delete the family account in Carol’s Family setup, or email [email protected], and the weekly note stops.

3. What we collect (APP 3)

About the person using Carol

Their first name, and the timezone their phone is set to
A random number that lets their phone reach their own family’s record and nobody else’s. It is not a hardware or advertising identifier, and it reveals nothing about them
The wording of each reminder, written by their family in their own words, and the times of day the family chose
Whether the button was pressed, and when. That is the whole record of what they do
When they asked Carol to be quiet for a few days, or turned off one reminder

About the family member who set it up

Name, email address, and a phone number if they added one
The messages they write, and the name they sign them with
Their purchase record, including Apple’s reference number if the family account came through the App Store. We never see card details — those go straight to our payment provider

Read on the phone and never sent to us

Whether the volume is down, whether notifications are off, and which voice is installed, so the app can say why Carol cannot be heard.

4. What Carol cannot collect

These are not undertakings about our intentions. They are things the software is built so as not to be able to do.

No medicine names, doses or conditions. A reminder is free text a family member typed. There is nowhere in our system for a drug name to go
No health records, diagnoses or clinical information. Carol does not know whether anything was taken. Only that a button was pressed
No location. The app never asks the phone where it is
No contacts. The one-tap call dials a number the family typed, not an address book
No audio and no recordings. Carol speaks. She does not listen. The app makes no use of the microphone at all
No photographs reach us. They are chosen from the parent’s own phone, stay on that phone, and are never uploaded anywhere

5. How we collect it (APP 3, APP 5)

From the family member, typed into the console or into the app during setup. From the parent, only by their pressing one button. They are never asked to type or supply anything.

We never collect personal information from anybody else. No data brokers, no address book uploads, no social sign-in, no purchased lists.

6. Why we use it (APP 6)

To speak the reminders and the family’s messages aloud
To tell the family member that their parent answered
To warn when Carol cannot be heard
To offer the one-tap call to the person who set her up
To provide support and process refunds

We do not use personal information for advertising, profiling, scoring, training machine learning models, or any inference about anybody’s health. We do not sell personal information and we will not.

7. Email (APP 7, Spam Act 2003)

We send the family member a weekly note saying how the week went, and email about their account. If you joined our list before buying, we email you when Carol is ready.

Every message carries a one-click way to stop it, with no login and no form. Once stopped it does not start again by itself, and we do not send anything asking you to reconsider.

8. Who we give it to (APP 6)

To the family member who set Carol up: whether their parent answered, when they asked for quiet, and which reminders they turned off. This is the service being bought, and the parent is told of it in Carol’s own words on the first day.

To providers acting on our instructions and bound to handle it consistently with the Australian Privacy Principles: our hosting and database provider, our email provider, and our payment provider.

We do not give personal information to advertisers, insurers, employers, aged care providers, health services or government, except where a law compels us.

9. Overseas (APP 1.4(g), APP 8)

Your parent’s information is stored in Australia. We chose an Australian region for our database deliberately.

Two providers may process some information outside Australia, in the United States: our payment provider, Stripe, which handles the purchase, and our email provider, Amazon Web Services (Amazon SES), which sends our emails from its Sydney region but is a United States company. Before using an overseas provider we take reasonable steps to ensure it handles personal information consistently with the Australian Privacy Principles.

10. Keeping it safe (APP 11.1)

We take reasonable steps to protect personal information from misuse, loss and unauthorised access: access controls, encryption in transit and at rest, multi-factor authentication on administrative accounts, and secure deletion.

Two choices reduce the risk rather than manage it. The family member signs in with a link sent to their email instead of a password, so there is no password to steal, guess or reuse. And the reminders run on the phone itself, so the app keeps working even when it cannot reach us — which also means less of your parent’s day depends on our servers being up.

11. If something goes wrong

If a breach of personal information is likely to cause serious harm and we cannot prevent that harm, we will tell the people affected and the Office of the Australian Information Commissioner as soon as practicable, under the Notifiable Data Breaches scheme.

12. How long we keep it (APP 11.2)

Button presses: two years, then deleted. The weekly note only ever looks back a few weeks; two years is generous and it is a limit rather than an intention
Everything else: deleted within 30 days of the account closing. Names, reminders, messages, phone numbers
The financial record of the purchase: five years, because Australian tax law requires it. That is a date and an amount, not anything about your parent’s day

If your parent dies, moves into care, or can no longer use Carol, tell us. We stop everything and do not ask you why. If you would rather keep the messages your family wrote, we will send them to you instead of deleting them — at that point it is a small archive of somebody’s last year, and it should be yours.

13. Our website

Our website sets no advertising cookies and carries no tracking pixels. We count visits in aggregate so we know whether anybody is reading the page. We do not build a profile of you and we do not follow you to other sites.

14. Dealing with us anonymously (APP 2)

You can ask us a question without telling us who you are. You cannot use Carol anonymously, because the whole service is sending a named person’s family a note about them — there is no version of it that works without a name and an email address.

15. Seeing it and correcting it (APP 12, APP 13)

You can ask for a copy of what we hold about you, or ask us to correct it. There is no charge. We aim to respond within 30 days.

The person Carol speaks to can see their own record any time, on their own phone, on the “This week” screen. They do not need to ask us and they do not need an account.

And they can ask us to delete it themselves. They do not need the permission of whoever bought Carol, and we will not ask them to get it. It is their information. We will tell the family member that the account has closed at their parent’s request.

16. Automated decisions (APP 1.7)

We do not make automated decisions about anybody. Carol writes a weekly note without a human reading it first, but a note is information for a family member, not a decision about their parent: nothing is granted, refused, scored or withheld, and nothing happens automatically as a result. What to do about it is always a person’s judgement, never ours.

17. Complaints

If you are unhappy with how we have handled your personal information, write to our Privacy Officer below. We will acknowledge it promptly and respond within 30 days.

If our answer does not satisfy you, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5288, Sydney NSW 2001.

18. Contact

Privacy Officer
Privaproof Pty Ltd, trading as Carol Says, ABN 57 699 856 794
PO Box 101, Randwick NSW 2031
[email protected]

19. Changes

We may update this policy. The current version is always here and the date at the top shows when it last changed. If we ever change it in a way that matters, we will email you rather than quietly swapping the page.