Privacy

Fammager holds a child's iPad shut and, if you ask it to, reads a bank balance. Both of those earn you a straight answer about what is stored and where. This page is that answer.

Last updated 2 September 2026

What is stored, and why

Signing in creates a family. Everything below is stored on Google's cloud servers under that family, so a parent's phone, another parent's phone and each kid's iPad all show the same thing.

• Account details. When you sign in with Google, Fammager receives your name, email address and profile picture. The email is what a co-parent invite is addressed to and what identifies you across your devices.
• Kid profiles. The name, avatar and colour a parent chooses, plus a profile picture if one is set. A kid who signs in on their own device is linked to the profile a parent already made.
• Chores and routines. Titles, notes, due dates, what each job pays in money or minutes, who it belongs to, and when it was finished and approved.
• Balances and history. What each kid has earned and not yet spent, their allowance settings, a recent window of payouts and screen-time grants, and their current and best routine streak.
• Household records. The week's dinner plan, the shopping list, saved recipes, and the grown-ups' to-do lists. A job carries the display name of the parent whose list it is, and the name of whoever ticked off a shared one. Those names are copied onto the job on purpose: one parent's device is not allowed to open the other's account record, so keeping a copy of just the name is what lets a list be labelled without opening anything wider.
• Notifications. If a parent turns notifications on, we keep the delivery address Apple issues for each of their devices, so we can tell them a kid has ticked something off. It identifies a device rather than a person, and kids' devices are never registered for notifications at all.

What never leaves your device

• Which apps are shielded. When you choose them, iOS hands Fammager a set of anonymous markers rather than the app names. Fammager is never told what you picked — only how many. The selection stays on the iPad it was made on and is never uploaded.
• The grown-up code. The four-digit code that guards the lock settings never leaves the device it was set on. It isn't stored as the digits you typed, but as a scrambled version that can be checked against and not read back — so the code itself isn't sitting anywhere, even on that iPad.
• Calendar events. Fammager reads today's events from calendars already on the device to show them on the home screen. Nothing is written back and no event is ever uploaded. Which calendars to show is a per-device, per-profile choice.
• Photographs of recipes. Reading a recipe from a photo uses the text recognition built into iOS, on the device itself. The photo is not uploaded and is not kept. Only the text you have read over and approved is saved.
• Your voice. Dictating a chore name uses on-device speech recognition. No audio is recorded or transmitted.

Bank linking

Linking a kid's account is optional and off unless you set it up. It uses Plaid, and it is read-only: Fammager cannot move money, and never attempts to.

• Your banking credentials are entered in Plaid's own screen. Fammager never sees them.
• The keys that can reach your bank never touch a phone or tablet. They are held on our servers, in a place the app itself is not permitted to read — only our own server code can, and that is the only thing which ever talks to your bank on your behalf.
• Balances are fetched live when a screen needs one, and are not stored in the family's records. Fammager keeps the account's name and last four digits so the card has something to label itself with.
• Unlinking an account from a kid's profile removes the connection.

Who can see what

Who is allowed to do what isn't decided by the app on your phone — it is decided on our servers, and checked every time. That distinction is worth spelling out: an app can be taken apart by someone determined enough, but a rule held on the server refuses regardless. So the limits below are real rather than merely hidden from view.

• A kid sees their own chores, routine, balances and streak, plus the shared household records: the dinner plan, the shopping list and the recipes. They can mark their own chores done. They cannot approve one, cannot change what it pays, and cannot alter their own balances.
• A parent sees the whole family and approves what pays out. The grown-ups can read each other's to-do lists — knowing what the other has already dealt with is the point of them — but only the person whose list it is can tick a job off, edit it or delete it. That separation is checked on our servers rather than left to the app: a job can move between your own list and the shared pool, and can never be pushed onto or taken off the other parent's list. Jobs in the pool belong to neither and either may work on them. Kids never see any of it.
• Nobody outside the family can read any of it. Joining requires an invite: a short code for a kid's device, or an emailed invitation for a co-parent.

Children

Fammager is set up and controlled by a parent. A kid's profile is created by a parent, and a kid's device joins only with a code that parent shares. The information held about a child is what a parent enters — a name, an avatar, the jobs they have been given and what those are worth. Fammager does not show advertising to anyone, does not profile children, and does not use family data to train anything.

A parent can delete a kid's profile at any time, which removes that child's chores and routine along with it.

Who processes data on our behalf

• Google Firebase — signing you in, storing the family's records, and sending notifications.
• Plaid — bank connections, only if you set one up.
• Apple — delivering notifications to your devices.

There are no other third parties. Fammager carries no advertising, no analytics and no crash reporting — there is nothing built into it whose job is to watch what you do and report back.

Deleting your data

You can remove a kid's profile, a chore, a recipe or a linked bank account from within the app at any time. To delete a family and everything in it, email privacy@fammager.com from the address you signed in with and it will be removed.

Changes

If this policy changes in a way that affects what is collected or who can see it, the date at the top of this page changes and the app will say so before the change takes effect.

Contact

Questions about any of this: privacy@fammager.com.