FamilyFlux Privacy Policy

Last updated: 2026-10-26

FamilyFlux shares your location with the people you add. This policy explains exactly what that involves, where it goes, and how to stop it.

Operator: [PLACEHOLDER: legal entity name] Registered address: [PLACEHOLDER: address] Contact: [PLACEHOLDER: contact email] Governing law: [PLACEHOLDER: governing law / jurisdiction]

A lawyer has not reviewed this document. See "Before this goes live" at the bottom for what still needs checking.

1. What we collect

Category	What	Why
Account	Your name, email address and photo — from Google Sign-In, or the name, email and password you enter (the password is held by Firebase Authentication, never by us); a photo you upload	To create your account and show you to your people
Live location	While Share my location is on: your position (as often as every few seconds when you move), battery level, whether you seem to be still, walking or driving (guessed from speed), and whether you are online	To show you on your people's map
Places and history	Places your group saves (name, address, area), when you arrive at and leave them, your trips (from, to, times, distance) and their routes, and alerts such as "arrived", "left" and "low battery"	To show where you are, notify your people, and show recent activity
Meets	Meets you create or join: title, place, time, guests, and who has arrived or is on the way	To run meets and their ETAs
Live links	When you send a live link: your name, destination, position and arrival	So the person you sent it to can follow you until you arrive
Contacts (phone app)	If you allow it, the phone numbers in your address book are turned into one-way fingerprints (hashes) on your phone and only the fingerprints are sent, to find people you know who use FamilyFlux; we don't keep the list. Your own number's fingerprint is kept so people who know you can find you, as your "Find me by my number" setting allows	To find people to add
Messages	What you send in Messages: text, photos, videos, voice messages, documents, polls, contact cards, and a location if you choose to send one; who called whom and when	To deliver messages and calls
Profile card	Name, photo, an "about" line and when you were last online; and a one-way fingerprint (hash) of your email address, never the address itself	So people can message and call you. Other signed-in users can see your card; nobody else sees your email address
Settings	Notification switches, appearance, who can find you, sharing on or off	To apply your choices
Push	A device token (Firebase Cloud Messaging)	To send notifications
Usage and crashes (phone app only)	Screens you open, events such as "call placed", crash reports and app performance, tied to your account identifier (never your name or email)	To fix bugs and see which features are used
Visit	Your IP address and browser, as with any website	To serve the site

On a phone, location sharing keeps running in the background while it is on; Android shows a "Sharing your location" notification the whole time.

2. Who can see it

The people you added see your live location, battery, places, arrivals, trips and alerts. Everyone you add sees the same; there is no admin who sees more.
Someone you send a live link sees your position and ETA until you arrive or the link ends (at most a day), without needing an account.
Your profile card is visible to other signed-in users. Your email address is not on it and is never shown to anyone else.
Messages and media are visible to the people in that chat or group. A media file can be fetched only by its sender and the people in the chat when it was sent; someone who joins a group later does not get the files sent before. Opening a file gives that person a link to it, which works for anyone they pass it on to, as a saved copy would.

3. Where it goes

Google Firebase / Google Cloud (United States): sign-in (Firebase Authentication), your group's places, history, meets and settings (Cloud Firestore), photos and media (Cloud Storage), notifications (Firebase Cloud Messaging), the server functions that manage groups, invites and alerts, and, in the phone app, Google Analytics for Firebase, Crashlytics and Performance Monitoring. Google processes this for us under its data processing terms.
Our live server. Your live position, battery and online status, and messages, call set-up and profile cards, travel through a message server (MQTT) we run on Google Cloud. It keeps the latest position you shared so your people see it when they open the app. Messages are kept on your device; one waits on the server only until the recipient's device collects it, for up to 30 days.
Google Maps Platform draws the map, and receives the text you type to search for a place (with your rough area to rank results), the start and end of a route to work out an ETA, and positions to look up an address.
Notifications for messages include the sender's name and up to the first 140 characters of the message, through Google's push service.
Calls go directly between devices where possible, using Google's public STUN server. When a direct route is blocked, the call's encrypted audio and video are relayed by Cloudflare (Realtime TURN), a TURN relay provider, which then sees your IP address.
The web app loads its engine and fonts from Google's content network (www.gstatic.com, fonts.gstatic.com).

We do not sell your data, we do not show ads, and we never send you marketing.

4. Your choices

Share my location on the You screen turns sharing off or on. Off, nothing about your position is sent and your people see you as they would a phone that went quiet.
Who can see you lists, by name, everyone who can.
Live links can each be ended from the list of links you have out.
Find me by my number (You → Account) controls whether people can find you from their contacts.
Leave these people removes you from the group.
Delete account (You → Account) deletes your account, your member card, your profile, your photo, your device registrations, your contact fingerprint and your contact requests. [PLACEHOLDER: today it does not remove trips, routes, activity and alerts already shared with a group that continues, chat media, or your last position on the live server — write to us and we will remove them.]
Your name and photo from Google can be changed in your Google account.

5. Retention

Trip routes are deleted after 30 days; live links after about a day; unanswered invitations and contact requests after a few days.
Undelivered messages expire from the message server after 30 days.
Places, trips, activity, alerts and meets are kept while the group exists. [PLACEHOLDER: retention period for history and for deleted accounts.]

6. Children

FamilyFlux is made for families, which can include children. The app does not ask anyone's age. [PLACEHOLDER: children's policy — the minimum age for a child's own account, and how a parent or guardian consents.] A parent or guardian can ask us to delete a child's data at [PLACEHOLDER: contact email].

7. Security

Access to every collection and file is controlled by Firebase security rules, the live server only accepts signed-in members of a group, and calls are encrypted in transit. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

8. Changes

We will change the date at the top when this policy changes, and tell you in the app about anything material.

9. Contact

[PLACEHOLDER: contact email]

Before this goes live — a lawyer must check

Children (COPPA, UK AADC, GDPR Art. 8). A family location app will have children on it; there is no age question and no parental-consent flow.
Precise and background location is sensitive data in several regimes (e.g. CPRA "sensitive personal information", some US state laws); check the consent wording on the permission screens and the app store disclosures (Google Play background-location declaration).
Deletion gaps listed in section 4.
Lawful bases, transfers, retention schedule (GDPR/UK GDPR), the CCPA notice, and an EU representative if needed.