Privacy Policy

Introduction

FamilyOS ("we," "our," or "us") is a shared organiser for a household: a calendar, lists, chores, and a place to keep important documents. This policy describes what we collect, why, who else is involved in providing the service, and what you can do about it.

Information We Collect

How We Use Your Information

• To run the service: showing your family's calendar, lists, and chores to the people in that family.
• To sign you in, by sending a one-time code to your email address.
• To manage subscriptions, including knowing whether your family has an active one.
• To find and fix faults, using the diagnostic reports described above.
• To contact you about the service when we need to — for example, about a problem with your subscription.

Who Else Is Involved

We rely on other companies to provide parts of the service. Each receives only what it needs to do its job:

• Apple — takes the payment for subscriptions. We never see your card details.
• RevenueCat — tells us whether your family's subscription is active, so the app knows what to unlock.
• Resend — delivers your sign-in codes by email.
• Cloudinary — stores photos you attach to vault entries.
• Neon and Railway — host the database and the servers the app talks to.
• Sentry — receives the diagnostic reports described above.

Inside a family, what you add is visible to that family. What each role can see and change is set out on our support page.

We will also disclose information where the law requires it, and it would transfer as part of a sale or merger of the business — in which case we would tell you first.

Data Security

Everything travels over an encrypted connection, and the database is encrypted where it is stored.

Family vault entries get an additional layer. They are encrypted with AES-256-GCM before they are written, using a key derived separately for each family, and are decrypted only when someone with permission asks to read them. Photos attached to a vault entry are stored so they can be reached only through a short-lived signed link, never a public address.

We should be plain about the limit of that: we hold the encryption key. It protects your vault against someone obtaining a copy of the database, but it is not end-to-end encryption, and we could technically decrypt it. Sign-in codes are stored only as a keyed hash, so a copy of the database does not reveal a working code.

Your Rights and Choices

• Delete your account from the Family tab in the app. This is permanent. The app tells you first what will happen — including whether a family will be deleted along with you, and who becomes its owner if you are leaving one behind.
• Correct your details at any time by editing your profile.
• Ask for a copy of your data, or ask us to delete it, by emailing us.
• Leave a family without deleting your account, by asking a parent in that family to remove you.

Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA, including the right to object to processing or to complain to a regulator. Email us and we will help.

Deleting your account does not cancel a subscription, because Apple bills it rather than us. Cancel it in your App Store settings.

Children's Privacy

FamilyOS is built for a household to use together, and a parent may create a profile for their child. Only a parent can do this, and only from an account they already control. A child cannot sign up on their own, and we do not knowingly collect personal information directly from children.

A parent can see everything in their child's profile, remove it at any time, and sign the child's devices out. If you believe a child's information has reached us some other way, email us and we will delete it.

Data Retention

We keep your information while your account exists. When you delete your account, it is removed, along with any family in which you were the only member.

Things you added to a family you shared with others — an event on the calendar, an item on a list — stay with that family, because they belong to the household rather than only to you, and they stop being attributed to you. Sign-in codes are deleted once used or expired, and diagnostic reports are kept for a limited period and then discarded.

Changes to This Policy

We may update this policy, and the date at the top changes when we do. If a change materially affects you, we will tell you in the app or by email rather than relying on you noticing that date.

Contact Us