privacy policy · v1.0

Privacy Policy.

Last updated: 2026-08-22.

1. Who we are

Pamily is published by Axel Trajano, a sole developer based in New Zealand. Contact: dev.puhgeh@gmail.com.

2. Scope

This policy applies to the Pamily mobile application for iOS and Android (bundle id com.puhgeh.pamily) and to this marketing website at pamily.puhgeh.com.

3. What information the app processes

All of the information you enter into Pamily — family member names, dates of birth, avatars, events, tasks, notes, subscriptions — is stored only on the device you typed it on. It is held in the app's private storage area, encrypted at rest by the operating system (Apple Data Protection on iOS, Android Keystore-backed file encryption on Android).

Unless you subscribe to cloud sync, the app does not transmit this content to us or to anyone else — there is no server-side copy. When sync is on, the content that leaves the device is end-to-end encrypted first (see the Sync section below). There is no advertising SDK. We do not share, sell, or rent any user data.

The app does send a small set of diagnostic signals to Google Firebase so we can keep Pamily stable and prioritise development. Two services are used:

• Firebase Crashlytics — when the app crashes, a stack trace and a small set of environment values (OS version, device model, app version, free memory at crash) are sent so we can fix the bug. The report is linked only to a per-install random identifier and contains nothing from your calendar, tasks, notes, or family records.
• Google Analytics for Firebase — anonymous counters of which screens are visited and which features are used (for example: "Tasks tab opened", "Backup exported"). Event payloads never include personal content. Data is linked only to a per-install random identifier. Google Signals and Google Ads personalisation are disabled in the Firebase project, so this data is not joined with any advertising profile.

Both services are controlled by the single "Send anonymous diagnostics" switch in Settings → Privacy. They are on by default; switched off, the SDKs stop transmitting and any pending payload is discarded. Local-only mode also forces them off automatically.

Sync (optional, subscription-gated)

The app offers optional Sync subscriptions in two shapes. In both, your family's content is end-to-end encrypted on your device before it leaves it, with a key that is generated on your devices and never reaches our servers — we never see the key, and we never see the contents.

Personal plan: the storage backend is your own iCloud or Google Drive — you pick which. Pamily writes encrypted blobs to an app-private area of your chosen cloud account. We operate no storage for this plan and cannot access your account.

Family plan: for real-time sharing across a household, encrypted blobs are stored in Pamily's Firebase (Google Cloud) infrastructure — ciphertext only: text content in the Cloud Firestore database, and photo/PDF attachments in Cloud Storage for Firebase. Every attachment is encrypted on your device with the family key before upload, exactly like the rest of your content. This plan uses a sign-in account via Firebase Authentication, so for it we store:

• your account: email address and a user id, used to identify family membership;
• your family's household record: the member user ids, the plan's seat limit, and a subscription-valid flag;
• invites: an encrypted key envelope that is only usable with the secret half of the invite code — which never reaches the server;
• device heartbeats: a platform name (e.g. "android"), a random per-install identifier, a last-synced timestamp, the user id of the member the device belongs to, and the device's public encryption key. Shown to your own family as the "Devices" list. No device names.
• member profiles: the display name and email address from each member's sign-in, published by their own device and visible to your family in the members list — so the roster shows people instead of account codes;
• key-rotation envelopes: when someone leaves a family, the remaining devices receive a fresh family key — each copy is encrypted to a specific device's public key, so what we store is ciphertext only a device in your family can open. We also store the key's version number and a short public fingerprint (which reveals nothing about the key itself).

Sync is gated behind an in-app auto-renewing subscription managed by the App Store or Google Play. Cancellation is handled in the store's subscription settings; after cancel, existing synced data remains readable on your devices, only new writes pause until you resubscribe or revert to local-only mode. If a Family plan lapses, sync pauses for every member of that family until the plan holder resubscribes.

While Sync is enabled, the app exchanges HTTPS requests with the backend of your plan:

• Apple iCloud Drive (*.icloud.com) via the standard iOS Files / iCloud Documents APIs.
• Google Drive (www.googleapis.com/drive/*) via the narrow drive.appdata scope (an app-only folder; the rest of your Drive is invisible to Pamily).
• Google Firebase (firestore.googleapis.com, firebasestorage.googleapis.com, Firebase Auth) for the Family plan — ciphertext blobs (content and attachments) and the membership metadata listed above.

4. What information this website processes

This website is hosted by Cloudflare Pages. Cloudflare may log standard request data (IP address, user agent, referrer) for security and abuse prevention. We do not place tracking cookies, we do not run analytics scripts, and we do not embed third-party social widgets.

5. Third-party services

The mobile app uses the following third parties:

• Google Firebase — Crashlytics and Analytics as described in §3; plus, on the Family plan, Firebase Authentication (your sign-in account), Cloud Firestore (encrypted sync blobs + membership metadata) and Cloud Storage for Firebase (encrypted photo/PDF attachments). Privacy policy: firebase.google.com/support/privacy. Google's role: data processor.
• Apple App Store / Google Play (billing) — when you start, manage, or cancel a Pamily Sync subscription. The store charges your payment method on file and tells Pamily whether the subscription is active. Pamily never sees your card number, billing address, or store account. Apple privacy: apple.com/legal/privacy. Google privacy: policies.google.com/privacy.
• Apple iCloud Drive and Google Drive — when you enable Sync, the app writes end-to-end encrypted blobs into a folder in your chosen account. You are the controller of that account; we cannot access it. Both providers may log standard request metadata under their own policies.
• Apple Keychain (iOS) and Android Keystore — to store the local encryption key used by the encrypted backup feature and (when enabled) by Sync. Keys never leave the device.
• The system file picker (Apple Files, Android Storage Access Framework) — when you choose to import or export an encrypted backup file. The destination is whatever you pick (iCloud Drive, Google Drive, Dropbox, AirDrop, local storage). We never see where you stored it.
• The system image picker, camera, and file picker — if you choose to set a member avatar or attach a photo or PDF to a note, task, or event (including files shared into Pamily from other apps). Avatars stay on the device; attachments stay on the device too, and leave it only as end-to-end encrypted ciphertext when sync is on — to your own iCloud/Drive on the Personal plan, or to Cloud Storage for Firebase on the Family plan.
• The device camera — only when you tap "Scan" to join a family by QR code. Frames are processed on-device to find the invite code and are never recorded or uploaded.

This website embeds web fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). Google may receive your IP address and user-agent when fonts are loaded. To avoid this, you can self-host the fonts in a future revision; we may do so before v1.1.

6. Encryption

The optional Encrypted Backup feature and all sync blobs use AES-GCM, an industry-standard symmetric cipher. Keys are generated locally and stored in the platform keychain (Apple Keychain / Android Keystore); sync blobs are encrypted with a family key that exists only on your family's devices. Exported files and synced blobs are unreadable without the key. Apple has classified this use as exempt under U.S. export regulations (EAR §740.17(b)(2)).

7. Children

Pamily is designed for adults managing a household, and accounts are for people 18 or older. It is not directed at children. Children appear in Pamily as profile records created and controlled by the adults in the family — they are not users, have no login of their own, and we knowingly collect no data from them. Like all family content, child profiles never leave your devices except as end-to-end encrypted ciphertext when an adult enables sync. The "Kid-safe mode" toggle on a member profile is part of that same content.

8. Retention

Your data lives on your device until you choose to delete it. Use Settings → Wipe data on this device to clear everything in one tap, or simply uninstall the app — both remove all stored content. Family-plan cloud data is deleted when the family's owner disbands it or deletes their account; Personal-plan blobs live in your own cloud account and are yours to delete at any time. See account & data deletion.

9. Your rights

Your family content stays on your device, so the standard data-subject rights (access, rectification, erasure, portability, objection) are exercised directly there:

• Access & portability: use Export encrypted backup. The exported file is yours.
• Erasure: use Wipe data on this device or uninstall the app; for the Family plan's cloud side, delete your account in-app.
• Rectification: edit any entry directly in the app.

For the diagnostic signals sent to Firebase (§3):

• Opt out: Settings → Privacy → switch "Send anonymous diagnostics" off. It stops both SDKs immediately and discards any queued payload.
• Reset the device identifier: uninstalling and reinstalling generates a fresh Firebase Installation ID and App Instance ID, severing the link to anything previously sent.
• Deletion of previously sent data: Google retains analytics events according to the retention setting in our Firebase project (currently 14 months) and crash reports for a comparable period; thereafter they are aggregated and individual records are deleted. You can also request deletion directly via Google: support.google.com/analytics/answer/9450800.

If you believe we are processing data about you that we do not realise we are processing, write to dev.puhgeh@gmail.com and we will investigate within 30 days.

10. Disclosures to authorities

We hold no readable copy of your family content — for the free and Personal plans we hold nothing at all, and for the Family plan only ciphertext we cannot decrypt — so a request directed at us cannot produce your content. For account records (Family plan) and the diagnostic signals held by Google, any lawful request would be handled per Google's own policy and applicable law.

11. International transfers

Your family content leaves your device only as end-to-end encrypted ciphertext, and only when sync is on. Family-plan ciphertext, account records, and the diagnostic signals sent to Firebase are processed on Google's global infrastructure and may transit between regions per Google's standard practice. The marketing site is served from Cloudflare's global network; the response payload contains no personal data of yours beyond a transient IP-level log on Cloudflare's side.

12. Changes to this policy

If we add features that change what is processed, we will publish a new version of this policy and disclose the change in the app before it takes effect. The current version is always at pamily.puhgeh.com/privacy.

13. Governing law

This policy is governed by the laws of New Zealand.

14. Contact

Questions, requests, or feedback: dev.puhgeh@gmail.com.