Your tree is yours.

Familión stores information about people both living and deceased — dates, places, photographs, medical history. We treat that data with the same care a family would entrust to a notebook. This page explains what we do, what we don't, and what you can ask of us at any time.

What information we store

• Your account: email address, display name, last sign-in date and the country you signed up from (the country code only).
• The tree: people, family relationships, dates, places, occupations, education, medical history, notes and stories that you or your relatives contribute.
• Photos and documents: the media files you upload to the tree, along with their captions and dates.
• Basic activity: what pages load, what actions are taken — only enough to detect errors and understand which parts of the product are working.
• Your devices: if you turn on notifications on a phone or a browser, what we need to send them (explained in “Notifications on your phone”).

Who sees what

Only members invited to your tree can see its contents. Within the tree there are two levels of access:

• Administrators see and edit everything and manage invitations.
• Other members can only edit their own profile and can write stories. They can't change other people's profiles.

Any member can buy credits for the family.

Medical history is sensitive data. It's shown only inside the tree, and every member can see it, including people who join later. Before adding it, the person writing it confirms they understand this and, if it's about another living person, that they have their permission. Anyone who can edit the profile can delete it at any time, and the person it's about can ask us to remove it at support@familion.app.

Your rights

You are responsible for the data you contribute to your tree (including data about other relatives you invite). At any time you can:

• View and edit your account and the data associated with it.
• Delete your account or the tree, if you are an administrator.
• Request access to a full copy of the data we hold about you, under the GDPR (EU) and the UK Data Protection Act 2018.

Cookies and tracking

We use session cookies — the ones strictly necessary to keep you signed in. If you arrive from one of our ads, we add one more, for 30 days, that only remembers which version of the page we showed you; it holds no data about you. We don't use tracking pixels. The only information we share with an advertising platform is the sign-up event described in the "Ad measurement" section, and only if you arrived from one of our ads.

Ad measurement

If you arrived at Familión from one of our ads on Facebook or Instagram and create an account, we notify Meta server-to-server so we can measure whether our ads work. That notification includes your email address in hashed form, your IP address, your browser, and the page you landed on. No pixels or tracking cookies are involved.

We never send anything from inside your tree: no relatives' names, no photos, no stories, no dates. Only the fact that an account was created.

If you didn't arrive from a Meta ad, we send Meta nothing about you. And if you want that event deleted, write to us and we'll request its deletion from Meta on your behalf.

Notifications on your phone

If you turn on notifications on a phone or a browser (in Settings, or after adding Familión to your home screen), we let you know what's happening in your family: someone joining the tree, a story you're tagged in or a comment, a birthday or an anniversary, a card to sign or a new game. In the first week we also send a few ideas for completing the tree. We send at most one notification a day and two a week, and none between 21:00 and 09:00 your time.

What we store for each device. The notification address your browser gives us and its keys, the type of browser and device (its “user agent”) and the device's time zone, so we don't send anything at night. If we don't have it, we use the main time zone of the country you signed up from. We don't use or store your phone number for notifications.

How they travel. Notifications travel encrypted through your browser's notification service (for example, Google's for Chrome or Apple's for Safari), which delivers them without being able to read them. Names from your family may show on your phone's screen.

How to stop them. In Settings you choose which notifications you want, or turn them off with “Turn off for this device”. You can also block them in your browser's or phone's settings.

When it's deleted. We delete a device's data when you turn notifications off on it, when the notification service tells us the device no longer exists, or when you delete your account.

Measurement. In our analytics (PostHog) we record whether you added Familión to your home screen, whether you turned notifications on, what kind of notification we sent, whether you opened it, and which visits started from the icon or from a notification. The notification address and its keys never reach PostHog.

AI Assistant

Familión has an optional assistant, the AI Assistant, with two modes: “Tell”, which asks you questions to complete your profile and your tree and to write stories, and “Ask”, which answers questions about your family. On the web you have both; in the iPhone app, “Tell”. It also works over WhatsApp and Telegram, but only if you turn it on: you link your account with a one-time code from Settings (or a tree admin connects a Telegram group with /connect). You can disconnect at any time from Settings or with /disconnect.

What data “Ask” uses. Only the trees you are a member of, and read-only: it cannot change or delete anything. For each question it looks up only what it needs to answer: names, dates, places, relationships, occupations, studies, residences, interests and favourites, achievements and awards, notes, stories, causes of death and pets, plus who the tree's members are (name and role) and some tree statistics. Health notes are only looked up if you explicitly ask about someone's health. It also receives your first name (on the web, the one on your profile in the tree or, if you have none, on your Familión account; on WhatsApp or Telegram, as it appears on your profile there) and who you are in the tree. It never receives photos, email addresses or phone numbers, and a copy of the tree is never sent.

Who processes it. To write the reply, your question and those records are sent to Anthropic PBC (United States), the provider of the Claude model, which acts as a data processor under its data processing agreement. The transfer to the United States relies on the European Commission's standard contractual clauses; Anthropic is also certified under the EU-U.S. Data Privacy Framework. Under its commercial terms, Anthropic does not use this data to train its models and deletes it from its systems within 30 days, except content its safety systems flag as possible abuse or anything a legal obligation requires it to keep.

Tell. With “Tell”, Familión asks you questions — on the web, in the iPhone app or on WhatsApp and Telegram — about you, your family or a memory. What you answer is sent to Anthropic, under the same terms, to read your answer or write up the story; if the question is about a relative, their name is sent too. To spell names correctly and know who a story is about, the tree's list of relatives (names and relationships) is also sent. Unlike “Ask”, “Tell” saves, and apart from the questions that complete your tree (below) it saves only what you expressly confirm: to your own profile and your stories and, if you are an admin of the tree, also to your relatives' profiles in that tree and to stories about them. Whatever is saved to a profile or a story is visible to that tree's members, like any other data in the tree. If you answer “I don't know”, or that someone doesn't have that detail, nothing is saved to the tree: we only note it so we don't ask again right away. While a story is half-told we keep what you have said so you can continue it, until you save it, discard it or delete your account.

When you complete your tree. The questions that complete your tree (for example, your parents' names or when your grandparents were born), when you create it or later from “Tell”, save your answer as soon as you give it, just as if you typed it into the form. If we can't read an answer about a person (their name and, if you give it, when they were born), we send only that answer to Anthropic, under the same terms, to read it.

The channels. Your messages travel through WhatsApp (Meta) or Telegram like any chat with a business; their own privacy policies apply to that transport. What you do on the web or in the iPhone app goes through neither. If you link WhatsApp, we keep your phone number (it's your WhatsApp identifier) and your profile name, to recognise your messages, reply to you and, if you turn it on, send you the daily digest of the family's birthdays and anniversaries; with Telegram we keep your Telegram identifier and username, not your number. We delete them when you disconnect the assistant or delete your account.

Retention. To understand follow-up questions on WhatsApp or Telegram we keep only the last 6 exchanges per link; after 30 minutes of inactivity they are no longer used and the next conversation replaces them. Disconnecting deletes them along with the link. On the web, “Ask” keeps the last 12 messages of your conversation so you can see it and carry on; if you ask again after 30 minutes of inactivity, a new conversation starts and the earlier messages are deleted. Lookup results are not stored; our technical logs record only the length of each message, never its content, and our analytics tool never receives what you type in the Assistant or its replies. If you started your tree by conversation, we also keep the answers you gave when you started it. All of this is deleted with your account. There are two exceptions, kept until the tree is deleted: a Telegram group's history, and the “I don't know” or “doesn't have” answers from “Tell”, which we keep so no one in the tree is asked again; if the person who answered deletes their account, they are kept without being linked to them.

Family cards

With family cards, a member of the tree makes a card for someone in the family or for someone else, like a friend or a colleague (for a birthday, say), invites other people to sign it, and we deliver it by email on the day they choose. Sending a card uses the family's credits; we don't ask for any new payment details.

What we keep. The design, the cover text, the letter and the photos chosen by the person making the card, and the greetings of the people who sign it. Photos are copies: we resize them (up to 1600 pixels) and strip all their metadata, including location. They're kept in private storage, separate from everything else, and shown only to the people on that card, through links that expire after 10 minutes.

The recipient's email. The person making the card types it in or, if the recipient already has a Familión account, we use their account email, without showing it to anyone. We use it only to deliver the envelope, to send the one-time code that opens it (the code goes only to that address), and to limit how many cards that address gets in a day. For that limit, we keep a one-way fingerprint of the address (never the address itself) for two days. If someone who receives a card chooses “I don't want cards from Familión”, we keep only a one-way fingerprint of their address (never the address itself), solely to stop sending them cards.

The people who sign. They're invited from the tree, by email, or through a group link the card's maker can turn on. We use their email for the invitation, a sign-in code and that card's notices (a reminder before it goes out if they haven't signed yet, a notice if their greeting didn't make it in, and the recipient's reply). If someone has no account, we create a card-only account with their email and the name they type; if they don't confirm it, we delete it after 7 days. They only see the card they were invited to, never the tree, and every notice has a link to stop them. We never send them any other email.

Who sees what. The person making the card sees the greetings before it goes out, to approve them. The recipient sees the card, the photos and the approved greetings once it arrives. Their reply is seen by the card's maker and the people whose greetings are on it. Cards never appear on public or visit pages. If someone in the family is already making a card for a person, the tree's other members can see who is making it, so they can sign it instead of making another, but not what it contains. The person it's for never sees this.

Signers appear next to their greeting with their profile photo from the tree, or with their initial if they have no photo or choose not to show it. We keep a copy of that photo with the card; only people who can see the inside of the card see it, and it's deleted if the card or that person's greeting is deleted.

Voice and video greetings. If the person making the card allows it, signers can record a voice or video greeting, or upload one from their phone. We keep it in the same private storage as card photos, and it only plays inside the card, through links that expire within minutes. It never has a public link, never appears in emails, notifications or previews, and has no download button. We don't transcribe or analyse it, and we never use it for advertising, to train AI models, or for the AI Assistant.

Who can play it. Only the person making the card, to approve it, and the person receiving it. Other signers can see that there's a voice or video greeting, but can't play it. Cards in memory of someone are different: everyone whose own memory on the card is approved can hear and see the others' approved voice and video memories. The recipient's reply, voice or video included, can be heard or seen by the person who made the card and by everyone whose greeting is on it.

Approval. No greeting goes on the card until the person making it approves it. If they don't, they can leave a note with the reason; the signer sees it and can sign again. The audio or video of a greeting that isn't approved is deleted straight away. If a greeting is still awaiting approval when the card is delivered, it isn't added, and we delete it.

Changing or removing it. Signers can re-record or remove their greeting until the card is delivered; after that, it stays in the card. The recipient can report any voice or video greeting, and delete the whole card, at any time. If you delete your account, your voice and video greetings disappear from every card, just like written ones. If you need a greeting removed after delivery, write to support@familion.app.

The family's voices, kept. If a signer has a profile in the tree, they can choose to keep a copy of their voice greeting on their profile as well. Only they can decide that, when they sign. Members of the tree can listen to that copy, including people who join later, like the rest of the profile, and the signer can remove it at any time. A tree admin can also remove it (never change it), and if the person is alive, we let them know. Any member can report it, as with a greeting on a card. Only the signer's own voice can be kept: a greeting in which a child speaks can't be kept on a profile. The copy is separate from the card: if the card is deleted, the copy stays on the profile, and the other way round.

Who answers for each greeting. The person making the card listens to or watches every greeting before approving it, and is responsible for what they approve, including the voices and images of other people and of minors. Whoever records a greeting agrees to have the permission of anyone who can be seen or heard in it and, for minors, of their parent or guardian.

If something shouldn't be there. The recipient, and the person who made the card, can report any greeting from the card; we hide it for everyone while we review it, and anyone can write to support@familion.app. We review every report and remove the greeting if it breaks our Terms (6. Acceptable use) or the law; when we do, we delete the audio or video and keep only the record of the report.

Deleting cards. The card's maker can delete it until it's first opened (the credits go back to the family); after that, only the recipient can. Deleting a tree removes its unopened cards; cards already opened stay with their recipients. If you delete your account, your greetings leave every card, and the cards you received and any you hadn't sent, had scheduled or that couldn't be delivered are deleted. A card already delivered but not yet opened can still be opened, with its maker's letter, even if the maker has deleted their account.

Analytics. For cards we only record counts and kinds of action (for example, that a card was sent), never names, text, emails or links.

If the card is in memory of someone in the tree who has died, its front shows their photo from the tree (or another the maker chooses), their first name and surname and, if recorded, their years of birth and death. The maker can change or remove the photo and remove the years before sending it. The recipient and the signers see all of this.

Family games

With family games, a member of the tree makes a quiz about the family (for a birthday, Christmas, Three Kings' Day or no occasion) and shares a link. Everyone plays on their own phone, or the person who made it hosts it on a screen (living-room mode) with the members in the room. A game uses the family's credits; we don't ask for any new payment details.

Where the questions come from. Most come from the tree and are written by our own code, without AI: how people are related, the decade someone was born, where they were born (as their profile shows it), jobs, and the nicknames of people who have died. In these questions we only use first names, never surnames. We never use contact details, addresses, weddings or separations. No question is about a minor (if we don't know the age of someone in the youngest generation, we count them as a minor); minors can only appear as an answer, by first name. Nor do we ask about someone who died recently, or use a first name two people share.

Family stories. The person making the game can pick up to 4 adults from the tree. Once per game, we send Anthropic PBC (United States), the provider of the Claude model, on the same terms as the AI Assistant, a short, filtered summary of what the tree holds about those people: their first name, the decade they were born (the year, if they have died), the country where they were born or lived, and the city when we recognise it (for someone living, only the country they live in now), their jobs without the workplace, the field of their studies, their hobbies and likes, their achievements and awards, their nickname if they have died, and up to 3 of the stories they appear in. From their profiles we never send health details or causes of death, adoptions or upbringing ties, weddings or separations, addresses, workplaces or notes; nor private chats with the Assistant, cards, or details of the people who weren't picked. Stories go as they were written, but without the surnames or names of others in the tree, and we take out the sentences about health, deaths, separations, money, legal matters, religion or politics. If they still mention other topics, the model is told not to use them, and our code drops any question that touches them, names someone else, or whose answer isn't in the tree.

Questions use first names only, and anyone the game is shared with sees them, including people outside the tree. That's why the person making the game reviews every question before sharing it, sees where it came from (“From Ana's profile”, “From the story “The trip to Lima”, by Marta”) and can change or remove it. Questions exist only inside their game: they're never saved to anyone's profile, and they're deleted with the game.

Crosswords and word searches. In crosswords, some words come from the tree: first names, surnames, nicknames (only if the person making the crossword includes them), the city or country where someone was born, lives or works, or where they lived or worked (only if it matches our list of cities and countries), and the names of living pets. The clues are written by our own code, without AI, and may mention the birth year of someone who has died or the birth decade of someone living. We never use words about minors, about the person whose birthday it is, or about someone who died recently. A crossword with words from the tree can only be played by its members; someone outside the tree can ask to join from the link, and the tree's admins see their name and email and decide. If someone reports a word, it won't appear in that tree's crosswords again: we keep that word for as long as the tree exists. Word searches use the same words from the tree, the same clues and the same rules as crosswords; a reported word stops appearing in both.

Who plays. Tree members play signed in. Anyone else who opens the link sees only the challenge (no question, name or result) until they confirm their email: they type a name and their email, and we send a one-time code to that address only. We then create a game-only account, like the card ones: it sees only that game, never the tree; if it isn't confirmed, we delete it after 7 days, and we never send it any other email. To limit code attempts, we keep the email and IP address only as a cryptographic hash, never as they are. If someone who played asks to join the tree, the tree's administrators see their name, email and the game they played, and decide whether to accept the request.

Who sees what. The person making the game reviews every question before sharing it and can change or remove any of them. Everyone who plays sees the questions and, after answering, the right answer and how many people picked each option, never who picked what. From 3 players, everyone sees the podium, with names as they were typed at the door; the person who made the game doesn't compete. The link preview (what WhatsApp and other apps show without signing in) shows only the challenge: no question, surname or face. In living-room mode, the screen shows each question, its answer and the scores of the people playing in the room.

The hall of fame. For tree members we keep their podium places from each game (the place, the occasion and its date, whether it was shared and when it was won) and their points, including after the game is deleted. Only tree members see it: on the hall of fame page, in a notice on Home for 14 days, and as a title on the winner's profile. We never record people from outside the tree there; if someone joins the tree while the game is still available, their place counts from then on. Someone who leaves the tree keeps their places but no longer sees the hall of fame. The family leaderboard, which only the tree's members see, shows each member with the first name and surnames on their profile (or “Family member N” if they have no profile) and the points they've scored in all the family's games, including ones that have since been deleted. Anyone who leaves the tree keeps their points, but doesn't appear on the leaderboard or see it until they come back. If you play without being in the tree, you don't appear on the leaderboard. On your account we keep only your points in that tree, how many games you've played there and the date of the last one (never your name or your answers), including after the game is deleted. If you join the tree with that account, those points move to the leaderboard; if not, they're deleted 12 months after your last game there or when you delete your account.

How long we keep it. A shared game is deleted 90 days after the last time anyone played; one that was never shared, 90 days after its last change. The person who made a game can delete it sooner: the same things are deleted, and the link stops working. Its questions, the names of the people who played, their answers and the code log go with it. Only the hall of fame places and the players' points remain. If a relative is deleted from the tree, the questions about them are deleted from every game. If you delete your account, the games you made, your plays and answers in other games, and your places, points and titles in the hall of fame are deleted. Deleting the tree deletes its games, its hall of fame and all the points scored in it.

Analytics. For games we only record counts and kinds of action (for example, that a game was finished), never names, questions, answers, emails, codes or links.

Curiosísimo. If you use “Call”, we open WhatsApp with a ready message. You send it, if you want to: we send nothing. The message holds only the question and its options, with no answer, no family names and no links, and WhatsApp handles it under its own rules. If you report a question, we keep which one it was in our question bank (not how it looked with your family's names), the reason, anything you write, and which tree it came from. We use this only to fix the bank. With “Not right for our family”, that question stops showing up in your tree.

Payments

Family credits are paid through Stripe, our payment provider. You enter your card or bank details on Stripe's page: we never see or store them. We give Stripe your account's email for the receipt, and we only keep, with your account, the payment confirmation, the pack, the amount and the currency. In Brazil, Pix payments are processed by EBANX, a Stripe partner: it shows as the payee in your banking app and emails you its own receipt. If someone signs up for Family+, we keep who pays for the plan, its status, its charge dates, and that person's language and time zone, which we use for their emails: the notices before each charge and the receipts. Tree members see the payer's name (for example, “Ana covers Family+ for the family”). In Brazil, the monthly Pix Automático charge is authorised in the payer's banking app, where they can also cancel it. For payments, the country of your connection chooses the currency you see and pay the packs in; with each purchase we keep that country, because your withdrawal window depends on it, and, in the European Union, the European Economic Area and the United Kingdom, when you asked to get the credits right away. If you withdraw online, we keep when you asked; the name and email you type are only used to send you the acknowledgement.

Children

You must be at least 16 to have a Familión account. Children can appear in the tree, in photos and in card greetings, always through an adult: whoever adds, photographs or records them confirms that they're the child's parent or guardian, or have their permission. We don't create accounts for children, including card-only accounts. If you're responsible for a child and want us to remove their data, photos or a greeting they appear in, write to support@familion.app and we will.

Retention

We keep your data while your account is active. If you stop signing in for more than 12 months, we'll email you a warning before deleting your content.

We back up the database and the photos, videos, documents and recordings, only so we can restore them if something fails or is deleted by mistake. Nobody browses these backups or uses them for anything else, and they stay with the same providers (Supabase in the European Union and Cloudflare R2). Anything you delete is also gone from the backups within 7 days at most.

We also keep a one-way fingerprint of each account's email (never the address itself), even after the account is deleted. We use it only to detect abuse of the credits every tree starts with, such as creating accounts over and over.

Contact

For any request related to your data, write to us at support@familion.app. We respond within 30 calendar days at most.