Privacy Policy

1. Who we are

Family Minder is made and run by Ben Spader, an independent developer in the United States. In this policy, “we”, “us” and “our” mean Ben Spader, who is responsible for the information described here. You can reach us at [email protected].

2. What we collect and why

We collect what the app’s features need. Most of it comes from your phone while you use Family Minder; some is entered by you or by someone else in your family.

Your account

• Sign-in. You sign in with Google, with Apple (on iPhone), or with an email address and password. We receive your email address and the name your sign-in provider shares with us. With Sign in with Apple you can choose to hide your email address, and we then receive a private relay address from Apple instead.
• Your profile. The name your family sees (you choose it), your phone’s time zone, so that times, curfews and schedules follow your local time, and a profile photo if you add one. A family can also give you a nickname and a colour for your pin on the map.

Your families and settings

• The families, which the app calls circles, that you create or join; your role in each (such as owner, parent, guardian, adult or kid); whether you’re a supervised member; who invited you; and when you joined or left.
• What you and your family set up: saved places (name, address, position and size), who is told about whom, arrival alerts, curfews, “hasn’t arrived” alerts, check-in requests, out-with-friends watches, battery alerts and drive settings. For age-based settings a parent can enter a child’s date of birth; for example, alerts about phone use while driving start at 16 unless a parent changes that.

Location

• While sharing is on, the app sends your phone’s location to our servers, including in the background when the app is closed or not in use. Each location point includes the coordinates, how accurate they are, speed, direction of travel, altitude, the time, your battery level and whether the phone is charging, and whether you’re still, walking, running, cycling or in a vehicle, which comes from your phone’s motion detection. A position from a mock-location app is marked as such.
• From these points we work out your current position on the family map; arrivals at and departures from saved places; how long you’ve been somewhere; places you visit often, to suggest saving them; your trail, timeline and heat map; daily totals of how far you walked, ran, cycled and drove; and when you’re on a flight.
• When you send an SOS or check in, we record your position at that moment and any note you add.

Driving

• If you’ve said yes to driving reports, drives are detected automatically while you’re sharing your location. For each drive we keep when and where it started and ended, the distance, speeds, the detailed route, a safety score, and driving events: speeding, hard braking, rapid acceleration and hard cornering, all worked out from your location.
• To tell whether a parent is in the car with a teen driver, and who else was along, we compare the positions of family members’ phones during the drive.
• On Android, two more features: phone use while driving, which records only that the screen was on while the car was moving and for how long, never what was on it; and crash detection, which watches the phone’s motion sensor during a drive for a hard impact followed by the car stopping, and asks you on the phone whether you’re okay.
• Driving reports, phone use while driving and crash detection are each yours to say no to. The app asks when you join a family, and asks a family’s owner too; you can change your answers at any time in the app (You → Driving features on Android, You → Driving reports on iPhone) or by emailing [email protected]. Your answers apply in every family you’re in. Until you’ve answered, a feature is off.
• What you say no to isn’t looked for on your phone, our servers refuse to record it, and nobody is alerted about it. Saying no to driving reports also hides the drives already recorded from everyone but you. Phone use and crash detection only work during a recorded drive, so they’re off whenever driving reports are. Turning phone use or crash detection off stops them from then on; what was recorded before stays with the drive it happened on.

Your phone

• The phone’s make and model, its system version and the app’s version; a push token, which is a random identifier from Google or Apple that lets notifications reach the phone; battery level and charging; whether location permission is set to always, while using the app, or off, and whether precise location is on; whether battery saving (Battery Saver or Low Power Mode) is on, whether the app may run in the background, and whether motion access is allowed; and how the app’s upload queue is doing, including its last upload error. These let your family see why a phone has gone quiet.
• On Android we also collect the ringer volume and mode and whether Do Not Disturb is on, so that a parent can turn up a supervised child’s ringer.
• When you sign out, we record it, and your family is told that phone has stopped sharing.
• On Android, the app can recognise your car’s Bluetooth connection to tell when a drive has ended. Which Bluetooth devices you use stays on your phone.
• We don’t collect advertising identifiers, your contacts list, your photo library, your messages, or what you do in other apps.

Invites and contacts

• Only an owner, parent or guardian of a circle can invite people. They type the person’s phone number or email address, or pick it with the phone’s own contact picker. The picker hands the app only the one contact chosen: the app doesn’t ask for permission to read your contacts and can’t see your address book. From that contact the app uses the name and the one phone number or email address the invite is for.
• We store each invite with that phone number or email address, and the name if one was given, so that only that person can use it, along with the role it’s for. The invite code itself is never stored, only a scrambled fingerprint of it (a hash). You send the invite yourself, from your own phone; Family Minder doesn’t text or email the person you invite.
• If an invite was sent to a phone number and the person joining has no verified phone number on their account, they are asked to confirm the number it was sent to.

Records that keep the service honest

• Consent records: which features each person agreed to, or later turned off, and when, under which version of the consent text, and from which app version and phone.
• Access log: each time someone opens another member’s location (on the map, on that person’s page or in their history), we record who looked at whom, and when.
• Security log: actions such as creating or deleting a family, invitations, joining and leaving, consent changes, erasing location history, removing a phone, connecting a home system, signing out and deleting an account.
• Alerts: the alerts Family Minder raises, such as “Harper arrived at School”, and for each person they were sent to, whether they were delivered, seen or cleared.

This website

• The site has no cookies, analytics, trackers or ads, and it loads nothing from other websites. Like any web host, Cloudflare, which hosts it, processes your IP address and browser details to deliver the pages and protect the site from attacks.
• The invite page reads the invite code from the link inside your browser and never sends it anywhere. In current invite links the code comes after a “#”, a part of the address that browsers don’t send to websites, so it doesn’t reach our host at all. Older links that carry the code as ?code= do reach the host, and the page then moves the code out of the address.
• If you email us, we receive your message and your email address.

3. How we use it

• To run Family Minder: to show your family where you are, send the alerts your family has set up, record and score drives, run schedules such as curfews, and keep your phones and settings working.
• To keep it safe: to keep each family’s information apart from every other family’s, stop people guessing invite codes, and look into problems and misuse.
• To help you when you contact us.

We don’t use your information for advertising, we don’t sell it or give it to data brokers, and we don’t use it to build profiles for anyone else. The apps contain no advertising or analytics software.

4. Who can see your information

Inside Family Minder, what someone can see depends on the circles you share with them and their role in each. These rules are enforced by our servers, not only by the app.

• People in your circles see your current position on the map, how long you’ve been there, your speed, your phone’s battery and whether you’re driving, and can look back at where you’ve been (your trail, timeline and heat map), unless you’ve paused, gone incognito or hidden your location from them.
• Parents and guardians in a family circle also see a supervised member’s drives and driving events, the alerts about them and their phone’s status, and set the rules that raise those alerts. They can switch on lost-phone mode, which makes a supervised child’s phone sound a siren and report its position every few seconds until it’s switched off. On Android they can also turn up that phone’s ringer or ask it to switch Battery Saver off; the child’s phone shows who asked.
• People a parent trusts with a child, such as a grandparent or a babysitter, can be given what a parent sees and hears about that child (alerts, drives, out-with-friends watches, lost-phone mode, the ringer and check-ins), either always or only while the child is in their care. Setting the child’s rules stays with the parents, and the child is told when such access starts and ends.
• Kids (supervised members) see where the family is now, but not other people’s history or drives unless a parent turns that on for the family. A parent can also stop the kids seeing a particular adult’s location.
• Alerts about a person go to the people set up to receive them, usually the parents or guardians, and the person the alert is about can see it too. An SOS goes to everyone in the family.
• Drives and driving scores are shown to parents and guardians, to people a parent has given access to a child, and to others only if a parent turns that on for the family.
• Home systems that a parent connects receive what’s described in Home automation.

Your controls:

• Pause (adults): stop sharing with a circle. Everyone in it sees that you paused rather than an old position.
• Incognito (adults): for a set time, from 5 minutes to 7 days, nothing is recorded and nobody is told. Others see your last position with its real time.
• Hide (adults): stop particular people seeing your location anywhere in the app. Emergencies such as an SOS or a possible crash still reach everyone.
• Leave (adults): leave a circle at any time. The circle is told.
• Driving features (everyone): turn driving reports, phone use while driving or crash detection off or back on. If you’re a supervised member, your parents are told when you turn one off.

Children who are supervised members can’t pause, go incognito, hide their location or leave a family on their own; a parent can remove them. That way the parents who supervise them can always see them.

Us: we can access information on our servers to run, support and secure Family Minder, to help when you ask us, or when the law requires it. We will disclose information to others only if the law requires it, such as under a valid court order, or if we believe it is necessary to protect someone from serious harm. If Family Minder ever passes to someone else, we will tell you first, and they will have to keep the promises in this policy.

5. Service providers and other services

These companies and services receive information to make Family Minder work. Each receives only what’s listed here. Google and Apple also have their own relationship with you under their own privacy policies.

Service and what it’s forWhat it receives

Supabase: our database, sign-in, file storage and server code, hosted on Amazon Web Services in Oregon, USA

The information in section 2 that reaches our servers.

Google Firebase Cloud Messaging: notifications on Android

Your phone’s push token and, for each notification, the alert’s ID, its type (for example, an arrival) and how urgent it is. No names, places or positions.

Apple Push Notification service: notifications on iPhone

Your phone’s push token and, for each notification, the alert’s ID, type and urgency, a plain title such as “Arrival”, and the words “Open Family Minder to see more.” No names, places or positions.

Google Sign-In and Sign in with Apple, if you use them

Google or Apple confirm who you are and tell us your email address and name, and they know you signed in to Family Minder.

Google Maps Platform: the map, address search and place names in the Android app

The map area you look at; what you type when searching for an address or a business, with a nearby location to rank the results; and the coordinates of spots the app shows a name or address for.

Google Play services: location and motion detection on Android

Your phone’s position and whether you’re walking or driving are worked out on the phone by Google Play services, under Google’s privacy policy.

Apple Maps: the map, search and addresses in the iPhone app

The map area you look at, what you type in a search, and the coordinates of spots the app shows an address for.

Your phone’s speech recognition: voice commands on Android, if you use them

The phone’s speech service (Google’s, on most phones) hears your command, with your family members’ names and your places as hints. The app receives only the text.

Google Maps or Apple Maps: directions

If you tap Directions, the app opens your maps app with that destination.

Google Places: out-with-friends watches

When a parent has started an out-with-friends watch on a child and the child stays somewhere, our server sends the coordinates of that spot to find out what’s there, for example a bar.

OpenStreetMap Overpass servers: out-with-friends watches for children a parent has recorded as 12 or under

During a watch, our server sends the child’s position, at most every 90 seconds and only after they’ve moved, to check for nearby water or major roads. These are public servers run by others in Europe: overpass-api.de, overpass.kumi.systems and overpass.private.coffee, tried in that order.

Open-Meteo, the US National Weather Service and the US Census Bureau: weather and big-city alerts

When a supervised child is walking, cycling or riding with no parent along, our server sends their position, at most every 10 minutes (sooner after they’ve travelled 3 km), to check the weather and official warnings there and, on foot, which city they’re in.

FBI Crime Data Explorer: crime-area alerts

A state and a city’s police department, to look up that city’s crime rate. No location or personal information.

City of Minneapolis and City of Saint Paul open data: the crime-area map layer

Nothing about you. Once a day our server downloads their published crime statistics.

Cloudflare: this website and our support email address

Your IP address and browser details when you visit the site, and the email you send to [email protected], which it forwards to us.

The lookups our server makes for watches and for weather and city alerts carry only coordinates or a place name. They include no names, account details or phone information, and they come from our server, not from your phone.

6. Notifications

Notifications pass through Google’s and Apple’s systems, so what we send them carries no names, places or positions: only an alert’s ID, its type and how urgent it is (on iPhone, also a plain title such as “Arrival”). The words you see, such as who arrived where, are fetched by the app from our servers over a secure, signed-in connection and shown on your phone.

7. Home automation

A parent or guardian can connect Home Assistant, HomeSeer or another home system to a family. Nothing is sent to a home system unless a parent or guardian sets one up. There are two ways:

• A token, made in the app (Home Assistant, or HomeSeer paired with a code). It is read-only and works for one family. For each member who is sharing, has agreed to share and hasn’t paused, it gives the name shown in the app, the position rounded to a 100-metre grid, speed, activity, battery and charging, the saved place they’re in, whether they’re driving, whether a parent is in the car on that drive, and the drive’s safety score. A paired HomeSeer is also told about arrivals, departures, drives and alerts: who, which place and which alert, without coordinates. A token stops working after a year (a paired HomeSeer renews its own while it’s in use), as soon as the parent who made it stops being a parent or guardian in the family, or when it’s revoked in the app. We record when each token was last used and from which internet address, to help spot a leaked token.
• A webhook: a web address a parent adds in the app. Family Minder then sends that address the family’s events: position updates with exact coordinates, arrivals and departures, driving changes, and alerts with their text. Each delivery is signed so the receiver can check it came from us. Nothing about a member is sent while they’ve paused sharing.

Once information reaches your home system, it’s kept and protected according to how that system is run, so keep tokens and webhook addresses private.

8. How long we keep it

These deletions run automatically every day.

InformationHow long we keep it

Location points

Deleted once they’re 90 days old. They’re deleted a calendar month at a time, so some points last up to about four months.

Daily summaries of where you spent time (heat map and stays)

90 days

Daily distance and time walking, running, cycling and driving (no locations)

400 days

Detailed drive routes

90 days

Drive summaries: start and end, distance, speeds, score and driving events

2 years

Your current position

Replaced by each new one; deleted when you erase your history or delete your account

Arrivals at and departures from saved places

Until you erase your history or delete your account, or the place or family is deleted

Alerts

Until the person they’re about deletes their account, or the family is deleted

Access log (who looked at whose location)

180 days

Security log

7 years. Entries are no longer linked to an account once it’s deleted.

Consent records

As long as the account they belong to

Invites, including the name, number or email address they were sent to

30 days after the invite expires. Invites last at most 14 days.

Attempts to use an invite code (the codes themselves aren’t kept)

7 days

Check-in requests

30 days after they expire

One-off arrival alerts and out-with-friends watches, with the lookups made for them

30 days after they end

Weather and city checks

7 days

Requests sent to a phone (ringer, lost-phone mode, Battery Saver)

30 days

Events waiting for a home system

7 days

A family that an owner deletes, and everything in it

Erased 30 days after it’s deleted

Everything else: your account, profile and photo, phones, places, settings and rules

Until you delete them or your account, or the family they belong to is deleted

Emails to us

As long as we need them to handle your request

9. Deleting your data and your account

Erase your location history

In the app, open the You tab, then Sharing & privacy, and under Your data tap Erase my location history. This deletes your location points, drives, current position, arrivals and departures, and daily totals at once, and the daily summaries made from them within the hour. Alerts already sent to your family stay until your account is deleted. Your consent records and the security log are kept, because they record decisions, not where you were.

A parent can erase a supervised child’s location history from the child’s page in the app. Children can’t erase their own.

Remove a phone or leave a family

On the You tab, Phones & devices lets you remove a phone: it then stops sharing as you and gets no more notifications. Adults can leave a circle from the circles page; the circle is told.

Delete your account

In the app, open the You tab and tap Delete account under your name. If your version of the app doesn’t show it yet, email [email protected] from the address you sign in with, and we’ll delete the account for you. When an account is deleted:

• The account, profile, profile photo, location history, drives, alerts about you, phones, settings, memberships and your consent records are deleted straight away.
• A family you own passes to its next adult (another owner if there is one, otherwise a parent, then a guardian, then another adult, longest in the family first), who becomes an owner, and the family is told.
• A family with no other adult in it is deleted, with its places, alerts and settings. The accounts of children in that family are not deleted with it: a child can delete their own account in the app, or a parent can ask us to delete it.
• Places you added stay with the family, and consent you gave for a child stays on the child’s record, without your name.
• Security log entries stay for up to 7 years, no longer linked to your account.
• Deleted information may remain in our hosting provider’s backups until those backups expire.

If you signed in with Apple, you can also remove Family Minder from your Apple ID’s Sign in with Apple settings.

10. Children

Family Minder is made for families, and many of the people it locates are children. It’s built so that a parent or guardian sets a child up and stays in charge.

• Who sets a child up. Only an owner, parent or guardian of a circle can invite someone, and the invite says whether the person joins as a supervised child. A child who is already supervised can join another circle only through an invite made by one of their own parents.
• Agreement before anything is collected. Using an invite doesn’t share anything by itself. Before any location is collected, the child’s phone shows what Family Minder collects and why, and asks for agreement to share location; until that agreement is recorded, our servers refuse location points from the phone. Each answer is recorded with the account it came from, the time, and the version of the text that was shown. If your child is under 13, you, the parent or guardian, should do this step yourself on your child’s phone. When a parent adds a supervised child to another of their circles, such as a grandparents’ circle, the child’s existing choices carry over and are recorded as given by that parent.
• What parents can see and do. Parents and guardians see a supervised child’s location, history, drives, alerts and phone status. Supervised children can’t pause sharing, go incognito, hide their location or leave a family on their own, and they don’t see other family members’ history unless a parent allows it.
• Reviewing and deleting a child’s information. A parent can erase a supervised child’s location history in the app and remove the child from a family. A parent can also email [email protected] to get a copy of their child’s information, including the consent records, to stop further collection, or to have the child’s account and information deleted. We check that the request comes from a parent or guardian of that child in Family Minder before acting on it. A child can also delete their own account in the app, and their parents are told.
• Only for the family’s features. Children’s information is used only to run the features their family set up. We don’t show ads, sell information, or use advertising or analytics trackers, for anyone.
• Age. We don’t ask anyone’s age, except that a parent can enter a child’s date of birth for age-based settings. Children under 13 shouldn’t create their own account or family. If we learn that a child under 13 is using Family Minder without a parent or guardian involved, we’ll delete the account.

Questions about a child’s privacy: [email protected].

11. Security

• Encrypted connections. The apps talk to our servers only over encrypted HTTPS connections, and refuse unencrypted ones.
• Access rules in the database. Every table holding your information has row-level security, so the database itself decides who may read each row, and one family can’t read another’s information. The apps hold no administrator keys.
• One way in for location points. Location points are accepted only through one server function, which files them under the signed-in account and checks consent and pauses first.
• Invite codes aren’t stored. Only a hash of each code is kept. Codes expire within 14 days, usually work once, and an account that enters 10 wrong codes in 10 minutes has to wait.
• Home-automation tokens are stored only as hashes, and webhook deliveries are signed.
• Private photos. Profile photos are shrunk on your phone first, which removes hidden details such as where the picture was taken, and are stored privately, so only members of your circles can see them.
• On the phone. On Android, the app keeps its own settings in encrypted storage and leaves all its data, sign-in included, out of phone backups and transfers to a new phone.

No system is perfectly secure. If a security breach affects your information, we’ll tell you as the law requires.

12. Where your data is stored

Our database and file storage are hosted by Supabase on Amazon Web Services in the US West (Oregon) region, in the United States. Some of the service providers in section 5 may process information in other countries. If you use Family Minder from outside the United States, your information is transferred to and stored in the United States.

13. Your rights

Wherever you live, you can ask us to:

• give you a copy of your information, including who has looked at your location;
• correct it;
• delete it, or your whole account;
• stop collecting it, by withdrawing your agreement to share your location.

Email [email protected] from the address you sign in with. We may ask you to confirm the request, and we’ll answer within 30 days, free of charge. Laws in some places, including several US states, give you these rights; we give them to everyone.

You can also turn off Family Minder’s location access or its notifications in your phone’s settings at any time. Without location access Family Minder can’t share your location, and if you’re a supervised member, your parents are told.

14. Changes to this policy

We’ll post any change here with a new effective date. If a change affects what we collect or who receives it, we’ll also tell you in the app before it applies, and ask for your agreement again where needed. The app records which version of its consent text each person agreed to.

15. Contact

Ben Spader, Family Minder
[email protected]
United States