Version: 1.0. Effective date: 28 October 2026.
This Privacy Policy explains what data Family Chat processes when you use the iOS and Android application, why it is needed, how it is protected, and how to contact us about your data. Sections about specific features apply when those features are available in the version of the application you use.
1 Who is responsible for your data
The owner of the Service and the controller of your data is Family Chat, Poland, referred to as "we" or "us".
For privacy and data protection questions, contact support@familychatapp.com.
2 What data we process
Family Chat does not require your real name and does not verify identity through this field. You may use a name of your choice within the format the application allows. Your date of birth is not requested, stored, or displayed. The name you enter is stored and processed as profile data; choosing an arbitrary name does not make all of your usage data anonymous.
Some information may be entered by another family member when they create an invitation or a profile. Other data arises from your use of the application.
| Category | What it includes | What it is used for |
|---|---|---|
| Profile and family | The name you entered, role, avatar, family name, membership of families and group chats | Displaying profiles, invitations, organizing communication and access rights |
| Connections and settings | Chat membership, links between families, chosen settings, visibility restrictions, and membership statuses | Access to chosen contacts and operation of family features |
| Devices and security | Technical account and device identifiers, platform, application version, device name, public cryptographic keys and certificates, authorization and access revocation records | Verifying requests, protecting access, linking devices, and preventing replayed requests |
| Messages and attachments | Content in the form that matches the protection of each message type, including text, images, audio, video, files, and captions | Delivery to chosen recipients and storage of conversations on devices |
| Delivery and activity | Chat and message identifiers, sender and recipients, sending time, delivery and read statuses, presence information, attachment sizes | Synchronization, delivery, unread messages, and interface operation |
| Notifications | Apple Push Notification service and Firebase Cloud Messaging tokens, notification settings, and notification service data | Delivering notifications about messages, calls, and events |
| Calls | Participants, call time and state, service information needed to establish the connection | Connecting participants and displaying call history |
| Subscription | Plan, trial period, access term and status, technical identifiers, and purchase verification results | Providing and verifying Premium, restoring purchases, and handling subscription changes |
| Diagnostics | Crash information, application and system versions, device parameters, technical installation identifiers, and server request results | Finding errors and keeping the service working and secure |
| Support requests | Sender address, message text, and materials you choose to send to support | Answering a request or a personal data request |
When a network connection is made, your IP address and technical connection parameters become available to the network services involved. This applies in particular to cloud infrastructure, push services, direct device-to-device connections, and external services you open from the application.
For ordinary creation and use of a family we do not ask for a passport, proof of identity, email address, or phone number. If you write to support or include such details in a message yourself, they are processed as part of that request or message delivery.
3 Why we need data
We process data to provide the features you use: creating and joining a family, communication, calls, linking devices, notifications, and subscription. Technical data is also needed to verify authorization, protect against abuse, fix errors, and meet applicable legal obligations.
Profile data and service information are not used to establish your civil identity. The chosen role does not by itself confirm actual age, family relationship, or the status of a legal guardian.
4 How messages and images are protected
Text messages, audio messages, files, and videos are encrypted on devices for delivery to recipients. These content types use end-to-end encryption: server delivery handles encrypted data, and decryption happens on devices that hold the required keys. Video captions and file details are also protected by the encryption designed for them.
End-to-end encryption does not hide all service information. For delivery, the server processes, for example, chat participants and identifiers, time, delivery status, and the size of transferred data.
Images are protected differently. For server delivery through Google Cloud they are sent over secure connections and stored temporarily in private Cloud Storage, which encrypts data at rest. Downloads use signed links with a limited lifetime, currently 15 minutes.
Images and their captions are not end-to-end encrypted: the server receives a JPEG and stores the caption separately for delivery. Cloud encryption and access control protect the data but allow technical infrastructure access with the appropriate permissions. Avatars are stored in the cloud in the same way. More about server-side encryption: Google Cloud documentation.
A signed link gives access to a specific image to anyone who has it until it expires. Do not forward such a link if you do not want to give access to the image.
Conversations and downloaded attachments are also stored in the application's private storage on your devices. A recipient can read, save, export, or forward material available to them. End-to-end encryption does not prevent such actions by a recipient and does not protect against access to an unlocked or compromised device.
Support does not restore access to a family and does not manage a family on behalf of its members. Device linking or recovery actions that the application provides to members do not restore lost history, files, or cryptographic keys.
5 Who sees data within Family Chat
Profiles and membership information are shown to other members according to the family and chat membership, links between families, and the visibility rules in effect. Messages are delivered to the members of the relevant chat and to their authorized devices that are permitted to receive them.
Creating a group, inviting a member, adding a Friend, linking another device, or linking with another family can change which people and devices receive the relevant data. The Parent role does not by itself give access to the content of all private chats.
The service administrator sees family names, member names including children's, their roles, and subscription status in the internal administration panel. This is needed for support and subscription management. Message content, invitation codes, keys, and push tokens are not shown in the panel.
If another member provides your data to Family Chat, they are the source of that data. You can contact us about the processing of such information.
6 Service providers and external features
The application uses the following categories of services:
-
Google Cloud — server infrastructure, database, and object storage in the cloud. The information processed depends on the feature and on the protection of the relevant content.
-
Apple Push Notification service and Firebase Cloud Messaging — notification delivery. The providers process the token or installation identifier, delivery parameters, and the service data sent. Where an encrypted message preview is used, the recipient's device decrypts it.
-
Firebase Crashlytics — crash diagnostics in application versions with the service enabled. It is enabled in Production versions for iOS and Android and in Staging test versions. It receives information about the crash, device, application, and technical installation identifiers. The data involved is described in the Firebase documentation.
-
Google STUN — determining network parameters for direct device-to-device connections. The service receives network request data, including the IP address. In a direct connection your network address may also become available to the other participant's device.
-
Apple App Store and Google Play — distribution of the application and processing of available purchases. We receive the information needed to verify a purchase and provide the subscription; we do not ask you for full bank card details.
YouTube, Instagram, TikTok, and other external links. A message with a link to a YouTube video, an Instagram post, or a TikTok video may be shown as a card with a thumbnail and title and opened in an embedded player. When such a card appears on screen in an open chat, the device itself requests the thumbnail and title from the relevant service; opening it loads the service's player. These services receive the IP address, the identifier of the chosen item, and technical request parameters. The embedded player may use cookies and local web storage, and their data may persist on the device between openings. Family Chat does not pass your name or account or family identifiers to these services. Members with the Child role are not shown these cards or the embedded player: for them the link stays an ordinary link that opens through the operating system. Processing by these services is governed by their own rules: the Google Privacy Policy for YouTube, the Meta Privacy Policy for Instagram, and the TikTok Privacy Policy.
Opening other external links or exporting a message passes the chosen data to the relevant application, website, or recipient. Its further processing depends on the recipient's actions and the external service's rules.
Support emails are processed through an email service. Information may also be disclosed to competent authorities when applicable law requires it. Disclosure to providers is limited to the data needed for the relevant feature.
7 Calls and speech recognition
Audio calls use a direct device-to-device connection over WebRTC. The Family Chat server coordinates connection setup and processes call service information; the current implementation does not record conversations on the server. The direct connection uses Google STUN and may reveal network parameters to the other participant's device.
On iOS, audio-to-text conversion uses Apple speech recognition available on the device. In the current implementation, audio is not sent to Apple's cloud service for recognition. The resulting text is sent to the other participant only through the corresponding send action in the application. If on-device recognition is unavailable, the application does not silently replace it with cloud recognition.
8 Device permissions
The camera is used to take the images and videos you choose, and the microphone to record audio messages and calls. The system photo or file picker gives the application only the material you select. Access to save to the photo library is needed when you save material there. Notification permission allows notifications to be shown by the operating system.
You can manage these permissions in your device settings. Refusing limits the corresponding feature. An operating system permission does not by itself replace separate consent to data processing where the law requires it.
9 Retention
Family Chat uses server storage for delivery and service functions. The service is not a permanent cloud archive of your conversations.
The periods below are those defined by the current implementation. The end of a delivery period or queuing an object for deletion does not mean that all backup and technical copies disappear at the same moment.
| Data | Retention period or criterion |
|---|---|
| Text, images, and audio for server delivery | Until delivered to all intended recipients or until the 15-day delivery period after the server accepted it expires; cleanup processes then delete it |
| Files and videos in server storage | Content is available for at most 7 days after the server accepted it; scheduled cleanup may delete it earlier |
| Service records of completed delivery without message content | 30 days after delivery completes |
| Technical access revocation records | Credential revocation records — 365 days after revocation; records of revoked device keys may be kept until the family is deleted and for 365 days after that |
| Account, devices, and their keys | Until the account is deleted. Leaving a family and logging out on a device do not delete the account |
| Family membership: name, role, status, and dates, as well as call history and service events involving that member | Until the family is deleted. After you leave a family, your name and role are kept so that the remaining members see chat history, system messages, and calls correctly. After account deletion, the name and avatar are deleted and an anonymized record with no link to the account remains in the family |
| Avatars | While used by the relevant profile; after replacement, leaving a family, or account deletion the object is queued for deletion |
| Local conversations and attachments | While kept in the application storage on the device and not deleted by the corresponding action |
| Firebase Crashlytics diagnostics | Google states 90 days before deletion of reports and related identifiers from live and backup systems begins |
| Administrator action log: changes to service settings and granting or revoking a family subscription | Kept indefinitely; records contain family identifiers without names |
| Purchase records | Purchase confirmations received from the store — 90 days; store notifications about subscription changes — 30 days; subscription verification and change records without payment data — 400 days; the link between a subscription and a family as an irreversible hash — indefinitely |
| Infrastructure logs | 30 days |
| Support emails | 30 days after the request is closed |
| Database backups | 7 days |
The Firebase Crashlytics period is taken from the provider's documentation. Push providers and external services apply their own processing periods. Payment data is processed by Apple App Store and Google Play; its retention is determined by the stores' rules.
Deleted cloud objects, including images, avatars, files, and videos, remain in the cloud storage recovery mechanism for another 7 days and are not accessible through the application. Data deleted from the database remains in backups until their 7-day period expires. These copies are used only to restore the service and are not intended for viewing conversations.
After you delete the application, leave, or change devices, history may be lost. Copies that recipients saved or exported themselves are outside Family Chat storage.
10 Legal bases
For processing subject to the GDPR, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Family, profiles, messages, attachments, calls, device linking, notifications, and subscription | Performance of a contract (Article 6(1)(b) GDPR) |
| Access protection, prevention of abuse and replayed requests, infrastructure logs, and crash diagnostics through Firebase Crashlytics | Legitimate interest in a secure and working service (Article 6(1)(f) GDPR) |
| Keeping records and disclosing information where the law requires it | Legal obligation (Article 6(1)(c) GDPR) |
| Answering support requests and personal data requests | Performance of a contract, and for data subject rights requests, legal obligation |
You can object to processing based on legitimate interest by writing to support@familychatapp.com. If any processing requires consent, it will be requested separately. Reading this Policy and accepting the Terms of Use do not mean consent to any processing.
11 Children's data
Family Chat allows family communication with children and processes their data for the features available to them. This includes the chosen profile values, family membership, messages, and the necessary technical information.
A child joins Family Chat only by invitation: a member with the Parent role adds the child to the family, enters the child's name, and creates the invitation. The child's data is processed for the features the Parent provides to the child in the family, on the basis of the contract with that Parent. We do not show children advertising and do not use their data for profiling.
Members with the Child role are not shown YouTube, Instagram, or TikTok cards or the embedded player, so the application does not itself contact these services on the child's behalf.
A Parent can delete a child's account immediately in Member Settings. A child can request deletion of their own account; the procedure is described in section 12.
The application does not collect date of birth and does not verify age from profile data. The Parent role does not confirm legal guardian status. Where specific processing requires a legal guardian's consent, the store age rating does not by itself replace it.
12 Your rights and data deletion
Where EU data protection law applies, you can request access to and a copy of your data, rectification, erasure, restriction of processing, and portability, and you can object to processing in the cases provided by law. You can withdraw consent where processing is based on it. These rights apply subject to the conditions and limitations provided by law. Explanations are published by the Polish data protection authority UODO.
To make a request, write to support@familychatapp.com and state which data or actions it concerns. Do not send access secrets, private keys, or full conversations unless they are essential to your request. To fulfil a request we need to determine which data it concerns and whether the requester is entitled to receive or manage it. Handling such a request does not mean that support restores access or manages a family.
Where the GDPR applies, we respond without undue delay, normally within one month. If the law allows an extension, we will tell you about it and the reasons. You can lodge a complaint with UODO or another competent authority.
Leaving a family, deleting a message, and full deletion of personal data are different actions. Leaving ends the relevant membership but does not guarantee destruction of all server information. Deleting a message works within the chosen feature and does not undo external copies recipients have already made.
When we receive a deletion request, we consider the data processed by us. Some records may be kept on a legal basis or for justified security purposes. For end-to-end encrypted content we hold no decrypted history that could be provided instead of the user's local copy.
How to delete your account. In the application, open Settings → Delete Account. Your account, name, profile photo, and devices are deleted, and all linked devices are signed out. If you are the last Parent in a family, the family is deleted for all its members; the confirmation screen lists such families in advance. Deleting your account does not cancel an app store subscription: cancel it in the App Store or Google Play settings.
- All Parents of the family receive a child's account deletion request. Any of them can approve it immediately; otherwise the account is deleted automatically after 24 hours.
- A Parent can delete a child's account immediately: that child's Member Settings → Delete Child's Account.
- If you have been removed from all families, the Leave Family button on the "You are removed from Family" screen deletes the account and its data.
After deletion, an anonymized member record remains in the families, and messages already delivered remain on other members' devices under the label "Deleted account". Technical access revocation records are kept for 365 days, and purchase records for the periods in section 9.
If you do not have the application, the procedure is described at familychatapp.com/delete-account, which also lists the information to send to support@familychatapp.com. Before deleting, we confirm the request with a Parent of that family, and we complete a confirmed request within 30 days.
13 Where data is processed
Family Chat servers, database, and cloud storage are hosted on Google Cloud in the europe-central2 region (Warsaw, Poland).
Some providers process data outside the European Economic Area, including in the United States:
| Recipient | What it processes | Transfer safeguards |
|---|---|---|
| Google: Google Cloud, Firebase Cloud Messaging, Firebase Crashlytics, Google STUN | Server infrastructure, push notifications on Android, crash reports, network parameters for direct connections | EU-US Data Privacy Framework and EU standard contractual clauses in the Google Cloud and Firebase data processing terms |
| Apple: Apple Push Notification service | Push notifications on iOS | EU-US Data Privacy Framework and EU standard contractual clauses |
Apple App Store and Google Play, as well as YouTube, Instagram, and TikTok when their content is loaded, process data as independent controllers under their own rules. In the latter case your device sends the data to them directly.
The Data Privacy Framework is based on Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection; the list of participants is published at dataprivacyframework.gov. You can request a copy of the safeguards we rely on at support@familychatapp.com.
14 Changes to this Policy
We update this Policy when features or ways of processing data change, and we state the date and version of the current text. The current version is published at familychatapp.com/privacy-policy.
We inform you about material changes through a means available in the application. If a change requires new consent or another action by law, publishing a new version does not by itself replace it.
Related document: Family Chat Terms of Use.