Privacy Policy

1. Who we are

Family Command Central is operated by lumingon DWC-LLC, a company based in Dubai, United Arab Emirates (“the Provider”). If you have any question about this policy or your data, contact us at support@familyccapp.com.

2. Information we collect

Account & sign-in

You sign in with Google or Apple. We receive a stable account identifier and, depending on what you approve, your name and email address. We do not receive or store your Google or Apple password. Every family member who signs in — parents and children alike — has their own account of this kind.

Family content you create

The information you and your family add to the app: member profiles (display name, role, optional short bio), calendar events, tasks, shopping and other lists, family projects, chat messages (in the family chat, custom chats and project chats — stored on our servers so every member sees the same conversation, and never scanned for advertising), and saved places (a name, an address and map coordinates you type or pick — we do not read your device's location to create them). This content belongs to your family and is visible only within your family; a parent can remove members and content.

Vault documents & document scanning

Parents on a paid plan can save photos and PDFs of household paperwork — warranties, receipts, school letters and similar — to a private Vault. Vault documents are visible only to the parents of your family, never to children or other families, and are stored encrypted in a private Google Cloud Storage bucket in Europe. When you take a photo for the Vault we remove its camera metadata (including any location data) before saving it. Using the camera or photo library is optional and only happens when you choose to add a document.

If a parent chooses Scan on a document and confirms, we send that document to Google’s Gemini API to extract facts such as the title, merchant, amount, purchase date and warranty expiry. The extracted values are shown back to the parent as suggestions to review and edit; nothing is created for the family unless a parent explicitly saves it. We do not use scanned documents to train models. Google processes them under its paid Gemini API terms as a service provider acting for us: it does not use them to train its models and keeps them only as long as its API terms allow for abuse monitoring. We send only the document a parent chose to scan — never chats, calendars, lists or other family content — and the extracted suggestions are stored with that document under your family's control. Scanning is limited per month by your plan, and you can add document details by hand instead of scanning.

Usage & device analytics

If the app crashes, a crash report (the technical stack trace, device model, operating-system version, app version and an internal member identifier — never message or document contents) is sent to Firebase Crashlytics so we can fix the problem. Crash reports are not sent from development builds.

Problem reports

You can report a problem or send us an idea from inside the app, by shaking your phone or from Account → Report a problem. A report is only sent when you send it. It holds what you write, a screenshot of the screen you were on (you can remove it or draw over it first, and screens in the Vault are never captured on their own), anything you choose to attach, technical details that help us find the problem (such as your device model, operating-system and app version, language, time zone, battery, memory, storage and connection type), and the city you sent it from, which is worked out from your connection without keeping your IP address. A report carries your internal member and family identifiers and your role, never your name or email address, though a screenshot shows whatever was on the screen. We don't record your screen, your activity in the app, your notifications or network traffic. Reports are stored for us by Shake.

Device identifiers & notifications

To deliver push notifications we store a push token and an app-installation identifier issued by Firebase for each device you sign in on; they are tied to your member record and removed when you sign out of that device or delete your account. Our sign-in and crash-reporting components use similar installation identifiers to work. We never use the advertising identifier and we do not track you across other companies' apps or websites.

To understand how families use the app and which features are useful, we collect product-analytics events (for example: screens viewed, features opened, and in-app actions such as adding a member or sharing an invite), together with basic device and app information (device type, operating-system version, app version, and a random analytics identifier), and the approximate area you use the app from (the country, region and city, worked out from your connection without keeping your IP address). Analytics events are keyed to internal identifiers, not to your message content, and we do not put the text you type into analytics.

Family Screens (tablets and TVs)

A parent can pair a tablet or a TV, including Apple TV, as the family’s screen. For each screen we keep its name, its kind and platform, who added it, its settings (night hours, whether children can tick their own jobs, and whether it shares usage analytics) and when it last connected. The screen creates its own access key; we store only a one-way hash of it, and of the optional 4-digit unpair code. A screen has no account and no sign-in. It shows the family’s calendar, tasks and lists, and a plain “Busy” block, with no title, where a parent’s shared calendar has them busy, never chats, the Vault, notes, addresses or surprise projects (nor the lists and places made inside one). A job a child ticks on a screen is recorded as done by that child. A tablet or Android TV screen sends a few analytics events: one a day saying it was on, and one when it starts showing a pairing code, when a child’s job is ticked on it, and when it is unpaired. Each says what kind of screen it is and its platform (an unpairing also says whether it was done on the screen or from a phone), never the family, the screen’s name or anything it shows. A parent can switch a screen’s analytics off at any time in Family → Screens → the screen → Share usage analytics, and that screen then sends none. The Apple TV app sends none at all. A parent can remove a screen at any time, which ends its access at once.

Calendars a parent shares (optional)

A parent can choose to show events from the calendars on their own phone (Google, iCloud, Outlook or a school subscription already added to it) in the family’s calendar (Account → Bring in your calendars). The app asks for access to the phone’s calendars only then, and every calendar starts as Only me: nothing leaves the phone until the parent switches that calendar on. For each calendar a parent shares, we receive and store the title, start and end of its events from today as far ahead as the family’s plan shows, whether each is all-day, the name the parent gives the calendar and what kind of account it is (for example Google). We do not receive notes, places, guests or links, or the account’s name or email address, and the phone sends the calendar’s identity only as a one-way hash. Events that this app’s own calendar link put into a calendar are never sent back. Parents see each event’s title and the calendar’s name. Other members, and the family’s Family Screens, see only that the parent is busy at that time, never a title or a calendar name. When a parent plans an event with the family, a family event is made from its title and time and follows it: if the parent moves or deletes it in their own calendar, the family’s copy moves or is removed. We never write to a parent’s calendar. A parent can stop sharing one calendar, or all of them, at any time in the app, and what we hold from them is removed at once (events the family already planned stay as the family’s own). Sharing also stops, and what was shared is removed, when the parent signs out, or when calendar access is taken away in the phone’s settings and the app next opens. Children cannot connect a calendar.

Subscriptions

When subscriptions are available, purchases are processed by Apple, Google, or our web payment processor. We receive subscription status (which plan, trial or active, renewal and cancellation) but not your full payment card details.

3. How we use information

• To provide the app and keep your family’s data in sync across devices.
• To operate secure sign-in and keep each family’s data scoped to that family.
• To understand product usage and improve features, flows, and performance.
• To manage subscriptions, trials, and renewals, and to prevent abuse.
• To communicate with you about the service, respond to support requests, and fix the problems you report.

4. Children & families

Family Command Central is a family app used by adults and children together. A family can only be created by an adult (a parent or guardian), and new members can only join through that adult's invite code — the invite is the parent's authorisation for that child to take part. Members who join with an invite are added as children; only a parent can change a member's role. An adult who adds a child is responsible for that child’s use of the app and for any consent required where they live, and can review, edit or remove what the child has added, or remove the child from the family, at any time.

From a child's account we collect the same limited information as from any member: the name and email address provided by Google or Apple sign-in, the content they add, push and installation identifiers, crash reports, product-analytics events, and any problem report they choose to send. Children never see the Vault or document scanning, which are parent-only features. Children cannot connect a calendar, and they see only that a parent is busy at a time, never what the event is. We do not show advertising to anyone, and we do not use children’s personal information for advertising, profiling or sale. If you believe a child has provided us information without appropriate consent, contact us and we will remove it.

5. Who we share information with

We do not sell your personal information. We share it only with service providers who help us run the app, under contracts that limit them to that purpose:

Your calendar link. If you ask for a calendar link (Account → Add Fam Central to your calendar) and add it to Google Calendar, Apple Calendar, Outlook or another calendar app, that service fetches the events the link holds (everything you can see in the app, or only your own, as you choose: never a surprise you're not part of) and keeps them under its own privacy policy. Anyone who has the link can read those events, so keep it to yourself. Resetting the link, or turning it off, stops it at once.

We may also disclose information if required by law, to protect the rights and safety of users, or as part of a business transfer, in which case we will tell you.

6. Where your data is processed

Our servers, database and Vault storage are hosted in Google Cloud Platform in Europe, and problem reports are stored by Shake in Germany. Some providers (sign-in, push notifications, crash reporting, analytics and the Gemini API used for document scanning) may process data in other countries. Where we transfer data internationally, we rely on appropriate safeguards for that transfer.

7. How long we keep it

We keep your family’s content for as long as your family account is active. Note that the app is forward-looking by design: past calendar events are not shown in the app. You can delete individual items at any time, and you can ask us to delete your account and its data (see below). Vault documents you delete move to a Trash for seven days so they can be restored, then they and their stored files are permanently removed; deleting your family removes its Vault documents and files as well. Scan results are kept with the document they belong to and are deleted with it. We keep a problem report until the problem it describes is fixed, then delete it; you can ask us to delete yours at any time. Events from a calendar a parent shares are kept only while it is shared: they are removed when sharing stops, about a day after each event ends, and when a calendar goes 14 days without being refreshed. A Family Screen’s record is kept until your family is deleted; removing a screen ends its access at once.

8. Your choices & rights

• Access and correction: most of your data is visible and editable in the app.
• Deletion: you can remove members, items, and content in the app, and delete your whole account from the app or by email — see Delete your account.
• Analytics in the app: you can turn usage analytics off any time under Account → Share usage analytics. Nothing further is sent from that device while it's off. A Family Screen has no Account page: a parent switches its analytics off in Family → Screens → the screen → Share usage analytics.
• Analytics on this website: we ask before counting anything. If you allow it, we count the pages you visit and the approximate area you visit from (the country, region and city, worked out from your connection without keeping your IP address). Until you choose “Allow”, no analytics are loaded and nothing is stored in your browser. If you change your mind, clear this site's data in your browser and the question is asked again.
• Depending on where you live (for example under GDPR or similar laws), you may have rights to access, correct, delete, or port your data, and to object to certain processing. Contact us to exercise them.

9. Security

We use industry-standard measures including encryption in transit, authenticated APIs, app attestation, and strict per-family access controls. No system is perfectly secure, but we work to protect your family’s data and to respond quickly if something goes wrong.

10. Changes to this policy

We may update this policy as the app evolves. We will post the new version here with an updated date and, for material changes, notify you in the app.