Privacy Policy
1. Controller, contact, and scope
FamilyFind’s Israel-based independent operator is responsible for the FamilyFind cloud records and support described here. Contact the privacy point of contact at FamilyFindApp@gmail.com. This policy covers the Android app, the public FamilyFind website, Firebase/Google services used by FamilyFind, optional telemetry, feedback, and support. The public site is not intended to use advertising or marketing cookies.
2. Intended users and children
FamilyFind is for parents, guardians, and other authorized adult caregivers, not child-created accounts. Adults are responsible for lawful authority and for considering the privacy, dignity, and views of people shown in media. We do not knowingly invite children to create accounts or knowingly collect cloud personal information directly from them; contact us if you believe that happened.
3. Photos, face-related information, and automated decisions
Selected photos, eligible video frames, face crops, facial representations, detailed match results, exact scores, filenames, and album paths stay on the device. OpenCV components process them locally; temporary face-related representations are held in memory only and are discarded after processing. If you enable Help us improve, a separate local journal records only coarse face-count ranges and fixed processing reasons for up to 48 hours; it is deleted when you turn the switch off and is never uploaded automatically. The journal contains no photos, face locations, templates, exact scores, names, filenames, or media paths. FamilyFind does not upload, receive, retain in the cloud, sell, or share photos or face-related information with the operator, and does not train cloud models or change recognizer weights using them. FamilyFind does not make solely automated decisions with legal or similarly significant effects. Local face processing may be regulated where you live; before using it, you must have any notice, consent, or other lawful authority that applies to people pictured. Optional feedback separately sends the user verdict and a coarse confidence category without the underlying media, as described in section 8. Automatic learning is on by default and separate from Help us improve; an existing explicit opt-out is respected. It uses individually confirmed still photos as bounded local references for the same account and child, without changing model weights. Up to 20 active examples are selected from at most 80 recent confirmations using quality, capture age and diversity, so clear recent appearances can replace older examples. Only media references, decisions and confirmation times are saved; temporary features and content fingerprints stay in a bounded memory cache. The bounded memory cache may also hold up to 80 small face crops while comparing photos; these crops are never saved to files. Unknown capture dates receive no recency bonus. Unreadable files, stale cached content and undone or rejected decisions are excluded. Turning learning off stops reuse and retains your gallery; clearing local data removes the setting and associations.
4. On-device storage
The app stores child nicknames, Android-granted media references, album/date choices, settings, legal acceptance, and limited search history in private app storage. App data is excluded from Android cloud backup and device transfer. Search history and unfinished reviews are retained for up to 365 days. Confirmed child-photo associations and your corrections remain locally until removed, the profile is deleted, or app data is cleared. Original photos are not duplicated; Android media references and human review decisions are stored locally and never uploaded. Exported copies are controlled by your photo library. You can remove local data in the app, through Android settings, or by uninstalling. Non-personal cached public legal-version metadata may remain after account deletion.
5. Cloud, website, and account data
Firebase Authentication processes Google sign-in information, including the Firebase user ID, display name, and email of the account needed to sign in. Firebase services also process technical security and service data, including IP address, service-request/user-agent data, Firebase app and installation identifiers, a messaging token during a Cloud Functions call, and an app-integrity attestation when the service requests one; these help authenticate, prevent abuse, and operate the service. Firestore stores limited account access and shared scan-usage records: normalized email, access state, shared limit/count/period, child-profile count, app version, and creation, last-use, and deletion timestamps. In-app support can include your signed-in email and message. The public site and its delivery/security providers may process ordinary technical request data, such as IP address, browser/device information, time, and security logs, to deliver and protect the site. FamilyFind does not write the technical security data to Firestore and does not send photos, child names, face data, media references, match results, or scores to Firestore.
6. Background scans and permissions
Initial setup requires full photos-and-videos access through Android before sign-in, including when Automatic Find and Video Find are off. Older Android versions use the applicable storage permission. Scans process the album and eligible media you choose locally. Automatic Find and Video Find are optional settings. Photo Picker is available for reference-media selection, but does not bypass initial media setup. Notifications exclude photos, child names, face data and match details. You can revoke access in Android settings; affected features remain blocked until access is restored. The app periodically checks this website for public legal-version metadata without sending account details, acceptance records, photos or media; the website provider processes ordinary technical request data.
7. Optional telemetry and crash reports
Telemetry and Crashlytics are off by default. If enabled, telemetry sends only allowlisted coarse actions, versions, Android SDK, language, a monthly rotating installation identifier, timestamps, aggregate remaining photo/video counts, total eligible-video duration, and calculated scan-timeout, resume, and stop-reason codes. It never sends the photos, videos, frames, filenames, paths, URIs, face data, child data, or match results behind those aggregates. Crash reports may contain stack and device diagnostics. FamilyFind does not deliberately attach account identity or free text to telemetry. Telemetry and feedback are scheduled for 30-day expiry, with physical removal completed by cleanup; Crashlytics follows Google retention process. The same Help us improve switch also keeps a separate on-device face-matching journal with only coarse face-count ranges and fixed processing reasons for up to 48 hours. It is cleared when the switch is turned off and is never uploaded automatically. If you choose to export diagnostics, the report may include these recent local reason codes for you to review and optionally send; it contains no photos, child names, media paths, face locations, templates, or exact matching scores.
8. Feedback and support
Optional match feedback includes your verdict, a coarse confidence category (“likely” or “possible”), reference/search count bands, any comment you enter, a monthly rotating installation identifier, app version, Android API level, language, and submission time. Your account email is attached only when you allow contact. Photos, facial representations, media references, and exact matching scores are not attached. You may also voluntarily provide an account-deletion reason; account email and name are not automatically attached, but your free text may contain information you choose to include. The reason includes a monthly rotating installation identifier and basic app/device information, is scheduled to expire after 30 days, and is not removed by account deletion. Do not include personal or sensitive information. In-app support messages contain your signed-in email and message. If you choose Sign-in help, FamilyFind opens your email app with an editable draft containing only a generic sign-in issue code, FamilyFind version, Android version/API level, and app language; it never adds photos, names, child details, face data, Google tokens, IP address, or a device identifier. Your email app chooses the sender address and you can remove any line before sending. Do not send photos, child names, face data, tokens, private diagnostics, or health information. Directly linked in-app support and opted-in contactable feedback are deleted with the account; unlinked telemetry and feedback are scheduled to expire after 30 days.
9. Purposes and legal grounds
We use cloud account data to provide sign-in, access control, shared scan limits, support, deletion, and service security; optional telemetry, crash reporting, and contactable feedback are used only after the applicable opt-in. Where a privacy law requires a legal basis, the basis is performance of the requested service, consent for optional collection, legitimate interests in security and reliability after balancing those interests with privacy, or compliance with law. We do not use cloud data for targeted advertising or to make solely automated significant decisions.
10. Providers, sharing, and international transfers
Google/Firebase is a service provider for authentication, database, App Check, and optional crash reporting. It and its subprocessors may process cloud and technical data in Israel, the United States, the EEA, and other locations where they operate, subject to their terms, data-processing commitments, and applicable transfer safeguards. We disclose information only to providers needed for the service, when you direct an export through Android, or when required by law or necessary to protect people or the service. FamilyFind does not sell or share personal information for cross-context behavioral advertising.
11. Retention and deletion
You can remove local data, uninstall, or request deletion in the app or at /account-deletion. After recent-authentication confirmation, the trusted backend deletes Firebase Auth and directly linked lifecycle, policy, usage, support, and contactable-feedback records. It does not delete your separate Google Account or exported photo-library copies. Website deletion cannot directly erase Android app storage; clear it in Android Settings or uninstall on devices where local data remains. Optional unlinked feedback, deletion reasons, and telemetry are scheduled to expire after 30 days and are not removed by account deletion. An opaque keyed deletion record, including protected account identifiers, is scheduled to expire after 30 days to verify deletion retries and prevent an earlier deletion from affecting a later sign-in. While deletion is processing, sign-in to that FamilyFind account is temporarily blocked; try again later or use another Google account. Once deletion finishes, you can return using Continue with Google and the same Google account. Deleted FamilyFind data is not restored, and there is no 30-day waiting period. Rate-limit records are scheduled to expire after 24 hours, and incomplete deletion requests after 7 days. Completed-deletion security records use opaque keyed identifiers rather than raw email addresses. Pending requests temporarily contain Firebase UID and email so the backend can finish deletion; they contain no photos or face data. Expiration and physical deletion are not simultaneous; cleanup may complete later. Provider security, backup, and service records follow the provider’s documented retention policies.
12. Your choices, rights, and complaints
You can revoke Android permissions, disable automatic scans, telemetry, or crash reporting, delete local data, and request account deletion. Depending on applicable law, you may ask for access, correction, deletion, restriction, objection, portability, or to withdraw consent; authorized agents may make requests where law allows. Israeli data subjects may request review and correction of personal information as provided by law. EEA/UK data subjects may also complain to their local data-protection authority. California residents may have rights to know, delete, and correct information and to limit certain sensitive-information uses; FamilyFind does not sell or share personal information for cross-context behavioral advertising. Contact FamilyFindApp@gmail.com; identity or authority verification may be needed. This policy is version 2026-10-20-legal-v19 and takes effect 20 October 2026.