Privacy Policy
FamilyHub, on the App Store and Google Play
Effective: 25 September 2026 Last updated: 26 September 2026
1. Who we are
FamilyHub is operated by Liquid Duck, MB (company code 307615390), Republic of Lithuania. We are the data controller for the information described here.
Contact: info@liquidduck.com — this is also the address for any request about your data, and the one we answer within 30 days.
2. The short version
- A household's content — its calendar, chores, lists, wishes and points — is stored so that the people in that household can share it. Nothing is shared outside it.
- We do not sell your data and we do not run advertising. There are no advertising trackers in the app. We measure how grown-ups use the app and collect crash reports (Google Firebase), without advertising identifiers and without any household content; a child's phone sends crash reports only (section 3.7).
- Children in a family do not have accounts, do not give us an email address, and are added by a parent. A parent can change or remove everything about their child's seat.
- You can delete your account from inside the app, and it takes your data with it.
- What the app reads from your phone's own calendar never leaves your phone.
3. What we collect, and why
3.1 Your account
Depending on how you sign in, we hold:
| Sign-in | What we hold |
|---|---|
| Email and password | Your email address and a hash of your password (we never see the password itself) |
| Apple | The identifier Apple gives us, and the email Apple passes on — which may be Apple's private relay address |
| The identifier Google gives us, and the email on that account | |
| Guest | Nothing. A guest session has no email, no password and no name attached to it |
Authentication is handled by Supabase Auth. We use it to know which seat in which household a phone is allowed to open.
3.2 Your household's content
This is the substance of the app, and it is stored so the family can share it:
- The family: its name, and the members in it — display name, role (parent or child), avatar photo if one is set, a colour, and the language that member reads the app in.
- Progress: points, level, streaks and badges earned, and when a chore was last done.
- Chores: what they are, who they are for, when they repeat, whether they need a parent's approval, and the record of each completion and approval.
- Calendar events: title, description, start and end, whether they repeat, who they are for, and whether an event is marked private.
- Lists: shopping items, to-do lists and their items, and who added them.
- Rewards and wishes: rewards a family offers, redemptions, and wishlist items — including any link you paste and any photo you attach.
Every one of these rows is scoped to one family in the database, and the security rules are enforced by the server, not by the app.
3.3 Photos you choose
An avatar or a wish photo is uploaded to our storage so that the rest of the family can see it, under a folder belonging to your family and a random file name.
Be aware: these files are served over unguessable public URLs. The folder cannot be listed and the name cannot be guessed, but anyone who is given the exact link can open the picture without signing in. Do not upload a photo you would not be comfortable being reachable by link. Photos are limited to 5 MB.
3.4 Invitations
When a parent invites somebody, the app issues a one-time code. Only a hash of the code is stored — the code itself exists on the screen that created it and nowhere else — and it expires 24 hours after it is issued. We keep a short record of failed attempts to enter a code, so that codes cannot be guessed by brute force.
3.5 Notifications
If you turn notifications on, we store the push token your phone's operating system issues and whether it is an iOS or an Android device, so a notification can reach that device. We also store which categories of notification you want and, for the daily reminder, the time you chose. Notifications are delivered through Expo's push service, which passes them to Apple or Google.
3.6 Subscription
If you subscribe to Pro, our payment partner RevenueCat records which entitlement you hold, which product was bought, on which store, and whether it is currently active and when it expires — keyed to your account identifier.
We never see or store card details. Payment is taken by Apple or Google under their own terms, and neither passes us a payment method.
3.7 Diagnostics
The app reports startup and performance traces to EAS Observe, an Expo service, so we can tell whether a release is slow or crashing. These are measurements of the app, not of you: they carry no household content and are not used to build any profile.
It also uses two Google Firebase services:
- Crashlytics sends a report when the app crashes or hits an error it recovers from: the error, the device model and system version, the app version, the name of the screen that was open, and your account's internal id so repeated crashes can be grouped. Never your name, email, family or anything you wrote.
- Analytics counts which screens grown-ups open and how often, against the same internal account id, so we can see which parts of the app are used. Screens are named by their type ("an event"), never by what is on them.
Both are set up without advertising: no advertising identifier, no Android device id, no iOS vendor id, no ad storage and no ad personalisation. These are switched off when the app is built and cannot be switched on from inside it. A child's phone sends no analytics at all, only crash reports.
Analytics is your choice. If your phone's region is in the EU, the EEA, the UK or Switzerland, nothing is counted until you say yes to a one-time question in the app. Everywhere else it is on until you switch it off. In every region you can change your answer at any time in Settings → Share usage statistics, and switching it off stops collection on that phone straight away. Crash reports are not part of this choice: they are sent so the app can be fixed, and carry nothing about you beyond the internal id above.
4. What never leaves your phone
- Your own calendars. If you turn on "Show your own busy time", the app reads the calendars you select and draws the blocks of time on the family's calendar. It reads times only — never titles, never who is invited — and none of it is uploaded, synced or shared with the family. It exists on that one phone.
- Family events written into your phone's calendar. The copy is on your device, in the calendar you chose. Private events are written as "Busy" with no title.
- The app lock. Face ID, Touch ID and your device passcode are handled entirely by the operating system. No biometric data reaches us, and none can.
- Your local copy. The app works offline against its own store on the phone and syncs in the background.
5. Permissions the app asks for
| Permission | What it is for |
|---|---|
| Calendar (read and write) | Copying the family's events into a calendar on your phone, and reading the busy times you choose to show |
| Photos | Choosing an avatar or a picture for a wish |
| Notifications | Reminders, and the alerts your family has enabled |
| Face ID / biometrics | Unlocking the app on this phone, if you switch the lock on |
| Vibration | Haptic feedback when something is completed |
| Run at startup (Android) | Restoring your scheduled reminder after the phone reboots |
Every one is optional. Refusing a permission disables that feature and nothing else.
6. How we use what we collect
We use it to run the app: to show a household its own calendar, chores and lists; to keep several phones in step; to award and total points on the server so they cannot be edited from a phone; to send the notifications you asked for; to know whether a household has Pro; and to keep the service working and secure.
We do not use it for advertising, we do not sell or rent it, we do not profile you or your children, and we do not use household content to train machine-learning models.
7. Who else touches it
We keep the list short on purpose. Each of these is a processor acting on our instructions:
| Service | What it does | Where |
|---|---|---|
| Supabase | Database, file storage, authentication, and the server functions the app calls | United States (us-east-2) |
| Expo / EAS | Push notification delivery, and app performance diagnostics | United States |
| Google Firebase | Crash reports (Crashlytics), usage analytics for grown-ups (Analytics), and Android push delivery (Cloud Messaging) | United States |
| RevenueCat | Subscription state | United States |
| Apple / Google | Payment, and sign-in if you choose it | Per their own terms |
One more, worth naming separately. When you paste a link into a wishlist, our server fetches that page to read its title, price and picture. The request goes to the website you linked to and carries nothing that identifies you or your family — no account, no name, no device.
We also disclose data if the law genuinely requires it, and we will tell you unless we are forbidden from doing so.
8. Children
This matters more here than in most apps, so it is set out plainly.
- Children do not have accounts. A parent creates a seat — a name, optionally a photo, a colour and a language — and hands over a one-time code. The child's phone claims that seat. We never ask a child for an email address, a password, a phone number or a date of birth.
- The parent is the one who agrees. By creating a seat, the parent confirms they are the child's parent or guardian and consent on the child's behalf to what is described here.
- What a child's seat holds is what section 3.2 describes: their name, their avatar if one was set, their points and badges, the chores assigned to them, their wishes and what they added to the family's lists.
- A parent is in control. Anything on a child's seat can be edited or removed by a parent from inside the app, and removing the seat removes it.
- No advertising, no profiling, no tracking. There is nothing in this app that monetises a child's attention or builds a profile of them. A child's phone sends no analytics; it sends only crash reports, so that a crash on it can be fixed.
- The app is not directed to children for the purpose of account creation. Account holders must be 13 or older.
- Children under 13 (US COPPA). We collect no personal information from a child directly: everything on a child's seat is entered by their parent, who consents on the child's behalf when creating it. A child's phone sends no analytics, and its crash reports carry no account identifier — only what Crashlytics needs to support the app's internal operations (the device model, system and app version, and the error). A parent can review, change or delete everything on their child's seat in the app, or by writing to info@liquidduck.com.
9. Legal bases (if you are in the UK or EU)
| What | Basis |
|---|---|
| Running your account and your household's content | Performance of a contract |
| Sending notifications you switched on | Consent, withdrawable at any time in Settings |
| Photos, calendar access, biometrics | Consent, given through the phone's permission prompt |
| A child's data | Consent given by the holder of parental responsibility |
| Keeping the service secure, preventing invite-code abuse | Legitimate interests |
| Subscription records and tax obligations | Contract and legal obligation |
10. How long we keep it
- Household content stays while the household exists. Deleting an item removes it from the app and marks it deleted on the server so every phone agrees it is gone.
- Invite codes expire 24 hours after they are issued.
- Push tokens are removed when you sign out or turn notifications off.
- Your account: deleting it from inside the app removes every seat you hold, removes any household where you were the last parent — together with everything in it — and then removes the account itself.
- Backups hold a copy for up to 7 days before they roll off.
11. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to it — and you can withdraw a consent at any time without affecting what was done before.
The quickest route for deletion is in the app: Settings → Delete account. For anything else, write to info@liquidduck.com and we will answer within 30 days.
If you are in the UK or EU and you think we have got this wrong, you may complain to your data protection authority. In the UK that is the ICO (ico.org.uk).
12. Security
Every table in the database has row-level security, and a household's rows are reachable only by the people in that household. Points and approvals are calculated on the server, so they cannot be edited from a phone. Invite codes are stored only as hashes and expire. The app holds no server keys or secrets. Traffic is encrypted in transit.
The honest caveat is the one in section 3.3: uploaded pictures are served from unguessable public URLs, so possession of the link is enough to view one.
No system is perfectly secure. If we discover a breach affecting you, we will tell you and the relevant regulator as the law requires.
13. Where your data is
Our infrastructure is in the United States. If you are in the UK or EU, that means your data is transferred outside your country, and our providers do so under the standard contractual clauses.
14. Changes
If this policy changes in a way that matters, we will say so in the app before the change takes effect. The date at the top always tells you which version you are reading.
15. Contact
Liquid Duck, MB Company code 307615390, Republic of Lithuania info@liquidduck.com