Famenza Privacy Policy

Last updated: October 17, 2026

Introduction

Famenza ("we," "our," or "the app") is a mobile and web app that helps a parent or guardian organize the schedules, reminders, and daily routines of the people in their household. This Privacy Policy explains what information we collect, how we use and share it, who processes it on our behalf, and the choices you have. Using Famenza means you accept this policy.

Information We Collect

Information you provide

• Account information: Email address, display name, and a password (stored as a salted BCrypt hash — we never store your password in plain text). If you sign in with Google, we receive your Google account ID, email, and display name from Google instead of a password. If you sign in with Apple, we receive your Apple-issued user identifier and (only on first sign-in) the email and full name you choose to share — if you select Apple's "Hide My Email" relay we receive only the per-app relay address, never your real email.
• Family and household information: The family name you choose, time zone, week-start preference, and the names, roles (parent or child), birthdays, and color labels of the family members you add. Family members are records you create about people in your household; they do not have their own logins unless you separately invite them as parent users.
• Events, schedules, and reminders: Event titles, dates, times, locations, categories, notes, items to bring, who an event is assigned to, recurring patterns, daily routines, named situations (e.g. "soccer season," "summer break"), and reminder rules you create.
• Photos and documents: Images and PDFs you capture or upload — typically school flyers, sports schedules, or printed handouts — for the app to extract events and tasks from.
• Audio recordings and transcripts: Audio captured when you use the voice-query or voice-import features. Audio is uploaded to our backend for transcription and is not retained after the transcript is produced (see Data Storage and Retention below).
• Text you enter: Chat messages to the in-app assistant, prompts, schedule descriptions you paste in for import, daily-review notes, and feedback. When you send beta feedback you may optionally attach a screenshot from your photo library; attached screenshots are stored for up to 90 days to help us review the report and are then automatically deleted.
• Forwarded emails (optional): If you opt in to inbound email forwarding, you are given a unique email address (e.g. family-abc12def@inbox.famenza.example). Any email you (or your school, coach, etc.) forwards to that address is delivered to our backend, parsed for events, and stored under your family. You can disable the alias at any time in Settings.
• Household money (optional, adults only): If you use the budget, the bank and card statements and store order histories you upload, card-alert and receipt emails you forward, receipt photos, expenses you type or tell the assistant, account nicknames and balances, bills, budget targets, pay schedules, savings goals, and (only if you enter it) your household's monthly take-home pay. Famenza never asks for your bank log-in. See Household Money below for exactly what is kept and what is sent to AI.
• Saved places and shopping lists: Addresses you label (home, school, workplaces), shopping-list items, and the lists they belong to.
• Play date groups (optional): If you create or join a play date group, you provide a group name and notes, the child (family member) you add to the group, that child's availability windows (recurring weekly times or specific dates, and whether you can host), and any play date proposals you make — a title, date and time, an optional free-text location you type, and notes. This information is shared with the other families in that group; see Sharing With Other Families (Play Dates) below.
• Friends and watch parties (optional): If you add a friend, you provide their name and the email address or phone number you use to invite them, so we can send a one-time invitation link (by email, or as a link you share yourself). We use this contact information only to deliver that invitation and to connect your accounts if they accept; there is no public profile or member search, so you can only be connected by someone who already has your contact details or an invite link you were given. If you host a watch party, you provide the event details, an optional bring-list of food and drinks, and a location — and if you choose "my place", your address is shared with invited guests only if you explicitly turn on "share my home address"; otherwise guests just see "host's home". Event details and the bring-list are visible to the guests you invite. Sporting-event suggestions are fetched from third-party sports-schedule services (Football-Data.org for soccer, and API-Sports for some other leagues) using only public league identifiers — none of your personal information is sent to those services.
• Precise location samples (opt-in only): If you (a parent) explicitly opt a family member's device in to location sharing, the app records periodic GPS coordinates from that device while the app or its background-location task is running. Location collection is disabled by default, can be paused or revoked at any time, has a configurable retention window (default 30 days), and is intended to power features like geofence-based reminders ("remind me when I get to the store") and location-aware assistant answers.
• Geofence rules: Named circular zones (a center coordinate and radius) you create to trigger reminders when an opted-in device enters or leaves them.
• Wearable movement data (opt-in only): If you connect the app to your phone's health platform (Health Connect on Android, Apple Health on iOS — which is where data from a Fitbit, Garmin, or Apple Watch lands), the app reads heart-rate samples, step counts, and workouts on your device and computes daily heart-rate-zone minutes there. Only the daily totals — zone minutes, steps, workout count and duration, and an optional resting heart rate — are uploaded and stored under the family member you choose. Raw heart-rate samples never leave your phone, and none of this health data is ever sent to our AI provider. You control a daily movement goal and an optional evening reminder (off by default); disconnecting is as simple as revoking the health permission in your phone's settings, and account deletion removes all stored daily totals.
• Google Calendar data (if you connect it): If you authorize Google Calendar sync, we exchange the OAuth code for access and refresh tokens, which we store encrypted (ASP.NET Data Protection keyring). We then read events from the calendars you select and copy them into Famenza. We may also write back events you create in the app, if you enable two-way sync.
• Inbox connections - Gmail and Outlook (if you connect them): If you separately authorize Gmail or Outlook inbox import, we exchange the OAuth code for access and refresh tokens (stored encrypted, same keyring as above) and read only messages our school/sports-domain heuristics flag as schedule-relevant. Extracted candidate events are returned for your review; how much Famenza applies for you automatically versus holds for your approval is set by your family's trust level, and every change is undoable. The Gmail / Outlook scopes we request are read-only and per-user (each parent connects their own inbox independently). Disconnecting from Settings -> Integrations revokes the token at the provider and deletes our stored copy. Account deletion does the same automatically.

Information collected automatically

• Crash and error reports: When the app or backend hits an unexpected error, we collect a stack trace plus a short event timeline ("breadcrumbs") via Sentry. Breadcrumbs can include the names of screens you navigated through and actions you triggered shortly before the error, so in rare cases they may contain limited context (for example, a screen route that includes an event title). Our scrubbing removes auth tokens, API keys, cookies, and any large image bodies before events are sent. Breadcrumbs do not include your photos, raw audio, or the contents of forwarded emails.
• Device and app information: Device model, operating system version, and app version, included in crash reports to help us reproduce bugs.
• Product-usage events: We collect anonymous events that describe how the app is used — for example, which screens are opened, when an event is created, and which feature flags are active for a given install. Each event is tagged with a random per-install identifier (a UUID stored on the device), the app version, and the platform; it is not tied to your email, account, or family. We use these events only to understand which features are valuable and where users get stuck, so we can improve the app. We do not use them for advertising and do not share them with third-party trackers. Reinstalling the app generates a new identifier and severs the link to your earlier events.

How We Use Your Information

• Run the app's scheduling features: Display your dashboard, calendar, reminders, and per-person views; match reminders to events; recognize routines.
• AI extraction: Photos, PDFs, forwarded emails, voice transcripts, and text descriptions you submit for import are sent from our backend at famenza.com to the models of our AI providers (Anthropic's Claude models or OpenAI's GPT-class models for extraction and chat; OpenAI's Whisper for voice transcription) to identify candidate events, tasks, and dates. The candidates are returned to your device for you to review and approve before anything is added to your schedule.
• In-app assistant: When you ask the assistant a question (by text or voice), we send the question — plus the slice of your family's schedule that's relevant to answering it — to our AI provider's chat models (Anthropic or OpenAI), then return the response.
• Google Calendar sync: Read events from calendars you authorize, optionally write events back, refresh OAuth tokens as needed.
• Inbound email parsing: Email forwarded to your unique alias is parsed by Postmark, delivered to our webhook, then processed (including any AI extraction) and stored under your family. If AI processing is turned off for your family, the email is kept unread and nothing in it is sent to an AI provider until AI is turned back on.
• Location-aware features (only when opted in): Match precise GPS samples from opted-in devices against your geofence rules to fire location-based reminders, and surface location context in the assistant.
• Movement summaries and reminders (only when opted in): Show each opted-in family member's daily zone minutes and steps in the app, include a short recap in the weekly digest email, and — only if that member turned the evening reminder on — send one supportive push notification on days when the movement goal hasn't been reached and the family calendar shows free time. These features are fully rule-based; wearable data is never processed by AI.
• Household budget (only if you use it): Turn statements, order histories, receipts and the expenses you enter into a monthly budget — sorting purchases into categories, matching each purchase across the places it was recorded, reminding you of bills, and answering questions about your spending. See Household Money below.
• Reliability and bug fixes: Crash reports and device info help us identify and repair defects.

Household Money

The budget is optional. If you use it, Famenza keeps a record of your household's spending so it can show where the money goes each month. It is built so that we never need your bank log-in: Famenza does not connect to your bank, does not use a bank-data aggregator, and never asks for a password to any bank or card account.

What we collect

• Statements and order histories you upload: bank and credit-card statements (CSV, OFX or PDF files, or a .zip of them) and order histories you download from a store such as Amazon or Target. For each transaction we store its date, its amount, and its description as your bank printed it; for each order-history item, the store, the date, the item's description, quantity and price. The uploaded file itself is read and then discarded — we do not keep a copy of it, only the transactions read from it and the file's name.
• Accounts and balances: a nickname for each account, its kind (checking, savings, credit card and so on) and its bank's name, plus balances — ones you type, ones printed on a statement you upload, and ones in balance-alert emails you forward. Accounts are saved by name, never by number: the app refuses an account name that contains an account number, and it does not read account numbers out of the contents of your files. When a file’s name carries the last four digits of a card next to the bank’s name (for example “Chase6021_Activity.csv”), the app compares them with the names of files you uploaded before, to tell two cards at the same bank apart; those digits are kept only in the file name. Two things are kept exactly as you gave them, though — the name of each file you upload, and each transaction's description — and some banks put the last four digits of a card in one or both.
• Purchases from the app's other doors: card-alert and receipt emails you forward to your Famenza address, receipt photos, expenses you type or tell the assistant ("I just spent $5 at the coffee shop"), and shopping trips you record. When the app reads a forwarded alert it removes the card and account numbers it recognizes from what it records about the purchase; the forwarded email itself is kept as it arrived, like any forwarded email. A receipt photo is deleted a year after it was taken (or a year after any return or price-adjustment deadline on it, if that is later); what was read from it stays with the purchase.
• Your budget: spending categories and targets, bills and their due dates, planned one-off expenses, savings goals and what you set aside for them, pay schedules, and — only if you enter it — your household's monthly take-home pay.

What is sent to AI, and what is not

Reading a CSV or OFX file, matching purchases to the ledger, recognizing transfers and card payments, finding recurring charges and paydays, and every total, comparison and budget figure are worked out by our own server, with no AI. AI is used for these steps only:

• Sorting purchases into categories. When the app doesn't already know a shop or an item, its name as printed — a shop's name from a transaction description, or an item's description from a receipt or order history — is sent to our AI provider to suggest a category. When you sort an imported history, a shop the app still can't place is sent with how many times you paid it, the total, whether the account was a card or a bank account, and up to five items your order histories link to it, and the AI provider may run a web search for the shop's name to learn what kind of business it is. Dates and individual transactions are not sent for this step. You can change any category the AI suggests.
• PDF statements. If you upload a PDF statement, its full text — everything printed on it, which usually includes your name, your address and some or all of your account number — is sent to our AI provider to copy out the transactions. CSV and OFX files are never sent to AI, so if you would rather not send a whole statement, export a CSV or OFX file from your bank instead.
• Spreadsheets the app can't read. Only if you ask the app to work out a spreadsheet's columns, its header row and first six rows are sent.
• Questions and short notes. A question you ask about your spending is sent so the AI can tell what you are asking; our server then works out the answer from your records, and that answer — its totals and the transactions it found (each one's date, amount and description as your bank printed it) — may be sent back to the AI to be put into plain words. The month-end review, notes on budget suggestions, savings tips and the "Families like yours" summary are written by the AI from category names, shop or service names and totals our server has already worked out — not from your list of transactions.

These requests go only to the AI providers named in Who Processes Your Data (OpenAI or Anthropic, both in the United States); our settings do not allow household money records to be sent to any other AI provider. Requests to OpenAI are sent with its do-not-store setting. To avoid asking the same thing twice, we keep a shared list of shop names and item descriptions as they were sent, with the category the AI suggested. That list is not linked to your family or your account and is used for every family; each entry is deleted after a year, and because it is not linked to you, deleting your account does not remove it.

"Families like yours"

The comparison with similar households is worked out on our server from spending tables published by the U.S. Bureau of Labor Statistics (the Consumer Expenditure Survey). It uses your household's make-up from your family roster, your take-home pay if you entered it, and your home state's region. Nothing about your household is sent to anyone to make the comparison, and the comparison is not stored. If a one-sentence summary is shown with it, that sentence is written by our AI provider from what the card shows: the household description, the income band, and the survey and family totals for each group.

Who can see it

Household money is visible only to the parent users on your family account. Children cannot open it — including a child using a parent's device in kid mode. Money notifications — low balances, budget alerts, new or changed charges, purchases — go only to adults, and purchase notifications only to adults who turn them on. Two things reach the wider household: a bill's due-date reminder (its name and amount) goes to the family member you make responsible for that bill, or to everyone in the household if you name nobody; and items you buy again and again, taken from receipts and order histories, can be offered as shopping-list suggestions that everyone in the household can see — health, pharmacy, sexual-health, alcohol and tobacco purchases are never offered this way.

How long we keep it

Household money records are kept until you delete them or the family account is deleted. You can delete individual expenses, bills, planned expenses, budget categories, pay schedules and savings goals at any time, and take back a history import you accepted. You can also delete a statement you uploaded for the monthly check, or a whole history import: the transactions and order items read from it, and the purchases it added to the budget, are deleted with it (purchases you recorded some other way stay, as they were). What the app worked out from those transactions goes with them too: pay schedules it guessed from them (one you confirmed stays, without the bank’s wording), the balance printed on the statement, prices learned from its order items, and accounts it created that nothing else uses. Otherwise, removing an account from the budget archives it rather than erasing it, because its transactions still name it. Household money belongs to the family, not to one person: it is permanently deleted when the last parent user on the family account deletes their account (see Data Storage and Retention); while another parent user remains, it stays with the family. We never sell this information or use it for advertising.

Sharing With Other Families (Play Dates & Watch Parties)

The play date feature is the one place where information you enter is shown to people outside your own household, and it only happens when you choose to use it. When you create a play date group and invite another family — or accept an invitation to join one — the following becomes visible to the other parent users who are members of that group:

• The group name and notes.
• The first name (or label) of the child you add to the group, so the other families know whose schedules they are matching.
• That child's play date availability windows (the times you mark as free, and whether you can host), so the app can find overlaps across families.
• Any play date proposals you make or respond to — the title, date, time, the optional location you type, and notes.

Invitations are sent by a private, single-link that you share (by your own text-message app, or by an email we send on your behalf to an address you enter). A group is private to its invited members — there is no public directory, no public profile, and no public feed. Only a child's play date availability and the group proposals are shared; the rest of your family's calendar, your saved places, your other children, and your account details are never exposed to another family. You can remove your child from a group, revoke an invite link, or (if you created the group) delete the group at any time. Nothing is written to another family's real calendar unless that family accepts a proposal.

This sharing is at your direction, for the app's play date coordination feature only. It is not a sale of personal information and is not sharing for advertising or cross-context behavioral advertising.

Friends and watch parties. The friends roster and watch parties work the same way: you can only connect with someone by inviting a contact you already have (their email or phone) or via an invite link they share with you — there is no member search or public directory, so strangers cannot find or request you, and we cap how many invites an account can send. When you host a watch party, the guests you invite can see the party's title, date, time, location, and the bring-list of food and drinks (including who has offered to bring what). Your home address is shared with guests only if you explicitly choose to share it; otherwise they see "host's home." A friend or guest can decline an invitation and block you so you cannot send further requests. This sharing is at your direction for the friends/watch-party feature only; it is not a sale of personal information and is not sharing for advertising.

"Suggest a place" and current location. When proposing a play date you can tap "Suggest a place." If you allow it, the app reads your device's current location once, in the foreground, and — together with your saved Home location and the children's ages — uses our maps provider (Mapbox) and AI provider (Anthropic or OpenAI) to suggest nearby public meeting spots such as parks, playgrounds, and libraries. Your home address is used only as a private starting point to find places near you; it is never suggested as a venue or shared with the group. Your current location is offered as one option, and if it appears to be a home or other residence you are warned and asked to confirm before it is shared. The location reading is used for that one suggestion and is not stored. Only the place you actually choose is added to the proposal and shown to the group.

Data Storage and Retention

• On your device: Your auth token, family member roster, and a working copy of recently viewed events are cached locally so the app works briefly without a connection. Cached data is removed when you log out or uninstall the app.
• On our backend: Your account, family, family members, events, reminders, places, situations, shopping lists, daily reviews, assistant conversations, imported documents (and the extracted text from them), photos you submitted for extraction, inbound email payloads, geofence rules, household money records (if you use the budget), and Google OAuth tokens are stored in our database (Postgres on managed cloud infrastructure) and persist until you delete your account or specific records, or until applicable retention windows elapse.
• Location samples: Stored only when location sharing is opted in. Each sample is automatically deleted after the retention window you (the parent) configure for that family member (default 30 days). Pausing location sharing stops collection but does not delete prior samples; the retention timer continues to apply.
• Voice audio: Audio you submit for transcription is forwarded to OpenAI's Whisper API and then discarded by our backend. Only the resulting transcript is stored alongside your assistant conversation or import record.
• Anthropic: Content forwarded to Anthropic is handled under Anthropic's Commercial Terms of Service. Under those terms, API inputs and outputs are not used to train Anthropic's models. Anthropic deletes API inputs and outputs within 30 days, except content its automated systems flag under its usage policy, which it may keep for up to 2 years. This is independent of our own backend retention described above.
• OpenAI: Content forwarded to OpenAI is subject to OpenAI's API data usage policy. OpenAI has confirmed that API inputs and outputs are not used to train their models by default and are retained only for abuse monitoring (currently up to 30 days) before deletion. This is independent of our own backend retention described above.
• Google: If you connect Google Calendar, the OAuth refresh token is held until you disconnect the integration in Settings (which revokes the token with Google) or delete your account.
• Postmark: Forwarded emails routed through Postmark's inbound parser are subject to Postmark's data retention; we ingest the parsed payload immediately and Postmark does not retain message content beyond its operational logs.
• Sentry: Crash reports are retained for up to 90 days and then automatically deleted.
• Product-usage events: Stored on our own backend, keyed only on the per-install random identifier described above. Because they are not linked to your account, they are not affected by account deletion; we retain them for up to 24 months for trend analysis and then purge them.
• Account deletion: When you delete your account, we permanently delete your account, family, family members, events, reminders, places, situations, shopping lists, location samples, geofence rules, OAuth tokens, daily reviews, assistant conversations, imported documents, inbound email records, household money records (expenses, bills, budget categories and targets, imported statement transactions and order-history items, accounts and their balances, pay schedules, and savings goals), and your family's play date availability, group memberships, and proposals from our active database within 30 days. Encrypted backup snapshots are overwritten by the next backup cycle (typically within 30 days). If another parent user remains on your family account, only your own account and personal settings are deleted; the family's shared records, including household money, stay with the family until its last parent user deletes their account.

Who Processes Your Data

We use the following third-party service providers. Each receives only the minimum data needed to perform its function:

External calendar lookups (the in-app sports / TV-show suggestion features) query public APIs (TheSportsDB, TVMaze) using only the search term you typed; no personal data is sent.

When you tap an outbound link in the app (an address opened in your maps app, a phone number, etc.), you leave the app and are subject to that destination's privacy policy.

We Do Not Sell Your Personal Information

We do not and will not sell your personal information, and we do not share it with advertising networks or data brokers. We have not done so in the past twelve months.

U.S. State Privacy Rights

If you reside in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you have rights under your state's privacy law regarding your personal information.

Categories of personal information we collect

Your rights

• Right to know what personal information we process about you.
• Right to access a copy of your data.
• Right to correct inaccurate information.
• Right to delete your personal information. The simplest path is to delete your account from Settings → Delete My Account; this removes your account, family, family members, schedules, location samples, and integrations within 30 days. You can also email the address at the bottom of this policy to request deletion.
• Right to non-discrimination for exercising your rights.
• Right to opt out of the sale or sharing of your personal information. Famenza does not sell or share personal information, so this opt-out has no additional effect.

To exercise any right, email the contact address at the bottom of this policy. We will respond within the time required by your state's law (usually 45 days).

Children's Privacy

Famenza is designed for use by a parent or guardian to manage their household's schedule, and is not directed at children under 13. Children do not create accounts or interact with our service directly. Information about children that appears in your family — names, birthdays, schedules, and (if you opt in) location samples from a child's device — is provided by you, the parent, on their behalf, and is treated as your data under this policy. Household money records are visible only to parent users; a child — including one using a parent's device in kid mode — cannot open them.

If you are a parent and you have provided information about your child to Famenza, you can review, modify, or delete that information at any time by editing or removing the family member in Settings, or by deleting your account. We do not knowingly collect personal information directly from children, and we do not use children's information for advertising or share it with third parties for advertising purposes.

Location sharing for a child is off by default and requires the parent to enable it for that specific family member. The parent can pause or revoke it at any time. The on-device prompts that the operating system shows when the app requests background location apply to the device the app is running on; nothing about location is collected for a family member who has not opted that family member's device in.

If a parent uses the play date feature, the parent — not the child — adds the child to a group and decides which families are invited. Only the child's first name (or label) and play date availability are shared with the other families the parent chose, and the parent can remove the child or leave the group at any time. Children never invite, join, or message anyone themselves.

International Users

Our servers and third-party processors (Anthropic, OpenAI, Google, Postmark, Sentry) are located in the United States. If you use Famenza from outside the United States, your information will be transferred to and processed in the U.S. By using the app you consent to that transfer. We rely on appropriate legal mechanisms (including Standard Contractual Clauses where applicable) for transfers from the EEA, UK, or Switzerland.

Your Choices and Controls

• Delete your account: Settings → Delete My Account deletes your account and all the data associated with it within 30 days.
• Disconnect Google Calendar: Settings → Integrations → Google Calendar → Disconnect revokes our refresh token and stops further sync.
• Disconnect Gmail / Outlook inbox import: Settings → Integrations → Gmail (or Outlook) → Disconnect revokes our refresh token at the provider and deletes the stored connection.
• Disable inbound email forwarding: Settings → Inbound Email → Disable deactivates your unique forwarding alias so future mail to it is rejected.
• Pause or revoke location sharing: Settings → Location → [family member] for foreground/background opt-in toggles, retention window, and pause. Revoking deletes future collection; the retention timer applies to existing samples.
• Notifications: Toggle reminder notifications on or off in Settings, or in your device's system notification settings.
• Camera, microphone, speech-recognition, photo-library, and location permissions: Revocable any time through your device's system settings. Some features will not function without the relevant permission.
• Do Not Track: Famenza does not use web cookies for tracking or follow you across apps or websites, so browser DNT signals do not apply.

Security

Data in transit between the app and our servers is encrypted with HTTPS/TLS. Passwords are stored as salted BCrypt hashes. Google OAuth refresh tokens are encrypted at rest using ASP.NET Core Data Protection. Data on your device is protected by your operating system's app-storage sandbox and (on supported devices) hardware-backed encryption. No security measure is perfect; use the app within a reasonable security posture (up-to-date OS, device passcode, etc.).

Changes to This Policy

We may update this Privacy Policy as the app evolves or as legal requirements change. Material changes will be announced in the app on next launch and the "Last updated" date at the top of this document will be revised.

Contact Us

Questions about this policy, or want to exercise a privacy right? Email:

bursonproperties@gmail.com