Privacy Policy

Information and purposes

We process account credentials and membership, profile and relationship information, submitted family records and media, activity and event records, messages, call participation and text transcripts, stated preferences, device notification registrations, and minimal security/audit metadata to provide authorized family services, deliver communications, support family review, investigate reported problems, and protect the service. We do not inspect unsent drafts, keystrokes, idle microphones, ordinary cellular calls, other applications, or clipboard content outside an explicit paste.

Scheduled drafts

When enabled under the published storage limit, you can explicitly save a scheduled message draft on the server for future delivery. Pending text is private to its author and is not inspected by automated safety rules or family reviewers before sending. You can edit or cancel it. At delivery, the service checks current agreement, participation and permissions, then sends it through the ordinary message pipeline. Sent text follows the conversation audience, automated scanning and message retention policy. Group participants may change before delivery. Changed authorization can stop sending; pending and blocked drafts expire no later than 365 days after initial server storage. Editing cannot extend the original deadline. Successful delivery and cancellation immediately remove pending draft text; expiry ends access and schedules removal. Non-content delivery and security records follow the audit retention policy. Service delays can delay or prevent delivery. Server administrators operate the storage under the stated safeguards and operational access policy.

Who can access information

Access follows the account, resource, conversation membership, and explicitly authorized review scope. New group participants normally see history from their join time. Removed participants receive no later content. Adult supervision requires informed authorization to the named reviewer. An ancestor or administrator does not inherit a supervisor's rights. Operational support access must be explicitly scoped and audited. A retention hold does not expand the audience or revive a revoked review permission.

Live calls

Messages voice and video calls are automatically transcribed for every participant. The service processes live Messages call audio to create text but does not save audio or video recordings of those calls. Family Meetings automatically record audio and video for the authorized Family Meeting archive, including its existing transcription workflow; Messages transcript expiry does not apply to that archive. Messages, transcripts, and supported submitted content are checked using automated safety and family-review rules. Content may be reviewed by conversation participants and specifically authorized family supervisors within the access shown for the account or conversation. Ordinary call transcripts are deleted 30 days after the call ends, unless flagged by the system or an authorized father for longer retention under the published retention policy. Shared microphones and overlapping speech can make attribution uncertain. A participant must affirm the current disclosure before admission. Speech-processing interruption is shown and can stop a call; missed speech cannot be recovered from stored audio. Ordinary phone calls and other applications are outside this service.

Retention and flagged text

Ordinary call transcripts and their corrections, excerpts, translations, summaries, and search derivatives expire 30 elapsed days after the actual call ends. A system flag or specifically authorized father can retain only its permitted text scope until an explicit finite date. The published settings below state the configured system extension and review period. Fathers choose an explicit date and reason; extensions require review and another explicit date. Releasing the last hold restores the original expiry; it does not start another 30 days. Expired content cannot be revived by a late flag. Attachments and ordinary messages follow their separate published settings. We cannot erase copies independently made by other users.

Devices, providers, and links

Device registrations support push delivery and incoming calls. Generic notification previews are the default; authorized details require sign-in. Providers and enabled integrations are identified in the current settings below. External links and connected services have their own practices; a link is not permission to send private content to them. Local-only processing does not silently fall back to a cloud provider. The Android app asks for or declares these permissions. Camera and microphone: calls and Family Meetings you join, voice messages you record and photos you choose to take. Foreground service for camera and microphone: keeps a call you joined connected when you leave the app, with an ongoing notification and a Leave button. Notifications: alerts and incoming calls, if you allow them. Nearby devices (Bluetooth connect): Bluetooth headsets during calls. Network and Wi-Fi state, internet, audio settings, vibration, keeping the device awake and starting after a restart: connecting, call audio and delivering alerts. Shared storage, on Android 12 and older only: files you choose to send or save. Software libraries in the app also declare biometric, install-referrer and home-screen badge permissions; the app does not use biometric sign-in or install-referrer data to collect information. Photos and files come from the system picker, only when you choose them. The app does not request location, contacts, SMS, call log or calendar access.

Security and recovery

Access is restricted and security-relevant actions are audited without copying private content into ordinary logs. The operator can technically access content while servers process it. Actual deployment safeguards and backup periods are stated below; absolute security is not guaranteed. Expiring transcripts require isolated storage or independently erasable keys and restore reconciliation before restored content is served.

Choices and contact

Account controls show your reviewers and scopes and let you manage supported notification choices. You can withdraw communications agreement and request access, correction, deletion, or account closure through the operator contact below. Help, policy pages, sign-out, withdrawal, and data-request controls remain available while ordinary access is gated. Applicable children's and other privacy rights are not waived by agreement.

Current operator and retention settings

Operator

Ren Anderson

Public contact

[email protected]

Operator location

Utah, United States

Initial service area

Utah, United States

Contact availability

Mailbox activation is deferred. This address is not currently an active support or emergency contact channel. Account request controls remain available through Help; a submitted request is not confirmation of completion.

Ordinary transcript days after the call ends

30

System-flag retention days after the flag

90

Hold review interval in days

30

Messages

No automatic age-based expiry is configured for ordinary direct or group messages. Sent content and retained revisions remain subject to authorized deletion, withdrawal and account/content request workflows; shared participant records and non-content audit evidence may remain under those workflows.

Submitted attachments

Deliberately submitted photos, videos, voice messages, documents and other stored files have no automatic age-based expiry configured. Authorized deletion and account/content requests are handled under the applicable audience, shared-content and retention workflow. Transcript expiry does not delete unrelated files.

Security and call metadata

Restricted security and non-content operational audit records have no automatic age-based purge configured. They remain until an authorized retention or deletion action.

Backups

Protected manual backups of ordinary site data and deliberately stored files remain until the operator removes them; no automatic backup-age expiry is configured. Call transcript text must be excluded from long-lived backups before activation. A restored system stays unavailable until current expiry, holds, withdrawals and deletion records are reconciled. We do not promise forensic erasure of underlying storage blocks or copies independently made by users.

Enabled providers and integrations

The platform uses self-hosted web, database and file storage and a self-hosted Jitsi call service. Speech recognition runs locally using Whisper; it has no silent cloud fallback. Google Calendar is enabled for connected accounts. Browser push uses the device-selected Google or Apple Web Push service for generic notices. Cloudflare carries the encrypted connection between the internet and our server. The 87 Family Android app is distributed through Google Play. Android push notifications use Google's Firebase Cloud Messaging: if you allow notifications, your device receives a push token from Google and we store it to address generic notices to that device, without message text. Firebase Cloud Messaging is not switched on yet; until it is, app notices appear only while the app is open. Other optional providers must be disclosed before activation.

Deployment safeguards

Public web access uses HTTPS. Account, conversation and resource permissions restrict who can see each item. Call audio is processed temporarily in bounded memory and discarded after recognition or a short enforced timeout; the qualified call service saves no replayable audio or video recordings. Security and operational records avoid copying private content into ordinary logs. Production safeguards must pass the activation checks. The current server pool is not encrypted at the disk level. Operators can technically access information processed by their servers; absolute security or forensic erasure is not promised.

Direct message expiry after sending

Until authorized deletion

Group message expiry after sending

Until authorized deletion

Father holds require an explicitly selected finite date and reason. They retain only the authorized text scope. Renewals require another explicit date and reason.

Scheduled messages

You can explicitly store a private scheduled draft on the server for up to 365 elapsed days. It is sent only after current authorization checks, then follows ordinary conversation access, automated scanning and message retention. Pending drafts are not scanned or shared with family reviewers. You can edit or cancel them. A blocked draft expires at its original displayed deadline.

Named safe concerns

You can expressly share a bounded message window with one named, voluntarily enrolled adult reviewer. People you identify as implicated are excluded. The selected message text can be retained and reviewed until your chosen expiry, up to 30 days, subject to current source restrictions. Sharing can be withdrawn. This does not grant access to a whole conversation, call transcripts, or independently restricted attachments.

Published version history

Version 3 — effective Nov 1, 2026

Version 2 — effective Oct 14, 2026

Version 1 — effective Oct 11, 2026