Privacy Policy
This policy is versioned alongside the app's source code; the most recent commit on
master is authoritative.
Read this part first: there are two different situations
Family Connect is self-hosted software. Your family's messages live on one server, and who runs that server decides who can read them. There are two cases, and they are genuinely different:
| If you… | Then… |
|---|---|
| installed from the App Store or Google Play and did not change the server address |
Your app is connected to https://fc.nettrash.me, which
I operate. I hold your messages, photos, videos, voice notes,
files, shared locations, profile picture and account details, and I am
technically able to read all of them. For you, I am the data controller.
|
| run your own server (you can change the address in the app before signing in) | I receive nothing at all. Your data goes only to your machine. Whoever operates that server holds it and can read it. The third parties listed further down are still contacted by the apps themselves. |
Family Connect is not end-to-end encrypted
This matters enough to say plainly and early. Messages, attachments, board notes and shared locations are stored in plaintext in the server's PostgreSQL database and on its disk. The server reads message text in order to build notification text, chat-list previews and reply quotations.
Traffic between the app and the server is encrypted in transit by TLS, and the audio and video of a call are encrypted peer-to-peer (DTLS-SRTP) so that a relay cannot decode them. But the operator of the server you use can read your messages. If that operator is me, I can. Please do not treat Family Connect as a secret-keeping tool; treat it as your household's own message board that happens to live on a computer somebody in your family trusts.
What the app sends to the server
| Data | Notes |
|---|---|
| Account details | Username, display name and password. No e-mail address and no phone number are collected. The password is stored only as an Argon2id hash, never in readable form. |
| Birthday (optional) | A day and a month only — never a year. Your age cannot be derived from it. A family owner can set or clear any member's birthday. |
| Profile picture (optional) | Re-encoded on your device to a 512 px JPEG before upload, so the original photo's EXIF metadata (including any GPS tag) is not sent. Stored in the server's database, visible to your family and to nobody else. |
| Message text | Everything you type, including in one-to-one chats. |
| Photos | Re-encoded on your device to at most 2048 px before upload, which removes EXIF metadata including any GPS coordinates. |
| Videos and files | Uploaded byte for byte, unmodified. Any metadata the file already contains travels with it — a phone video typically carries the location it was recorded at, the device model and the date; a document typically carries its author and revision history. Family Connect does not strip these. |
| Voice notes | Recorded in the app and uploaded as audio files. |
| Shared locations | Full-precision WGS-84 latitude and longitude plus an accuracy radius. These are not rounded, blurred or reduced to a neighbourhood. Sharing a location is always an explicit action. |
| Board notes, polls and reactions | Text, colour, position and author. Poll votes are attributed and visible to everyone in the chat — a poll is not a secret ballot. |
| Read receipts | Your last-read position in each chat, with a timestamp, shared with the family. There is no setting to turn this off. |
| Notification tokens | The Apple (APNs) or Google (FCM) token for each device you sign in on. |
Family statistics are visible to every member of your family, not only the owner: how many messages each person sent, how many photos, videos, voice notes and locations, the total size, and how many assistant questions they asked.
What the apps do not do
- No analytics, no advertising SDK, no attribution SDK, no crash-reporting service, no third-party tracker of any kind.
- No address-book upload. On iOS and macOS you can link a family member to a contact on your device so the Phone app can call them through Family Connect; that link is kept only on your device and is never sent to any server. Android has no such feature.
- No advertising identifier, no fingerprinting, no cross-app tracking.
- The server records no IP addresses, user agents or device fingerprints in its database. (A web server in front of it, such as nginx, keeps its own access log by default; that is the operator's to configure.)
Other companies your device or server contacts
Even on a server you run yourself, some things necessarily leave your network. All of these are on by default unless stated otherwise.
| Who | What they receive, and when |
|---|---|
| Apple (APNs) and Google (FCM) | Notifications. By default the payload includes the full message text, the sender's display name and the family's name. An operator can turn the message text off; even then, the sender's name and the family name still travel in the notification title. Notifications are only sent to devices that are not already connected at that moment. |
| Google (public STUN server) |
By default, every voice or video call asks
stun.l.google.com to discover your public address, which
reveals your IP address to Google. An operator can point this
at their own server instead. Note also that a successful call necessarily
reveals each participant's IP address to the other participant; that is
inherent to peer-to-peer calling and no setting can remove it while calls still
work.
|
| Apple Maps (iOS, iPadOS, macOS) Google Maps (Android) |
When a shared location is displayed, your device requests map tiles for that coordinate. You can turn map previews off in Settings, and the location then shows as a pin and a label with no tile request. |
| Any website linked in a message | To draw a link preview, your device fetches the page directly from that site, which sees a request from your IP address. You can turn link previews off in Settings. Note that when previews are on, the request is made for every message carrying a link, including messages hidden because you blocked their sender — this is deliberate, so that blocking somebody cannot be detected by the owner of a linked site. |
| Microsoft (Azure OpenAI) — only if the server operator has enabled the assistant |
The assistant is off unless an operator configures it. Where it is enabled,
mentioning @ai in the family chat sends recent family conversation
— up to 200 messages or 30 days, including other members'
words, their display names and timestamps — to Azure OpenAI to answer the
question. A family owner can switch that history off, leaving only the message
that mentioned the assistant. Private chats with the assistant send only that
conversation.
Nothing is sent until you have agreed to it. Before your first message can reach the assistant, the app shows you a screen naming the service that will receive it — on the default server, Microsoft Azure OpenAI — and everything that travels with it, and nothing is sent unless you agree there. The server itself refuses to call the model for anybody who has not, so a client cannot bypass it. You can stop it at any time in Settings → Assistant; that takes effect immediately, although what has already been sent cannot be recalled. The history a mention carries is filtered by each sender's own agreement, so declining also keeps your words out of somebody else's question. The assistant's daily greeting, where a family turns it on, is a fixed instruction plus the star signs of stored birthdays: no names, no messages, nothing anybody wrote. |
Family Connect uses Google's open-source WebRTC library for calls, and the Android build additionally uses Google Play services for maps and Firebase for notifications. These are software libraries rather than data services, but it would be wrong to claim the app contains no third-party code.
How long things are kept
The server deletes messages older than a limit its operator sets — 100 days by default. Deleting a message also deletes the photos, videos, voice notes and files it carried. An operator can lengthen this, shorten it, or switch it off entirely, so on a server you do not run yourself you should ask its operator.
The sweep is not a general erasure. It does not touch:
- board notes,
- profile pictures,
- accounts, sign-in sessions or registered devices,
- blocks,
- and, most importantly, moderation reports and their quoted text — see the next section.
One further caveat: if two people send the identical file, the server stores one copy and both messages point at it. Deleting or expiring one of those messages does not remove the file while the other still refers to it.
Reporting a message, and what it makes permanent
Any member can report a message or a person to the family's owner. When a message is reported, a complete copy of its text is frozen and stored for the owner to read. That copy:
- survives the author editing the message afterwards,
- survives the retention sweep deleting the original,
- survives the report being marked as handled,
- and survives the author deleting their account.
This includes messages from one-to-one chats, and it is the only route by which a private message in Family Connect reaches a third person. It requires the deliberate act of the person who received it, and the apps say so on the reporting screen before you confirm. A report about the family owner is never shown to that owner; if the problem is the owner, the server operator's published contact is shown on the same screen as an escalation route.
Deleting your account
You can delete your account from Settings, on every platform. Be clear about what this does:
- It removes your identity. Username, password, profile picture, birthday, sessions, registered devices and notification tokens are erased, and every device you were signed in on is signed out.
- It does not remove what you wrote. Your messages in the family chat, your board notes, your emoji reactions and your poll votes remain, re-labelled as coming from a “Deleted account”. This is deliberate: the rest of your family did not agree to lose their conversation.
- It does delete your one-to-one chats in full — including the other person's messages in them. That person is not asked.
If you want your messages gone as well, delete them or ask the operator of your server; on the default server, write to me and I will do it.
Permissions the apps ask for
| Permission | Why |
|---|---|
| Camera | Video calls, and taking a photo to send. |
| Microphone | Voice and video calls, and recording a voice note. |
| Photo library | Choosing a photo or video to send, and saving one you received. |
| Location (when in use) | Only when you choose to share your location in a chat. Family Connect does not track you in the background. |
| Local network (Apple platforms) | Connecting to a family server on your own Wi-Fi, and direct call connections. |
| Notifications | Telling you about new messages and incoming calls. |
| Bluetooth (Android) | Required by the system telephony library so a call can use a Bluetooth headset. |
Two things happen at the operating-system level that are worth knowing. Calls are written into your phone's own call history, so that you can return a call from the system dialer; on iPhone that history may sync through iCloud. And on iPhone, placing a call also suggests it to Siri, which puts the other person's name into the system's suggestion store. Both stay on your device, and neither is sent to any server.
Children
Family Connect is built for households, and children are an expected part of that. It collects no age and no date of birth, so it cannot and does not profile anyone by age. There is no advertising, no tracking and no public directory — a Family Connect account can only be reached by people who are in the same family, and joining a family needs an invite code and, by default, the owner's approval. A parent or guardian who sets up the family is the person who decides who may join it, and who can remove a member at any time.
Your rights
If you use the default server, write to nettrash@nettrash.me and I will tell you what is stored about you, correct it, export it or delete it. There is one honest limit: I cannot remove your messages from other people's conversations without removing part of theirs, so I will discuss what you want before doing anything irreversible.
If you use somebody else's server, I hold nothing about you and cannot act on it; your request goes to whoever runs that server.
The protection third parties give
Where data leaves the server it leaves for one of the companies named above, and each of them is bound by terms that provide the same or equal protection of that data as this policy states. In particular, for the optional assistant, Microsoft's Azure OpenAI Service terms provide that prompts and responses are not used to train or improve Microsoft's or any third party's models and are not shared with other customers or with OpenAI. Apple's and Google's notification services carry only what the notification says (who wrote, never what they wrote). No data described here is sold, rented, or handed to a data broker, and nothing is used for advertising or profiling.
Where data is held
The default server runs on a machine in the European Union. Notifications pass through Apple and Google, and the assistant, where enabled, through Microsoft — these companies operate globally and may process the data described above outside your country. A self-hosted server is wherever you put it.
Changes to this policy
If a future version changes any of the above — new data collected, a new third party contacted, a new permission requested — this document is updated in the same release and the Effective date above is bumped. The history of this file is public in github.com/nettrash/family.connect.
Contact
For anything in this policy, email nettrash@nettrash.me.