Privacy Policy

Introduction

Pinamily is a family organizer that brings household calendars, lists, chores, recipes, meal plans, birthdays, and support into one shared service. This policy applies to the Pinamily mobile app, related services, and pinamily.app.

Pinamily's public pages are prebuilt static pages. They have no public account area, contact form, advertising, tracking pixels, browser analytics, or non-essential cookies, and they do not collect family content. The private Comando area uses a functionally necessary administrator session cookie.

Information You Provide

When you create and use an account, Pinamily processes information such as your name, email address, email-verification status, password credential, account status, and the settings or actions associated with your account. Passwords are stored as password hashes, not as readable passwords.

You may also provide Household names, invitations and memberships; managed Child Profile details such as a display name, calendar color, and designated managing adult; and content for the features you choose to use, including shared calendar entries, lists and list items, chores, recipes, birthdays, meal-plan entries, notes, and attachments. Shared or free-form content may contain personal information about a child or another family member. Support requests include the subject, message, category, and replies that you submit.

Information Collected Automatically

Pinamily processes limited technical and operational information needed to authenticate requests, maintain sessions, synchronize data, protect the service, diagnose failures, and operate product features. This can include timestamps, session lifecycle information, IP address and user-agent information associated with authentication sessions, app version, platform, operating-system version, locale, time zone, request or correlation identifiers, and service health or error signals.

The app also maintains local data needed for offline use and synchronization. Information held only on your device is subject to your device controls and may be cleared when you sign out or after account deletion is confirmed.

Family and Household Data

Household features are cloud-connected. Pinamily stores the account, membership, invitation, entitlement, and shared feature data needed to synchronize the service across household members and their devices.

Current members of the same Household can see and work with shared Household content, including managed Child Profiles and content associated with them, according to their role and the product rules. Only the Household Owner can create, edit, change the designated managing adult, or archive a managed Child Profile. The managing-adult designation does not by itself grant administrative authority. Invite only people you intend to share that space with.

Calendar Data

The Pinamily shared calendar stores the event details, timing, recurrence, reminder settings, and change information needed to provide and synchronize calendar features for a Household. Calendar reminders are delivered as local device notifications; remote consumer push is not active in the current release architecture.

External Device Calendars

External calendar integration is optional and read-only. If you enable it, Pinamily reads events from calendars you select on the device and displays them as a local overlay. External event content is not imported into the Pinamily Household calendar, sent to the Pinamily backend, or persisted there.

Pinamily does not connect to Google Calendar or Microsoft Calendar through cloud OAuth and does not write to device calendars. On iOS, the operating system may describe the required permission as Full Calendar Access even though Pinamily uses that access only for this read-only view. On Android, Pinamily requests calendar read access, not calendar write access.

Notifications

Calendar and birthday reminders are scheduled locally on your device when you enable them and grant notification permission. Birthday reminder preferences are device-local. Disabling permission, changing the relevant setting, signing out, or removing app data can affect scheduled reminders.

Invitations and certain account, recovery, support, or operational messages may be sent by email. Remote APNs or FCM consumer push notifications are not active in the MVP.

Subscriptions and Billing

Purchases are completed through the Apple App Store or Google Play. The Store handles your payment method. Pinamily does not receive your full payment-card details.

To provide and maintain subscription access, the Pinamily backend receives and verifies the Store transaction or subscription evidence needed for entitlement status, renewal, expiration, cancellation, restore, and reconciliation. Sensitive Store evidence is excluded from product analytics and is not exposed through ordinary client responses.

Advertising

The Free plan may show Google AdMob adaptive banner ads only on Home and the Lists hub. Gold does not show ads. Pinamily requests non-personalized ads only, does not use family content for ad targeting, does not request Apple App Tracking Transparency permission, and does not use advertising for cross-app tracking by Pinamily.

The AdMob SDK may process limited device, network, consent, and advertising-delivery information needed to request, display, protect, and measure a non-personalized ad. Where applicable, Google User Messaging Platform provides the privacy or consent flow. If the required consent, market, entitlement, provider, or configuration state is not ready, Pinamily does not request an ad.

Analytics

Pinamily uses first-party product and operational analytics. Events use an allow-listed name and limited metadata, with a pseudonymous actor identifier derived for analytics. Pinamily analytics do not include family message or content payloads, email addresses, raw user or household identifiers, support-message text, or Store purchase evidence.

Raw analytics event records are retained for 90 days and then removed. Aggregated operational or product reporting may remain where maintained by the current architecture, without the underlying family content or raw pseudonymous actor event history. No third-party analytics provider is active.

When someone opens a Pinamily marketing short link, this website may record the link and campaign identifiers, the time of the click, the referring domain when a browser provides one, a coarse device class derived in memory, and a two-letter country code only when trusted deployment infrastructure provides it. The application does not store the raw IP address, raw User-Agent, full referring URL or query, fingerprint, advertising identifier, user identity, or household identity for these clicks.

Like any internet service, network and hosting infrastructure necessarily process connection information to deliver HTTP traffic and may apply their own security controls. The application logging policy excludes raw client IP addresses, raw User-Agent values, full Referer values, and query strings from application request logs.

Marketing-link measurement happens in the server-side redirect. It does not set a tracking cookie, does not add browser analytics to the public pages, and does not use a third-party analytics SDK. A direct visit to pinamily.app that does not use a short link is not measured by this module. These records measure clicks, not installs, sign-ups, subscriptions, or revenue conversions. Limited first-party raw or minimal marketing click events may be retained for up to 24 months. Aggregated marketing statistics may be retained longer without the underlying individual click-event rows.

Support and Diagnostics

When you contact support, Pinamily stores your ticket, its status, messages and replies, and limited operational diagnostics. Diagnostics use an allow-list of technical fields such as app and operating-system versions, locale and time zone, capability state, sync health, notification or secure-storage state, billing state, and request identifiers. Family content is not attached automatically.

The MVP does not accept support attachments. Internal support notes are visible only to administrators, not in My Requests. Email notifications about a support update do not include the support-message body.

Data Export

From More > Privacy and data, an account holder can request a Personal Export of account data and private content. It can include account profile information, the requester's Household memberships and roles, private lists, privacy-request history, user-visible support requests and messages, safe diagnostics, and in-app inbox records.

A Personal Export does not include managed Child Profiles or Household-owned shared content such as shared calendars, family lists, chores, recipes, birthdays, and meal plans. A Household Backup is a separate Owner-controlled export that includes active and archived profiles and supported shared Household records. Export and backup downloads require configured private storage. When available, the download link is signed for 15 minutes and a completed artifact is retained for 7 days before deletion.

Account Deletion

Account deletion is requested in More > Privacy and data and requires fresh authentication and explicit confirmation. It is processed by the service as a lifecycle request, so the app may show Pending or Processing before completion rather than reporting instant deletion.

A Member can delete their account and leave the Household while shared Household content remains. If that account is designated as the managing adult for a Child Profile, deleting the account does not by itself delete the profile or its shared history; the Household Owner can designate another active account holder or archive the profile. An Owner of a Household with other members must first transfer ownership to an existing Member. A sole Owner and sole member must explicitly choose Delete account and family, which removes the Household, managed Child Profiles, and other shared Household content. Sessions are revoked during processing, and local app data is cleared after the server confirms completion.

Some sanitized security, operational, or audit records and de-identified technical links may remain where needed to protect the service, preserve system integrity, or meet applicable requirements. See the separate Delete Account page for step-by-step instructions.

Data Retention

Pinamily does not apply one universal retention period to every record. Account and Household information is generally kept while needed to provide the service and then handled through the relevant membership, Household, deletion, security, and operational lifecycle. Archiving a managed Child Profile keeps the profile and its existing shared event and completed-chore history while the Household continues; active chores are unassigned and the archived profile is unavailable for new assignments. Deleting the Household removes its managed Child Profiles and related Household records through the Household deletion process.

Specific current periods are: 90 days for raw first-party product analytics events, up to 24 months for limited raw or minimal website marketing click events, and 7 days for completed privacy-export artifacts. Aggregated marketing statistics may be retained longer than the underlying click events. Authentication, billing, support, security, audit, and operational records may be retained for the time needed for their purpose, service integrity, dispute handling, fraud prevention, or applicable legal requirements. Pinamily minimizes or sanitizes retained references where the deletion lifecycle requires it.

Service Providers

Pinamily uses or is designed to use a limited set of providers for release functions. Availability and configuration can vary by platform, market, and environment:

• Apple: App Store purchasing, subscription administration, and Store transaction verification for iOS.
• Google: Google Play purchasing and subscription administration for Android; Google AdMob and User Messaging Platform for eligible Free-plan banner ads and related privacy choices.
• Mailgun: delivery of verification, account and recovery, invitation, support, and operational email.
• Cloudflare R2: private object storage for completed privacy-export artifacts.

Pinamily does not list an observability vendor because no concrete third-party analytics or OTLP vendor is selected. This policy also does not name a hosting or database vendor that has not been ratified for release.

Security

Pinamily uses technical and organizational safeguards appropriate to the service, including authenticated and role-authorized access, verified sessions, hashed passwords, protected device credential storage, data minimization, private export storage, short-lived export links, and controls intended to keep secrets and sensitive evidence out of logs and analytics.

No online service can guarantee absolute security. Keep your credentials private, use your device security controls, and report suspected unauthorized access through Help and support.

International Use

Pinamily is designed for use in multiple markets. When you use the service, information may be processed in locations where Pinamily operations or the providers described above handle the relevant function. Privacy rights and provider disclosures can vary by location, and market-specific consent controls are applied where the product is configured to require them.

Children and Family Use

A Household Owner can create a managed Child Profile for a child in the Household. A Child Profile is part of the Household, not a Pinamily account: it has no independent sign-in, membership, or Household role. It contains a display name, calendar color, active or archived status, and a link to the account holder designated as its managing adult. It can be associated with shared events, chores, and completion history.

Current Household members can see Child Profiles and associated shared content. Only the Household Owner can create, edit, change the designated managing adult, or archive a profile. Selecting a managing adult confirms only that the person has an active account in the same Household; it does not verify age, relationship, guardianship, or other legal authority.

Archiving a Child Profile removes it from new assignments and unassigns active chores, but keeps existing shared history. A Personal Export does not include managed Child Profiles; a separate Household Backup controlled by the Owner includes active and archived profiles. Deleting the managing adult's account does not by itself delete the profile or its shared history. Deleting the Household removes its managed Child Profiles and related Household data.

Your Choices and Rights

You can choose what Household content to add, who to invite, whether to enable external device calendars, which calendars to display, and whether to allow local notifications. Store controls let you manage subscriptions. Eligible advertising flows provide the privacy choices required for the relevant market.

The app provides Personal Export, account deletion, active-session controls, and signed-in support. Depending on where you live, applicable law may also give you rights concerning access, correction, deletion, restriction, objection, or portability. A Personal Export does not include managed Child Profiles. If you can sign in, use More > Help and support for a request concerning Child Profile data. If you cannot sign in, visit the public Support page for the current status of external contact options. Pinamily may need information sufficient to assess identity, authority, the affected profile, and the request scope before taking action.

Changes to This Policy

This policy may be updated as Pinamily changes or as legal and operational requirements evolve. The updated version will be posted at this URL with a revised date, and additional notice may be provided in the app when appropriate.

Contact

For privacy questions or requests, open Pinamily and go to More > Help and support. If you cannot sign in, email pinamily.app@gmail.com or visit https://pinamily.app/support#contact-us-by-email. For a request about personal data, including information associated with a managed Child Profile, describe the affected account, Household or profile and the action requested. Pinamily may request information reasonably necessary to assess identity, authority, the affected data, and the scope before acting.