privacy policy · v1.0

Privacy Policy.

Last updated: 2026-09-12.

1. Who we are

Pamily is published by Axel Trajano, a sole developer based in New Zealand. Contact: dev.puhgeh@gmail.com.

2. Scope

This policy applies to the Pamily mobile application for iOS and Android (bundle id com.puhgeh.pamily) and to this marketing website at pamily.puhgeh.com.

3. What information the app processes

All of the information you enter into Pamily — family member names, dates of birth, avatars, events, tasks, notes, subscriptions — is stored only on the device you typed it on. It is held in the app's private storage area, encrypted at rest by the operating system (Apple Data Protection on iOS, Android Keystore-backed file encryption on Android).

Unless you subscribe to cloud sync, the app does not transmit this content to us or to anyone else — there is no server-side copy. When sync is on, the content that leaves the device is end-to-end encrypted first (see the Sync section below). There is no advertising SDK. We do not share, sell, or rent any user data.

The app does send a small set of diagnostic signals to Google Firebase so we can keep Pamily stable and prioritise development. Two services are used:

• Firebase Crashlytics — when the app crashes, a stack trace and a small set of environment values (OS version, device model, app version, free memory at crash) are sent so we can fix the bug. The report is linked only to a per-install random identifier and contains nothing from your calendar, tasks, notes, or family records.
• Google Analytics for Firebase — anonymous counters of which screens are visited and which features are used (for example: "Tasks tab opened", "Backup exported"). Event payloads never include personal content. Data is linked only to a per-install random identifier. Google Signals and Google Ads personalisation are disabled in the Firebase project, so this data is not joined with any advertising profile.

Both services are controlled by the single "Send anonymous diagnostics" switch in Settings → Privacy. They are on by default; switched off, the SDKs stop transmitting and any pending payload is discarded. Local-only mode also forces them off automatically.

Sync (optional, subscription-gated)

The app offers optional Sync subscriptions in two shapes. In both, your family's content is end-to-end encrypted on your device before it leaves it, with a key that is generated on your devices and never reaches our servers — we never see the key, and we never see the contents.

Personal plan: the storage backend is your own iCloud or Google Drive — you pick which. Pamily writes encrypted blobs to an app-private area of your chosen cloud account. We operate no storage for this plan and cannot access your account.

Family plan: for real-time sharing across a household, encrypted blobs are stored in Pamily's Firebase (Google Cloud) infrastructure — ciphertext only: text content in the Cloud Firestore database, and photo/PDF attachments in Cloud Storage for Firebase. Every attachment is encrypted on your device with the family key before upload, exactly like the rest of your content. This plan uses a sign-in account via Firebase Authentication, so for it we store:

• your account: email address and a user id, used to identify family membership;
• your family's household record: the member user ids, the plan's seat limit, and a subscription-valid flag;
• invites: an encrypted key envelope that is only usable with the secret half of the invite code — which never reaches the server;
• device heartbeats: a platform name (e.g. "android"), a random per-install identifier, a last-synced timestamp, the user id of the member the device belongs to, and the device's public encryption key. Shown to your own family as the "Devices" list. No device names.
• member profiles: the display name and email address from each member's sign-in, published by their own device and visible to your family in the members list — so the roster shows people instead of account codes;
• key-rotation envelopes: when someone leaves a family, the remaining devices receive a fresh family key — each copy is encrypted to a specific device's public key, so what we store is ciphertext only a device in your family can open. We also store the key's version number and a short public fingerprint (which reveals nothing about the key itself).

Sync is gated behind an in-app auto-renewing subscription managed by the App Store or Google Play. Cancellation is handled in the store's subscription settings; after cancel, existing synced data remains readable on your devices, only new writes pause until you resubscribe or revert to local-only mode. If a Family plan lapses, sync pauses for every member of that family until the plan holder resubscribes.

While Sync is enabled, the app exchanges HTTPS requests with the backend of your plan:

• Apple iCloud Drive (*.icloud.com) via the standard iOS Files / iCloud Documents APIs.
• Google Drive (www.googleapis.com/drive/*) via the narrow drive.appdata scope (an app-only folder; the rest of your Drive is invisible to Pamily).
• Google Firebase (firestore.googleapis.com, firebasestorage.googleapis.com, Firebase Auth) for the Family plan — ciphertext blobs (content and attachments) and the membership metadata listed above.

4. What information this website processes

This website is hosted by Cloudflare Pages. Cloudflare may log standard request data (IP address, user agent, referrer) for security and abuse prevention. We do not place tracking cookies, we do not run analytics scripts, and we do not embed third-party social widgets.

5. Third-party services

The mobile app uses the following third parties:

• Google Firebase — Crashlytics and Analytics as described in §3; plus, on the Family plan, Firebase Authentication (your sign-in account), Cloud Firestore (encrypted sync blobs + membership metadata) and Cloud Storage for Firebase (encrypted photo/PDF attachments). Privacy policy: firebase.google.com/support/privacy. Google's role: data processor.
• Apple App Store / Google Play (billing) — when you start, manage, or cancel a Pamily Sync subscription. The store charges your payment method on file and tells Pamily whether the subscription is active. Pamily never sees your card number, billing address, or store account. Apple privacy: apple.com/legal/privacy. Google privacy: policies.google.com/privacy.
• Apple iCloud Drive and Google Drive — when you enable Sync, the app writes end-to-end encrypted blobs into a folder in your chosen account. You are the controller of that account; we cannot access it. Both providers may log standard request metadata under their own policies.
• Apple Keychain (iOS) and Android Keystore — to store the local encryption key used by the encrypted backup feature and (when enabled) by Sync. Keys never leave the device.
• The system file picker (Apple Files, Android Storage Access Framework) — when you choose to import or export an encrypted backup file. The destination is whatever you pick (iCloud Drive, Google Drive, Dropbox, AirDrop, local storage). We never see where you stored it.
• Calendar files (.ics) — when you choose to export your calendar (or one event), the app writes a standard iCalendar file and hands it to your phone's share sheet, so you can open it in another calendar app. Unlike a backup, a calendar file is not encrypted: other calendar apps must be able to read it, so share it only where you mean to. Importing reads only the file you pick. Pamily sends nothing anywhere for either; the app needs no calendar permission.
• Calendar links — if you add a calendar by its link (a school's term dates, a club's fixtures, public holidays, or the private address of your own calendar), your phone downloads that calendar directly from the website that publishes it, and checks it again every few hours. No Pamily server is involved. That website sees an ordinary web request — your IP address and "Pamily" as the app name — and may log it under its own privacy policy. The link and the events it brings are stored like the rest of your family's content: on your devices, and end-to-end encrypted when sync shares them with your family. A private calendar address works like a password — anyone who has it can read that calendar — so add only links you're happy for your family to hold.
• The phone's own calendars — two switches in Settings → Privacy, both off until you turn them on, each per phone. Phone calendars in Pamily reads the calendars you pick (work, a personal Google or Outlook calendar) so their events appear in the Days view; they are read for the dates on screen, never stored by Pamily, never synced to your family, and never included in reminders, recaps or exports. Copy family events to a phone calendar writes copies of your family's events into one calendar you choose, and your phone's own account sync carries them to that account (Google, Microsoft, Apple) — so those copies are ordinary calendar events, not end-to-end encrypted, and subject to that provider's policy. Turning the switch off, leaving the family, or wiping the device removes the copies again. Local-only mode keeps copying off. No Pamily server is involved either way, and calendar permission is requested only when one of these switches is turned on.
• The phone's own AI model — "Ask Pamily", the helper behind the button on the Today tab, runs on the language model built into your phone (Gemini Nano through Android's system AI service, or Apple's Foundation Models on iOS). Your question, a one-week summary of your family's events and to-dos, and your family's first names are given to that on-device model. Nothing is sent to us or to any AI company: there is no API key, no account, and no cloud fallback — phones without a model of their own simply don't show it. The one network call the feature makes goes the other way: Pamily asks Firebase for its own two settings (whether the helper is switched on at all, and whether it should sit out a particular phone model), so we can turn it off quickly if it misbehaves. That request carries no question, no answer and nothing about your family, and Local-only mode skips it entirely. The conversation is not stored: it exists while the sheet is open and is gone when you close it. Anything the helper offers to add is only written to your family's data when you tap to confirm it. On Android the system downloads its model once, from the platform, not from us. Flagging an answer happens inside the app: the report — the answer, your reason and anything you add — is kept on your phone, and if diagnostics are switched on, only the reason (for example "it was offensive") is sent to us, never the answer and never your family's details.
• The system image picker, camera, and file picker — if you choose to set a member avatar or attach a photo or PDF to a note, task, or event (including files shared into Pamily from other apps). Avatars stay on the device; attachments stay on the device too, and leave it only as end-to-end encrypted ciphertext when sync is on — to your own iCloud/Drive on the Personal plan, or to Cloud Storage for Firebase on the Family plan.
• Reading a notice you photograph or share — "Scan a notice" takes a photo (or one you pick from your library) of a school newsletter, an invitation or a permission slip, and reads the words off it with the text recogniser built into your phone. A photo or PDF you share into Pamily from another app is read the same way, on the device, and is still kept as a note whether or not anything was found in it. The words are then turned into things to add, either by the phone's own AI model where there is one or by plain date-matching rules where there isn't. The photo and its words never leave the device: nothing is uploaded, no AI company is involved, and the scan keeps no copy of the photo — the temporary one the picker makes is deleted as soon as it has been read. Nothing is added to your family's data until you tap Add.
• Text shared into Pamily from another app — if you share a message or an email into Pamily (the class group's reminder, a note from school), the same on-device reading looks it over for dates and offers what it found. The text is read on your phone and goes nowhere else. Whatever you don't take up is kept as a note on your fridge board, so nothing you sent is silently thrown away, and like the rest of your content it leaves the device only as end-to-end encrypted ciphertext if sync is on.
• The microphone — only when you tap the microphone button in Ask Pamily to say something instead of typing it, and only on phones whose speech recognition runs entirely on the device: on those, what you say is turned into text by the phone itself and the audio is never stored or sent anywhere. On phones where the system cannot guarantee that, Pamily shows no microphone button at all — the keyboard's own mic key still works there, under your phone maker's policy rather than ours. Permission is asked for at that first tap, never at launch.
• The device camera — only when you tap "Scan" to join a family by QR code. Frames are processed on-device to find the invite code and are never recorded or uploaded.

This website embeds web fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). Google may receive your IP address and user-agent when fonts are loaded. We may self-host the fonts in a future revision to avoid this.

6. Encryption

The optional Encrypted Backup feature and all sync blobs use AES-GCM, an industry-standard symmetric cipher. Keys are generated locally and stored in the platform keychain (Apple Keychain / Android Keystore); sync blobs are encrypted with a family key that exists only on your family's devices. Exported files and synced blobs are unreadable without the key. Apple has classified this use as exempt under U.S. export regulations (EAR §740.17(b)(2)).

7. Children

Pamily is designed for adults managing a household, and accounts are for people 18 or older. It is not directed at children. Children appear in Pamily as profile records created and controlled by the adults in the family — they are not users, have no login of their own, and we knowingly collect no data from them. Like all family content, child profiles never leave your devices except as end-to-end encrypted ciphertext when an adult enables sync. The "Kid-safe mode" toggle on a member profile is part of that same content.

8. Retention

Your data lives on your device until you choose to delete it. Use Settings → Wipe data on this device to clear everything in one tap, or simply uninstall the app — both remove all stored content. Family-plan cloud data is deleted when the family's owner disbands it or deletes their account; Personal-plan blobs live in your own cloud account and are yours to delete at any time. See account & data deletion.

9. Your rights

Your family content stays on your device, so the standard data-subject rights (access, rectification, erasure, portability, objection) are exercised directly there:

• Access & portability: use Export encrypted backup. The exported file is yours.
• Erasure: use Wipe data on this device or uninstall the app; for the Family plan's cloud side, delete your account in-app.
• Rectification: edit any entry directly in the app.

For the diagnostic signals sent to Firebase (§3):

• Opt out: Settings → Privacy → switch "Send anonymous diagnostics" off. It stops both SDKs immediately and discards any queued payload.
• Reset the device identifier: uninstalling and reinstalling generates a fresh Firebase Installation ID and App Instance ID, severing the link to anything previously sent.
• Deletion of previously sent data: Google retains analytics events according to the retention setting in our Firebase project (currently 14 months) and crash reports for a comparable period; thereafter they are aggregated and individual records are deleted. You can also request deletion directly via Google: support.google.com/analytics/answer/9450800.

If you believe we are processing data about you that we do not realise we are processing, write to dev.puhgeh@gmail.com and we will investigate within 30 days.

10. Disclosures to authorities

We hold no readable copy of your family content — for the free and Personal plans we hold nothing at all, and for the Family plan only ciphertext we cannot decrypt — so a request directed at us cannot produce your content. For account records (Family plan) and the diagnostic signals held by Google, any lawful request would be handled per Google's own policy and applicable law.

11. International transfers

Your family content leaves your device only as end-to-end encrypted ciphertext, and only when sync is on. Family-plan ciphertext, account records, and the diagnostic signals sent to Firebase are processed on Google's global infrastructure and may transit between regions per Google's standard practice. The marketing site is served from Cloudflare's global network; the response payload contains no personal data of yours beyond a transient IP-level log on Cloudflare's side.

12. Changes to this policy

If we add features that change what is processed, we will publish a new version of this policy and disclose the change in the app before it takes effect. The current version is always at pamily.puhgeh.com/privacy.

13. Governing law

This policy is governed by the laws of New Zealand.

14. Contact

Questions, requests, or feedback: dev.puhgeh@gmail.com.