The question we hear most often from parents who have just heard about Molo is some version of: "Wait, you want me to forward my children's school emails somewhere?" It is a reasonable reaction. School communications contain names, class details, sometimes medical information about children at the school, and information about your family's schedule. The question of what a third-party service does with that forwarded data is worth asking carefully.
This article answers it plainly. I am Amara, Molo's CTO, and I designed the data handling architecture. I will describe exactly what happens to a forwarded school email, what we retain, and what we do not.
What the forwarding process looks like technically
When you set up Molo, we give you a forwarding address, something like [email protected]. You add that as an auto-forward rule in your email client, or you manually forward emails you want processed. We receive the email over standard SMTP, exactly as any email arrives at an inbox.
At the point of receipt, the processing pipeline starts. The email body and any PDF or image attachments are passed through our extraction layer, which identifies dates, times, event names, and location details. The extraction runs and produces structured output: a set of calendar events with fields filled from what the document contained.
Those extracted events are then written to your calendar via whichever integration you have connected (Google Calendar, Apple Calendar via CalDAV, or Outlook). The calendar entry contains the event name, date, time, and any contextual notes we extracted. That is what you see in your calendar.
What Molo stores and for how long
The extracted calendar events are stored against your account so we can handle things like duplicate detection (if the same event arrives in two newsletters, we do not create it twice) and so you can see a history of what has been extracted.
The original email body and attachment content is a different matter. We do not retain the raw content of forwarded emails after extraction is complete. Once the processing pipeline has run and the events have been written to your calendar, the source content is discarded. We do not store a copy of the school newsletter. We do not store your child's class teacher's name as extracted text. We do not build a profile of your school based on what arrives.
What we retain is: the structured output (the calendar events) and the metadata needed to make duplicate detection and account management work. The raw email content does not persist.
What your children's school does not know
School communications are typically sent by the school to the parent's email address. When you forward that email to Molo, the school's communication has already been delivered to you. The forwarding is an action you take with a message in your own inbox. The school does not receive any notification that you forwarded their newsletter to a processing service, and we do not have any relationship with or access to the school's own systems.
This is worth stating clearly because some parents assume that using a school-email-processing tool creates some connection to the school's data infrastructure. It does not. We only ever see what you choose to forward to us, from your inbox, under your control.
GDPR, UK data protection, and what applies here
Molo operates under UK GDPR and the Data Protection Act 2018. The relevant points for this use case are:
The data you forward to Molo is data you hold in your own inbox. When you forward it, you are directing how your own received data is processed. We process it as a data processor on your behalf, with the purpose of extracting calendar events. We do not use your forwarded emails for any purpose other than that extraction.
We do not sell data. We do not use forwarded email content to train models or improve our extraction in a way that retains identifiable information. The content goes in, the events come out, the content is discarded.
Our Privacy Policy sets out the full legal basis for processing, retention periods, and your rights under UK GDPR. It is available on our site and is written to be readable, not just legally compliant.
The case for being honest about what we do not know
There are questions about data handling that we cannot answer with complete certainty because they are inherent to how software infrastructure works at scale. We use cloud infrastructure for our processing pipeline, which means emails transit through systems we operate but do not physically own. We apply encryption in transit and at rest. We have chosen infrastructure providers with strong data residency commitments for UK-based data.
We are not saying there is zero risk in forwarding anything anywhere. Email by its nature transits infrastructure you do not control. What we are saying is that our specific handling of your forwarded content is: extract and discard the source, retain only the structured output, do not repurpose the data, operate under UK data protection law. That is a narrower and more defined data footprint than most email services you already use.
What to consider before you start
If you decide to use Molo, the practical thing to think about is which emails you want to forward. You do not have to auto-forward your entire inbox. Most families set up forwarding specifically from school or clinic addresses, or manually forward individual newsletters. The more targeted your forwarding, the smaller the set of content we ever process.
If a notification contains information you would prefer not to forward (a personal email from another parent, for instance, that happens to mention your child's name alongside a school event), simply do not forward that one. The service works by individual message: nothing is processed that you did not actively send to the forwarding address.
The data question is a fair one to ask. We think the honest answer is that the risk is narrow, the purpose is single, and the handling is straightforward. But the decision about your family's data should be yours, made with accurate information rather than guesswork. That is why we wrote this.