Familinx
Privacy Policy
Last updated 23 October 2026 · Effective from the first public release of Familinx
The short version. Familinx stores what you type into it — your lists, your budget, your savings goals — so your family's phones can show the same thing. We do not sell it, we do not advertise in the app, and there is no advertising identifier. Crash reports and usage statistics are off unless you switch them on. You can delete your account from inside the app.
1. Who we are
Familinx is an Android application operated by John S. Halaka, an independent developer, trading as Familinx. In data protection terms, we are the controller of the personal data described below.
Privacy questions and requests: privacy@familinx.app. Anything else: support@familinx.app.
2. What we collect
Almost everything here is something you typed into the app yourself. We do not buy data about you, and we do not collect your contacts, your location, your photos or your calendar.
Account
- Email address — how you sign in and how we send you a one-time code.
- Display name — the name your family sees next to what you add.
- Google account identifier and profile name, if you choose to sign in with Google. We do not receive your Google password, and we do not get access to any other Google service.
Family
- Which family you belong to, and whether you are a parent or a child in it.
- Family name, invite code, and requests to join a family.
What you put in the app
- Lists and list items.
- Budget accounts — shared and personal — along with transactions, amounts, currencies, categories, notes and dates you record against them.
- Categories you create, and the monthly spending caps a parent sets.
- Savings goals and the contributions made towards them.
These are financial records you keep for yourself. Familinx has no connection to any bank, card or payment provider, and cannot move money.
Device and technical
- Push notification token, with the platform and the app version, so we can deliver a notification to the right device. It is removed when you sign out or delete your account.
- A random device identifier generated by the app, used to tell your own devices apart when they sync. It is not your phone's advertising ID — the app does not request one — and it is not linked to anything outside Familinx.
- Your IP address, held briefly by our rate limiter so that sign-up, password reset and family search cannot be abused, and in our hosting provider's server logs.
Optional, and off by default
Both of these start switched off. Nothing is collected until you turn them on in Settings → Notifications ("Share crash reports" and "Share usage statistics"), and switching them off again stops collection.
- Crash reports (Firebase Crashlytics) — the stack trace, the device model, the Android version and the app version at the moment the app failed.
- Usage statistics (Firebase Analytics) — which screens are opened and which features are used, so we know what to improve. No advertising identifier, no ad personalisation.
3. Why, and on what legal basis
If you are in the European Economic Area or the United Kingdom, the GDPR requires us to name a legal basis for each use. Here they are.
| What | Why | Legal basis |
|---|---|---|
| Email, display name, Google identifier | To create your account, sign you in and show you to your family | Performance of a contract |
| Lists, budget, savings goals, categories | They are the service: storing them and syncing them to your family's devices | Performance of a contract |
| Push token | To deliver the notifications you asked for | Performance of a contract |
| IP address, rate-limit counters | To stop abuse of sign-up, password reset and search | Legitimate interests — keeping the service available and secure |
| Crash reports | To find and fix the faults that affect you | Consent — the switch in Settings |
| Usage statistics | To understand which parts of the app are worth improving | Consent — the switch in Settings |
Where we rely on consent, you can withdraw it at any time with the same switch, and that does not affect anything collected before you did.
4. What your family can see
Familinx is a shared app, so some of what you add is visible to the other members of your family by design:
- Visible to the family: your display name, shared lists and their items, shared budget accounts and the transactions in them, categories, savings goals and contributions, and who added or changed what.
- Not visible to the family: your email address, your personal budget accounts and the transactions in them, and your app settings.
- Parents can additionally manage the family — invite and remove members, set the monthly caps, and change the family's budget settings.
Nothing you add is visible to anyone outside your family, and families cannot see each other.
5. Who else processes it
We use a small number of service providers who process data on our instructions. We do not sell your data and we do not share it with advertisers or data brokers.
| Provider | What they do for us | What they see |
|---|---|---|
| Supabase | Database, authentication and the server functions behind the app | Your account and everything you store in the app |
| Google — Firebase Cloud Messaging | Delivering push notifications | Your push token and the notification's content |
| Google — Firebase Crashlytics | Crash reports (only if you turned them on) | Crash diagnostics and device model |
| Google — Firebase Analytics | Usage statistics (only if you turned them on) | Screens opened and features used |
| Google — Sign in with Google | Signing you in, if you choose it | That you signed in to Familinx |
| Resend | Sending the one-time codes and account emails | Your email address and the message |
| Cloudflare | This website, and forwarding mail sent to our addresses | Website requests; the content of emails you send us |
We may also disclose data where the law requires it, or where it is necessary to establish or defend a legal claim.
6. Where it is stored
Your account and everything you store in Familinx is held in a Supabase project in the European Union (Frankfurt, Germany).
Some of our providers — Google and Cloudflare in particular — operate globally, so data processed by them may be transferred outside the country you live in, including to the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, or on the EU–US Data Privacy Framework where the provider is certified under it.
7. How long we keep it
| Data | Kept |
|---|---|
| Your account and your personal data | Until you delete your account |
| A family whose last member has left it | Marked for deletion, then permanently erased after 30 days |
| Shared content in a family you leave | Stays with the family — see account deletion |
| A departure record after you delete your account — your display name and which family you left | Kept so your family's phones can remove you from their member list. Erased with the family |
| Push notification token | Until you sign out, delete the app, or delete your account |
| Rate-limit records holding an IP address | Deleted within a day |
| Crash reports | Up to 90 days, by Firebase Crashlytics' own retention |
| Usage statistics | Up to 14 months, by Firebase Analytics' own retention |
| Emails you send to our addresses | While we need them to answer you, and then up to 12 months |
| Database backups | Held for disaster recovery on a short rolling cycle and overwritten. A deletion reaches a backup when that backup is replaced. |
8. Your rights
You can ask us to:
- Show you the personal data we hold about you.
- Correct anything that is wrong — most of it you can edit in the app yourself.
- Delete your account and your personal data.
- Give you a copy of what you provided, in a machine-readable format.
- Restrict or object to a use that relies on our legitimate interests.
- Withdraw consent for crash reports or usage statistics.
Write to privacy@familinx.app from the address on your account. We answer within 30 days. There is no charge, and we will not treat you differently for asking.
If you are in the EEA or the UK and you think we have handled your data badly, you may complain to your national data protection authority. If you are in California, we do not sell or share personal information as those terms are used in the CCPA, and we do not offer financial incentives for data.
9. Deleting your account
In the app: open the home screen, tap your avatar to open Profile, then Delete Account. Or email privacy@familinx.app from the address on your account.
What is deleted and what stays with the family is set out in full on the account deletion page.
10. Children
Familinx is not directed at children under 13, and we do not knowingly collect personal data from them. The app is installed and the family is created by an adult.
A family is a shared space, and parents may invite younger members into one. Where a child uses Familinx, the parent who invited them is responsible for that decision, can see what the child adds to shared content, and can remove them from the family at any time.
If you believe a child under 13 has given us personal data without a parent's involvement, write to privacy@familinx.app and we will delete it.
11. Security
- All traffic between the app and our servers uses TLS.
- The database enforces row-level security: a signed-in user's queries can only reach their own rows and their own family's rows. It is not left to the app to be careful.
- We never see your password; it is held, hashed, by our authentication provider.
- Sign-up, password reset and family search are rate limited, and the service is checked automatically every day.
No service can promise perfect security. If a breach affects your data and the law requires us to tell you, we will — without undue delay.
12. Changes to this policy
We will update this page when the app changes what it collects. The date at the top always says when it last moved. If a change is significant, we will tell you in the app before it takes effect.
13. Contact
Familinx — a service operated by John S. Halaka
Privacy: privacy@familinx.app
Support: support@familinx.app
Website: familinx.app