Privacy Policy

1 Who we are

FamilyRun Ltd is a company registered in England and Wales (company number 17312091), whose registered office is at Lytchett House 13 Freeland Park, Wareham Road, Poole, Dorset, United Kingdom, BH16 6FA. We operate the FamilyRun app and the familyrun.co.uk website.

FamilyRun Ltd is the data controller for all personal data collected through our app and website. This means we are responsible for deciding how and why your data is used, and for keeping it safe.

FamilyRun has assessed its ICO registration obligations. Registration is not required at this stage as the company is not yet trading commercially. This will be reassessed before any public launch or revenue activity begins.

2 What we collect

We collect different information depending on how you interact with us.

If you join our waitlist:

• Your email address
• Your response to our "what are you most looking forward to?" question (optional)
• The date and time you signed up

If you use the FamilyRun app:

• Account details — your name, email address, and password (stored as a secure hash, never in plain text)
• Profile information — your date of birth and phone number, if you choose to add them
• Household data — events, tasks, shopping lists, meal plans, school schedules, and notes you create or are assigned to
• Family member profiles — names and roles of household members you add, including managed members (e.g. children) who do not have their own app accounts
• Usage data — actions taken in the app (e.g. completing a task), attributed to your account or the Family User if using Family Mode
• Device information — your device push notification token, if you enable push notifications
• Feedback — any messages you send us through the in-app feedback form

Birthday data: if you use the Birthdays feature, we store a name and full birth date (day, month, and year) for contacts you add to your household birthday list. These can be household members or anyone else you choose to add.

Subscription data: if you purchase FamilyRun Plus, your subscription status and entitlements are shared with us by the app store or payment processor via RevenueCat, our subscription management provider. We do not receive or store your payment card details.

3 How we use it

Waitlist data is used solely to send you a one-time email when FamilyRun launches. We will not add you to any other mailing list, send you marketing emails, or share your details with third parties for marketing purposes.

App account data is used to:

• Create and manage your account and household
• Provide the FamilyRun service — calendar, tasks, lists, meal planning, and school scheduling
• Send push notifications you have opted into (event reminders, task reminders, member activity)
• Send security alerts (e.g. when all sessions are signed out — these are mandatory and not subject to notification preferences)
• Respond to feedback and support requests
• Comply with our legal obligations

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4 Our legal basis for processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

• Consent — for sending you a launch notification email when you join our waitlist, and for sending optional marketing or digest emails in the app. You can withdraw consent at any time.
• Contract — for processing data necessary to provide the FamilyRun service to you as an app user (account management, household data, notifications you have enabled).
• Legitimate interests — for security monitoring, fraud prevention, and improving the reliability of our service, where this does not override your rights and interests.
• Legal obligation — where we are required to process data to comply with applicable law.

5 Data storage and security

All personal data is stored on servers located in the United Kingdom (EU West 2 — London region), operated by Supabase Inc. on our behalf. Your data does not leave the UK.

We protect your data using:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Bcrypt hashing for passwords — we never store passwords in plain text
• Row-level security policies that ensure each household can only access its own data
• JSON Web Tokens (JWT) stored in secure device storage for authentication

How long we keep your data:

• Waitlist signups — until you ask us to delete your entry, or until 12 months after our app launches, whichever comes first
• App account data — for as long as your account is active, and for up to 30 days after account deletion to allow for recovery, after which it is permanently deleted
• Feedback messages — up to 12 months

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.

6 Children and family members

FamilyRun is designed for use by adults managing a household. Children do not create their own accounts. Child profiles within a household are created and managed by a parent or guardian (the household Admin) and contain only a first name, a role (Child), optionally a birth date (day, month, and year) if added to the household birthday list, and optionally a year group for the school scheduling feature.

Child profiles do not have login credentials, do not receive marketing communications, and are not used for any purpose other than assigning tasks and events within the household.

We comply with the ICO's Age Appropriate Design Code (Children's Code). We do not collect more data about child profiles than is strictly necessary for the features described above.

If you believe a child's data has been added to our service without appropriate parental authority, please contact us immediately at the address below and we will delete it promptly.

7 Cookies and device storage

The FamilyRun app does not use browser cookies. It uses the following device storage mechanisms:

• AsyncStorage — used to cache household data (events, tasks, lists, school schedules) locally on your device so the app works when you are offline. This data mirrors what is stored on our servers and is cleared when you sign out or uninstall the app.
• Expo SecureStore — used to store your authentication token and, where Family Mode is enabled, the Family User credentials. This is encrypted storage provided by the operating system.

The waitlist website (familyrun.co.uk) does not use cookies or any persistent tracking technologies. No analytics, advertising, or third-party tracking scripts are loaded.

We do not use any non-essential cookies or storage. We therefore do not display a cookie consent banner, as none is required under PECR for the technologies we use.

8 Your rights

Under UK GDPR you have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you. In the app, you can do this via Account → Export My Data.
• Right to rectification — you can correct inaccurate data. In the app, you can update your profile via Account → Edit Profile at any time.
• Right to erasure — you can ask us to delete your data. In the app, you can do this via Account → Delete Account. For waitlist data, email us at the address below.
• Right to restrict processing — you can ask us to pause processing your data in certain circumstances.
• Right to data portability — you can request your data in a structured, machine-readable format. In the app, this is available via Account → Export My Data.
• Right to object — you can object to processing based on legitimate interests.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

We will respond to all requests within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

9 Marketing and communications

Waitlist: by joining the waitlist you consent to receiving one email from us when FamilyRun launches. We will not send you any other emails unless you separately opt in.

App email digest: the optional weekly email digest is off by default. You can opt in and out at any time via Account → Notifications → Email digest.

Unsubscribing: every marketing or digest email we send will include an unsubscribe link. You can also email us directly to be removed from any list.

We will never sell your email address or personal data to third parties for marketing purposes.

10 Third parties

We use a small number of carefully selected third-party services to operate FamilyRun. Each processes data only as necessary to provide their service to us:

• Supabase Inc. — database, authentication, and server infrastructure (data stored in UK)
• Resend Inc. — transactional email delivery (launch notifications, export emails, security alerts)
• Expo / Expo Push Notifications — push notification delivery via Apple APNs and Google FCM
• Sentry — anonymised crash and error reporting to help us fix bugs
• Vercel Inc. — hosting for the familyrun.co.uk website

We do not share your personal data with any third party for their own marketing, advertising, or analytics purposes.

11 Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we will update the "last updated" date at the top of this page and, for app users, notify you via the app. Continued use of FamilyRun after a change constitutes acceptance of the updated policy.

We will never reduce your rights under this policy without explicit notice and, where required, your consent.

12 Contact us

To exercise any of your rights, ask a question about this policy, or report a concern:

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: ico.org.uk.