Privacy notice
Last updated 8 November 2026
KidRota is in testing. This page will be finalised before it is released publicly.
KidRota is run by Cosala Limited. We decide how your information is used, and we're responsible for it under UK data protection law.
Who we are
Cosala Limited, registered in England and Wales, company number 13460700. Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. Contact us at info@cosala.co.uk.
What we collect and why
| Information | Examples | Why we use it | Legal basis |
|---|---|---|---|
| Your account | Name, email address, the colour that marks your time | To create your account, invite the other parent and send you updates | Contract with you |
| Your children | First names | To show each child's schedule | Contract with you |
| Schedule | Pattern, start date and agreed changes | To build and show the shared calendar | Contract with you |
| Events | Title, date, time, how often it repeats, and whether it follows the school holidays | To show them on the shared calendar and the home-screen widget | Contract with you |
| To-dos | The job, who's doing it, and whether it's done | To let you share jobs between both homes | Contract with you |
| Information vault | Contacts, clothes and shoe sizes, and other practical details you choose to save | To keep the details both homes need in one place | Contract with you |
| Swap requests and history | Dates, an optional reason, replies with any note, times | To let you agree changes and keep a shared record of them | Contract with you |
| Device information | Notification token, and whether your phone is Android or iPhone | To send notifications | Legitimate interests |
The other parent in your family can see your shared schedule, events, to-dos, vault, requests and history. We don't sell your information, and KidRota has no adverts.
Sensitive information
KidRota isn't for health, medical or legal information. Please don't put it in notes, events, to-dos or the information vault. The vault is for practical details like contacts and sizes, not medical records. If something like that is added anyway, we protect it like the rest of your record, and you can ask us to remove it.
Companies that help us run KidRota
| Company | What they do for us | Where the data is |
|---|---|---|
| Supabase | Stores your account and schedule | United Kingdom (London) |
| Cloudflare | Runs our website and links | Global network |
| Resend | Sends sign-in codes by email | United States |
| Google (Firebase Cloud Messaging) | Delivers notifications to Android phones | United States |
| Signs you in with your Google account, if you choose to | United States | |
| Expo | Builds and updates the app, and passes notifications on for delivery | United States |
When information goes outside the UK, we use the safeguards UK law requires, such as approved contract terms.
How long we keep it
We keep your information while your account is open. When you delete your account, your sign-in, email address and notification tokens are deleted straight away. Anything waiting for an answer is cancelled.
What you shared stays with the other parent, because it's part of their family's record too: the calendar and agreed changes, events, to-dos and the vault. The history also stays. It keeps your name and what you wrote in requests, replies, events and to-dos, and no one can edit it. If neither parent is left in the family, the calendar, events, to-dos, vault and children's names are deleted. The history, including the names in it, is kept but can no longer be seen by anyone.
We keep backups of the database for up to 90 days, then delete them.
Your rights
You can ask to see, correct, export or delete your information, or object to how we use it. Email info@cosala.co.uk and we'll reply within one month. You can delete your account on the Family tab in the app, or by emailing us (see how to delete your account). If you're unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
KidRota is for parents aged 18 and over. Children don't use the app.
Keeping it safe
Your information is encrypted when it's sent and when it's stored, and only people who need it to run KidRota can access it.
Changes to this notice
If we make a significant change, we'll tell you in the app before it takes effect.