Privacy Policy

Famigram is operated privately by its administrator, who is the data controller for everything described here. Questions, requests for your data, and deletion requests go to famigram@donnydon.com.

Famigram stores only what you put into it:

• Account: your email address and a hashed password (we never store the password itself), plus sign-in timestamps.
• Profile: username, display name, optional bio, optional avatar photo, and optional date of birth (used for the birthday calendar).
• Content you post: photos, videos, captions, comments, polls and poll votes, and likes.
• Messages: direct and group messages, including voice notes and reactions.
• Connections: friend requests, friendships, blocks, and invite codes you create or redeem.
• Family tree: names and birth/death years of relatives, and how they are related. This can include people who are not Famigram users, including relatives who have died.
• Notifications: a record of activity involving you, and — if you turn notifications on — a push token identifying your device or browser.

We do not collect location data, contacts, advertising identifiers, or device fingerprints, and we do not track you across other apps or websites.

Access is enforced in the database itself, not just in the app. Posts are visible to you and the family members you are friends with. Messages are visible only to the people in that conversation. Profiles, the family tree, and the birthday calendar are visible to signed-in members of this Famigram instance, except to anyone you have blocked.

The administrator has technical access to the underlying server and database, as anyone running a server does.

Famigram has no third-party SDKs, ad networks, or analytics. Data leaves the server in only three places:

• Push notifications. To reach your device, notifications pass through Apple (APNs), Google (Firebase Cloud Messaging), or your browser's push service. These carry only the sender's display name, the type of event, and a link into the app — never message text, comments, or captions. Browser push payloads are encrypted so the push service cannot read them.
• Invite emails. Invite emails are sent through an email provider, which necessarily sees the recipient address.
• Link previews. If you post a link, the server fetches that page to build a preview. The request comes from the server, so the linked site does not see your device or IP address.

Content stays until it is deleted. Deleting a post, comment, or message hides it immediately and marks it deleted; the underlying row is removed on a scheduled cleanup. Deleting your account removes your profile, posts, media, messages, and push tokens.

The server keeps encrypted nightly backups for 30 days, so deleted content can persist in backups for up to that long before ageing out.

• Edit or clear your profile, bio, avatar, and date of birth at any time in Settings.
• Turn push notifications on or off per device in Settings.
• Block another member to hide yourself from them and them from you.
• Delete individual posts, comments, and messages.
• Ask for a copy of your data, or for your account and its content to be deleted, by emailing famigram@donnydon.com. Deletion requests are honoured.

Famigram is a family app and children may use it with the involvement of a parent or guardian who is a member. Accounts exist only by invitation from an existing member, so there is no way for a child to sign up unsupervised. A parent or guardian may request deletion of a child's account and content at the address above.

Traffic is encrypted in transit (HTTPS). Passwords are hashed. Photos, videos, and voice notes are held in private storage and served only through short-lived signed links. Access rules are enforced by the database, so a bug in the app cannot expose content to someone who should not see it.

No system is perfectly secure. Famigram is a family project run on family hardware, and it is offered as-is.

If this policy changes, the date at the top changes with it. Material changes will be mentioned in the app.