What Happens to Your Family's Data When an App Is Acquired

Ammar Khatib · 20 October 2026

You chose a family app. You read enough of the privacy policy to feel comfortable. You put your children's schedules, schools and photographs in it.

Then the company is sold, and the people you chose are no longer the people holding the data.

This is not hypothetical in this category — family and calendar apps are bought and folded into larger products regularly. Here is what actually governs it, what the policies really say, and the one line worth looking for before you commit.

General information, not legal advice.

The clause is already in the policy you agreed to

Almost every consumer app has one. Here is what three family apps actually say.

Cozi — the long version, which also covers bankruptcy:

"We may disclose Personal Information as part of a corporate business transaction, such as a merger or acquisition, joint venture, corporate reorganization, financing, or sale of company assets … We may also disclose Personal Information in the event of insolvency, bankruptcy, or receivership in which Personal Information could be transferred to third parties as one of the business assets in the transaction."

OurFamilyWizard — one line inside a list:

"in connection with any possible sale merger or restructuring of all or any part of our business or assets"

TimeTree — the shortest of all:

"Information may be provided in the event of a merger or other business succession."

Notice what none of the three contains: a promise to tell you.

For contrast, Google's policy does make that promise — that it will "give affected users notice before personal information is transferred or becomes subject to a different privacy policy."

That difference is the single most useful thing in this article. The clause itself is normal and nearly universal. Whether it comes with a commitment to notify you first is a genuine difference between companies, and it takes thirty seconds to check.

What the law actually requires

There is no GDPR article about mergers. The words do not appear as a governing provision, because an acquisition is treated as an ordinary disclosure of personal data to a new controller — so the general rules apply.

The lawful basis is usually legitimate interests, Article 6(1)(f). What makes that interesting is Recital 47, which turns on what you would expect:

"The legitimate interests of a controller … may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller."

And it adds that those interests may be overridden "where personal data are processed in circumstances where data subjects do not reasonably expect further processing."

In plain words: what you reasonably expected when you handed the data over matters legally, not just morally.

On telling you, European data protection authorities have endorsed guidance that is unusually direct. Changes that should always be communicated include "a change to the identity of the controller" — and that information "should be provided to the data subject well in advance of the change actually taking effect", by a method that is "explicit and effective".

A change of owner is a change of controller. So under EU guidance, being told — in advance, clearly — is the expectation, whatever an individual privacy policy does or does not promise.

What happens in practice

Less than that, often.

When Cozi was acquired by OurFamilyWizard — announced 4 May 2022 — the press release described the deal, the market and the leadership. It said nothing about user data, the privacy policy, or what would happen to accounts. We could find no contemporaneous public statement from either company on data handling at the time.

That is not unusual and it is not evidence of wrongdoing. It is simply what acquisition announcements are: documents written for the industry press, not for the people whose data is in the boxes.

Three cases where it became a public issue

Worth knowing, because they show what the guardrails look like when they are tested.

23andMe, 2025. When the genetic-testing company entered bankruptcy, the chairman of the US Federal Trade Commission wrote to the bankruptcy trustee, quoting the company's own policy allowing data to be "accessed, sold or transferred" in a sale, and stating that any purchaser should expressly agree to be bound by the existing privacy commitments.

Kurbo by WW, 2022. The FTC fined the operator of a weight-management app used by children as young as eight, and ordered it to delete the children's personal information and destroy the algorithms derived from it.

Edmodo, 2023. An education platform was ordered to delete models and algorithms built from children's data collected without parental consent — and the order was written to bind the company even though it had already suspended US operations.

The through-line: data about children attracts the most regulatory attention, and "the company stopped operating" is not a way out of the obligations.

What to actually check, in two minutes

Open your family app's privacy policy on your phone and search it for "merger" or "acquisition".

Is there a clause? Almost certainly yes. That on its own is normal.

Does it promise notice before the transfer? This is the real question, and most do not.

Does it say what happens to children's data specifically? In an app built for families, silence here is telling.

Is there an export? The practical protection. If you can take a copy whenever you like, a change of owner is a decision you get to make rather than one made for you.