FamiTask privacy policy

Last updated: 19 October 2026

FamiTask is an app for organising housework and daily routines as a family, with profiles for the children (up to eight people per family). This policy explains what data it keeps, what for and for how long, in plain language.

Who is responsible

FamiTask is a free, non-profit personal project. The data controller is Alfredo Escamilla González (alfredo.escamilla.gonzalez@gmail.com). For anything about your data you can write to that address or to famitask@lienzovirtual.com.

Data is stored on the hosting of the domain lienzovirtual.com, located in the European Union, which acts as data processor. It is never sold or handed to third parties for commercial purposes.

What data is stored

• Your account: email address, the name you choose and your language. The password itself is never stored, only a cryptographic hash it cannot be recovered from.
• Your group: the 6-letter code that joins your family and the group type.
• Activity: tasks created, done, approved or rejected (with the reason), coins earned and spent, shelf rewards and redeemed rewards.
• Photos (optional): the photo you attach as proof of a task.
• Notifications: if you allow them, a device identifier so they can be delivered.
• App crashes: if the app closes on its own or fails, an automatic report is sent with the error, which screen it happened on and technical details of the phone (model, operating system), so it can be fixed. It never includes your email, your name or the contents of your tasks.

FamiTask does not collect your location, contacts, files or your use of other apps. There are no ads: the only things collected outside the app itself are the technical crash reports above and the management of the Premium subscription (see "Who it is shared with"), never for advertising purposes.

What it is used for

Only to make the app work: signing you in, showing the board you share with your group, keeping count of the coins and telling you what the others do. No profiling, no automated decisions, and nothing is sent to any AI service.

Legal basis

• Your account, your group and your activity: they are needed to provide the service you ask for when you sign up (GDPR article 6.1.b).
• Notifications and photos: your consent (article 6.1.a). You can withdraw it at any time by turning notifications off or removing the photo.
• Blocking code guessing, the server's security logs and app crash reports: the legitimate interest in protecting accounts and keeping the app working (article 6.1.f).
• Kids' profiles: they are created by the parent or guardian, who consents on their behalf, as required by GDPR article 8 and article 7 of Spanish Organic Law 3/2018 for children under 14.

How long it is kept

• Photos are deleted automatically after 15 days, and also as soon as you remove them or the task is deleted.
• Everything else is kept while your account exists. If you do not sign in for two years, we email you and, if you still do not sign in a month later, the account is deleted automatically.
• We make encrypted backups of the database, kept for 14 days and then deleted. Deleted data may remain in them until they expire.
• Deleting your account removes your personal data, your sessions and your coin movements. If your group is left empty, the group is deleted too. If a family has no adults left, the kids' profiles and everything of theirs are deleted as well.
• To stop abuse (mass account creation, guessing passwords or codes, requesting emails non-stop) an encrypted fingerprint of the connection or the email address is kept for one day at most, never the IP address or the email in clear text.
• Like any website, the hosting server records connections (IP address, date and page requested) in its security logs, which are deleted automatically after a limited time.

Who it is shared with

• The people in your group: your name, the tasks, the photos you attach, rejection reasons, your rewards and how many tasks you did each week. That is the point of the app. Not your coins: each person's balance is visible only to them. Custom tasks are visible only to whoever assigns them and whoever receives them.
• The notification service (Expo and, underneath, Google Firebase Cloud Messaging), only if you allow notifications: it receives the text of the notification and the device identifier, nothing else.
• The app update service (Expo): when the app checks for a new version, that service sees the phone's IP address, like any download. It receives no account data.
• Sentry, if the app crashes: it receives the technical error report described above. It never receives your email, your name or the contents of your tasks.
• RevenueCat, to manage the Premium subscription: it receives a group identifier (not your name or email) and the purchase data the app store (Google Play or the App Store) already handles.
• Nobody else.

Expo, Google, Sentry and RevenueCat are in the United States. These transfers rely on the safeguards the GDPR provides for international transfers (the EU-US Data Privacy Framework or the European Commission's standard contractual clauses). The website uses no cookies and no third-party services: even the fonts are served from our own server. The browser version only keeps your session in the browser itself so it does not ask for your password every time.

Children

FamiTask accounts are for people aged 18 or over. In «Family» groups, an adult can create kid profiles for the children in their household. Those profiles have no email, password or access of their own: the child plays on the adult's phone or on their own tablet, which the adult links with a single-use code that expires after ten minutes. The adult creates the profile, is responsible for it and can sign the tablet out at any time. For a kid, the app keeps only the name the adult types (we recommend a nickname), whether they can read yet (so the app speaks and shows pictures) and their activity in the app: tasks, coins and rewards. No photos, date of birth or any other data are requested. The adult can delete the profile at any time from Profile → My group, and everything belonging to it is deleted with it.

Security

All traffic is encrypted with HTTPS. Passwords are stored as a modern cryptographic hash. Sessions are stored encrypted on the phone and can be closed at any time. Photos get a long random address that cannot be guessed, and their hidden data (EXIF), including location, is stripped on upload.

Your rights

You have the right of access, rectification, erasure, objection, restriction of processing and portability. Requests are handled within one month.

You can access, correct or delete your data, object to its processing or ask for a copy. The quickest way:

If you believe your data is not handled properly you may complain to the Spanish Data Protection Agency (aepd.es).

Changes

If this policy changes, it will be published here with a new date and, for important changes, announced inside the app.

Versión en español · Delete my account