Privacy Policy

1. Controller and scope

VAV Apps LLC operates FamiJo and is responsible for the personal information described in this Privacy Policy. This Policy applies to FamiJo's website, mobile applications, and related services. Contact us at support@famijo.com with privacy questions or requests.

This Policy should be read with the Terms of Use. For consumer health data covered by the Washington My Health My Data Act or a similar law, read the separate Consumer Health Data Privacy Policy at famijo.com/health-data.

2. Categories of information we collect

Account and security information: email address, display name, password credential records, account settings, your device's time zone (such as America/Los_Angeles, so dates, reminders, the Journimal's time of day and your calendar link follow your local time), session and authentication information, age confirmation, birth month and year required for new independent accounts, optional profile details, and information needed to protect accounts from abuse. New signup does not ask for an exact birth day. We retain the month and year with the account to check age eligibility over time; older records may contain a previously supplied full birth date. Birth information is private account information, not a public profile field or advertising data.

Journal and family information: entries, day pins, tags, custom sections, photos and associated metadata, events, reminders, family posts, profile details, invitations, reactions and sharing choices. An event or to-do can have a time of day (and an event an end time), saved with the time zone it was set in, and how long before that time its phone reminder should come. A travel journal's day can hold a place you type (FamiJo does not use your device's location), and a Health journal's day the meals, glasses of water and activities with their minutes that you record and, if that journal counts calories (a setting of the journal, off until someone who writes in it turns it on), the calories you enter for each meal, which stay with their days if it is turned off again (Health journals were called Exercise journals before October 2026); they are saved with the day and encrypted like its words. You can also save foods with their calories to a list of your own (My foods, in Settings > Journal settings), so that a Health journal that counts calories suggests them as you type; the list is kept encrypted with the server key, is shown to no one else (a co-author sees only their own), and is deleted with your account. Habit check-ins (called trackers in the journal editor) are the items you choose to record, such as reading, brushing teeth or exercising, their labels and completion status. They are not advertising trackers or cross-site browsing history, and they are not filled in from a health or fitness app. A check-in may still reveal sensitive information depending on what you enter.

Daily steps (optional): if you turn on Steps in the FamiJo app on your phone or tablet, FamiJo reads each day's step count from that device's health app (Apple Health or Health Connect, which may include steps counted by a watch), with the permission the device asks you for. FamiJo reads nothing else from the health app and writes nothing to it. It saves a day's step count, and which health app it came from, only with a day that has a journal entry, in your own journal and in Health journals you created, so the count shows on your other devices and to the people who can open that journal. famijo.com shows saved steps but cannot read a health app.

Connected-service and communications information: push-notification tokens and preferences; provider account identifiers, verified email addresses (including Apple relay addresses), and available profile details when you choose Google or Apple sign-in; email delivery status for verification and recovery messages; and purchase or membership state where available.

Calendar link (optional): if you turn on the calendar link in Settings > Calendar, we keep a record of whether it is on, which items it includes, when it was made and how many times it has been reset, when a calendar last read it (noted at most once an hour) and, for about an hour at a time, how many times it was read, to stop misuse. The link is made from that record with a secret key and is not itself stored. Section 6 describes what the link shows and who can read it.

Support and essential operations: support messages and diagnostic captures you choose to submit; limited security, error, account, transaction and email-delivery records; and service-level request counts, response status and timing needed to operate and protect FamiJo. Infrastructure providers also process network information, such as IP addresses, to deliver and protect the Service.

Group and co-author relationships means access-control records, not an inferred personal relationship. Co-authors are people a journal's owner invites to write in and help manage that journal (earlier versions of this Policy called them co-managers). These records show which account created or joined a group, accepted an invitation, manages a journal, or has permission to view, edit or share it. They connect account and journal identifiers, roles, invitation status and sharing choices so FamiJo can enforce access. Names and roles you provide may themselves identify family or other personal connections. We do not infer biological relationships, relationship quality or a social profile for advertising. We also keep a record of the people you block, so that each of you stops seeing the other's posts and invitations.

Optional usage statistics: only when you turn on Help improve FamiJo, we record daily page-visit and feature-use counts, the web/iOS/Android platform, and loading-time totals and sample counts, linked to your account identifier. The event format does not accept journal text, photos, audio, search terms, habit answers, passwords, email bodies or full request payloads. Account-linked counters are personal information, not anonymous data. They are separate from habit check-ins and from the signals used to provide Journimal.

Help improve FamiJo is a first-party feature: these counters go to FamiJo's own API and service database, operated using the hosting and database providers described in Section 6. This optional statistics feature does not send its events to a separate third-party analytics service. Billing-provider technical information and essential infrastructure records are separate and described below.

3. Sources of information

We receive information directly from you when you create an account, write or upload content, create profiles or groups, choose settings, contact support, connect an optional service, or make a purchase. An authorized adult, co-author, or group member may also add information to a shared or managed profile. Where a parent switches on a child sign-in, we also receive information directly from the child, as Section 13 describes.

We receive limited essential technical information automatically to deliver and protect the Service. Optional page-use and loading-time statistics are collected only after your separate opt-in. We receive account information from a sign-in provider only when you choose that provider, and daily step counts from the health app on your phone or tablet only when you turn on Steps (Section 2). We do not buy journal content or consumer health data from data brokers.

4. How we use information

We use information to create and authenticate accounts; save, sync and display content; provide family sharing, notifications, search, reminders, the calendar link, memberships, and optional Journimal features; send verification and password-recovery messages; respond to support; and enforce the Terms.

We use essential operational and security records to keep the Service available, investigate faults, detect fraud or abuse, manage capacity and billing, and meet legal obligations. With your separate permission, we use optional usage statistics to understand which screens and features are used and where loading is slow. Declining these statistics does not reduce your journal features or membership. Neither type of record is used for targeted advertising, marketing profiles, unrelated model training or sale.

We use daily steps only to show them on the journal days they belong to. We do not use them for Journimal, statistics, insights, search, family posts, advertising or marketing; we do not sell them or transfer them to advertising platforms, data brokers or anyone else for their own purposes; we do not use them to decide creditworthiness or lending; and people at FamiJo do not look at them except with your permission (such as in a support request you send), for security, or where the law requires.

We use a Health day's meals, glasses of water, calories and activities only to show them with the day and, except calories, to find the day in search, and to offer you, for a meal you have not written yet, the last one you wrote before that day. We use a travel day's place to show it with the day, to find the day in search, and to draw the trip's route and the map of your trips, the trip recap's distances and the postcard you can send; the matching against place names happens on FamiJo's servers with bundled map data (GeoNames and Natural Earth), no map service is contacted, and your device's location is never read. What they say is not counted for Journimal or statistics (a day saved with only them still counts as a day you wrote), and a day posted to a family group does not include them; a travel day you send to another app includes its place.

5. Journimal and sensitive journal information

Journal text, photos, day pins, tracker items, daily steps, Health journals with their meals, calories and activities, other exercise or health-related journals, routines, event and to-do titles, and managed-profile details can contain sensitive personal information, including information that may be treated as consumer health data under some laws. You choose whether to enter, upload, or share that information.

A medical history, diagnosis, or mental-health condition is not required to create an account or use FamiJo. If you or an authorized manager voluntarily include such details, receiving, storing, syncing, or displaying them is still processing personal information. Your choice to include them does not authorize sale, advertising use, unrestricted disclosure, or uses unrelated to the purposes disclosed in these policies.

Journimal is optional. It uses limited activity signals to select a companion or reflection: when and how often you write (the time of day a journal day was first written, weekends, days in a row), word and line counts, voluntary day pins, the presence of photos or events, tracker progress, whether you answered Today's question and, for your own Journimal, how many side journals of each kind you keep (not a child's own private pages), how many family groups you belong to, how many posts you wrote to them in the last four weeks and whether a journal of yours shares its days to one. It does not use what a day's place, meals or activities say, or their calories. A child's Journimal uses only the child's own journal days. It does not read free-form journal text or photos to infer a diagnosis, treatment, health status, mental health status, clinical risk, emergency risk, or personality.

FamiJo is not a health, wellness, medical, diagnostic, therapy, or safety-monitoring service. You can turn Journimal off in Settings. Turning it off prevents future Journimal updates and hides its surfaces; it does not itself delete journal content.

The separate Consumer Health Data Privacy Policy explains the categories, purposes, recipients, and rights applicable when journal or other information is covered by a consumer-health-data law. Its presence does not mean FamiJo provides health care. It is not replaced by accepting the Terms, and acknowledging it is not consent to a new or unrelated use of sensitive information.

6. How information is disclosed

We disclose content to people or services you choose: family members, co-authors, group participants, invitees, and external services or platforms to which you direct a share. Those recipients process content under their own practices after receiving it.

Calendar link: if you turn it on, anyone who has the link can read, without signing in, a calendar file of your events and to-dos with, for each, an identifier, its title, date, time, end time and time zone, how it repeats, its kind (such as Birthday), when it last changed and, for your own items only, its notes, together with your account's time zone. It holds events from the past year on, repeating ones whenever they started and, unless you leave them out, to-dos until they are done and the family events and to-dos other people share with a group you are in (with their titles, dates and times, not their notes). In the same way, family events and to-dos you share with a group can appear in the calendar link of anyone in it. The calendar app or service you add the link to, such as Google Calendar, Apple's Calendar or Microsoft Outlook, reads the file again from time to time and keeps its copy under its own terms and privacy policy: you choose it, and it is not our service provider. Reset the link if it may have been shared, turn it off to stop it working, and remove the FamiJo calendar from that service to remove its copy.

We use service providers that process information to operate the Service. Depending on the feature you use, these providers include Render for application hosting, Neon for database hosting, Resend for account email delivery, Expo for push-notification delivery, Google for Google sign-in, and Apple for Sign in with Apple. Connected sign-in services also operate under their own terms and privacy policies. Apple and Google may process purchase or distribution information when you use their app-store services. The FamiJo app on a phone downloads its speech model for on-device voice typing once from huggingface.co, which sees your device's network address for that download and receives no audio.

When in-app subscriptions are enabled, RevenueCat processes an opaque FamiJo billing identifier, store transaction and entitlement information, and technical SDK information to validate purchases, restore subscription access, and reconcile renewals, cancellations, and refunds. We do not send journal entries, photos, search text, account email addresses, or display names to RevenueCat through this integration. Apple or Google processes payment details under its own terms. A billing identifier and transaction records are personal information even when they do not directly include your name.

We may disclose information when reasonably necessary to comply with law or valid legal process; to enforce rights; to investigate or prevent fraud, abuse, or security incidents; or to protect the safety, rights, and property of users, VAV Apps, or others. We may also disclose information in connection with a corporate transaction, subject to applicable law.

Copyright and other content reports may include identity, contact details, a signature, content identifiers and statements needed to evaluate a claim. We may share the relevant report or response with the affected uploader, complainant or their authorized representative where needed for the applicable notice-and-review process. A formal DMCA counter-notification is forwarded to the original complainant with its legally required contact information. Do not include unrelated journal content or credentials. Report records are limited to complaint handling, rights enforcement, safety and legal compliance, with retention subject to Section 11, not advertising or public publication of complaints.

Cloud hosting and storage: FamiJo is an online service, not storage confined to your phone. Hosting and database providers process saved content and account records on our behalf. Photos may be stored in the database or in private S3-compatible object storage configured for the Service. Authorized photo views may use short-lived signed links. Moving a photo between these storage systems does not authorize advertising use or change whom you have chosen to share it with. Contact support@famijo.com for information about the photo-storage provider used for your account.

Device notifications: remote pushes pass through Expo and the applicable Apple or Google notification infrastructure (on Android, Google's Firebase Cloud Messaging, with its analytics and automatic start-up switched off). FamiJo uses generic push previews rather than journal text, photos, user-written event titles or group names. Delivery requires a device push token and may include, for routing, an opaque event identifier or the name of the page to open (such as Parent controls), never journal text or a journal identifier. Current mobile clients also schedule local reminders with generic text and opaque account/event identifiers, at 9 am on an item's day or, for an item with a time, at the time you choose before it. A device may display a notification on its lock screen; notification permission and preview settings are controlled by you and the operating system. Previously delivered notifications or reminders scheduled by an older app version may retain their earlier previews until cleared, canceled or rescheduled. In-app notifications shown after authentication and account emails are separate channels and may contain information relevant to their purpose.

Provider roles differ. Hosting, database, email and other contracted service providers process the information needed for their assigned services. App stores, identity providers and external sharing destinations may also act independently for their own authentication, payment, security and legal obligations under their respective privacy notices. Our provider arrangements must include the data-protection terms, confidentiality, security, retention and subprocessor safeguards required by applicable law. Using a cloud provider does not transfer away VAV Apps' own legal responsibilities.

7. What we do not do

We do not sell, rent, or broker personal information or journal content. We do not use journal entries, family posts, photos, or operational metrics for targeted advertising, cross-context behavioral advertising, data-broker sharing, or advertising profiles.

We do not disclose personal information or journal content to third parties for their independent advertising, marketing, or data-broker purposes. This is not a promise of no disclosures at all: the recipient choices you make, service-provider processing, and legally permitted disclosures are described in Section 6. VAV Apps remains responsible for obligations that applicable law places on it.

We do not routinely have people read private journal content. We do not use private journal content to train an unrelated artificial-intelligence model. These statements do not prevent limited processing described in this Policy, such as hosting, backups, a support request you submit, security work, or legal compliance.

8. Access by people and service providers

FamiJo is designed so private content is processed to deliver the features you choose rather than casually reviewed by people. Authorized personnel may access the minimum information reasonably necessary to respond to a support request, troubleshoot a reported issue, maintain or secure the Service, investigate abuse, honor a privacy request, or comply with law.

Support diagnostics are designed to filter obvious passwords, tokens, and other sensitive technical values. Do not include journal text, photos, passwords, recovery codes, or other sensitive content in a support message unless it is necessary for the request. Automated filtering cannot guarantee removal of every detail you choose to submit.

9. Security and encryption

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including HTTPS transport, access controls, authentication (with optional two-step sign-in), protected server storage, limits on repeated attempts, and security monitoring. Repeated sign-in attempts (passwords, emailed sign-in codes and children's family codes) are limited by account, email address and network address, and repeated wrong journal PINs add a wait that grows each time, up to a day. No security measure is perfect, and we cannot guarantee absolute security.

Written journal fields, mood scores and tags use application-level AES-256-GCM encryption in supported storage paths. For a private main journal and its private transfer archives, a configured journal PIN contributes to the encryption key together with server-held key material. Shared managed journals use server-managed encryption so authorized co-authors can use them. The server receives the PIN over an authenticated encrypted connection when needed and can decrypt authorized content to provide the requested feature. A PIN is therefore more than a screen lock, but this architecture is not device-only or zero-knowledge encryption. Daily steps saved with a journal day are encrypted the same way as that day's written fields, including with the journal PIN where it applies.

Encryption protections are not identical for all information. Every photo and its small copy is encrypted with the server key, whether held in the database or in private object storage (photos saved before October 2026 are re-encrypted in the background), and is served only through FamiJo's own signed links; photos do not use the journal PIN. Account details, group access records, events and other metadata are not all encrypted as journal text. HTTPS protects supported client-to-service connections in transit. We do not claim that every stored field has the same encryption or that only you can ever decrypt all account content.

Photo attachments do not use journal PIN encryption, whether held inline in the database or in object storage. Signed photo links are issued only after the relevant account or sharing access check and currently expire within 30 minutes of being issued. Anyone who obtains a still-valid link can use it until it expires; a copied or device-cached image can outlast that expiry. Do not post private links publicly. A change to group membership, sign-out or a PIN change does not itself revoke a previously issued link or delete copies held on another device.

A calendar link (Section 6) works like a password for reading the events and to-dos it includes: it is signed with a key only FamiJo holds, can be read at most 120 times in each clock hour, and stops working when you reset it or turn it off. Anyone who obtains it can use it until then, and a calendar's copy can outlast it.

Two-step sign-in is optional. If you turn it on in Settings, Security & PIN, each new sign-in with your email and password also needs a 6-digit code we email to your account's email address. A code works once, for 10 minutes, five wrong tries end it, and we store codes only in a hashed form. Turning two-step sign-in on needs your password and a code from that email, turning it off needs your password, and we email you when it is turned on or off. Because the codes go to your email, someone who controls your email account could reset your password and receive them, so keep your email account secure. Two-step sign-in does not apply to Google or Apple sign-in, which use those providers' own protections (FamiJo does not promise that a provider requires a second factor for each sign-in), or to a child's family-code sign-in. Email verification and recovery codes, the journal PIN and optional device biometric sign-in are separate protections, not a second sign-in factor.

FamiJo is not a full end-to-end encrypted vault. Authorized server-side processing may make content available in memory to sync, display, share, search or operate a feature you request. Access by personnel is limited as described in Section 8; this is not a promise that human access is technically impossible. No encryption design eliminates the risks of a compromised account, device, key or service.

If you forget a PIN, account-ownership verification does not recover the old encryption key. The destructive PIN-recovery flow warns before removing affected PIN-encrypted journal data so a new PIN can be set. The dated-text import tool accepts supported CSV or plain text, not encrypted backups, and does not recover lost PIN-encrypted entries. Imported entries are processed to validate dates, preview the import and save confirmed text under the main journal's encryption configuration. Personal cloud backups and journal-file exports are not offered. Statutory account data-copy requests remain available through Settings and support.

9A. Optional device biometric sign-in

On supported mobile devices, you may choose Face ID, Touch ID, fingerprint or another supported device authentication method to access a saved FamiJo sign-in credential. Your device operating system performs authentication. Through this feature, FamiJo does not receive, store or upload your face or fingerprint images, biometric templates or biometric measurements. The app receives limited information such as whether device authentication is available, the supported method and whether authentication succeeded, failed or was canceled.

The saved sign-in credential is held in operating-system secure storage with authentication required for access. FamiJo also saves a device-local enabled preference and account identification used to present the sign-in option. Device-passcode fallback may be available under the operating system's rules; this feature is not a promise that only a particular face or finger can unlock your device. Protect device access and enrolled authentication methods. FamiJo does not use device authentication for advertising, profiling or identification of people in uploaded photos.

Biometric sign-in is optional. Choose Not now when offered to continue with ordinary sign-in. To remove FamiJo's saved biometric sign-in on that device, use Sign out; if device-storage cleanup fails, the app reports the failure so you can retry. You may decline setup on the next sign-in, and can manage enrolled biometrics in your device settings. Removing FamiJo's saved credential does not delete biometric enrollment held by the operating system. Biometric sign-in does not replace the journal PIN or recover an old journal encryption key. Account recovery remains separate from device authentication.

10. Security incidents and notices

If we identify a suspected security incident involving FamiJo information, we will assess it and take steps that are reasonable and appropriate under the circumstances to investigate, contain, and address it. No safeguard can eliminate every risk of unauthorized access, loss, or disruption.

Where notice is required by applicable law, we will provide notice to affected individuals, regulators, or others as required. The timing, content, and recipients of any notice depend on the facts, the information involved, applicable law, and lawful law-enforcement requests. Keep your account email current so we can contact you when needed. A security notice is not an admission of fault or liability.

11. Retention and deletion

We retain account and content information while your account is active and for as long as reasonably necessary to provide the Service, maintain security and integrity, meet legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data type and purpose. Optional usage statistics are kept for no more than 13 months even while the feature is on; the notification log keeps no message text; expired requests and codes are deleted. If a free trial ends and the account never subscribes or receives other access, we delete the account and its content 12 months after the trial ended, after emailing notices from 9 months on, as the Terms of Use describe; accounts that share a household, a family group or a co-authored journal with someone who has active access, or that need review first, are kept.

When you delete content or submit a verified account-deletion request, we take steps to remove it from active systems. Completion may involve database records, photo objects, caches, providers and backup copies rather than a single operation. Applicable deletion deadlines and legally permitted exceptions control; technical difficulty or a provider's usual retention cycle does not itself authorize indefinite retention or extend a statutory deadline. We must communicate covered deletion requests to recipients where law requires and honor applicable restrictions on retained copies. A support acknowledgment is not a representation that all deletion steps have finished.

Delete my account (Settings > Privacy & data) locks the account at once and, 30 days later, deletes it with its journals, photos, events and to-dos, family posts, calendar link, support messages, usage statistics, saved foods and any child sign-ins with their consent records; signing in and choosing Keep my account during those 30 days cancels it. Journals other people write in, and a family with other adults in it, are left to a person you choose instead; what you wrote in another person's journal stays there; reports other people made about content are kept, and reports you made are deleted. Delete data, on the same page, keeps the account and moves the days of your journals, their photos, your events and to-dos and your family posts into a trash for 30 days, during which Bring it all back restores them, and deletes them after. Where our billing provider, RevenueCat, holds a record for the account, we ask it to delete that record as well; a subscription bought through Google Play or the App Store must be cancelled there.

Information collected through a child's sign-in follows the children's retention rules in Section 13.

The calendar link's record is deleted when you turn the link off or delete your account, and a reset replaces the link so the old one stops working. Copies a calendar app or service already has stay there until you remove the FamiJo calendar from it.

Daily steps stay with their journal day: they are deleted with the day, its journal or the account, and when you remove saved steps. Turning Steps off on a device stops it reading new steps; steps already saved stay with their days until you remove them.

Copies you save or share outside FamiJo are not automatically recalled when you cancel Pro, delete FamiJo content, or close your FamiJo account. Recipients may retain copies outside our technical control. Manage those copies with the recipient or service. This limitation does not remove any legal obligation on VAV Apps or a recipient to notify, assist with or honor a valid deletion request.

12. Your choices and privacy requests

In Settings > Privacy & data, Help improve FamiJo is off by default and is separate from agreement to the Terms. Turning it on starts a fresh optional usage history and records your account preference, the consent wording version and the time of your choice. You can turn it off at any time without losing journal access: this stops optional usage recording across devices and clears saved optional usage statistics from our active database. Turn off & clear usage history also removes earlier optional counters even when the setting already shows off. Previously produced aggregate reports and backup copies may remain subject to applicable retention and deletion duties; aggregation alone does not mean information is anonymous. Essential service, security, billing and legal records are not optional usage statistics. We retain a limited record of usage-consent choices, including the account identifier, choice, available wording version and time, separately from usage history to document permissions and withdrawals; this record does not contain journal content or your IP address.

We retain account-linked records of legal acknowledgments and acceptance, including document versions, publication fingerprints and acceptance times, to demonstrate which notices or agreements were presented. The review process does not require a copy of journal text, photos, an identity document, or your IP address in the acceptance record. An acknowledgment of a privacy policy is not consent to advertising or to new sensitive-data processing, and refusing updated Terms does not remove your statutory privacy rights.

We may verify your identity before responding. If we deny a request, you may appeal by replying to the decision or emailing support@famijo.com with the subject line "Privacy appeal." Additional rights may apply based on where you live; the Consumer Health Data Privacy Policy describes specific rights for covered consumer health data.

Journimal has a separate control. Turning it off stops new Journimal updates and hides its display; it does not erase entries, photos or the check-ins you deliberately saved in a journal. You can remove those items with the available editing or deletion tools, or submit a privacy request. Optional usage consent does not authorize new sensitive-data uses or replace any additional consent legally required for Journimal.

Steps has its own controls in Settings > Journal settings: turn it off on a device, or remove the steps saved with your days in your journal and the Health journals you created. You can also stop FamiJo reading steps in the device's settings: on an iPhone or iPad, Settings > Privacy & Security > Health > FamiJo; on Android, Health Connect's app permissions.

In Settings > Calendar you can turn the calendar link on or off, choose whether it includes family events and to-dos and whether it includes to-dos, and reset it so the old link stops working.

Available request actions include Request copy, Request correction, Request deletion, Other privacy choices (including objection, restriction and withdrawal of consent), and Start appeal. Deleting your account or your journal data is done in the app itself (Section 11); the other actions prepare a message for you to review and submit and do not immediately export or change data. Describe the request without including passwords, a PIN or unnecessary private content. You may also email support@famijo.com. Rights requests do not require a paid membership or acceptance of revised Terms.

The website and apps use local device storage for sign-in, security, user-selected preferences and words you haven't saved yet. What you type in a journal day, a family post, an event or to-do, a new journal (its name, a child's birth month and year, and the email addresses of co-authors you invite), a support message or an import is kept on that device (in the browser's storage on famijo.com, or in a file of the app's own on a phone or tablet, which the device's own backups may include) so it isn't lost if you leave the page or the app closes. It stays there until it is saved, sent or discarded or you sign out on that device; after two weeks it is no longer offered back and is removed the next time FamiJo opens there. A sign-in that ends another way (it expires, or is ended from another device) leaves it until then. It reaches FamiJo only when it is saved or sent (a journal day also saves itself when you leave it or the app goes to the background; the copy on the device covers a save that hasn't finished). FamiJo does not encrypt it on the device and your journal PIN does not protect it there, so anyone who can use that device or browser profile may be able to read it. This storage is distinct from habit check-ins and optional usage statistics. We do not use advertising cookies or cross-site advertising identifiers in the FamiJo client. We do not track you across other websites and do not respond to Do Not Track or Global Privacy Control signals, because there is nothing for them to switch off. A provider you choose to visit or use may operate its own storage technologies under its notice.

13. Children under 13 years old and adult-managed profiles

FamiJo does not permit a child under 13 years old to create or control an independent account. A parent, legal guardian, or other adult with legal authority may create a child profile for a child under 13 years old only within that adult's account. Information in that profile can include the child's display name, birth month and year (or, for a profile created earlier, an age in whole years), journal entries, photos, trackers, events, and sharing choices that the Authorized Adult or an authorized co-author adds or permits, and, with a child sign-in, what the child adds.

Before a child profile for a child under 13 years old is created or converted, FamiJo requires the adult creating or managing it to attest that they are the child's parent, legal guardian, or otherwise legally authorized to act for the child. We record the adult's account identifier, time of acknowledgment, and the applicable child-profile acknowledgment version. This recorded attestation is not independent verification of parental or legal-guardian status and does not substitute for verifiable parental consent when applicable law requires that consent. In that event, VAV Apps may require additional steps and limit a profile until they are completed.

The adult account holder controls the profile's access and may authorize co-authors, family groups, external shares or other available features. The adult is responsible for reviewing these choices and limiting access to people with an appropriate reason to see the child's information. We do not sell, rent, or use information in child profiles for children under 13 years old for targeted advertising, marketing profiles, data-broker sharing, or unrelated model training.

A parent or legal guardian may ask to review, correct, delete, or stop future collection or use of information associated with a child profile for a child under 13 years old by using Parent controls or Settings, or by contacting support@famijo.com from the adult account email. We may verify identity and authority before acting.

Child sign-in. Where a parent or legal guardian switches on a child sign-in, FamiJo collects directly from the child: the journal text, day pins, Daily wins and tracker items and photos the child adds (with the journal day each photo was added to; the photo's own date and location are removed); what the child picks in the star shop and the look of the child's journal; and the requests the child sends the parent (for a new journal, for voice typing, for steps, or to share a day); and, only if the parent turns steps on (below), the child's daily step count. The child's first name and birth month and year come from the profile the adult created. To protect the sign-in, FamiJo briefly counts wrong passcodes, under keyed hashes that hold no name, code or address. FamiJo does not collect from a child an email address, phone number, day of birth, address, school, precise location, contacts, advertising identifiers, biometrics or voice recordings, does not keep the child's sign-in times or device details, and does not use analytics in a child's session. Words the child has typed but not yet saved are kept on the child's device, as Section 12 describes, until they are saved. A child's sign-in cannot add events or to-dos or turn on a calendar link.

Voice typing. In the FamiJo app on a phone or tablet, a child's speech is turned into text on the device and no recording leaves it. In a web browser, voice typing for a child is off unless the parent turns it on from Parent controls after reading what it means (where FamiJo offers it); the browser then turns speech into text using its maker's speech service (Google for Chrome, Microsoft for Edge, Apple for Safari), which receives the recording under its own privacy policy. The parent can turn it off at any time. FamiJo receives only the resulting text, which is kept like anything typed.

Steps. Where FamiJo offers it, a child's journal shows the child's daily steps only if the parent turns steps on in Parent controls after reading what it means; the child can ask, and the parent is told in FamiJo and by email. FamiJo then reads only each day's step count from Apple Health on the child's iPhone or iPad (never from Health Connect on Android, which Google does not allow for children), with the permission that device asks for, and saves it only with the days the child writes, in the child's journal, encrypted like the child's writing. It shows there to the child and to the people who can open that journal, and to the parent in Review and in a download. It is never posted to a family group or sent outside FamiJo, and never used for the Journimal or anything but showing it on the day. The parent can turn steps off at any time, which deletes the steps saved in the child's journal.

We use information collected through a child's sign-in only to provide the child's journal (steps only to show them on the day), Journimal and star shop and to keep the sign-in secure. We do not use it for advertising, marketing, profiling, sale or unrelated model training, and we do not disclose it to third parties other than the service providers that host and run FamiJo for us (Section 6); it stays within the parent's account. If a parent chooses to share a day from the child's journal with people in the parent's family groups, that is the parent's action from the parent's account. The same holds when a parent who allowed it sends a day the child asked about to other people through another app (such as WhatsApp), from the parent's own device: FamiJo sends nothing, and the app used and the people who receive it keep their copy under their own terms. The parent turns the child's asking, and whether photos may be included, on or off in Parent controls, after reading what they mean.

Before a child sign-in starts, we email the parent a direct notice describing this collection and obtain the parent's consent by having the parent confirm from that email while signed in, followed about a day later by a separate confirmation email with a link to stop the sign-in ("email plus"). If we change that notice materially, the child's sign-in pauses until the parent reads the new notice and confirms it again; nothing is deleted meanwhile. Parents may at any time review the information collected from the child (including the child's own pages), download a copy of its text, delete it, or stop further collection, from Parent controls in FamiJo or by emailing support@famijo.com from the account address; we verify that the request comes from the account holder before acting. Deleting the sign-in data removes the child's own pages and the child's sign-in; the family journal the parent created remains under the parent's control.

Retention for a child's sign-in: we keep children's journal content for as long as the journal exists in the parent's account, and consent, permission and review records for three years after a sign-in is deleted (or, for a consent request that was never confirmed, three years after it ended), or until the parent's account is deleted if that is sooner. A child's session lasts at most 30 days. A child sign-in ends when the child turns 13: FamiJo switches it off, tells the parent and keeps the journal, which the parent can still review, download or delete.

Age screen and a child's own account: when someone creates an account we ask for their birth month and year to check that they are at least 13 (see Section 2). If a child tells us in the app that they are under 13, we freeze their account at once, so nothing more is collected; if we learn it another way, we suspend it. If the child gives us a parent's email address, we use it only to ask that parent, and delete it when the request ends. Unless the parent consents within 14 days and moves the child's journal into a child profile in the parent's account (after which the child's own account, with its email and login, is deleted), we delete the account and everything in it.

The minimum independent-account age of 13 is a product rule, not a declaration that every 13-year-old can legally consent in every country. Some laws require a higher age or verified permission from a parent or guardian, especially for sensitive information. A managed-profile label, an adult's attestation or a teen's handoff acknowledgment does not override these requirements. An adult may not consent on someone else's behalf without the legal authority required for that processing.

14. International hosting and transfers

VAV Apps is based in the United States. Information may be stored, accessed and processed in the United States and other countries where our contracted cloud hosting, database, storage and other service providers operate, rather than only in the country where you live. Foreign laws and lawful government-access rules may differ from those in your country.

Infrastructure location depends on the regions available from our providers and the configurations selected by VAV Apps. FamiJo currently connects to a configured application database and, where enabled, a configured private photo store. It does not offer a customer setting for country-specific residency, automatically route accounts to a local database based on residence, or geographically isolate each user's data. Choosing a database region alone does not determine all locations of application processing, photo storage, backups, logs, email delivery, support access or independent sign-in and payment services. We do not guarantee domestic-only storage or processing.

Where a transfer is legally restricted, an applicable transfer mechanism and required safeguards must be in place before the transfer. Depending on the countries and providers involved, these may include an adequacy decision, approved standard contractual clauses with necessary supplementary measures, or an applicable UK transfer instrument. This notice is not itself a transfer mechanism, proof of certification, or your consent to waive transfer protections. Contact support@famijo.com to request information about destinations and applicable safeguards.

We remain responsible for our obligations under applicable law when using providers. A provider's regional offering or contractual terms do not by themselves establish that all required localization or transfer safeguards are satisfied. Where applicable requirements cannot be met, the affected processing must not take place. These disclosures do not reduce your mandatory regional privacy rights or authorize processing prohibited by law.

15. Regional legal bases and rights

Where the GDPR, UK GDPR or comparable law applies, processing needed to provide the account, synchronization and other features you request generally relies on performance of our service contract. Necessary fraud prevention, proportionate security and essential reliability processing may rely on legitimate interests, subject to your rights and an appropriate assessment; legal recordkeeping and required disclosures rely on applicable legal obligations. Optional usage statistics rely on your separate consent. Withdrawing consent does not affect processing lawfully carried out before withdrawal.

Sensitive information, including health information, can require an additional legal condition beyond a service contract or legitimate interests. We must establish that condition, and obtain separate explicit or parental consent where required, before the covered processing. Voluntarily typing sensitive information or accepting these Terms is not automatically a valid waiver or consent for every use. If a required legal condition cannot be satisfied, the affected use or feature must not be offered.

Depending on applicable law and its exceptions, you may request access and a copy, correction, deletion, portability in a usable electronic format, restriction of processing, or objection to processing based on legitimate interests; withdraw consent; and complain to the competent data-protection authority. You need not appeal to us before contacting a regulator. We respond within the applicable statutory period and explain any permitted extension, refusal or limitation and available appeal rights. Requests are normally free; any legally permitted fee or refusal for an excessive or unfounded request must be explained.

Where applicable US state privacy laws cover FamiJo, residents may also have rights to know categories, purposes and recipients, correct or delete information, receive a portable copy, use a properly authorized agent and appeal a refusal without unlawful discrimination. We do not sell personal information or share it for cross-context behavioral advertising, including minors' information. There is no advertising sale or sharing to switch off in the current Service. Optional usage controls remain available everywhere, not only where a specific regional law requires them.

We may request proportionate information to verify identity or an agent's authority before disclosing, changing or deleting data. We will not ask for your password or journal PIN as identity evidence for a support request. Account-holder consent does not extinguish the independent rights of a child, teen or other person described in a journal. Applicable local privacy and mandatory consumer protections prevail over inconsistent contractual language.

16. Changes and contact

We may update this Privacy Policy to reflect changes to the Service, applicable law, or our practices. The updated Policy will show its effective date. When required by law, we will provide additional notice or obtain consent before a material change takes effect.

For privacy questions, requests, or appeals, contact VAV Apps LLC at support@famijo.com.