Last updated September 26, 2026
Marlow holds what a family needs to get somebody to an appointment: names, an address, times, and who is driving. It has no analytics, no trackers, and no advertising of any kind, and it sells nothing to anybody. What you enter is visible to the people in your circle and to nobody else.
Your email address, which is how you sign in. The name you go by in the circle, and a phone number if you add one. Which circles you belong to and whether you organize them.
Their name. Their home address, and the map coordinates for it, so a driver can be given directions. A phone number if you add one. Their language, time zone, text size, and how far ahead their phone shows the schedule. They do not have an email address or a password with Marlow. Their phone is paired to the circle instead.
The title of an appointment, any note you write on it, when it starts and ends, where it is, where the pickup is, whether it needs a driver, who claimed it, and the times a driver confirmed, set off and arrived. Marlow also keeps a record inside each circle of who changed what and when, so a disagreement about the schedule has an answer.
If you turn on notifications, Marlow stores a push token for each of your devices, which platform it is, and when it was last used. That is enough to send you a notification and nothing more. It is not an advertising identifier and cannot be used as one.
Only if you turn it on in Settings. Marlow then adds the rides you claim to your calendar, so you do not double-book yourself, and takes an entry back out if the ride stops being yours. It also reads your calendar while you are choosing a time, to tell you when you already have something then. That reading happens on your phone: what it finds is never stored, never sent to Marlow, and never shown to anybody else in your circle. Turn it off and Marlow neither reads nor writes anything.
On the paired phone, Ask Marlow can be asked a question out loud. The phone’s own speech recognition turns the words into text: on an iPhone that usually happens on the phone itself (when a phone cannot, Apple’s speech service does it), and on an Android phone the system speech service may send the audio to Google to do it. Marlow never records or keeps the audio. When the phone is online, the question is sent, together with that day’s schedule (appointments, rides, medicines and the weather), to Anthropic, whose Claude model writes the answer. Anthropic does not use it to train its models and deletes it within 30 days. Marlow does not keep the question or the answer. With no connection, the phone answers on its own from the schedule already there, and nothing is sent. A request for help is always handled on the phone first and never depends on that service: if the question says they feel unwell, have fallen or need help, the words they said are sent to the people in the circle as a notification, and nowhere else.
Feedback you send from Settings is stored so that it can be emailed on. That email carries your message, your email address so we can reply, and a few facts about the app: its version and build, the phone model, the operating system version, and which language you were reading. Nothing else goes with it, and if you never write to us, none of it exists.
Marlow does not track location. It never records where you or the person you care for actually are, only the addresses somebody typed in. It has no analytics SDK, no crash reporter, and no third-party trackers, so nothing about how you use the app is measured or sent anywhere. It reads no contacts, and it never browses your photos. When you pick a picture to fill in an appointment, the system hands Marlow that one image and nothing else, and it is read on your phone rather than sent anywhere. Your calendar is the one thing it can read, only if you switch that on, and only on your own phone.
Everyone in your circle can see the schedule, the addresses, and who is driving. That is the point of a circle. Only the organizer can add or remove people. The paired phone shows only that one person their own day. The database enforces this in its own right, row by row, rather than trusting the app to ask the right question.
Supabase stores the data and handles sign-in; the database is in Canada (ca-central-1). Notifications are addressed by Expo and delivered by Apple or Google, so the text of one passes through all three on its way to your phone. Address search differs by platform: on an iPhone it is Apple Maps, and on an Android phone what you type, along with the drive time and the picture of the destination, goes to Mapbox. Resend carries the feedback you write, and nothing else. The weather on the paired phone comes from the US National Weather Service, which is sent the home’s location rounded to about a kilometer, and nothing else. Anthropic writes Ask Marlow’s answers when the phone is online, from the question and that day’s schedule, and does not use them to train its models. An invite is a link you share yourself, by whatever means you choose; Marlow sends no email to the person you are inviting. Marlow shares data with no one else, and sells it to no one at all.
Until it is deleted. Deleting a circle deletes its appointments, rides, members and record of changes with it.
Settings → Delete my account. It erases your name, your email and your sign-in, and it is immediate. There is no waiting period and no way to undo it. A circle you organize is not destroyed along with you if anybody else is in it: the longest-standing member becomes the organizer, and the app tells you who by name before you confirm. A circle with nobody left but the person you care for is deleted outright, appointments and addresses with it, because a paired phone alone cannot administer or erase anything.
Marlow is not built for or directed at children, and accounts are for adults coordinating care.
If this policy changes in a way that affects what is collected or who sees it, the app will say so rather than quietly changing the date at the top.