Privacy Policy
What FamilyDeck shares, who can read it, what the relay server can and cannot see, and how to delete everything.
Last updated October 27, 2026.
Who we are
FamilyDeck is made by Harborline (“we”, “us”, “our”). You can reach us at harborlineapps@protonmail.com.
How FamilyDeck works
A parent starts a family on their phone, with a family name and their own name, and becomes its owner. Other phones join in person: a parent shows a one-time QR code (it works once, for 10 minutes), the new phone scans it, and the parent approves it on their phone. A child without a phone can be added as a person, without a phone. We never receive anyone’s name, phone number, email address or password, because the app doesn’t ask for them and has no account to put them in.
Each phone makes its own keys for the family: one to sign its changes and one to receive sealed messages. Every change is signed by the phone that made it and sealed separately for each other family phone before it leaves. The encryption uses libsodium (X25519 keys with XSalsa20-Poly1305, and Ed25519 signatures), and the keys never leave the family’s phones. Every phone checks each change it receives, its signature and whether that person is allowed to make it; the relay is never asked.
What family members can see
Every phone in the family, children’s phones too, keeps a full copy of the family’s data:
- The family name, the currency it counts in, and who the owner is.
- The people in the family: the names given in the app and each person’s role (parent or child).
- Chores, with their rewards, how often they repeat and who they are for; which child picked which chore for which day, and whether it was done, approved or declined, with any note and reason.
- Rewards: each child’s points and money, approvals, payouts and bonuses. These are only numbers; FamilyDeck moves no money.
- The grocery list.
- Events and trips: the day, time, place, notes, who is going, the reminder and the checklist.
The app shows each person what their role needs; for example a child sees their own chores and balance. The data itself is on every family phone.
What the relay server can see
When the phones share, changes travel through a relay server: by default Harborline’s relay, the same one FamilyBeacon uses. It can see:
| Data | What it is | How long it is kept |
|---|---|---|
| Mailbox addresses | Random values each phone creates for its inbox. They aren’t linked to your name, phone number, device ID or Google account. FamilyDeck’s mailboxes look exactly like FamilyBeacon’s, so the relay can’t tell which app a mailbox belongs to. | Only while messages are waiting for that mailbox |
| Encrypted messages | Sealed content the relay can’t open, padded so that its size gives little away. | Deleted when collected, and in any case within 24 hours |
| Timing | When messages arrive and are collected. A phone shares when the app opens, after a change and about every 15 minutes in the background, so the relay can see roughly when a phone is in use, but not who it belongs to or what changed. | Not recorded |
| IP addresses | Needed to answer a connection. | Held only in memory, never written to disk |
The relay never sees names, chores, events, amounts or the grocery list.
Cloudflare. Harborline’s relay is reached through Cloudflare, which carries the connection between your phone and our server. Cloudflare handles the same technical details as the relay (IP address, mailbox address, encrypted message) under its own privacy policy. It can’t read the encrypted content either.
Your own server. When you start a family you can type the address of your own server instead of Harborline’s; phones that join use the family’s server. In that case that server’s operator, not us, handles the details above. Everything it holds is still encrypted the same way.
What stays on your phone
FamilyDeck keeps two files on each phone:
- The phone’s keys, the family’s id and the sync state, encrypted with a key held in the phone’s Android Keystore.
- A log of every change the family has made, each one sealed.
Neither is included in Android cloud backups or device-to-device transfers. Reminders, including the parents’ end-of-day check, are set on each phone and need nothing from us.
What we never collect
- No account, sign-in, email address or phone number.
- No readable chores, events, names, amounts or lists. The relay only ever holds encrypted copies.
- No analytics, crash reporting or usage statistics.
- No advertising, and no ad or tracking software.
- No contacts, photos, location or browsing.
- We never sell or share data, and we never pass it to data brokers.
Other services the app uses
None. FamilyDeck has no third-party services and talks only to your family’s relay. Feedback in the app opens our website in your browser; FamilyDeck itself sends nothing.
Why the app asks for the permissions it does
- Internet and network state. To reach the family’s relay, and so the background sync waits for a network.
- Notifications. Event reminders, the parents’ end-of-day check, and approvals for children. On Android 13 and newer, Android asks you.
- Camera. Only to scan a family’s join code, asked when you scan. The code is read on the phone.
- Run at startup. So reminders and the background sync come back after the phone restarts.
You are always in control
- You join a family only by scanning a code in person, and only after a parent approves it on their phone.
- Parents other than the owner can leave the family. The owner hands the family to another parent first.
- The owner can change roles and remove people; parents can remove children.
- Anyone can remove the family from their own phone at any time, in Family.
Deleting your data
“Remove the family from this phone” deletes both files and the Keystore key from your phone. Uninstalling the app, or clearing its storage in Android’s settings, also deletes everything on the phone. Anything still waiting on the relay is unreadable and is deleted within 24 hours. We hold no other copy, so there is nothing else to request. The other family phones keep their own copy of the family’s data, including what you added.
Children
FamilyDeck is made for families, and children use it on their own phones or through a parent’s. We don’t collect personal information from anyone, and a family’s data can only be read on its own phones.
Security
Harborline’s relay is reached over HTTPS, and everything a family shares is also end-to-end encrypted. Keys are made on the phone and protected by the Android Keystore. If you find a security problem, please email us.
This website
This site is hosted by Netlify. Like any web host, Netlify’s servers see the ordinary technical details of a visit, such as your IP address, when they deliver a page. We don’t use analytics, tracking or advertising on this site. The light or dark theme you pick is remembered only in your own browser. Fonts and images are served from this site, so your browser doesn’t contact Google Fonts or any other third party.
The report form. If you send us a bug report or an idea through the form on the home page, the details you enter (your email address, your message, and any phone details you choose to give) are received and stored by Netlify’s form service and delivered to us by email. We use them only to understand the problem and reply to you. We don’t share them with anyone else. Email us if you would like a submission deleted.
Google Play
FamilyDeck isn’t on Google Play yet. When it is, Google Play will handle installation, and any purchase, under its own privacy policy.
Changes to this policy
If this policy changes, the new version will be posted here with a new date. Because the app has no account and no way to contact you, this page is the place to check.
Contact
Questions about this policy: harborlineapps@protonmail.com.