Legal

Privacy Policy

Version 1.0 · Last updated: October 9, 2026

In short

We use your data to make Family Space work for you and your family. We don't sell personal data or use it for personalized advertising.
We collect what is needed: your account, your family's profiles and what you add to the app.
Usage metrics never include names, emails, titles or text you write.
You can correct your data in the app and delete your account at any time.

1. Who we are

Family Space is developed and operated by Lex Tec (CNPJ 44.403.777/0001-72, registered at Quadra 10 Conjunto L, Planaltina-DF, Brazil), the controller of the personal data processed in the service under Brazil's General Data Protection Law (Law No. 13,709/2018, “LGPD”).

This policy covers the Family Space app for iOS and Android, the web app at app.familyspaceapp.com and this website (familyspaceapp.com). Read it together with the Terms of Use.

2. Data we collect

2.1 Your account

Sign-up: email, display name, preferred language and the date you confirmed your email.
Password: we store only a cryptographic hash (Argon2), never the password itself.
Sign in with Google or Apple (when available): your account identifier at that provider and, if it shares them, your verified email, name and language.
Guest mode (app): an account without an email, linked to your device identifier.

2.2 Family and member data

Family: family name and time zone.
Member profiles: name, member type (for example adult, child or pet), avatar color, roles and permissions and, optionally, date of birth.
Managed profiles: an adult can add people who don't have an account, such as children or grandparents. Whoever adds them confirms they are responsible for that person or have their permission.
Invitations: the invitee's email and the details of the profile proposed for them.

2.3 What you add to the app

Calendar events (title, description, typed location, meeting link, time and participants), birthdays, tasks, chores, recurrences, reminders and the family's activity history (who did what and the item's title). This content is created by you and your family members.

Free-text fields, such as titles, descriptions, notes and locations, accept whatever you write, including information about other people. Only add and share what is necessary and appropriate for organizing your family, and respect the privacy of the people you mention. Some of this information, such as a family member's health details, may count as sensitive personal data under the law (see section 3).

2.4 Device and notifications

Device identifier, platform (iOS or Android) and app version.
Push notification token.
Your notification preferences and the notifications sent to you (in the app, by push and by email).

2.5 Technical and security data

IP address: used at request time to limit abuse. It is not stored with your account.
Technical logs: method, route and result of each request. They don't include headers or the content you send.

2.6 Usage metrics

We use Google Analytics for Firebase to understand how the app is used and to improve it. We collect:

events (for example “task created”);
the name of the screen visited;
counts, platform and app version;
a random identifier for your account.

We never send names, emails, titles or free text. We don't collect the device advertising identifier (IDFA/AAID), and ad personalization is turned off.

In the web app, metrics are turned on only after you consent in the cookie notice. You can withdraw consent at any time in Settings › Privacy.
In the iOS and Android apps, metrics are based on our legitimate interest in improving the service. You can object using the contact in section 13.

2.7 What we don't collect

We don't collect your GPS location, your contacts, your photos or payment data.

3. How we use it and legal bases

Purpose	Data	Legal basis (LGPD)
Create and maintain your account and sign you in	Account, device	Performance of a contract (art. 7, V)
Provide family features: calendar, tasks, members and invitations	Family, members, content	Performance of a contract (art. 7, V)
Send service emails (confirmation, password reset, invitations and account notices) and notifications	Email, push token, notification content	Performance of a contract (art. 7, V)
Protect the service, prevent abuse and fix errors	Technical data	Legitimate interest (art. 7, IX)
Measure usage to improve the product	Usage metrics	Consent on the web (art. 7, I); legitimate interest in the apps (art. 7, IX)
Comply with legal obligations and defend rights	The data needed in each case	Art. 7, II and VI

Sensitive personal data that you choose to enter in free-text fields, such as health information, is processed only to provide the feature where it was entered, in line with the LGPD's specific requirements for this type of data (art. 11).

We don't make decisions about you based solely on automated processing.

Your family members: family content is visible to its members, according to each item's visibility and each member's permissions.
Service providers (processors), who process data only on our behalf:
- Hetzner Online GmbH: hosting for the servers and database.
- Google / Firebase: push notification delivery and usage metrics.
- Apple: notification delivery on iOS.
- A transactional email provider.
- Hostinger and Cloudflare: hosting and network for this website.
- Google Fonts: fonts for this website; Google receives visitors' IP addresses.
Authorities: when required by law or court order.

We don't sell or rent personal data.

5. International transfers

Some of these providers store or process data outside Brazil, for example in the European Union and the United States. In those cases we use the safeguards in art. 33 of the LGPD, such as contractual clauses that ensure adequate data protection.

6. How long we keep it

Data	Period
Account, profile, sessions, devices and preferences	While the account exists
Family content and activity history	While the family exists
Notifications	90 days
Codes and links in security emails	Erased within 24 hours of sending
Accepted, declined or expired invitations (invitations expire after 7 days)	30 days after they close
Technical logs	Up to 30 days

We may keep data longer when the law requires it or to defend rights in legal proceedings.

Deleting an account does not, by itself, delete the family's shared content. See section 7.

7. Deleting your account or family

You can request deletion of your account in the app, under Settings. You may need to confirm your identity, for example with your password. Once you make the request, access to the account and active sessions are ended. Data deletion is carried out by internal processes and may not finish right away.

Account data: your profile, sessions, devices, notifications and preferences, and your personal content (events and birthdays marked as personal, and reminders) are deleted. Invitations and emails sent to your address are deleted too.
Shared family content: tasks, events and other family items you created belong to the family and may remain available to the other members, no longer linked to your account.
Activity history: stays available while the family exists. We don't keep your name to preserve this history; instead, the app may show a generic label such as “Former member”.
Text written by other members: we can't automatically remove mentions of you that other people wrote in titles, descriptions or notes. You can ask the author to edit the text or contact us using the details in section 13.
Sole owner: if you are a family's only owner, deleting your account also deletes that family and all of its shared content. The other members keep their own accounts.

An owner can also delete the whole family, which erases all of its content for every member. Data we are legally required to keep may be retained for the period set by law.

8. Your rights

Under the LGPD (art. 18), you can ask for, as applicable:

confirmation that we process your data, and access to it;
correction of incomplete or outdated data;
anonymization, blocking or deletion of data that is unnecessary or processed unlawfully;
portability;
information about who we share your data with;
withdrawal of consent;
objection to processing based on legitimate interest.

You can correct your data and request deletion of your account directly in the app. For any other request, write to the contact in section 13. We reply within the deadlines set by applicable law. To protect your data, we may ask for additional information to confirm your identity.

You can also complain to Brazil's National Data Protection Authority (ANPD). If the European Union's General Data Protection Regulation (GDPR) or the UK GDPR applies to the processing of your data, you also have the rights those laws provide, including the right to complain to the competent data protection authority.

9. Children and teenagers

Only people aged 18 or over can create an account on their own.
Children and teenagers may only use an account with the authorization and under the supervision of their parent or legal guardian. The rules of use are in the Terms of Use.
Children and other dependents can also appear as managed profiles, added and controlled by a responsible adult, with minimal data (name, color and, if the adult chooses, date of birth).
A guardian's authorization to use the app is not the same as the legal basis for processing data. We process children's and teenagers' data only where the LGPD allows it, following the requirements of art. 14 and of the Digital ECA (Law No. 15,211/2025).
This data is processed in the best interest of the child or teenager and in line with the applicable legal protections. We never use it for advertising.

If we find a minor's account being used without proper authorization, we may take protective measures, such as restricting access, suspending the account, requesting the guardian's authorization or, when necessary, deleting it.

10. Cookies and local storage

This website doesn't use cookies. It only stores the last language you chose in your browser (fs-lang).
In the web app:
- the essential fs_refresh_token cookie (HttpOnly, valid for 30 days) keeps you signed in;
- local storage keeps your theme, language, metrics choice and the page to open after sign-in;
- metrics cookies (_ga) are only set with your consent and are deleted if you withdraw it.
In the apps: session credentials are kept in the system's secure storage (Keychain/Keystore) and preferences in the app's storage.

11. Security

All traffic uses an encrypted connection (HTTPS).
Passwords and tokens are stored only as hashes.
The database is not exposed to the internet.
Access to each family is controlled by roles and permissions checked on the server.

No system is completely immune to failures. If a security incident poses a relevant risk, we will notify you and the ANPD as the law requires.

12. Changes to this policy

We may update this policy. The version and date at the top of the page show the latest one. If there are relevant changes, we will tell you in the app or by email before they take effect.

13. Contact

For questions about privacy, to exercise your rights or to ask for information about how your personal data is processed, write to [email protected].