Privacy Policy

1. Who We Are

The Famino application ("App") and this website are provided by:

Daniel Prause
c/o COCENTER
Koppoldstr. 1
86551 Aichach
Germany
Email: service@famino.app

(Hereinafter referred to as "we", "us", or "our".) We are the controller for the processing described here. Because of our size we are not required to appoint a Data Protection Officer, so please send all privacy questions to the address above.

2. Information We Collect

Famino is a family organization app that helps families plan their daily lives together, with a shared calendar, tasks, expenses, meal planning and recipes. To provide these services we collect and process the following types of information.

2.1 Account Information

You can use Famino in four ways:

• Anonymously. We create a temporary account identified only by a random Firebase user ID. No name and no email address.
• With email and password. We store your email address and send you a verification email. Verification, password reset and welcome emails are generated by our Cloud Functions and delivered through an SMTP relay of Hostinger International Ltd. (see section 8). When we send, or try to send, one of these emails directly to Hostinger's mail server, we keep a delivery record for 90 days: the kind of email, its language, a shortened form of the address (its first character and, for large email providers, the provider's domain, otherwise only the top-level domain such as .de), the time, a technical message ID and the delivery result. The record holds neither the content of the email nor the link in it. Until we have completed this change, some of these emails are still handed to Hostinger through a queue in our database (Google Cloud Firestore); a queue entry holds the address, the email including the link, and its delivery status, and is deleted when we remove the queue.
• With Google Sign-In. Google provides your name, email address, Google user ID and profile picture.
• With Sign in with Apple. Apple provides a stable user identifier and, if you allow it, your name and email address. If you choose Apple's Hide My Email, we only ever receive Apple's private relay address and never your real one.

If you start anonymously and later add a login method, your existing family data stays attached to the same account. We also store your app language (languageCode) on your account so that notifications and support replies reach you in the language you use.

Purpose: To create and manage your user account, authenticate you, and personalize your experience.

2.2 Family and Member Data

• Information: Family name, family ID, member IDs, roles (owner, parent, child), invitation codes, calendar colors, display names.
• Purpose: To organize the family structure, assign content, and manage permissions.

2.3 Child Accounts and Members Without an Account

• Information: The child's name and the linked parent account (managedByUserId). A family owner can also add members who have no account at all, in which case only a display name and a color are stored.
• Purpose: To let children take part without their own email address.
• Note: Child accounts have no independent login and can only be used through the managing parent. The adult who creates such an account decides what is entered about that child and stays responsible for it. See section 11.

2.4 Calendar Events

• Information: Title, description, start and end time, location, assigned family members, recurrence rules, reminder settings, optional image attachments (Premium), comments (Premium), private flag.
• Purpose: Shared scheduling within the family.

2.5 Tasks

• Information: Title, notes, due date, priority, status, assigned members, task list assignment, optional image attachments (Premium), comments (Premium).
• Purpose: Shared task management.

2.6 Expenses and Budgets

• Information: Amount, description, category, date, creating member, recurring expenses (Premium), budget data (Premium).
• Purpose: Shared expense tracking and budget management.
• Note: Expenses and budgets have no private flag. Everything entered here is visible to every member of your family. See section 6.2.

2.7 Meal Plans, Recipes and Shopping Lists

• Information: Recipe titles, ingredients, steps, servings, preparation times, planned meals per day, shopping list entries.
• Purpose: Shared meal planning and shopping within the family.

2.8 Image Attachments

• Information: Images you attach to tasks or calendar events and photos you add to your recipes (Premium). Images are compressed on your device before upload (max 1200px, 70% JPEG quality, target size below 100KB).
• Storage: Firebase Storage.
• Purpose: Visual supplement to tasks, events and recipes.

2.9 Device Calendar Access

• Information: When you enable device calendar import, the App reads events from the local calendars you select (for example Google, Samsung, iCloud).
• Purpose: To display external calendar entries inside Famino.
• Storage: Device calendar events are not stored in our cloud. They are read and displayed locally only.

2.10 ICS Calendar Import

• Information: The contents of an .ics calendar file that you open with Famino.
• How it works: The file is parsed on your device. Nothing is uploaded while you are still choosing.
• What is stored: The events you then confirm are saved to your family calendar like any event you type in yourself. Their titles, times, locations, descriptions and any participants named in the file become visible to your family members and stay in the family calendar.
• Please note: Only import files whose contents you may share with your family.

2.11 Camera Access

• Information: Access to your device camera for taking photos for image attachments and for scanning printed event cards and receipts.
• Purpose: (a) Creating photo attachments for tasks and calendar events; (b) scanning printed event cards and receipts to pre-fill a new entry, see sections 2.18 and 2.19.
• Storage: Image attachments are compressed and uploaded to Firebase Storage. Scan photos are not stored by us. They are sent once for structured extraction and then discarded server-side (details in 2.18 and 2.19).

2.12 Notifications

• Information: One Firebase Cloud Messaging token (FCM token) per device you use, your notification preferences, and your app language (languageCode).
• Purpose: Reminders for events and tasks, family notifications, notifications about shared plans (see 2.25), and sending them in the language you use.
• Local reminders: Reminders that your device schedules on its own, for events and tasks, are generated locally and are not sent through our servers.

2.13 Subscription and Purchase Data

• What the store gives us: When you buy a subscription, the store hands the app a purchase receipt: a purchase token on Google Play, a signed transaction (JWS) on the Apple App Store.
• What we do with it: The app sends that receipt to our Cloud Function verifyAndActivatePurchase (Firebase, region europe-west1), which asks Google Play or Apple to confirm that it is genuine and still valid.
• What we store: The resulting subscription state, meaning plan, base plan, validity period, trial status and the store's transaction identifiers (Google purchase token, Apple original transaction ID), on your user document and, for a family plan, on your family document.
• Notifications from the stores: Google and Apple also notify our servers directly when a subscription renews, lapses, is cancelled or refunded (Google Play Real-time Developer Notifications, Apple App Store Server Notifications). A daily job re-checks subscription status with both stores.
• Payment details: Payment is processed exclusively by Google Play or the Apple App Store. We never receive your card or payment details.
• Retention: We keep purchase records while your subscription is active and afterwards for as long as statutory retention periods under German commercial and tax law require.

2.14 Bonus Time and Referral (discontinued)

The referral programme is no longer offered in the app. We still store bonus expiry dates on accounts that earned a bonus in the past, and a daily job clears them once they expire. We no longer read the Google Play Install Referrer.

2.15 Usage and Diagnostic Data

We use Firebase Analytics, Firebase Crashlytics, Firebase Performance Monitoring and Firebase Remote Config.

• Analytics records which screens you open and which actions you take, for example that a task, an expense, an event or a recipe was created, and whether it had a due date, a reminder or an assignee. It also records the onboarding steps you pass through. It never records the content of your entries: no titles, no descriptions, no amounts, no names. When you answer a hint, we record only which hint and which answer, see 2.26.
• Account-level properties. We set three properties on your analytics profile: your role in the family, the size of your family, and whether you have Premium.
• Remote Config lets us switch product options on and off and run A/B tests on our subscription screen, for example which headline or which plans are shown.
• Crashlytics and Performance Monitoring collect crash reports and performance traces containing device model, operating system version and a stack trace.
• Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a stable app and in understanding which features are actually used. You may object at any time under Art. 21 GDPR by writing to service@famino.app.

2.16 Local App Settings

• Information: Onboarding status, device calendar settings, display preferences, widget settings, a copy of the hints list and the climate data, when each hint was first shown (see 2.26), and whether the "Thought of …" card is switched on. Your holiday country and region selection is also stored here, see 2.21.
• Storage: SharedPreferences on your device.
• Purpose: To personalize your experience.

2.17 Home Screen Widget and Links

• Home screen widget. To draw the widget, the app copies the next few event and task titles, their times and locations, their colours, your app language and your Premium status into the shared widget storage of your device. Depending on your device settings these can be visible on your home screen or lock screen, including to anyone who can see your screen. Removing the widget clears that data.
• Links. Famino handles famino.app links and app links so that invitations and notifications open the right screen. The link itself may carry an invitation code or a record ID.

2.18 Event Card Scan (Premium feature)

• Information: A single photo of a printed event card (invitation, notice, ticket) that you choose to capture.
• Purpose: To extract title, date, time, location and description automatically, so we can pre-fill a new calendar event for your review.
• How the photo is processed: The photo is compressed on your device and sent over an encrypted connection (HTTPS) to our Cloud Function scanEventCard (Firebase, region europe-west1). The Cloud Function forwards the image to our sub-processor Mistral AI SAS (France, EU) for OCR and structured extraction. The structured result (event fields) is returned to the app.
• No persistent storage of the photo: We do not save the photo in Firebase Storage, in Firestore, or anywhere else on our side. Under our data processing agreement, Mistral AI processes the image on request, processes it within the EU, and does not retain it for training purposes.
• What we log: Only non-content telemetry (your user ID, app locale, request duration, model confidence score, image size in kB). We explicitly do not log the photo, the extracted text, or any of the event fields.
• Access control: Premium users only. Usage is rate-limited to 30 scans per user per hour to prevent misuse.
• Legal basis (GDPR): Art. 6 (1) (b) GDPR, processing is necessary to provide the Premium feature you requested.
• Your control: You decide every time whether to scan a card; you can always enter events manually instead.

2.19 Receipt Scan (Premium feature)

• Information: A single photo of a printed receipt, invoice or bill that you choose to capture, plus the list of your own expense category IDs and names (read server-side from your family's data, so we can suggest a matching category).
• Purpose: To extract amount, date, merchant, suggested category and a short description automatically, so we can pre-fill a new expense for your review.
• How the photo is processed: The photo is compressed on your device and sent over an encrypted connection (HTTPS) to our Cloud Function scanReceipt (Firebase, region europe-west1). The Cloud Function reads your family's expense category list from Firestore, forwards the image together with the category names and IDs to our sub-processor Mistral AI SAS (France, EU) for OCR and structured extraction, and returns the structured result to the app.
• No persistent storage of the photo: We do not save the photo in Firebase Storage, in Firestore, or anywhere else on our side. Under our data processing agreement, Mistral AI processes the image on request, processes it within the EU, and does not retain it for training purposes.
• What we log: Only non-content telemetry (your user ID, app locale, request duration, model confidence score, image size in kB, category count, whether a category was matched). We explicitly do not log the photo, the merchant name, the amount, or any of the extracted expense fields.
• Access control: Premium users only. Usage is rate-limited to 30 scans per user per hour.
• Legal basis (GDPR): Art. 6 (1) (b) GDPR.
• Your control: You decide every time whether to scan a receipt; you can always enter expenses manually instead.

2.20 Recipe Import (Premium feature)

• Information: The recipe URL you paste, and the readable text of that public web page (structured data, visible text, preview image link). We do not send any of your family data.
• Purpose: To extract title, ingredients, steps, servings and preparation time automatically, so we can pre-fill a new recipe for your review.
• How the page is processed: The app fetches the public page and reduces it to plain text on your device. That text is sent over an encrypted connection (HTTPS) to our Cloud Function importRecipe (Firebase, region europe-west1), which forwards it to our sub-processor Mistral AI SAS (France, EU) for structured extraction. The structured result is returned to the app.
• No persistent storage of the page: We do not store the page text on our side. Under our data processing agreement, Mistral AI processes the request within the EU and does not retain it for training purposes.
• Recipe images: If the page names a preview image, the link to it is taken into the new recipe. Our Cloud Function onRecipeWritten (Firebase, region europe-west1) then downloads that image once from the source website and stores a copy in Firebase Storage in the EU, in your family's area; the recipe then refers to this copy, so the image stays available even if the website later changes or removes it. In this step our server only requests the image address from the source website, with its own technical request data; no data about you or your family is sent. The copy is deleted immediately when you remove or replace the image in the recipe; after the recipe or the family has been deleted, it is removed by our regular clean-up, usually within two days. Recipes from Cookidoo are the exception described in the next point.
• Recipe images from Cookidoo: For recipes imported from Cookidoo (Vorwerk) from October 23, 2026 onwards, we store only the link to the recipe photo, not the photo itself; for Cookidoo recipes imported earlier, the copy of the photo stored in our file storage when they were imported remains there. Each device that shows such a recipe loads the photo directly from Vorwerk's image server (assets.tmecosys.com) and keeps a copy only on that device. When the photo is loaded, Vorwerk's server receives the device's IP address and the usual technical request data; Vorwerk's own privacy policy applies to that processing. The copy on the device is not included in device backups and is removed when you uninstall the app or clear its data. Legal basis: Art. 6 (1) (b) GDPR, as showing the photo of a recipe you imported is part of this feature.
• What we log: Only non-content telemetry (your user ID, app locale, request duration, text length). We explicitly do not log the page text or any of the extracted recipe fields.
• Access control: Premium users only, rate-limited per user.
• Legal basis (GDPR): Art. 6 (1) (b) GDPR.
• Your control: You decide every time whether to import a recipe; you can always enter recipes manually instead.

2.21 Holiday Country and Region

• Information: The country and, optionally, one or more regions (for example federal states or provinces) that you select yourself.
• Only on your request: If your family has set a region (see 2.26), the holiday display uses it by default and does not ask again. Otherwise we ask for a country and region only when you switch the holiday display on. For the holiday selection we do not use GPS, your device location, your IP address or any other automatic means to determine where you are; you pick country and region yourself from a list. (Location is used only for the optional weather widget, see 2.22.)
• Purpose: Solely to decide which regional public holidays and observances are shown in your calendar and home screen widget. We do not use this selection for anything else: no analytics, no advertising, no profiling.
• Storage: A selection you make in the holiday settings is stored only on your device (SharedPreferences) and is never transmitted to us. Your family's country and region (see 2.26) are stored with your family in our database.
• How the holidays are looked up: The holiday dates ship inside the app as local data files. Displaying them requires no server request, so your selection never leaves the device.
• Legal basis (GDPR): As the selection stays on your device and is not transmitted to us, we do not process it. Should it be considered processing, it rests on your consent under Art. 6 (1) (a) GDPR, given by enabling the feature. For your family's country and region, see 2.26.
• Your control: You can change or clear the selection at any time in the holiday settings, and switching the holiday display off stops it from being used. Uninstalling the app removes it from your device.

2.22 Weather Widget and Location (Premium feature)

• Information: If you enable the weather widget, you can either grant Famino access to your device location or type in a city name. In the first case we read your coordinates (latitude and longitude) while the app is open.
• How it is processed: Your coordinates, or the city you typed, are sent over HTTPS to our Cloud Function getWeatherForecast (Firebase, region europe-west1), which forwards them to the Google Maps Platform Weather API and, if you entered a city name, to the Google Geocoding API, in order to obtain a forecast.
• What we store: To keep the number of requests low we cache the forecast together with the coordinates, the resolved place label, your timezone and your app language in your own user document. The cache expires after 3 hours, and we allow at most 4 live refreshes per day. Your weather settings, the cached forecast and the refresh counter are deleted when you delete your account or when your family is deleted.
• Nothing else: We do not use your location for anything else: no analytics, no advertising, no profiling. We never share it with anyone other than Google as described here.
• Your control: You can revoke location access at any time in your device settings and keep using the widget with a city you enter manually. Turning the weather widget off stops the processing.
• Legal basis (GDPR): Art. 6 (1) (b) GDPR for the feature you requested; where your operating system asks you for location permission, that permission is your consent under Art. 6 (1) (a) GDPR.

2.23 Support Requests

• Information: When you contact us from within the app, we store your message, your user ID, your display name or email address and your app language in our database, so that you and we can follow the conversation in the app.
• Attachments: You may attach up to three images, for example screenshots. These are uploaded to Firebase Storage into a folder that belongs to your account. Please avoid sending screenshots that show other people's personal data where you can.
• Who reads it: Our support team reads and answers tickets through an internal administration tool operated by us. No notification copy of your message is sent by email; the tool notifies our team directly.
• Retention: We keep support conversations for as long as we need them to handle your request and any follow-up questions or legal claims. You can ask us at any time to delete a conversation. We delete your ticket attachments immediately when you delete your account.
• Legal basis (GDPR): Art. 6 (1) (b) and Art. 6 (1) (f) GDPR.

2.24 Family Activity Log

• Information: When a member creates, edits, completes, reopens or deletes a task, calendar event or expense, or adds a comment, the App records an entry with the member's user ID and display name, the kind of change, the title of the entry concerned and, for edits, which fields changed (for example the old and new title, date, location, amount or assigned members). For notes and descriptions the log only records that they changed, not their content.
• Purpose: To let every member of the family see what has recently changed in the shared workspace.
• Who sees it: All members of your family. Log entries are not field-encrypted.
• Retention: Log entries are deleted automatically after 90 days, and immediately when the family is deleted.
• Legal basis (GDPR): Art. 6 (1) (b) GDPR.

2.25 Shared Plans

A shared plan lets you organise something with people outside your family, for example a trip, a class party or a birthday. A member of your family creates the plan in the app, switches on the components it needs (a vote, a list, comments, a date) and shares a link. Everyone who opens that link can ask to take part, with or without a Famino account.

• What a plan holds: its title, its description, its start and end date, the fixed date if the organising family sets one (that date is then also the plan's end date, optionally with a time and a place they enter), whether it is running, ended or archived and when it was archived, and when it was purged, the components switched on, the options and list items, the votes (who voted how), who took on or ticked off a list item, the comments, and for every participant a pseudonymous user ID, a display name, the kind of participant (Famino app user or browser guest, and for an app user from another family that family's ID), the moment they joined, whether and when they continued in the app from a guest participation, and their status in the plan (waiting for approval, taking part, or removed).
• Adding the date to a calendar. On the plan page, a guest can add the fixed date to their own calendar. "Add to calendar" has the browser itself create a calendar file; nothing is sent to us. The "Google Calendar" button opens Google with the plan's title, date, time, place, description and link, only once the guest taps it, and Google's own terms and privacy policy then apply. App users can copy the date, with the plan's title, description, place and link, into their family calendar. The copy is stored like any event they add themselves (see 2.4 and 7.2), with an unencrypted marker that links it to the plan, so the app can show that it is already in the calendar. It is visible to all members of their family and is theirs to change or delete; we do not change or delete it when the plan changes, ends, is archived, deleted or purged.
• Not encrypted. Plan content is stored unencrypted, see section 7.2. We keep it this way because guests read a plan in an ordinary browser that holds no family key. Please do not put anything into a plan that you would not want stored in plain form.
• Guests without an account. When someone opens a plan link in a browser, we sign them in with Firebase Anonymous Authentication as soon as they start typing a name, or immediately if they already took part before. That creates a random user ID which identifies the browser to our database and to our security rules. It is a pseudonym: it carries no name, no email address and no device identifier of its own, and on its own it does not tell us who anyone is. The browser keeps this sign-in, so the same browser is recognised on the next visit. Clearing the site data ends it, and the guest joins again as a new participant.
• Guest name. Guests type a name once, so that other participants can tell votes, list items and comments apart. The name is shown to everyone taking part. A guest can remove it themselves with "Remove my name" while the plan is running and also after it has ended. Once the plan has been archived, the link no longer opens for anyone new; in the browser the guest used, it still opens the plan's ended page with "Remove my name" until the plan is purged (see Retention), after which nothing of the name is left (a hidden comment's copy follows its own period, see Hidden comments). From another browser, or after clearing the site data, a guest can instead ask us to remove their name or anything else they entered by writing to us with the plan's title, see section 9.
• Continuing in the app. A guest who has joined, also while still waiting to be let in, can ask for a personal link to continue in the Famino app. We then create a random one-time code and store only a hash of it, together with the plan's ID, the guest's pseudonymous user ID and when it was created and expires. The page copies the link to the device's clipboard and can hand it to the device's own share function. On Android it also tries to open the Famino app directly; if the app is not installed, the browser opens Famino's page in the Google Play Store instead, without the code, and Google's own terms and privacy policy then apply. The link is meant only for the guest: whoever opens it first in the app takes over the participation, so please do not pass it on. The code itself is not stored, and our own code writes neither the code nor its hash to a log. If the link is opened in a browser instead of the app, or a chat app fetches it to show a preview, its address, including the code, reaches our server like any other page address and can appear in the standard server access logs of our hosting (see 6.1). The link works once, for 24 hours and only while the plan is running, and only in the Famino app with a signed-in account (also one started anonymously) and a valid App Check token; a new link makes the previous one useless. When it is opened there, the guest's participation moves to the user ID of that app account: the participant record (name, status, when they joined and any write block still running), the guest's votes, the list items they took on, ticked off or added, their comments and their hourly write counter (see Abuse prevention). If that account already takes part in the plan, its own name and joining time stay, and where both voted on the same option, or both chose an option in a vote that allows only one choice, the account's vote counts and the guest's is deleted. The guest's record is then deleted, so that browser no longer has access to the plan and could only ask to join again as a new participant. The record of a code is deleted as soon as the code has been used or a new link replaces it. If the last step of continuing fails, the record is kept so that opening the link again in the same app account can finish it; it then also holds that account's user ID and when the link was used, and is deleted within about 8 days. A code that is never used is deleted within about 24 hours after it expires. A copy of a hidden comment (see Hidden comments) keeps the guest's user ID.
• Access is by link. The link carries a random 128-bit token. There is no directory, no search index and no sitemap entry, and the plan pages are marked noindex. Before anyone is let in, opening the link already shows a preview, for example when the link is pasted into a chat app, because the page uses this to tell a visitor who is inviting them to what before they join. The preview shows no dates. It shows the title and the name of the person who created the plan only while the plan is still open to new requests or is full; if that name has been removed or its owner is no longer active, it shows no name. Once the organising family closes the plan or the plan has ended, the preview shows neither. About 90 days after the end date the link stops working for good for anyone new, except in the browser of a guest who already took part (see Guest name and Retention). The preview is cached for up to 60 seconds on our content delivery network, so a change to the title or the name, closing the plan or renewing the link can take that long to show everywhere. Everything else, in particular the options, list items, comments and other participants, stays hidden until a request to join has been accepted. Whoever holds the link can ask to join, so share it only with the people you mean. Every new participant waits for the organising family to let them in; a guest who continues in the app with their personal link needs no new approval, even if the plan has since been closed to new requests: a guest who was let in stays in, and one still waiting keeps waiting, unless the app account already takes part in the plan or belongs to the organising family, in which case they are in. While the plan is running, the family can close it to new requests or renew the link at any time, which makes the old one useless, and the family can remove any participant at any time. A waiting participant can withdraw their own request at any time, which deletes their participant record immediately. A removed participant's record keeps the status "removed", so that the same browser or account cannot rejoin through the link. A plan holds at most 50 participants.
• Abuse prevention. We limit how many plans a Famino account can start per day (5), how many content reports one account or guest can send per day (5), and how many comments and list items together one participant can add per plan and per hour (60, the organising family excepted). To count them we keep one counter per participant and plan, holding when the current hour started, how many entries were counted in it, the last entry counted and when the counter last changed; only our server can read it, and it is deleted together with the plan, when the plan is archived, or with that participant's account. Going over that limit blocks writing in that plan for an hour, and we store the moment that block ends on the participant's record.
• Telling our app from a browser. Requests from the app to create a plan, change its components or period, set or withdraw the plan's date, renew its link, close or delete it, and to continue a guest participation in the app, are rejected without a valid Firebase App Check token (Play Integrity on Android, App Attest on iOS). Joining a plan, creating a personal link and reporting content do not require this check, so that guests without the app can use them; the plan pages in the browser go through no equivalent verification by a third party. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in keeping the Service free of abuse.
• Hidden comments. A member of the organising family can hide any comment that someone else wrote, and can undo that; we can hide a reported comment as well, and only we can restore it then. Everyone taking part then sees a notice with the author's name and the time instead of the comment's text, saying whether the organising family or we hid it. Once hidden, the text is removed from the plan and kept in a separate copy that only our server and our support team can read, together with its author, the time, the reason we gave and a log of who hid or restored it and, for our own decisions, which support ticket it belongs to. We keep that copy for 30 days after the organising family last hid the comment and for 6 months after we last hid it, also if the comment is restored in the meantime; Firestore's automatic time-to-live deletion then removes it, usually within 24 hours. The copy outlives the deletion of the comment, the plan, the organising family or an account. When our decision comes from a report we handle, the request that records it is also kept for 6 months as our log of that decision. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in letting the organising family undo a mistake and in handling reports, objections and complaints about the hidden comment. Where we hid the comment, we also need the copy to establish, exercise or defend legal claims, so it is exempt from erasure until its period ends (Art. 17 (3) (e) GDPR). You can object to the organising family's 30-day copy under Art. 21 GDPR.
• Notifications. Members of the organising family get push notifications about what people outside their family do in the plan: requests to join, votes, new list items, taking on, giving back or ticking off a list item, and comments. What their own family does is not counted for them. They can switch these notifications off under "Own" in the app's notification settings. Members of other families who take part in the plan get notifications about it only if they switched on "With others" there, which is off by default; they hear about votes, list items, list changes and comments by anyone in the plan, including the organising family, but never about requests to join, and nothing at all if they were the only person who acted. Guests get no notifications, see 6.9. We bundle these notifications: each group gets at most one per plan about every 10 minutes, showing the plan's title and how many of each kind happened, not who acted or what they wrote. A request to join goes out within about a minute, at most once per plan every 10 minutes; further requests in that time follow with the next bundle. For the bundling our server keeps one short-lived record per plan (collection planNotifyPending) holding the plan ID, the organising family's ID, the plan's title, the counters, when the bundle started and is due, when a request last brought it forward, and the user IDs of up to 20 people who voted, added or changed list items or commented. It holds no content of comments, list items or votes, and only our server can read it. It is deleted when the notification is sent or discarded, usually about 10 minutes after the first action and at most about 20 minutes after it. Notifications are delivered through Firebase Cloud Messaging like all other app notifications, see 2.12 and 6.1. Legal basis: Art. 6 (1) (b) GDPR, as for push notifications in general (section 5): for the organising family they are part of the plan feature they use, and members of other families receive them only after choosing this option themselves.
• Retention. A plan ends on its own once its end date has passed: usually within two days after that date our server marks it as ended, and from then on nobody can join, vote, add, take on, tick off or comment. About 90 days after its end date our server archives the plan: it deletes the plan's link and the per-participant write counters (see Abuse prevention); the old link then no longer opens the plan for anyone new, except in the browser of a guest who already took part, see Guest name. An archived plan stays readable in the app for the organising family and for app users who took part, until it is purged (see below), unless the organising family deletes it earlier or is deleted itself. About a year after its end date, usually in a nightly run, our server purges the plan: it deletes the options, list items, votes, comments and every participant, including any guest name, and also the fixed date's time and place, if any. The organising family keeps an entry with the plan's title and dates. For every other family whose members took part through the app, an entry with only the plan's title and dates stays with that family, visible to its members, until one of them removes it or the family is deleted (in that case within a few days). It contains no names, no participants and no content. Deleting your account does not remove your family's entry, and a family deleting its own entry does not remove the entries other families kept; if the organising family is later deleted, its title can still be read in those other entries, because they belong to the families that kept them, not to the organising family. If you want a title removed from those other entries sooner, write to us, see section 9. We make no promise to keep a copy of a plan beyond what is described here, except for a hidden comment's copy as described above, which is kept up to the periods named there even after the plan, the family or an account is deleted. If you delete your own account, we remove your participation, your votes and your comments from every plan you took part in, and from plans of other families also the options and list items you added. In a plan of your own family, the options and list items you added stay as part of your family's plan, together with other people's votes on them. Any item you had taken on but not yet ticked off becomes free again, while items you already ticked off stay in the plan's history.
• Reporting. Every plan and every visible comment carries a report link on the plan page, see section 14. Tapping it opens a dialog with an optional reason you can type, capped at 200 characters on the page (we cap it at 500 characters on our side); you see a confirmation on screen once it is sent. A report reaches us as a support ticket; because reports sent through the link carry no email address, we cannot confirm receipt by email or give reasons back unless the reporter writes to us, see section 9.2 of our Terms of Service. A report goes only to us, never to the organising family.
• Legal basis (GDPR): Art. 6 (1) (b) GDPR for running the feature you asked for, and Art. 6 (1) (f) GDPR for the abuse prevention around it.

2.26 Hints ("Thought of …")

On the "My Day" screen, Famino can show a card called "Thought of …" with timely reminders for family life, for example that winter shoes may no longer fit, that school books need ordering or that someone's birthday is coming up. With one tap a hint becomes a task. We write the hints; the app picks the ones that fit your family on your device, using fixed rules. No AI runs in the app for this, and no decision is made about you.

• Your family's country and region: If no country is set for your family yet, the App sets it the next time a parent or the owner opens the App (for example right after creating the family), from the region setting of the device or, failing that, from its language. The region (for example a federal state, state or province) is optional; parents and the owner pick it from a list under "Location". We do not use GPS, your device location or your IP address for this. Both are stored unencrypted on your family (countryCode, regionCode) and are visible to all members. Purpose: to choose hints that fit your country, region and climate (for example when winter starts), and as the default for the public holidays in your calendar, see 2.21. Parents and the owner can change it at any time or choose "Whole country".
• Birthdays of family members: Optional. Parents and the owner can enter a birthday for any member of the family, children and adults alike; adults can also enter their own and remove it at any time. Children cannot enter or change one. The date is stored on the member's record, encrypted with your family key (birthDateEnc; this is encryption at rest, not end-to-end encryption, see 7.2). All members of the family can see it in the App. Purpose: hints that fit a child's age (for example the school year) and hints that a family member's birthday is coming up. The App never shows anyone a hint about themselves. Without a date, that member simply gets no hints about age or birthday. Birthdays do not trigger notifications or calendar entries. You can delete a birthday in the App at any time; it is also deleted when the member is removed, leaves the family or deletes their account, and when the family is deleted.
• Selection happens on your device: The App downloads the complete list of hints in your app language and the climate data for your country or region, and keeps a copy on the device. Which hints apply is worked out only on your device, from the date, country, region, climate, birthdays, holidays in your calendar, school settings, your Premium status and, if you switched the weather widget on, the forecast already stored for it. Neither our servers nor the editorial tool in which we write the hints learn which hints apply to your family or are shown to you. This information is assembled in memory only and is neither stored nor sent.
• Keywords (Premium): Some hints appear only if a word occurs in your open tasks or in your calendar events of the next six weeks, or only if it does not (if "Buy winter shoes" is already a task, the hint is skipped). This search runs only on your device, in the decrypted titles. No title leaves your device for it.
• Weather (Premium): Weather hints use the forecast the weather widget has already fetched (see 2.22). There is no additional request and no additional location access.
• Your answers: When a parent or the owner answers a hint (creating a task or an event, "All good" or "Skip", "Later"), we store one record per answer with your family (hint_responses), so that the hint does not come back and the answer applies to the whole family. The record holds, encrypted, an identifier made of the hint, the member concerned and the period, and, unencrypted, the kind of answer, for "Later" the date it is postponed to, the user ID of whoever answered and the time. Only parents and the owner can read these records; child accounts see no hints. On the device, the App remembers when a hint was first shown, only to limit the number of new hints per week.
• Tasks from hints: A task created from a hint is an ordinary task (see 2.5 and 6.2), assigned to you and visible to your family. Tasks about a particular person, for example a gift, go into your private list "Gifts": the other members do not see them in the App, and they are not recorded in the family activity log (2.24). Like private events, they are still stored on our servers (see 6.2).
• Retention: Answers are deleted automatically two years after they were given (Firestore time-to-live deletion, usually within 24 hours after that). The answer that the invitation to set up hints should not appear again is kept for as long as the family exists. All answers are deleted together with the family. Answers belong to the family: if a member leaves the family, is removed from it or deletes their account, their answers stay with the family until they are deleted as described here, but we remove that member's user ID from them. Should this removal fail in an individual case, the user ID stays on the answer until the answer is deleted.
• Analytics: When a hint is answered, Firebase Analytics records an event hint_answer holding only the hint's ID and the kind of answer: no child, no age, no name, no text. Like all analytics events (2.15), it is linked to the pseudonymous analytics ID of your app installation, not to your name.
• Your control: You can switch the card off at any time in the display settings of "My Day" ("Thought of …", per device). The region and birthdays are optional and can be removed at any time.
• Legal basis (GDPR): Art. 6 (1) (b) GDPR for the hints, your answers, and your family's country and region, as part of the feature you use; the same for birthdays. Where a parent enters another adult's birthday, Art. 6 (1) (f) GDPR, the family's legitimate interest in being reminded of birthdays; that adult can object under Art. 21 GDPR and can remove the date themselves. Analytics: Art. 6 (1) (f) GDPR, see 2.15.

3. Transparency About AI-Generated Content (EU AI Act)

Three optional Premium features use an AI system: the event card scan, the receipt scan and the recipe import. All three are provided by us on the basis of models operated by Mistral AI SAS (France, EU). We disclose this in line with Article 50 of Regulation (EU) 2024/1689 (AI Act).

• Where AI is used: Only in the three features named above, and only when you actively start them. Everything else in the app, meaning calendar, tasks, expenses, meal planning and reminders, works without AI.
• What the AI produces: Structured field suggestions read from the image or page you provided. For the two scans, short free-text fields (title, description) may be summarised and written in your app language, which means they are generated text rather than a literal copy.
• You always review first: No AI result is saved automatically. The extracted fields are shown to you for checking and editing before anything is stored, and the screen says so.
• Machine-readable marking: When you save a scanned or imported entry, we store a provenance record with it (aiProvenance) that names the feature, the model and exactly which fields you accepted unchanged from the AI output. If you rewrite a field, it is removed from that record; what you wrote yourself is never marked as AI-generated.
• Which models: We currently use Mistral's OCR model for reading images and a small Mistral chat model for structuring the result. We may move to a newer version of these models; the provenance record always names the model that was actually used.
• Onboarding videos: The short example scenes shown on the welcome screen are AI-generated. They are illustrations, not recordings of real people or events, and are labelled accordingly in the app.
• No chatbot, no profiling: The app contains no conversational AI assistant, no emotion recognition and no biometric categorisation. AI is not used to make decisions about you.

4. How We Use Your Information

• To provide, operate, and maintain the Famino App and its features
• To authenticate you and manage your account
• To manage your subscription and provide access to Premium features
• To synchronize your family data via Firebase
• To enable shared calendar, task, expense, meal and recipe management
• To send push notifications (reminders, family notifications) in your language
• To show the home screen widget
• To show the weather forecast if you enable the weather widget
• To show hints that fit your family ("Thought of …")
• To answer your support requests
• To improve the App, diagnose technical issues, and ensure stability
• To personalize your experience (for example settings and calendar colors)

5. Legal Bases for Processing

Under Art. 6 (1) GDPR we rely on the following legal bases:

Where a processing operation rests on our legitimate interests, you may object under Art. 21 GDPR. Where it rests on your consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR).

6. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances.

6.1 Google and Firebase

We use Google Firebase services for our backend infrastructure:

Google processes this data on our behalf as our processor. For in-app purchases, Google Play Billing is used. We do not receive or store your payment card details.

More information: Google Privacy Policy

6.2 What Your Family Members Can See

Famino is a shared workspace. Every member of your family can see the calendar events, tasks, expenses, budgets, shopping lists, meal plans and recipes created in it, including titles, descriptions, dates, locations, amounts, categories, assigned members, comments and any images attached, together with the display name and colour of whoever created them. They can also see your family's location (country and region) and the birthdays entered for its members, see 2.26.

• Private events and private task lists. Marking a calendar event as private, or putting a task into a private list, hides it from the other members in the app. It is still stored on our servers. Expenses, budgets and recipes have no private flag.
• Invitations. Anyone you invite gains this access from the moment they join, so only invite people you would show these entries to.
• Leaving a family. Members who leave a family stop seeing its content, but the entries they created remain with the family. If you want them removed, delete them before you leave, or ask the family owner.
• Anonymous accounts. If you started anonymously and later added a login method, the family data created before that stays attached to the same account.

6.3 Google Maps Platform (Weather and Geocoding)

If you use the weather widget, your coordinates or the city name you entered are sent to the Google Maps Platform Weather API and, where a city name has to be resolved, to the Google Geocoding API, in order to obtain a forecast. Nothing else about you is sent, and nothing is sent when the weather widget is switched off. See 2.22.

6.4 Apple

If you sign in with Apple, Apple provides us with a user identifier and, at your choice, your name and email address or a private relay address. If you subscribe through the App Store, we exchange purchase receipts and subscription status with Apple, and Apple sends server notifications about your subscription directly to our endpoint. See 2.1 and 2.13.

More information: Apple Privacy Policy

6.5 Mistral AI (Event Card Scan, Receipt Scan and Recipe Import)

Mistral AI SAS, 15 Rue des Halles, 75001 Paris, France, acts as our sub-processor for OCR and structured extraction in three Premium features that you start explicitly: the event card scan (2.18) sends a single photo; the receipt scan (2.19) sends a single photo together with your family's expense category names and IDs; the recipe import (2.20) sends the reduced text of the public recipe page you chose. Under our data processing agreement, processing takes place within the EU and Mistral does not retain this content for training. Nothing is sent to Mistral outside of these explicit user actions.

More information: Mistral AI Privacy Policy

6.6 Our Administration Tool

We read and answer support messages through an internal administration tool that we operate ourselves and that writes replies back into your ticket. No support message is sent by email. See 2.23. Reports from a shared plan arrive in the same tool as a support ticket, see 2.25 and 14.

6.7 Legal Requirements

We may disclose your information if required to do so by law, or in the good faith belief that such action is necessary to comply with a legal obligation, protect our rights, prevent fraud, or protect the safety of users.

6.8 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of such a transaction.

6.9 Who Can See a Shared Plan

Opening the link shows the plan's title and the display name of the person who created it to anyone, before any request to join is accepted, see 2.25. Beyond that, a plan is shared on purpose: everyone whose request to join has been accepted sees the description, all options, list items and comments, and the display name of every participant together with what that participant entered. Members of the organising family see the plan in the app and may edit the wording of options and list items, switch list items off, tick off list items, and delete options and list items (a list item only while nobody has taken it on and it is not yet ticked off); for a comment someone else wrote they can only hide it, see 2.25, and apart from that they cannot change other people's entries.

We send guests no email and no notifications, and beyond what the link preview shows we pass plan content to nobody outside the plan, except that once a plan is purged, every other family whose members took part through the app keeps its title and dates, visible to all its members, see 2.25 (Retention), and except what a participant themselves chooses to copy out, as set out next. Participants can also take the fixed date, with the plan's title, description, place and link, into their own calendar, see 2.25 (Adding the date to a calendar); an app user's copy sits in their family calendar, visible to all members of that family, and stays there after the plan has ended, been deleted or been purged.

7. Data Storage and Security

7.1 Cloud Storage

Your data is stored on Google Firebase servers (Cloud Firestore, Firebase Authentication, Firebase Storage). Data transfer is encrypted (HTTPS/TLS).

7.2 Additional Encryption of Sensitive Content

In addition to transport encryption, particularly sensitive content is stored in our database in encrypted form (encryption at rest at field level), using a key generated for your family:

• Calendar events: title, description and location
• Tasks: title and notes
• Comments on events and tasks: the comment text
• Birthdays of family members
• Answers to hints: the identifier of hint, member and period (see 2.26)

This is not end-to-end encryption, and it does not anonymise the data. The family key is generated and held on our servers so that new members and our server-side features can read the data; a copy is cached in your device's secure storage (Android Keystore, iOS Keychain). Because we hold the key, this content remains personal data that we are technically able to access, and your rights under section 9 (including access, export and deletion) apply to it in full. Expenses, budgets, recipes, meal plans, shopping lists, image attachments and support messages are not field-encrypted, and metadata such as dates, amounts, categories and assignments is not encrypted either. Shared plans (section 2.25) are not field-encrypted either, because guests read them in a browser that holds no family key.

7.3 Local Storage

Onboarding status, device calendar settings and app preferences are stored locally in SharedPreferences, protected by your operating system's security mechanisms.

7.4 Image Attachments

Images are compressed on your device and transferred encrypted (HTTPS) to Firebase Storage. Storage security rules ensure that only authenticated users can access them.

7.5 Your Responsibility

While we work to protect your information, no security system is impenetrable. You are responsible for safeguarding the credentials of the account you sign in with, and for deciding whom you invite into your family.

8. Data Retention and Deletion

• Account data is retained as long as your account exists.
• Family data (calendar, tasks, expenses, recipes, meal plans) is retained as long as the family exists. When a family is deleted, all associated data is removed.
• Images (image attachments, recipe photos and profile pictures in our file storage): an image you remove in the app is deleted immediately; an image you replace is overwritten by the new one, except that a copy from an older app version can remain until the entry or account it belonged to is deleted. Once the entry, recipe, family or account an image belongs to has been deleted, the image is removed by our regular clean-up, usually within two days.
• Calendar events, expenses, recipes and meal plans are never deleted automatically. They stay until you, another member of your family or the family owner deletes them, or until the account or family is deleted.
• Completed tasks are deleted automatically 90 days after you marked them as done, together with their comments and attached image. Open tasks are never deleted automatically.
• Family activity log entries (who changed what, see 2.24) are deleted automatically after 90 days.
• Answers to hints are deleted automatically two years after they were given, and all of them when the family is deleted (see 2.26). When a member leaves the family, is removed from it or deletes their account, we remove their user ID from their answers.
• Birthdays are deleted when you remove them, when the member is removed, leaves the family or deletes their account, and when the family is deleted.
• Images attached to one-off calendar events are removed automatically 3 years after the event took place. The event itself and its comments stay.
• Child accounts and members without an account are removed when the family is deleted, and a parent can delete them individually at any time.
• Invitations expire automatically after 7 days.
• Support conversations are kept as long as needed to handle the request; you can ask us to delete them, and their attachments are deleted immediately when you delete your account.
• Weather forecast caches expire after 3 hours.
• Email delivery records (see 2.1) are deleted automatically, usually within a day after 90 days.
• Purchase records are kept while the subscription is active and afterwards for as long as statutory retention periods require.
• Expired bonuses and free trials are cleared by a daily cleanup job.
• Shared plans end on their own after their end date and are archived about 90 days later (the link stops working for anyone new, except in the browser of a guest who already took part; the plan stays readable, see 2.25), or deleted earlier by the organising family or together with it. About a year after their end date, usually in a nightly run, they are purged: the options, list items, votes, comments and every participant, including any guest name, are deleted, and so are the fixed date's time and place, if any. The organising family keeps an entry with the title and dates, and so does every other family whose members took part through the app; those entries hold no names, no participants and no content, each family can remove its own at any time, and such an entry is also removed within a few days if that family is deleted, see 2.25 (Retention). If you want a title removed from those entries sooner, write to us, see section 9. We make no promise to keep a copy of a plan beyond what is described here. A hidden comment's copy (see 2.25) is the exception: it is kept for 30 days after the organising family last hid it, or for 6 months after we last hid it, even past the deletion of the plan, the family or an account, and is then deleted within about 24 hours of that period ending. The short-lived record we keep to bundle plan notifications (see 2.25) is deleted when the notification is sent or discarded, at most about 20 minutes after the first action it counts.
• Guest participation in a shared plan ends when the plan ends; the guest's name, votes and entries stay in the plan, also once it is archived, until the plan is purged about a year after it ended, or deleted earlier by the organising family or together with it. Guests can remove their name themselves in the same browser while the plan is running and also after it has ended, up until it is purged, and can ask us at any time to remove their name or anything else they entered, see section 9. If a guest continues in the app (see 2.25, Continuing in the app), their participation, votes and entries become those of their Famino account instead, and deleting that account then removes them like any other account's participation (see below). The anonymous sign-in record itself (a random ID with the time it was created and last used) stays in Firebase Authentication after a plan ends or is deleted; it holds no name and no plan content. We do not delete these records automatically at present.
• When you delete your account we immediately remove your entries, your comments, your support attachments and your weather settings including the cached location (images attached to the entries you created and your profile picture follow with our regular clean-up, usually within two days, see Images above), we remove your participation, your votes and your comments from every shared plan you took part in, and from plans of other families also the options and list items you added (options and list items you added to a plan of your own family stay as part of that plan, see 2.25); any item you had taken on but not yet ticked off becomes free again, while items you already ticked off stay in the plan's history, and we remove your user ID from entries assigned to you and from your answers to hints (see 2.26) (a copy of a comment that was hidden stays for the period set out in 2.25).

9. Your Rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to object to processing based on our legitimate interests (Art. 21). Where processing rests on your consent, you may withdraw it at any time with effect for the future (Art. 7 (3)).

You can delete your account and all of your data directly in the app, in Settings under Advanced settings, Delete account. The deletion is carried out immediately and cannot be undone. To exercise any other right, write to service@famino.app. We answer within one month.

If you took part in a shared plan as a guest, you can remove your name from that plan with "Remove my name" on the plan page, in the same browser, while the plan is running and also after it has ended, up until it is purged about a year after the end date (see 2.25); your votes and comments then stay, shown without a name. You can withdraw your own votes and delete your own comments yourself while the plan is running. While you are still waiting for the organising family to let you in, "Withdraw my request" on the plan page deletes your participant record immediately. If you continue in the app with your personal link (see 2.25, Continuing in the app), the participation becomes your Famino account's: from then on you manage it in the app like any other participation there, deleting your account removes it (see section 8), and the browser options described here no longer apply to it. To have everything else you entered removed, or if the link no longer works for you, write to service@famino.app with the plan link (or, once the plan has been archived, its title) and the name you used. Without these details we cannot find you, because we hold nothing else that points to you.

You also have the right to lodge a complaint with a supervisory authority (Art. 77). The supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
www.ldi.nrw.de

You may also contact the supervisory authority of your own place of residence.

In addition, you can do the following directly in the app:

• Access and correction: view and edit your data in the App.
• Deletion of single records: delete individual entries in the App.
• Manage permissions: control camera, calendar, location and notification access in your device settings.
• Manage subscription: manage your subscription in the Google Play Store or the Apple App Store.
• Leave family: leave a family at any time, except as its owner.
• Disable device calendar: switch device calendar import off at any time in the App settings.
• Log out: log out from the App menu at any time.

10. Third-Party Services

• Google Firebase: Firebase Privacy and Security
• Google Sign-In: Google Privacy Policy
• Sign in with Apple: Apple Privacy Policy
• Google Play Billing and Apple In-App Purchase: payment processing for Premium subscriptions
• Google Maps Platform (Weather API, Geocoding API): weather forecast for the optional weather widget
• Google Calendar: opened only when a guest taps the button on a plan page, with the plan's title, date, time, place, description and link
• Google Gmail: our support mailbox
• Hostinger International Ltd. (Cyprus, EU): SMTP relay that delivers our transactional emails (verification, password reset, welcome); it processes the recipient address and the email content for delivery
• Vorwerk (Cookidoo): image server assets.tmecosys.com, contacted directly by your device only to show photos of recipes imported from Cookidoo (see 2.20). Vorwerk receives the device's IP address and the usual technical request data and is not our processor; Vorwerk's own privacy policy applies.
• Mistral AI (France, EU): sub-processor for the event card scan, receipt scan and recipe import features, invoked only when you use them. Mistral AI Privacy Policy

11. Children

Famino is meant to be set up and run by an adult. A parent can create child accounts and members without an account for their own household. The parent chooses the name and any details and remains responsible for what they enter about their child.

A parent may enter a child's birthday. It is optional, encrypted (7.2) and used only on the device to pick hints that fit the child's age (2.26). Child accounts see no hints.

We do not ask children for an email address, we do not let child accounts sign in on their own, and we never use children's data for advertising, for profiling, or for analytics beyond the family-size counter described in 2.15 and the answers to hints described in 2.26, which name only the hint and the answer, never a child.

Where consent is the legal basis, EU law (Art. 8 GDPR) sets the age between 13 and 16 depending on the country. Below that age the parent must consent, which they do by creating the account. Outside the EU we apply 13 years (COPPA).

A parent can delete a child account or a family member at any time in the app, which erases that member's data. If you are a parent or guardian and believe that a child's information reached us without your knowledge, please contact us at service@famino.app.

12. International Data Transfers

Our Cloud Functions run in the European Union (region europe-west1). Your family's content and uploaded images are stored in the European Union: our Firestore database runs in Google's European multi-region eur3 (Belgium and the Netherlands), and our file storage is located in the EU as well (Belgium). Our sub-processor Mistral AI processes the AI scan features within the EU.

Some of our providers are US companies whose support and infrastructure teams may access data from outside the EU. Transfers to Google LLC and Apple Inc. take place on the basis of the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and, in addition, the Standard Contractual Clauses contained in our data processing agreements with them.

13. What We Do Not Do

• We do not sell your data.
• We show no advertising and use no advertising identifiers.
• We do not build behavioural profiles about you.
• We do not use your family content to train AI models.
• We do not use your location for anything other than the weather widget you switched on.
• We do not require a date of birth. Birthdays are optional and used only for hints, see 2.26.

14. Reporting Content

If someone in a family you belong to uploads an image or writes a comment that does not belong there, contact us at service@famino.app. We will look into it and can remove content and, where necessary, accounts. You can also remove a member from your family yourself if you are its owner, and you can leave a family at any time.

Shared plans. Every plan and every visible comment carries a report link on the plan page in the browser; in the app, use the support function or write to us. On the plan page the link opens a dialog where you can type an optional reason before you send it, and you see a confirmation once it is sent. A report reaches us as a support ticket holding the plan, the reported entry and its text up to 300 characters where there is one, the reason given, the language of the app or page, and the pseudonymous ID, the kind and, where available, the name of whoever reported it; see 2.23. Reports sent through the link carry no email address. We handle it under the notice and action procedure set out in section 9.2 of our Terms of Service. The organising family can hide any comment that someone else wrote in its own plan straight away, which can be undone, see 2.25; it can still edit, switch off or delete a list item or an option (deleting a list item only while nobody has taken it on and it is not yet ticked off).

15. This Website

This section covers famino.app itself, not the App.

• Language choice: We store the language you pick in your browser under the key faminoLang. This is strictly necessary to show the site in the language you chose and is not used for tracking.
• No analytics: We use no analytics, no tracking pixels and no advertising cookies on this website.
• Hosting: The site is hosted on Firebase Hosting, which keeps standard server access logs (including IP address) for operation and security. Legal basis: Art. 6 (1) (f) GDPR.
• Shared plan pages (famino.app/p/…, with their files served from famino.app/g/…): These pages sign you in with Firebase Anonymous Authentication, kept in your browser's IndexedDB, and keep the plan you joined under a key of the form famino.plan.<link token> in your browser's local storage. Both are strictly necessary to show you the plan and to keep your own votes, list items and comments yours. "Withdraw my request" removes this local storage entry together with your participant record, see section 9. The fonts and the Firebase SDK these pages use are served from our own server, not from a third party. They connect only to Firebase (Cloud Firestore, Firebase Authentication and Firebase Cloud Functions, see 6.1 and 2.25). There is no analytics on these pages either.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the date at the top of this policy and, in some cases, by showing a notice inside the App.