Privacy policy

Information collected

Parent accounts

Email address, password hashes, verification and consent records, sign-in sessions, and hashed IP addresses.

Connected devices

Device model, installed launchable apps, app usage, battery level, and permission status.

Optional features

SMS and MMS, available Google Messages text, photo and video metadata, thumbnails and uploaded originals, location, blocked domains, and blocked incoming-call events. Collection depends on the features and Android permissions enabled. Selected photo access limits sharing to the selected items.

Support

Messages, attached images, optional contact email, staff replies, and submission dates. Image attachments are resized if needed and stored without embedded metadata such as GPS coordinates. Avoid including passwords, parent codes, or private family information in screenshots.

FamilyHarbor does not record the camera, microphone, typed drafts, or web page contents.

Use and access

Information is used for the controls, history, alerts, and monitoring features you enable. Message analysis runs on the FamilyHarbor server. Automated findings can be incorrect and require a parent’s review.

Invited parents can access the family’s shared information. The service operator can access stored data and encryption keys to operate and support the service. Support messages and attachments are available to the operator; they are not shared with other families or the reported parent.

Service providers

Amazon Web Services

Hosts the application, database and local message analysis in the United States.

Cloudflare

Provides HTTPS connections and optional DNS filtering. Cloudflare processes connection traffic and DNS queries, and terminates HTTPS, allowing it to process data in transit.

Stripe

Processes subscriptions, payments and invoices. Stripe receives the billing email, payment information entered at checkout, and an internal family identifier. FamilyHarbor stores subscription status and Stripe identifiers. To prevent repeated trials, it compares keyed hashes of email addresses and Stripe card fingerprints. Card numbers are not stored on the FamilyHarbor server. Stripe may retain payment and invoice records after account deletion for its legal and financial obligations.

Resend

Delivers account and enabled alert emails. It receives recipient addresses, email contents, verification codes, and delivery information.

Notifications

Browser push providers receive generic notices and delivery information. Enabled SMS alerts use Twilio. These notices do not include child message evidence.

OpenStreetMap

Loads map tiles when you select Load map. Requests disclose your IP address and the approximate area being viewed.

Retention

• Phone history: Activity and alert evidence last 30 days by default; parents can choose 1–90 days.
• Photos and videos: Server copies and thumbnails expire within 14 days after upload, or earlier if a shorter history period is selected. Viewing or syncing does not extend that period. Parents may request a new copy from the phone. The library’s file list remains until removed or the device history or family is deleted. Originals on the phone are unchanged.
• Operational records: Activity records last 30 days, operator audit records 90 days, and deduplication receipts 91 days. Expired verification codes and abuse counters are pruned. Security email jobs last up to seven days.
• Trial eligibility: Keyed email and card-fingerprint hashes are kept for 365 days from a trial claim, including after account deletion, to prevent repeated free trials. These records contain no card numbers or child data.
• Support: Reports, replies, and attachments are deleted after 180 days without an update.
• Backups: The newest 14 successful daily encrypted snapshots are retained by default. Routine server backups exclude child media files and thumbnails; they preserve accounts, settings, history and the library’s file list. Downloaded family exports are separate copies controlled by the parent.

Service interruptions can delay cleanup. Minimal encrypted deletion records and hashed device-removal credentials remain to prevent deleted accounts from returning after a restore and to release phones that reconnect later. These records contain no messages or media.

Your choices

In Account and device controls, you can change collection and retention settings, remove saved media or device history, revoke access, export family data, and delete your account. Disabling collection takes effect when the phone syncs and does not erase existing records. Deleting server copies does not remove originals from the phone.

Deleting the owner account deletes the live family and revokes all family access. An invited parent’s deletion removes their own access. Offline phones complete removal when they reconnect, or a parent can stop management with the phone’s parent code. See account deletion for details.

Children and parental authority

Parent accounts are for adults authorized to manage the child’s device. Review the phone’s disclosures together before enabling monitoring. The app remains visible and shows what is shared. Monitoring a partner or another adult is not permitted.

Use the privacy contact form to request access, correction, deletion, or withdrawal of permission for a child’s information. We may verify identity and authority before acting. Email verification establishes mailbox access only.

Storage and security

The service is hosted on Amazon Web Services in the United States. Message evidence, location payloads, uploaded media, support attachments, and backups are encrypted at rest. Some operational metadata is not field-encrypted. Encryption keys are held on the server. Website connections use HTTPS, and essential cookies maintain sign-in sessions.

Report security concerns through the contact form. Material changes to this policy will be announced before they take effect, with renewed consent when required.