Skip to main content

Privacy Policy

Last updated: October 2026

1. Controller

Max Bauer (sole trader)
Freiherr-vom-Stein-Str. 4
59558 Lippstadt
Email: info@famprio.com

2. Purposes and legal bases of processing

  • Performance of contract (Art. 6(1)(b) GDPR): Providing the app features (calendar, tasks, chat, budget, recipes, documents, gallery and more) and managing family accounts and members.
  • Chat and messages (Art. 6(1)(b) GDPR): We store the text of your messages, attached files, who wrote them, who they went to and when they were read. The chat is not end-to-end encrypted. Transmission is encrypted, but the message sits on our server in plain text — we could technically read it. We do not, except for the automatic check for offensive language (see next point) and when a message is reported to us. If notification previews are enabled, an excerpt is passed to Apple on iPhone and iPad (see push notifications).
  • Automatic checking of chat content (Art. 6(1)(f) GDPR, protection of children and young people): Every message written runs through an automatic word filter. Detected expressions are replaced with asterisks; only on a match is the unchanged original also stored, so the incident can be reviewed. Only text is checked — photos, videos and voice messages are not checked automatically. In the adults' community and in direct messages, a serious breach can lead to an automatic, time-limited block; this is an automated decision within the meaning of Art. 22 GDPR. You may object at any time and request review by a human: info@famprio.com. There is no automatic block in family and topic rooms or in the event and timetable chat.
  • Authentication and session security (Art. 6(1)(f) GDPR): Strictly necessary session cookies for secure sign-in.
  • Payment processing (Art. 6(1)(b) GDPR): Processing of payment data via Stripe Payments Europe Ltd., Dublin (Ireland) for web payments, or via Apple (in-app purchase on iOS) or Google (Google Play Billing, Android) for purchases through the app stores, once payments are activated.
  • Product analysis and performance measurement (Art. 6(1)(f) GDPR): Anonymized usage statistics via Vercel Web Analytics and Vercel Speed Insights (both cookie-free, no personal data, no cross-site tracking). We collect only page views per route and technical performance metrics (loading times, Core Web Vitals).
  • Adults-only community 18+ (Art. 6(1)(f) GDPR): Operation of a closed community area exclusively for adults. Age verification via the parent account; children and teenagers are excluded by the system.
  • Location sharing (Art. 6(1)(a) GDPR): Only with the explicit consent given on your device. No storage without active consent.
  • Arrivals & departures (Art. 6(1)(a) GDPR): Only in the iPhone app and only if you explicitly turn the feature on and grant iOS the “Always” location permission. The device itself detects when you enter or leave a saved family place and transmits only that statement (place and direction) – no coordinates and no routes. Recipients are exclusively family members with whom you are sharing your location at that moment; they receive a notification that is stored like all notifications. You can turn it off at any time under Settings › Location sharing.
  • Map display (Art. 6(1)(f) GDPR): When you open a map feature, maps are loaded via MapTiler; in doing so, technically necessary connection data (e.g. IP address) is transmitted to the tile server.
  • Push notifications (Art. 6(1)(a)/(b) GDPR): If enabled, we send notices about events, tasks and new messages. Delivery is handled technically by the push service of your browser or device manufacturer (e.g. Google, Apple, Mozilla). In the browser the content is encrypted for that service; only an anonymous push endpoint is processed there. In our app for iPhone and iPad, however, the notification is passed to Apple unencrypted: it contains the notice text, the first name of the sender and, for chat messages, the first 140 characters as a preview.
  • Error and stability monitoring (Art. 6(1)(f) GDPR): If enabled, we use Sentry to detect technical errors (cookies and auth headers are masked in the process) in order to improve the app's stability.
  • Self-promotion on the Free plan (Art. 6(1)(f) GDPR, legitimate interest): On the free plan we show only references to our own paid features (currently the Plus plan). These are our own product references with no involvement of third parties: no advertising partners, no sharing of data, no additional data processing, no profiling, no behavioural targeting, no cross-site tracking. No third-party advertising takes place. Plus users receive the service free of such references.
  • Device and display information (Art. 6(1)(f) GDPR): In the app we store, linked to your account, which device you use and how large its display is (screen and window size, pixel density, safe margins, orientation; for installations from the App Store additionally the manufacturer's model name). You can view this information yourself in the settings at any time. To handle support enquiries, we can view it too — this allows a display error to be attributed to the right device without you having to look up technical details. No profiling and no device-based tracking takes place. The information is removed when you delete your account.
  • Date a photo was taken (Art. 6(1)(b) GDPR): When you upload photos from the app to the gallery or to an experience, we transfer only the date taken, so they appear on the right day and in the “On this day” look-back – never the location (GPS) and no other photo data.
  • Moving to a new device (Art. 6(1)(b) GDPR): If you choose “Move to new device” in the app, your files that are stored only on your device are placed temporarily in our storage at Cloudflare (EU). They are encrypted with AES-256 on your device before upload; the key is derived from a transfer code that only your old device shows and that we never receive. We therefore cannot read the content. The package is bound to your account, does not count towards your storage and is deleted automatically after it has been restored, when you cancel, or after 7 days at the latest.
  • Personal profile with health information (Art. 9(2)(a) GDPR, explicit consent): Only if you create a personal profile. Details are set out in section 9.

3. Storage location and servers

All personal data is processed and stored exclusively on servers in the European Union. The database server is located in Frankfurt am Main, Germany (provider: Neon, Inc., EU region). Hosting is provided by Vercel Inc. (EU edge network).

4. Processors

We work with the following service providers, with whom data processing agreements (DPAs) under Art. 28 GDPR have been concluded:

  • Vercel Inc. (USA, Frankfurt edge) – hosting of the web application. Standard contractual clauses in place.
  • Neon, Inc. (USA, Frankfurt) – PostgreSQL database in the EU region eu-central-1. Standard contractual clauses in place.
  • Cloudflare, Inc. (USA, EU region) – object storage (R2) for file uploads (images, documents, audio, video). Storage location EU. Standard contractual clauses in place. On request, files can instead stay only on your own device and are then not stored with FamPrio; others cannot see them then.
  • Resend, Inc. (USA) – transactional emails (welcome, password reset, invitation and notification emails). Standard contractual clauses in place.
  • Zoho Corporation (India, EU data centre) – inbound email mailbox info@famprio.com.
  • Stripe Payments Europe Ltd. (Ireland, EU) – payment processing, if a Plus plan is booked. Processed exclusively for payment purposes.
  • Apple Distribution International Ltd. (Ireland, EU) – handling of in-app purchases on iOS, sign-in with Apple (verification of your Apple ID) via the Apple account, and delivery of push notifications to iPhone and iPad (Apple Push Notification service). The content of the notification is passed to Apple unencrypted.
  • Google Ireland Ltd. (Ireland, EU) – handling of in-app purchases on Android via Google Play Billing.
  • Google Ireland Ltd. / Google LLC (Ireland, EU and USA) – only if you start the calendar import yourself: with your explicit permission we retrieve your Google Calendar events once (read access only, scopes “view your calendar list” and “view events”). The access token is revoked with Google immediately after the import and is never stored by us; there is no ongoing sync and no background access. We store the title, time and place of the event and – only if you explicitly tick the box – the note. We do not take over attendees, email addresses, attachments or video call links. Google acts as its own controller here and not as our processor; processing in the USA is based on Google's certification under the EU-US Data Privacy Framework. We use this data solely for the calendar feature in FamPrio (Google “Limited Use” requirement) and do not pass it on to third parties.
  • MapTiler AG (Switzerland) – map display, if a map feature is used. For Switzerland there is an adequacy decision by the EU Commission (Art. 45 GDPR); no additional safeguard is required.
  • Functional Software, Inc. (Sentry) (USA) – optional error and stability monitoring, active only if monitoring is configured. Transfer to the USA on the basis of EU standard contractual clauses.

No personal data is shared with third parties for profiling or personalised advertising. On the Free plan we show only our own product references to our paid plans (see Section 2 above) — with no involvement of third parties, no advertising partners and no cookies. A complete list of technical and organisational measures (TOMs) and a record of processing activities under Art. 30 DSGVO are available on request.

5. Cookies

This website uses only strictly necessary cookies (session cookies for sign-in). These cookies are required to operate the service and cannot be disabled. They are deleted automatically at the end of the session, or after 7 days at the latest.

Vercel Web Analytics and Vercel Speed Insights both work without cookies and collect no personal data. They measure only aggregated page views per route and technical performance metrics (Core Web Vitals: LCP, INP, CLS, TTFB). No consent is therefore required.

The self-promotion on the Free plan (see Section 2) is shown without cookies and without tracking pixels. Plus users see no such references.

6. Retention period

We store personal data only for as long as it is needed for the respective purpose. After an account is deleted, all associated data is fully removed within 30 days. Backups are rotated after 30 days at the latest.

Chat messages are deleted automatically 21 days after being sent and are no longer available in the app from that point; the records are removed permanently after a further week. Attached files are deleted after just 7 days. Inbox notices — which contain the beginning of a message — disappear on the same 21-day schedule, all other notices after 90 days. Pinned and favourited messages are kept until you remove the marking.

Data relevant for tax purposes (invoices, payment records) is retained for 10 years in accordance with § 147 of the German Fiscal Code (AO).

7. Your rights

You have the right at any time to:

  • Access to the data we hold about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data ("right to be forgotten", Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, contact us at: info@famprio.com

Self-service: You can trigger data export (Art. 20) and account deletion (Art. 17) yourself directly in the "My data" area. Account deletion comes with a 30-day grace period during which you can cancel the process at any time. Family owners must first hand over the owner role so the family is not left without a main person.

Notwithstanding this, you have the right to lodge a complaint with the competent data protection supervisory authority. In North Rhine-Westphalia (NRW) this is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

8. Children's rights, youth protection and parental authority

FamPrio is aimed at families and allows legal guardians to invite children as family members. For children under 16, Art. 8 GDPR applies: processing personal data requires the explicit consent of the legal guardian.

Anyone who invites a minor child actively confirms during the invitation process that they hold parental authority (parental care under § 1626 ff. of the German Civil Code (BGB) or equivalent authority) for the child. This confirmation counts as data protection consent under Art. 8 GDPR. Persons without parental authority may only invite minors with the prior written consent of the legal guardian.

The adults-only community is accessible exclusively to people aged 18 and over. The system prevents minors from entering community areas or creating content there.

9. Personal profile and health data

In your personal profile you can store information that may matter in everyday life or in an emergency. All fields are optional: height, weight, blood group, allergies, pre-existing conditions, medications (name, dosage, frequency, times of intake), family doctor (name, phone, email), emergency contacts, health insurance, as well as custom fields and notes. Much of this information is health data (Art. 4(15) GDPR) and therefore belongs to the specially protected categories of data under Art. 9(1) GDPR. We are the controller for storing and providing the profile – including when you enter information about relatives (Recital 18 GDPR).

Legal basis: We process health data in the profile exclusively on the basis of explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). Before health data is stored for the first time, we ask for this consent separately in the app. As proof (Art. 7(1) GDPR) we store when, by whom and for whom it was given and which version of the consent text was shown; this record itself contains no health data. Consent is voluntary – you can use all other FamPrio features without a profile. You can withdraw it at any time by deleting the profile in the app or by writing to us at info@famprio.com. Withdrawal takes effect for the future; processing carried out until then remains lawful (Art. 7(3) GDPR). Names and contact details of emergency contacts and the family doctor are not health data; we process them so that you and the people you share with can reach the right people in an emergency (Art. 6(1)(f) GDPR). Please let your emergency contacts know that you have added them.

Profiles for other people: Adults in a household can also create a profile for household members without their own account, for example for children or for a grandmother. For children under 16, consent is given by the holder of parental responsibility (cf. Art. 8 GDPR; Sections 1626, 1629 German Civil Code, BGB). You may only create a profile for an adult if that person agrees or if you are legally entitled to represent them, for example under a lasting power of attorney or as a court-appointed legal guardian with the relevant remit. You confirm this in the app before entering the first health information. Please inform the person about their profile and about this privacy policy. The person entered – or their legal representative – can contact us directly at any time, even without their own account, and exercise all rights set out in section 7. If they object to the profile or withdraw their consent, we will delete the health information.

You decide who sees the profile: A new profile is shared with nobody. For each group of information – for example medications or emergency contacts – you decide whether individual people, an entire household or a Circle (a group of linked households) may see it. If you share with a household or Circle, everyone who currently belongs to it can see the information – including people who join later. You can revoke any sharing at any time; from then on, the information is no longer accessible to those people in FamPrio. We cannot retrieve anything that someone saw beforehand and wrote down or photographed. So only share such information with people you truly trust. Recipients are exclusively the people you share with and, for technical operation, our processors listed in section 4. We do not pass profiles on to emergency services, doctors, health insurers, insurance companies, employers or any other third parties, we do not use them for advertising, profiling or AI analysis, and we do not sell them.

Protection and storage location: The information is stored on our servers in the EU (database at Neon in Frankfurt am Main, see sections 3 and 4). Before it is written to the database, we additionally encrypt it at application level (AES-256-GCM); transmission is encrypted as well. This is not end-to-end encryption: our server decrypts the information in order to display it to you and to the people you have shared it with. We do not look into profiles ourselves unless you expressly ask us to (for example in support) or we are legally obliged to. In the app for iPhone and iPad, access is additionally protected by a lock using Face ID, Touch ID or your device passcode. This check is performed solely by iOS on your device; FamPrio only learns whether it succeeded and receives no biometric data.

Medication reminders: If you turn them on, the app schedules them as local notifications on your device, and the device triggers them itself. We do not send any message via our server or via Apple's push service for this. Depending on your iOS settings, the notification – for example the name of the medication – may be visible on the lock screen. You can hide previews in the iOS settings under “Notifications”.

Change history: So that it remains traceable who changed what and when, we store for each change the time, the person making the change, the field concerned and the old and new value. Entries are only ever added, never changed afterwards. The history is part of the profile, is encrypted in the same way and is covered by the same consent.

Retention period: The profile and its change history remain stored until you delete the profile, withdraw your consent or the associated account or profile is deleted. They are then removed from our database; they disappear from backups after 30 days at the latest (see section 6). If you delete only individual entries, their previous values remain in the change history until the profile is deleted. We keep the record of consent (without health data) after that only for as long as we need it to defend legal claims, for a maximum of three years (Art. 17(3)(e) GDPR).

Your rights: You can view, correct and delete the profile in the app at any time. In addition, all rights set out in section 7 apply, in particular access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and withdrawal (Art. 7(3) GDPR). You can obtain a copy of your information on request at info@famprio.com. No automated decisions or profiling take place with this information.

10. Changes to this privacy policy

We reserve the right to adjust this privacy policy as needed. The current version is always available at famprio.com/datenschutz. In the case of significant changes, registered users will be informed by email.