Trestle Privacy Policy

Effective date: August 21, 2026

This Privacy Policy explains what Trestle collects, how it's used, and the choices you have. Trestle is a co-parenting communication service built around a shared, tamper-evident record of what you and your co-parent send each other — that's the whole point of the product, and it shapes how your data is handled. We're explicit about it below.

1. What We Collect

Account information. Your phone number or email address (for sign-in verification), display name, and any profile details you add (photo, username). Your phone number is used for verification and is only shared with your co-parent if you opt in.

Communication records. Messages you send and receive — including photos, videos, voice notes, and document attachments — delivery and first-read timestamps, call activity (who called whom, when, how long), call recordings when consent conditions are met, call transcripts, and shared calendar events. These are written to the shared record when they occur — see Section 3.

Contacts (optional). If you use contact discovery, the phone numbers in your address book are hashed on your device and sent to us to check which of your contacts use Trestle. We never receive the raw numbers or names, we only answer the lookup, and we don't keep a copy of your address book.

Location (optional). If you choose to share your location with the Trestle assistant, the coordinates are sent to our servers, kept as your last shared location for the assistant to use, and processed by our AI provider as part of your request. Location sharing is off unless you turn it on, and nothing about your location is shared with your co-parent.

Diagnostics. Crash reports and reliability data (things like connection failures, message send failures, app start time). These contain event names, timestamps, and device/OS info — never message content. You can turn diagnostics off in Settings; crash reporting helps us keep the app working.

Device information. Device type, OS version, app version, push notification tokens.

2. How We Use It

• To deliver messages, calls, and calendar updates between you and your co-parent
• To maintain the shared record that is the core of the Service
• To provide optional AI features you invoke (see Section 5)
• To send notifications you have enabled
• To operate, debug, and improve the Service (diagnostics)
• To respond to legal process and enforce our Terms

We do not sell your personal information, and we do not use the content of your communications for advertising.

3. The Shared Record — What Retention Looks Like

Unlike a typical messenger, Trestle is built so the record of what was said between you and your co-parent can't be quietly changed or removed — not by either of you, and not by us in the ordinary course. That's what makes it something both of you can trust.

• Every message, delivery event, read event, call, and transcript is copied to an append-only archive when it happens.
• Archive copies are stored on write-once storage with multi-year retention and cryptographic integrity chains, so tampering is detectable.
• Deleting the app, deleting a message from your device, or closing your account does not remove archived records before their retention period ends. When the retention period expires, records are deleted.
• Both parents in a family have equal access to the record of their shared communication, including exports.

4. Who We Share Information With

• Your co-parent: by design, your communication is visible to both of you — including its delivery/read record.
• Professionals you choose: you can export records or share them with attorneys, mediators, or courts through features in the app.
• Service providers that process data on our behalf: cloud hosting (Amazon Web Services), sign-in verification (Supabase), calling infrastructure (LiveKit), transcription (Deepgram), AI processing (Anthropic), and crash reporting (Sentry). Each receives only what it needs for its function.
• For legal reasons: we respond to valid subpoenas, court orders, and other legal process. Given the nature of the Service, records requests in family proceedings are expected and supported.

5. AI Features

Trestle Spirit assistant. Messages you send to the assistant — and your location, if you've chosen to share it — are processed through our AI provider (Anthropic) to generate its replies. Assistant chats are stored like other messages but are not visible to your co-parent and are not included in shared-record exports.

Tone analysis. Optional tone analysis can run either on your device (no data leaves your phone) or through our servers using the same AI provider. Cloud analysis processes only the draft text you submit at that moment; drafts analyzed before sending aren't added to the record unless you send the message.

Call transcription. When a call is recorded with consent, the audio is transcribed by our transcription provider (Deepgram).

AI providers we use are contractually restricted from training on your data.

6. Security

Data is encrypted in transit (TLS) and at rest. Archive storage uses write-once (WORM) object storage with integrity verification. Access to production systems is restricted. No system is perfectly secure; we will notify you of breaches as required by law.

7. Your Rights and Choices

• Access and export: you can export your communication records at any time in the app.
• Profile: you can update or remove profile details.
• Diagnostics: you can opt out of diagnostics sharing in Settings.
• Deletion: you can delete your account, which removes profile data and stops all future collection. Entries already on the shared record are kept for a limited retention period after deletion — based on your co-parent's equal interest in the shared record and legal bases including the establishment, exercise, or defense of legal claims (e.g., GDPR Art. 17(3)(e)) — and are deleted when that period expires. We will tell you exactly what is and isn't removed when you request deletion.
• What account deletion removes and keeps: deleting your account in the app (Settings → Account → Delete Account) permanently removes your profile information (name, phone number, email, photo, and any other profile details), signs you out everywhere, and removes your sign-in. Messages, calls, transcripts, and other entries already on the shared record are kept for the remainder of the retention period: your co-parent keeps access to them, and you can request a copy of entries you were a party to by contacting [email protected] and verifying your identity. This is intentional: it means someone with access to your device can't destroy the record by deleting the app or the account.

8. Age

Trestle is for adults (18+).

9. Data Location

Data is stored in the United States.

10. Changes to This Policy

If we make material changes, we will ask you to review and accept the updated policy in the app.

11. Contact

Privacy questions or requests: [email protected]