Privacy Policy

1. The short version

• Your household's data is visible only to the members of your household. The database enforces that on every request.
• We don't sell your data, share it with advertisers, or show ads. Premium subscriptions pay for FamilyHQ.
• AI features send the relevant slice of your data to an AI model, run on Microsoft Azure, to answer you. It's not used to train models.
• Sharing price data to improve comparisons for other families is off unless you switch it on, and anonymised if you do.
• You can export your data and delete your account at any time.

2. Who is responsible

The responsible party under the Protection of Personal Information Act, 2013 (POPIA) is The WDDNG Co, registration number 2026/583514/07, of 19 Milcliff Road, Paulshof, Sandton, 2191, Gauteng, South Africa ("we", "us"). Our Information Officer can be reached at support@familyhq.tech.

Where you are in the European Union or United Kingdom, we act as the data controller and the GDPR or UK GDPR applies alongside this policy.

3. What we collect

Information you give us

Information collected automatically

• Push token. If you turn notifications on, the device token that lets us send them, and the platform (iOS or Android).
• AI usage. Counts of AI requests and processing units per household, so allowances can be applied. Not the content.
• Crash and performance reports. If the app crashes, a report goes to Sentry with the device model, OS version, app version and a technical trace. It doesn't include your household's data.
• Server logs. Standard request logs (IP address, time, endpoint, status) kept briefly for security and debugging.
• Purchase records. For Android, the purchase token and subscription status Google gives us so we can verify Premium. Apple purchases are verified on the device. We never see your card details.

We don't collect precise location, contacts from your phone's address book, or any advertising identifier.

4. Why we use it

We don't use your data for advertising, and we don't build profiles of you for anyone else.

5. AI features, in detail

Because this is where the most data moves, here is exactly what happens.

• Chat with Thuli. When you send a message, our server assembles a compact summary of the relevant household data (budgets, recent transactions, lists, debts, upcoming events, and facts you've asked her to remember), your recent conversation, and your message, and sends it to a large language model. The model runs on Microsoft Azure AI (Azure OpenAI Service and models available through Azure AI Foundry, which may include models from OpenAI and Anthropic). Under Microsoft's terms for these services your data is not used to train models and is not available to other customers. The reply is shown to you and saved to your conversation.
• Voice. While the voice screen is open, microphone audio is streamed through our server to the same Azure service in real time, and Thuli's spoken reply is streamed back. We don't record or store the audio. A text transcript of the exchange is shown on screen and may be kept in your conversation history.
• Receipts, products and belongings from photos. The photo is sent to the model to read the receipt, identify the product, or describe the item. The photo itself is stored in your household's private storage as part of the record you save.
• Pricing an item at today's cost. The item's name, brand and category (not your photo or personal details) are sent to a web search service to find comparable prices.
• Barcode lookups. The barcode number is looked up in our shared product catalogue and, if it's not there, at Open Food Facts. Only the barcode is sent.
• Address search. When you type an address into the property form, the text you type is sent to Google's Places service (Android) or Apple Maps (iOS) to suggest matches.
• Thuli's actions. When Thuli adds or changes something, it's written to your household's records using your own sign-in, so the same access rules apply as if you'd done it yourself.

You can turn off the "fill in from photo" behaviour in Settings, in which case photos are kept but not sent for identification.

6. Who we share it with

We share personal information only with providers who process it on our behalf, under contracts that restrict what they may do with it:

We'll also disclose information if the law requires it, to protect someone's safety, or as part of a sale or merger of the business, in which case this policy continues to apply to it. We never sell personal information.

Some of these providers are outside South Africa. Where personal information leaves the country we rely on the provider being subject to laws that protect it substantially like POPIA does, or on contractual protections, as section 72 of POPIA allows.

7. Optional price-data sharing

Price comparisons get better when many households contribute what things cost. In Settings you can switch on data sharing. When it's on, product prices from your receipts and lists — the product, the price, the shop and the date — are added to an anonymised pool. Nothing identifying you, your account or your household goes into it, and the pool can't be traced back to you. The app records when you opted in and which version of this policy you saw. It's off by default, and switching it off stops any further contribution immediately.

8. Where it's stored

Your household's records, receipts and photos are stored with Supabase in the European Union. Our application servers run on Microsoft Azure in South Africa North (Johannesburg). Backups are kept by these providers in the same regions.

9. How long we keep it

• Your records: for as long as your household exists, or until you delete them.
• Conversations with Thuli: until you clear the conversation in the app, or your account is deleted.
• Account and household: until you delete your account. When the last member leaves a household, its data is deleted.
• Deleted data: removed from live systems immediately and from backups within 30 days.
• Push tokens: removed when the device unregisters or notifications fail permanently.
• Server logs and crash reports: up to 90 days.
• Purchase and billing records: as long as required for tax and accounting law, typically 5 years.

10. Security

• Every record carries its household, and the database applies row-level security so a request can only ever read or write its own household's rows — even if there were a bug in the app.
• All traffic is encrypted in transit (TLS). Data is encrypted at rest by our providers.
• Passwords are hashed, never stored as text. Sign-in sessions on Android are stored encrypted with a key held in the device's hardware keystore; on iOS, in the Keychain.
• Receipts and photos are in private storage and served only through short-lived signed links to signed-in household members.
• Access to production systems is limited to the people who run the service, and we don't look at your data except to fix a problem you've asked us to fix.

No system is perfectly secure. If we learn of a breach affecting your personal information we'll notify you and the Information Regulator as POPIA requires.

11. Your rights

Under POPIA (and the GDPR where it applies) you can ask us to:

• Tell you what personal information we hold about you, and give you a copy (most of it is already in the app; email us for a full export).
• Correct anything that's wrong (you can edit almost everything in the app).
• Delete your personal information (see below).
• Stop particular processing, or withdraw consent you've given — for example switch off notifications or data sharing in Settings.
• Object to processing based on our legitimate interests.
• Move your data: we'll provide it in a common machine-readable format.

Email support@familyhq.tech. We'll respond within 30 days and may need to confirm it's you. You may also complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@justice.gov.za.

12. Deleting your data

Delete your account from the profile screen in the app (tap your avatar on Home → Delete account), or email us with the subject "Delete my account" from the address on the account. Full steps are on the support page.

Deleting your account removes your sign-in, profile, personal lists and conversation history immediately. Household records you created remain with the household for its other members; if you're the last member, the whole household — including receipts, photos and the inventory — is deleted. Backups clear within 30 days. Records we must keep for tax or legal reasons (for example, that a subscription was paid) are kept only for as long as the law requires, without the rest of your data.

13. Children

FamilyHQ is for adults and isn't directed at children under 18. We don't knowingly create accounts for children. Parents and guardians may record information about their own children — names, birthdays, savings, events — and are responsible for doing so appropriately; that information is subject to the same protections as everything else in the household. If you believe a child has created an account, email us and we'll delete it.

14. Device permissions

• Camera and photos: to scan barcodes and photograph receipts, products and belongings. Used only when you tap to do so.
• Microphone: to talk to Thuli. Only while the voice screen is open.
• Notifications: to tell you about savings on your shopping lists. Asked for from the shopping list, not on first launch.

You can change any of these in your phone's settings at any time.

15. Changes

When this policy changes, the version and date at the top will change and, if the change matters to you, we'll tell you in the app or by email before it takes effect. The version you agreed to when opting into data sharing is recorded with your choice.

16. Contact

The WDDNG Co — Information Officer
19 Milcliff Road, Paulshof, Sandton, 2191, Gauteng, South Africa
Email: support@familyhq.tech