California Privacy

Legal
California Privacy Notice
Effective: April 24, 2026
In plain language
If you live in California, the CCPA (as amended by the CPRA) gives you specific rights over your data. We do NOT sell or share your personal information for cross-context behavioral advertising. You can still ask to see, correct, or delete what we have.
1. Who this notice applies to
This notice applies to California residents and supplements our general Privacy Policy with the disclosures the California Consumer Privacy Act (CCPA, as amended by CPRA) requires.
2. Categories of personal information we collect
In the past 12 months we may have collected the following categories (defined by Cal. Civ. Code § 1798.140):
Identifiers
Email, display name, account ID, IP address (collected at request time, hashed in audit logs only).
Personal records (Cal. Civ. Code § 1798.80)
Family member names, child birth dates, home address (only if you enter it).
Internet activity
App-feature usage (only with your analytics consent).
Geolocation data
Approximate device location — only when you turn Location Sharing on.
Audio/visual data
Photos and PDFs you upload to your Vault or to Photo→Event.
Sensitive personal information
Precise geolocation (when sharing is on); content of communications (co-parent messages); medical documents you choose to store.
Inferences
Tone-of-message score; coverage-gap suggestions. Drawn from your own content; never sold.
We do not collect biometric information, employment information, professional information, education records (other than the child's school name you enter), or commercial information.
3. Why we collect each category
•
To provide the family-coordination features you signed up for.
•
To process subscription payments through Apple/Google.
•
To detect and prevent abuse, fraud, and security incidents.
•
To comply with legal obligations.
•
With your separate consent, for AI processing (PDFs, tone, retro) or anonymous analytics.
We use sensitive personal information only for these listed purposes. We do not infer characteristics about you from your sensitive PI.
4. We do not sell or 'share' your data
We have not sold or "shared" (in the CPRA sense — for cross-context behavioral advertising) any personal information in the past 12 months. We do not have a Do-Not-Sell button because there is nothing to opt out of. We will not begin doing so without 30 days' notice and an opt-out mechanism.
5. Categories of recipients
We share personal information only with service providers under written contracts that prohibit secondary use:
•
Supabase Inc. — database, authentication, file storage.
•
OpenAI, L.L.C. — AI processing of your content (with your consent).
•
Apple, Google, RevenueCat — subscription billing.
•
Expo, Inc. — build pipeline (no runtime user data).
The full vendor table lives at /subprocessors.
6. Your CCPA / CPRA rights
•
Right to know — request a list of the categories, specific pieces, sources, and purposes of the personal information we have about you. Self-serve via Settings → Privacy → Export.
•
Right to delete — request deletion. Settings → Privacy → Delete my account starts a 14-day clock; you can cancel before the deadline.
•
Right to correct — fix inaccurate personal information. Edit in the app, or email us.
•
Right to opt out of sale/share — already off by default; we don't sell or share.
•
Right to limit use of sensitive PI — toggle off Location Sharing, AI processing, and analytics from Settings → Privacy.
•
Right against retaliation — exercising any of these rights does not affect your subscription, pricing, or feature access.
7. How to exercise your rights
You have three options:
•
In-app (fastest) — Settings → Privacy → Export or Delete. Verifies via your active session.
•
Email — privacy@famcove.com with the request and the email address on file. We may ask one verification question.
•
Authorized agent — submit a signed authorization letter and proof-of-relationship to the same email. We'll respond within 45 days (extendable to 90 with written notice).
We do not charge to fulfill verifiable consumer requests.
8. Retention
See section 9 of the Privacy Policy. The summary: we keep account data while the account is active and for 30 days after deletion. Audit logs and backups have explicit, shorter caps.
9. Contact for California requests
Email privacy@famcove.com. We respond within 45 days. The California Privacy Protection Agency takes complaints at cppa.ca.gov.
Questions?
Email privacy@famcove.com — we respond within 30 days as required by GDPR. Replace with your real contact before public launch.