Privacy statement

Updated 24 October 2026

FamilieApp is one family’s calendar, lists and weekly menu. What goes in is ordinary enough — who has football when, what needs buying — but it is still information about you and your children. This page says in plain words what we keep, why, for how long, and who can see it.

The short version: we sell nothing on, and nobody outside your own family sees your data.

One thing comes on top of that: the app measures how it is used (which screens, how long, at which moments), never what you put into it. Only we see that, and you can switch it off. It only starts after you have seen a notice about it in the app. Read more under “How the app is used”.

What we keep, and why

Your account: your email address, your name, your language, your colour in the calendar and whether you are an administrator. Without those you cannot sign in and the app does not know who you are.
Your family: the family name, the country and time zone, and the members. Children without their own login are listed with their name, date of birth and optionally their school and class. People outside the family, such as grandma or a teacher, are in it with their name, their birthday and possibly a photo that only your family sees.
Your calendar: appointments, repeats, who takes part, who drives, checklists and what changed. If you connect a calendar from outside, from school or work, we fetch its appointments.
Your lists: groceries, tasks, categories, and a photo on a line if you add one. Children’s chores and stars belong here too.
Food: recipes, the weekly menu, ingredients and what is in the house.
Notifications: what you do and do not want to hear about, and the weekly overview by email if you switch it on.
Parties and links without an account: who you invited, who answered, gift lists, secret santa draws and the photos that go with them.

Why we are allowed to

Mostly because you use the app: without storing your appointments we cannot show you a calendar. That is performing the contract.
For children’s data, health data and sharing a link we ask your consent. You can always withdraw it by removing the child, the post or the link.
For security, such as stopping abuse of a shared link, we have a legitimate interest.
For the usage measurement below (which screens, how long, at which moments) that is our legitimate interest in making the app better. You can always object to it.

Children’s data

A child has no login of their own in FamilieApp. A parent or guardian adds the child and gives explicit consent at that moment. We record who did it and when, and nothing else.
What is stored about a child is up to the parent: name, date of birth, and optionally school and class. Nothing more is needed for the app to work.
To withdraw that consent, remove the child under Family. Their details go with them. Appointments that were about the child stay, but without their name on them.

Health data

On the babysitter note you can add medical information per child, such as an allergy or a medicine. It is off by default. If you switch it on, only the sitter sees it, and only after entering your family’s PIN.
We use this for nothing else, and it never goes to anyone outside your family except through a link you share yourself.

Links you share without an account

For a party, a gift list, a secret santa draw, a babysitter note or an invitation to a single appointment you create a link. Whoever has the link sees what is in it, without an account.
Such a link carries a 32-character code that cannot be guessed, is set to no-index for search engines, and you can revoke it at any time. For the more sensitive ones, with children’s photos or health information, your family PIN is added.
We keep no IP address of visitors to such a link. We keep only an encrypted fingerprint of it, to stop anyone trying thousands of codes in a row.

If you connect your Google account

In FamilieApp you can connect your Google account. It is a choice: without it, FamilieApp does not touch anything at Google. You sign in with Google and decide what FamilieApp may do. Everyone in the family connects their own account.
FamilieApp in your Google calendar: FamilieApp creates one new calendar called “FamilieApp” in your Google account and puts your family’s appointments in it. FamilieApp only creates, changes and deletes appointments in that calendar. In this option it cannot see your other calendars.
Your calendars in FamilieApp, only if you choose this: FamilieApp reads the list of your calendars (name, colour, whether it is your main calendar, your access rights to it and its time zone) so you can choose which ones appear in FamilieApp. From the calendars you choose, FamilieApp reads the appointments: title, start and end, location, description, repetition, whether they are private and whether you declined them. FamilieApp never changes anything in those calendars.
What we do with it: those appointments appear in FamilieApp as a copy nobody can edit. Only your own family sees them, and you decide how: everyone sees everything, others only see “busy”, or only you. We use them only to show them in your family’s agenda, not for advertising and not to train a language model.
What we store: the permission Google gives us (encrypted, with a key that is not in the database), the email address and the number of your Google account, the calendars you chose with your settings, and the copies of their appointments. If you choose to show your calendars in FamilieApp, we also keep the list of all your calendars: their name, colour and your role, including the ones you do not choose, so that you can choose. The data is stored at Supabase in Frankfurt; Vercel runs the app.
Who can read it: only your family, as you set it up. We do not read your Google data along, unless you ask us for help with a problem, where it is necessary for security or to prevent abuse, or where the law requires it. We do not sell it and do not pass it on, except to the companies in the table below that run the app for us.
You can disconnect at any time under Link calendars. FamilieApp then withdraws the permission at Google and erases the permission, the list of your calendars with your choices and the copies of their appointments. If you also want the “FamilieApp” calendar in your Google account to disappear, choose that when you disconnect; otherwise it stays there and FamilieApp no longer updates it. You can also withdraw the permission yourself in the security settings of your Google account: FamilieApp notices within a quarter of an hour and stops reading and writing. What was already in FamilieApp stays until you disconnect in FamilieApp.
If you close your account, the connection and the copies disappear along with the rest of your data. The permission itself then remains at Google until you withdraw it there, so disconnect in FamilieApp first.

Google’s rules for data from Google

Google asks us to state this:

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

In plain words: we use data we get from Google only for what you see in the app. We do not sell it, use it for advertising or to train a language model, and nobody reads it except with your permission, for security, or where the law requires it.

Read Google’s policy

If you connect your Outlook or Microsoft 365 account

In FamilieApp you can connect your Outlook account: Outlook.com, Hotmail, Live or a work or school account for Microsoft 365. It is a choice: without it, FamilieApp does not touch anything at Microsoft. You sign in with Microsoft and decide what FamilieApp may do. Everyone in the family connects their own account.
The permission Microsoft asks for is broader than what FamilieApp does. For calendars Microsoft has no smaller permission than “read and write your calendars”, so that is what Microsoft’s screen says, even if you only choose to put FamilieApp in your Outlook calendar. FamilieApp keeps to the limits below itself; Microsoft does not enforce them.
FamilieApp in your Outlook calendar: FamilieApp creates one new calendar called “FamilieApp” in your Outlook account and puts your family’s appointments in it: for each appointment the title, start and end, location, description, a link back to FamilieApp and a marker by which FamilieApp recognises its own appointments. Attendees are never sent along, so no invitations go out, and appointments you set to “only me” are not sent. FamilieApp only creates, changes and deletes appointments in that calendar and, in this option, reads no other calendar.
Your calendars in FamilieApp, only if you choose this: FamilieApp reads the list of your calendars (name, colour, whether it is your main calendar and whether you may edit it) so you can choose which ones appear in FamilieApp. From the calendars you choose, FamilieApp reads the appointments: title, start and end, location, description, repetition, whether they are private and whether you declined them. FamilieApp never changes anything in those calendars.
What we do with it: those appointments appear in FamilieApp as a copy nobody can edit. Only your own family sees them, and you decide how: everyone sees everything, others only see “busy”, or only you. We use them only to show them in your family’s agenda, not for advertising and not to train a language model.
What we store: the permission Microsoft gives us (encrypted, with a key that is not in the database), the email address and the number of your Microsoft account, the calendars you chose with your settings, and the copies of their appointments. If you choose to show your calendars in FamilieApp, we also keep the list of all your calendars: their name, colour and whether you may edit them, including the ones you do not choose, so that you can choose. The data is stored at Supabase in Frankfurt; Vercel runs the app.
Who can read it: only your family, as you set it up. We do not read your Microsoft data along, unless you ask us for help with a problem, where it is necessary for security or to prevent abuse, or where the law requires it. We do not sell it and do not pass it on, except to the companies in the table below that run the app for us.
You can disconnect at any time under Link calendars. FamilieApp then erases the permission, the list of your calendars with your choices and the copies of their appointments. If you also want the “FamilieApp” calendar in your Outlook account to disappear, choose that when you disconnect; otherwise it stays there and FamilieApp no longer updates it.
Unlike with Google, FamilieApp cannot withdraw a permission at Microsoft itself: Microsoft offers no way to do that. After you disconnect, the permission therefore stays at Microsoft until you withdraw it there, although FamilieApp can do nothing with it any more, because our copy is erased. You do that with a personal account (Outlook.com, Hotmail, Live) at account.live.com/consent/Manage and with a work or school account at myapps.microsoft.com. If you withdraw it there without disconnecting in FamilieApp first, FamilieApp stops reading and writing as soon as Microsoft no longer gives access; it notices at the next round, every quarter of an hour. What was already in FamilieApp stays until you disconnect.
If you close your account, the connection and the copies disappear along with the rest of your data. The permission itself then remains at Microsoft until you withdraw it there, so disconnect in FamilieApp first and then withdraw it at Microsoft.

How the app is used (the usage measurement)

FamilieApp measures how the app is used, to make it better. For everybody who is signed in we note which screen you open (the kind of page, for example the weekly menu, never the real address and never a name or number in it), which function that screen belongs to, how long you are actively busy with it, at which moment, in which language, on what kind of device (phone, tablet or computer, judged by the width of the screen) and whether you use the installed app or the browser.
Active time only counts while the tab is visible and you touched something in the last minute and a half. A new visit (a session) starts after thirty minutes without activity.
We only start measuring after the notice about the usage measurement has been shown to you, on the first screen you open in the app after signing in. What you did before you saw that notice was not measured.
Some screens we do not measure at all, because merely opening them says something about your family or your children: the screens about a baby (the birth announcement, the visits after the birth, the help after the birth and the reveal) and the babysitter note, which can hold medical information about your children. We count no page view and no time there, and they do not appear in the figures per function either.
We never measure what you type or read: no titles, names, texts, photos or search terms. This measurement stores no IP address, sets no cookie, makes no fingerprint of your device and sends nothing to another company. The figures sit in our own database in Frankfurt.
Why: to see which parts are used and which are not, at which moments of the day families use the app, where people drop off and which screens need to be better. The legal basis is our legitimate interest in improving the app, not consent. We weighed that interest against your privacy: the figures say nothing about the content of your family life, only the owner can see them, and you can object with a single tap.
Who sees it: only the owner of FamilieApp, on an admin page that exists for nobody else. Not the other members of your family and not the admin of your family.
How long: the individual page views and the summary per person per day are kept for 400 days, then we delete them. A summary per day with no persons in it (for example how many people opened the weekly menu that day) is kept for five years, to see how use develops; after that we delete that too. A day or part only appears in that summary when at least five different people belong to it; what belongs to fewer people is left out.
You can object at any time and it takes one tap: switch the usage measurement off in Settings › Privacy, or choose Switch off on the notice you saw on your first visit. From that moment we no longer measure which screens you open, for how long and at which moments, on any device of yours. Counting how many actions are taken per day, such as adding an appointment or ticking something off, is not covered by this switch and carries on. It is only a number, never what you did. What was already measured is kept until it is deleted after 400 days, or until you ask for it to be deleted sooner. If your browser sends the Global Privacy Control or Do Not Track signal, we do not measure the screens, the time or the moments either.
Want to know what was measured about you, or have it deleted? Send a message to the address under Contact. We give you the data or delete it within thirty days.
This applies to everybody who is signed in, including people who signed up when we only counted how many actions were done. They get the notice first, are only measured after that, and can object.

What we do not do

We do not sell or rent your data, to anyone.
There is no measurement code from another company in the app, and no Google Analytics or anything like it.
We do not read along with your appointments, lists or posts, and we do not use them to train a language model.
There is no cookie banner on the app, because there are no cookies that would need one.

What sits on your device

A cookie that keeps you signed in. Without it you would have to sign in on every page.
Your choice of light or dark, in your browser’s storage. It never leaves your device.
Which version of the notice about the usage measurement you saw, in your browser’s storage. It never leaves your device.
On a guest page behind a PIN: a cookie that remembers for a few hours that the PIN was right.
If you switch on notifications, we keep the address your browser receives push messages on.

How long we keep it

Your data stays as long as your family uses the app. If you delete something, it is gone.
A photo on a grocery line disappears by itself thirty days after the line is ticked off.
A shared link works until the date you set, or until you revoke it.
You have your account or the whole family deleted yourself in the app, under My data: after you confirm there are thirty days to undo it, and after that we delete for good everything that belongs only to you or to the family.
We keep the usage measurement for 400 days, per person. A summary per day with no persons in it is kept for five years.

Who can see it

The members of your own family. The database allows only your own family, row by row. That is not a promise but a lock that sits on the server.
Whoever gets a link from you sees exactly the one thing the link is about.
Us, only when it is needed to fix a fault or when the law requires it. We do not look out of curiosity.
Only the owner of FamilieApp sees the figures of the usage measurement. They are figures about use, never the content of your appointments, lists or messages.

Your rights

You may ask what we hold about you, have it corrected, or have it deleted. In the app you can request a download of your data yourself, under Profile. What the usage measurement recorded of you is not in it yet: ask for that at the address under Contact.
You may object to a processing, and withdraw your consent for children’s or health data at any time.
If we cannot sort it out together, you can complain to the Data Protection Authority in Brussels, at dataprotectionauthority.be.
You may object to the usage measurement. You can do that with one tap in Settings › Privacy.

During the test with twenty-five families

There is a Let us know button in the app. If you send something, along goes: your text, which page you were on, which version of the app you had, what kind of device you use and how wide your screen is. Not the contents of your screen, and no screenshot.
We count, per person per day, how many actions were taken, such as adding an appointment or ticking something off. We count the number and never keep what you did. That tells us whether the app is still being used in week four. This counting is part of the usage measurement above, but the switch in Settings › Privacy does not stop it, and it carries on after the test.
The Let us know button stops when the test ends.
Under an article of the help centre there is the question “Was this helpful?”. We keep your answer, yes or no, with the name of the article, the language, the day and your family. Not who in the family answered, and no text. We only use it to see which articles need to be better.

If this statement changes

If something material changes, we say so in the app and put a new date at the top of this page. Small wording fixes are not announced separately.

Who else can reach it

To run the app we work with a few companies. They may use your data only to deliver that service and nothing else. For Google, Microsoft, YouTube and the push services of your browser, their own privacy policy applies as well, because you have an account or a device with them. Some of them only work when you switch them on; that is stated in the table. These are all of them.

Company	What for	Which data	Where
Supabase	The database, photo storage and signing in	Everything you put in the app, plus your email address and password	Frankfurt, Germany
Vercel	Running and delivering the app itself	Your browser’s requests, with your IP address in the logs	European Union, company in the United States
Hostinger	The emails for your account (confirming, forgotten password, invitations) and receiving messages sent to us	Your email address and the contents of those emails	European Union
Resend	Only if you switch on the weekly overview: sending that email, and the confirmation to an outside address that you add	The email address the overview goes to, and your family’s appointments that week, without anything marked private	Company in the United States
Anthropic	Only if you have a school letter or a recipe read: the reading model Claude reads the photo, the PDF or the text of the recipe page	That photo, PDF or text and, for a letter, the name and class of the children you choose. Nothing else from your family goes along	Company in the United States, where the reading also happens. Anthropic does not use what we send to train models and deletes it within thirty days under its terms
Google Sign-In	Only on the pages to sign in and sign up: the “Continue with Google” button and, if you press it, signing in with your Google account	The page loads a script from Google, so Google sees your IP address and browser, even if you do not press the button. If you do, we receive your name, your email address and proof that it is you from Google. Nobody on our side sees your Google password	At Google, under Google’s privacy policy
Google	Only if you connect your Google account: the “FamilieApp” calendar in your Google Calendar, and reading the calendars you choose	Your family’s appointments (to Google), the appointments from the calendars you choose (from Google) and the email address of your Google account	At Google, under your own Google account and Google’s privacy policy
Microsoft	Only if you connect your Outlook or Microsoft 365 account: the “FamilieApp” calendar in your Outlook calendar, and reading the calendars you choose	Your family’s appointments (to Microsoft), the appointments from the calendars you choose (from Microsoft) and the email address of your Microsoft account	At Microsoft, under your own Microsoft account and Microsoft’s privacy policy
YouTube	Only if you tap the play button of a video on a recipe: the video is then loaded from YouTube	Your IP address and the page you are on, from the moment you tap. Until you tap, nothing goes to YouTube	At YouTube (Google), through youtube-nocookie.com, under Google’s privacy policy
Apple, Google, Microsoft, Mozilla	Only if you switch on notifications: delivering push messages to your device through the push service of the company behind your browser	The address of your device for push messages, and the message itself, encrypted: the push service cannot read what is in it	At the company behind your browser, under its own privacy policy
Sentry	Only when error reporting is switched on: a technical report when something goes wrong in the app, so that we can fix it	What went wrong and on which page, with a user number. Not your email address, not what you type and no access codes from addresses	Company in the United States
Stripe	Only if you take a paid plan later (not available yet): payment and invoices	Your name, email address and payment details. You enter your card number at Stripe; we never see it. For fraud checks and legal duties Stripe is itself also responsible for that data	Company in the United States

Nobody else. No analytics company and no data broker.

Contact

Questions about your data, or want it deleted? Write to support@familieapp.eu. We answer within thirty days, usually sooner.