FamFind Privacy Policy
FamFind is a family location app built on a simple principle: your family's location data belongs to your family, not to us. FamFind has no accounts, no sign-up and no server that stores your data. This policy explains what the app handles and where it goes.
The short version
- Your location, chat and family data travel directly between your family's phones over end-to-end encrypted connections.
- We (the developer) run no database and cannot see any of it.
- A few services help phones connect or provide a feature (listed below). None of them can read your family's end-to-end encrypted data.
- No ads, no analytics, no tracking, no data sales.
What leaves your device, and where it goes
| Data | Where it goes | Who can read it |
|---|---|---|
| Live location, location history (only if you turn on history sharing; up to the last 30 days by default), places, chat, events, pets, item tags, battery level, profile name/emoji/photo, optional phone number, SOS and check-in status, weekly driving summary (only if you turn it on) | Directly to the devices of members of the families you joined, end-to-end encrypted. If no direct path exists, encrypted packets pass through relay servers operated by n0, Inc. (iroh relays). The relays see your IP address and an anonymous device key, not the content. To help phones find each other, your device key and relay address are published to n0's discovery service. | Only your family members |
| Invite codes | An encrypted invitation is published to public Nostr relays (relay.damus.io, nos.lol, relay.primal.net, relay.snort.social) until it is used, revoked or expires. Relays see your IP address and the encrypted blob. The family admin who created the code must approve each join, and each code works once and expires after 24 hours. | Only someone with the code |
| Approximate location for weather alerts (only if you turn weather alerts on) | A location rounded to about 1 km is sent to the US National Weather Service (api.weather.gov) or Environment and Climate Change Canada (api.weather.gc.ca). No identifier is sent. | That weather service |
| Map tiles, address and place search, Look Around | Apple Maps (Apple's MapKit), like any maps app. | Apple, under Apple's privacy policy |
| SOS texts and calls | Only when you tap them: Messages opens a text to your emergency contacts with a map link, or the dialer opens your local emergency number. | The people you text, your carrier |
FamFind does not use a push notification service. All alerts are local notifications created on your phone.
Data stored only on your device
Your identity key (in the iOS Keychain), recovery phrase, emergency contacts, notification settings, blocked members, no-show rules, crash-detection motion readings (processed on the phone, never stored or sent), and the shared family data described above.
Third parties
We don't sell or share personal data. The services above (n0 relays, Nostr relays, weather services, Apple Maps) only receive what's needed to deliver their function, and none of them can read your family's end-to-end encrypted data. We choose services whose terms protect that data at least as much as this policy does.
Who can see your location
Only members of families you joined with an invite code. Before you create or join a family, FamFind shows you exactly what members will see. Everyone in a family can see the member list. You are told when someone opens your location history, and when someone sets a no-show alert for you. You can pause sharing (Safety tab or Settings), turn off history sharing, use a Bubble, block a member's messages, or leave at any time. While paused, FamFind sends no location, arrivals at places, ETA replies or history. An SOS you start always shares your exact location with your families.
Safety features
SOS, check-ins, no-show alerts and crash detection notify your family through FamFind. FamFind does not contact emergency services, and these features depend on your phone's battery, signal, location permission and iOS letting FamFind run. Crash detection is experimental and can miss crashes or trigger by mistake. In an emergency, call your local emergency number.
Retention and deletion
Location history stays on your phone for 30 days by default (adjustable from 1 to 90 days in Settings › Location history) and is deleted automatically after that. Invitations stay on relays until used, revoked or expired. Settings › Privacy › Delete identity & all data takes you out of every family and removes your key and every FamFind file from this phone. Copies that family members already received (for example past chat messages or history they viewed) stay on their phones until they leave or delete the family. Because we hold no data, there is nothing for us to delete on a server.
Children
FamFind is meant to be set up by parents or guardians for their family. If a child uses FamFind, a parent or guardian should create or join the family with them and decide what is shared. We collect no personal data from anyone, including children.
Changes to this policy
If we change this policy, we will update this page and the effective date above. Significant changes will also be noted in the app's release notes.
Contact
Questions or requests: reecemarkowsky@gmail.com · Support