Privacy
Plainly: what we collect, who processes it, how long we keep it, and the parts we cannot promise. We are a small team, so this page says exactly what is true rather than what sounds strongest.
What we collect
- Your phone number, so the agent knows who it is talking to (verified once by text code).
- What you tell us: your children's names and grades, their school, and the things you ask us to help with.
- What the school sends: emails you forward or connect, and the forms and pages involved.
- What we do on your behalf: drafts, forms filled, emails sent, and the confirmation the school gives back.
We do not ask for your child's Social Security number, and we do not want medical records. Please do not send health details you would not want stored.
Who processes it
Your messages are read by the AI that writes our replies, and pages are read by the browser service that visits them. These are the companies involved, and what each one sees:
| Provider | What it sees |
|---|---|
| Anthropic | Your messages and family details, to write replies and do research |
| OpenAI | Page content from sites the agent reads |
| Skyvern | Form details and pages, plus a saved school-portal sign-in while you stay connected |
| Browserbase | The browsing session (session recording is switched off) |
| Tavily | Search queries about schools and districts |
| Voyage AI | Search queries built from your messages, when looking up school and district information |
| Resend | Emails we send to a school when your Gmail is not connected |
| Gmail and Calendar, only if you connect them | |
| Retell | Phone calls, if you ask us to call |
| Supabase, Railway, Vercel | Where the data is stored, hosted and logged |
We do not sell your information and we do not share it for advertising. Outside of the providers above, nothing goes to a school or anyone else until you approve the exact message or form.
What your school sees, and what a circle sees
Mycelium works for your family. It never reports on your family to your school, and the school sees only what you choose to send. When you approve a message or a form, the school sees that message or that form, and nothing else about you.
What Mycelium learns about a school itself, like the calendar, the early releases and which office handles rides, is shared as school information so that every family at that school benefits from it. No family's personal details are part of it, and one family's answers are never used to answer another family's question.
Circles are not live yet. When they are, these are the rules. A circle sees the plan and nothing else, never why a family needs help. Your children's schedules are visible only to the circle you invite. There is no open school directory and no live tracking of children by default, and a pickup follows your school's authorized-pickup list.
How long we keep it
| Data | Kept |
|---|---|
| Conversation messages | 90 days |
| School emails we triaged | 60 days |
| Family profile, children, cases | While your account is active |
| Connected Gmail or school-portal sign-in | Until you disconnect |
| Consent records (what you approved) | 7 years — audit trail, no family details |
| Browser session recordings | Not collected |
Deleting everything
Text reset and we delete your family's data: the profile, your children, the
cases, the messages, the emails we triaged, and the connected mailbox token. We disconnect
the saved school-portal sign-in first, because that is a live key to your account. We then
keep one record saying a deletion happened — the fact, the date, and the counts, never the
content — so nothing gets re-created by accident.
What we cannot delete, and will not pretend to:
- Encrypted backups, which clear on a rolling cycle.
- Copies our AI providers keep for a period under their own safety and anti-abuse rules.
- Emails already sent to a school — those cannot be recalled.
What we cannot promise
- Your messages are not "never shared": they reach the AI provider that writes our replies, as listed above.
- We are not "FERPA compliant" and we are not a school official. We act on your own access to your child's information, with your permission.
- We cannot guarantee an AI is never tricked by something on a webpage. That is why nothing is sent, submitted or changed without your explicit yes, and why a form submission is only reported as done when the site itself confirms it.
- We do not yet hold a SOC 2 report. We will say so plainly here if and when we do, and we will not describe a report we do not have.
Contact
Questions, a deletion request, or a security concern: our contact form.
This page describes the assistant service. The website's own form data is covered separately in the privacy panel on the home page.