Privacy Policy
Last updated:
Fam108 (“the app”, “we”) is a family expense tracker. This policy explains what data the app handles and how. If you turn on Family Sync, your family's data leaves your device for our server (or one you choose) — section 2 explains what that means. If you create a personal account, section 3 covers what we store for that.
1. Data the app stores on your device
When you use Fam108 you create data that is saved on your device:
- Family name and member profiles (name, color, role) you create.
- Accounts (cards/cash) and their balances.
- Transactions (amount, category, account, payer, date, optional note, private flag).
- Budgets and spaces you set up.
- App preferences (theme, language, currency).
We do not sell this data. There are no advertising SDKs, and no analytics beyond what section 7 describes.
2. Family Sync — what leaves your device
Family Sync lets your household see the same data on every phone. Fam108 ships with a default sync server that we operate (api.fam108.com) — Family Sync is off until you turn it on, but turning it on does not require you to run your own server; it uses ours by default. You can point the app at a different server you or your family run instead, if you prefer (in Settings).
When Family Sync is on, the server you're connected to (ours, by default) stores:
- Your family's data (section 1 above), so every device in the family can pull it.
- Encrypted in transit (HTTPS). At rest on the server, this data is not end-to-end encrypted — the server can read it, the same way most cloud apps' backends can. This is a deliberate trade-off explained in our public engineering decisions (ADR-006): it keeps the app simple and fast to build, at the cost of the server operator being a party who technically could read your data (we don't, but the architecture doesn't cryptographically prevent it the way, say, Signal's does).
If you point the app at a server you run yourself, we do not operate, control, or receive a copy of that server's data — the paragraph above only describes our default server.
3. Accounts (email/password, Apple, Google)
If you create a personal account (as opposed to only using a family invite code as a guest), we collect and store on our server:
- Your email address, if you sign up with email+password.
- A cryptographic hash of your password (Argon2id) — never the password itself. We cannot see or recover your password.
- If you sign in with Apple or Google, an opaque identifier from that provider (not your Apple ID or Google account itself) and, if the provider shares it, your email.
- Login sessions: which devices are signed in and when, so you can review and revoke them.
- Which families you belong to and your role in each.
An account lets you sign in to your family from any device without re-entering an invite code, and lets you reset a forgotten password. If you never create an account — just using a family invite code as a guest device — none of the above applies to you.
4. Biometric authentication
If you enable Face ID / Touch ID / fingerprint unlock, authentication is performed entirely by your device's operating system. Biometric data never leaves your device and is never accessible to the app or to us.
5. Secure storage
Session tokens, sync tokens, and similar secrets are kept in the platform secure store (iOS Keychain / Android Keystore) on your device.
6. Data export
You can export your data to a CSV file via the system share sheet. This is initiated by you, and the destination (email, files, etc.) is chosen by you.
7. Children
There are two different ways a “child” shows up in Fam108, and they have different privacy consequences:
- A child Member profile inside your family, set up by a parent for budgeting purposes (which categories they see, what's visible to them). By itself this is just a label inside your family's data — a name and a color — the same as any other Member profile, and it carries no separate account.
- A child login, if a parent generates a one-time code and a child enters it on their own device. This creates a restricted account on our server so the child can sign in independently — it does not require or collect the child's email address, and the account holds nothing beyond what any other account holds (section 3), scoped to a single family with reduced permissions. A parent can revoke this at any time by deleting the child's account (Family → member → Remove) or the whole family's data (section 8).
We do not knowingly collect more personal information from a child than the above, and we do not use anything associated with a child account for advertising or profiling — there is no advertising or profiling of anyone in Fam108, adult or child.
8. Deleting your data
Two different actions, because they delete different things:
- “Erase all data” (Settings) permanently deletes your family's data — accounts, transactions, settings — from the device it's run on, and, if Family Sync is on, from the sync server too (owner-only, since this affects everyone in the family).
- Deleting your account (if you created one, section 3) permanently deletes your login — email, password hash, sessions, and your membership records — without touching your family's shared data, which the rest of the family keeps. You can do this in-app or at fam108.com/delete-account from any browser, without reinstalling the app.
Uninstalling the app removes its local data but does not delete server-side data covered by either action above — use one of them first if you want that too.
9. Subscriptions and payments
We do not see or store your payment details. Subscriptions are purchased through the App Store or Google Play, or on our website. Apple and Google process mobile-app payments; Stripe processes web payments on our behalf as our payment processor. What reaches our sync server is the minimum needed to unlock the features you paid for: the family identifier the subscription belongs to, which plan is active, whether it is a trial, and when it renews or expires.
We do not receive your name, card, billing address or store account from this. We do not use this information for advertising, and we do not share it with anyone.
10. Changes
We may update this policy. Material changes will be reflected by updating the date above.
11. Contact
Questions: support@fam108.com.