Privacy policy
Version 15 · October 19, 2026
This covers the Smart Fams app (today at app.smartfams.com,
and the coming iPhone app) and this website, smartfams.com. It's deliberately
written in plain language: if anything is unclear, ask us and we'll fix it.
The short version
- No passwords, no phone numbers. We ask adults for an email address, verified with a code, so they can get back in if they change phones; we never ask a child for one. The Weekly Postcard by email is optional and turns on with one tap.
- There are no ads, no analytics, no trackers and no profiling of children.
- We don't sell or hand over personal data to anyone, for advertising or anything else.
- Your family's data is what your family writes in the app, and we delete it if you ask.
1. Who we are
Smart Fams is a product of We Sync Global, LLC, a small independent company whose mailing address is 333 S. Grand Ave, Suite 3310, Los Angeles, CA 90071 and whose phone number is (323) 524-4967. For anything about privacy — a copy of your data, a correction, a deletion or a question — write to support@smartfams.com. A person answers, normally within one or two working days and always within 30 days.
2. What data exists
Everything we store is written by the family itself inside the app:
| Data | What it's for |
|---|---|
| Each member's profile: name or nickname, emoji, colour, whether they're an adult and their year of birth | Knowing who is who. The year is required on every profile: for a child, to suggest the agreements for their age and so the database can never store an email on their profile; for an adult, to confirm they are one |
| A fingerprint of the PIN (bcrypt hash), on the server | Checking the PIN without storing the number anywhere. It never leaves the server, and five failed attempts in a row lock the profile for fifteen minutes. Each device also keeps a separate local fingerprint, only so you can switch profiles offline |
| Each adult's email address, and whether it's verified | Getting back in from a new phone and, if they turn it on, receiving the Weekly Postcard (next sections) |
| Goals, activities planned, completed or cancelled, and the notes they write | The week's plan and the family's history |
| Agreements and permissions between adults and children, requests, challenges and meetings | How permissions are shared out and what the family decided |
| Cheers, postcards and the garden | The celebrating part |
| Invitations: the code and who invited whom | Letting a new member in |
| An anonymous per-device identifier (a random number the app creates the first time, with no name or email), which of the family's profiles that device is linked to, a device label and the date of last use | So the server knows which device writes what, and so no device from another family can read your log. It is not an advertising identifier and is shared with nobody |
| The family's time zone | Closing the week on Sunday at 9:00 your time and sending the Postcard at that hour |
| The plan status (trial, active, grace or expired) and when the trial ends | Knowing whether the family can keep writing or is read-only |
| The one-time codes — the 6-digit one to verify the email, the 8-letter one to sign in on a new device and the confirmation link — stored only as a fingerprint (hash), with their expiry (10 minutes, 15 minutes or 24 hours depending on the case) and which device requested them | Checking the code without anyone, us included, being able to read it in the database |
| One anonymous ⭐ per Library goal and per device | Sorting the Library by popularity. It is the only thing that crosses families, and it only says "this device starred this goal", with no name and no family |
| A record of every email we send: what kind (Postcard, code, email confirmation, consent confirmation for a child, inactivity deletion notice), which family, the address's fingerprint and the identifier the provider returns | Counting sends so we stay under the daily quota and never send the same Postcard twice |
| A record of every support action on a family and of every inactivity deletion: what was done, when, on which profile or invitation (by its internal identifier) and why, with no names or addresses | Being able to say what we did and when if anyone asks |
What we never ask for or store: a password, phone number, postal address, contacts, photos, camera, microphone or the device's location. The app has no passwords: there is none to lose. The one piece of contact information that exists is each adult's email address: we ask for it when they create their profile (and, for those already in, from settings) so they can get back in if they change phones and, if they turn it on, for the Weekly Postcard. Always an adult's, and always removable from those same settings.
We never ask for or store a child's email address, whether or not the Postcard is turned on in that family. It isn't only that the form is never offered to them: our database refuses to store an address on a child's profile, and on an adult's profile whose year of birth says otherwise.
The adult's email: verifying it, and signing in with it
When they enter their address we send a single email with a 6-digit code that is typed inside the app, on the same phone it was requested from: that's how we check the inbox is theirs. If the code lands in the wrong inbox it is useless, because that phone is needed. Until the address is verified we don't use it for anything.
With a verified address, an adult who changes phones can ask from the sign-in screen for a sign-in code to be emailed to them (valid for 15 minutes) and then type their usual PIN: the email alone isn't enough, and neither is the PIN alone. There are no passwords. We answer that request the same way whether or not the address exists, so nobody can use it to find out which addresses have a profile.
The Weekly Postcard, by email (optional)
If an adult in the family turns it on in settings — one tap, on their already-verified address — every Sunday we email them the Weekly Postcard — the same summary already shown inside the app — and, if something changes about their subscription, a notice about that subscription. It's the only commercial email we send, and only to whoever asked for it. Addresses saved before this version are verified the same way, with the code, from settings; anyone who had already confirmed from their inbox has nothing to do.
What the email contains: the family's names — children's included — and what each of them did that week, the same as the app's own screen. The attached image, the one meant for sharing, carries no children's names: only their avatar.
What we store: their email address, whether it's verified and when, whether the Postcard subscription is still active, and when and from where they turned it on. To avoid emailing someone who unsubscribed or whose address bounced, we also keep a fingerprint (SHA-256 hash) of that address on a suppression list — not the address itself, just its fingerprint, and we keep that forever: it's what stops us emailing them again by mistake.
We also keep a record of every sign-up, activation and unsubscribe: the address's fingerprint, what happened and when, never the address itself. That record survives the deletion of the profile and of the family, and it is the only thing that lets us answer someone who asks why they received an email from us.
How to opt out: the one-click unsubscribe link on every email — no need to open the app or write to us —, by removing the address in the app's own settings, or by asking support@smartfams.com. Unsubscribing stops the Postcard immediately; removing the address deletes it from the profile (only its fingerprint remains, see §6).
Every Postcard email also carries the company's postal address in the footer, as US commercial email law (CAN-SPAM) requires.
3. Where it lives
On your devices
The app keeps in the browser's local storage a copy of the family's log (so it works offline), which member uses that device, that device's anonymous session (the identifier from the table above and its credentials, which is what lets it talk to the server), a local fingerprint of the PIN of each profile opened on it, the version of the Terms accepted, the light or dark theme, whether sound is off, a cached weather reading, and some technical bookkeeping so nothing is sent twice. We use no cookies, neither in the app nor on this site.
On the server
The family's log lives in a PostgreSQL database hosted by Supabase in the
United States (region us-west-1), which also manages each device's anonymous
session. The app and this site are served through Cloudflare. Both, like any
web server, handle the request and keep temporary technical logs (IP address, time, browser
type) to serve the pages and protect them from attacks.
4. Children
The app is meant to be used as a family, and there are children in it. A child enters the app with an invitation created by their parent or legal guardian: when creating it they see what we store about the child and why, and they give their consent (the full list is in §2). Right after that we send a confirmation to their verified email with what they authorized and how to withdraw it; that is why inviting a child requires a verified email. The adults in the family can correct that profile in the app, and whoever invited the child or whoever leads the family can delete it at any time (or ask us to): deleting it withdraws the consent and stops any further collection; their name, birth year and avatar are replaced by "Deleted profile" throughout the record (§6) and what they did stays in the family's history without a name. If the parent or guardian would rather that disappear too, they ask us and we delete it. A child's data is the minimum the game needs — a name or nickname, an emoji or avatar, the year of birth, their goals, activities and notes, the family's decisions about them (agreements, requests, challenges), the cheers they give or receive, a fingerprint of their PIN, the anonymous identifier of their device and, as on any server, their IP address in the technical logs (§3) — and it is never sold, never used for third-party advertising and never profiled. Only the providers that run the app see it (§5): for example, it reaches our email provider (Resend) when an adult in the family asks us to send them the Weekly Postcard, because that is the only way to deliver it. Beyond that, only if the law requires it. We ask no child for contact details.
In the iPhone app, Apple may tell us the age range of the device's account (under 13, 13-15, 16-17 or adult), never the date of birth, and only if the person or their guardian agrees to share it. That range is stored only on that device, is never sent to our servers, and is used solely to apply the family's agreements and limits: if Apple says the person using that iPhone is a minor, the app treats them as one even if the profile is marked as an adult.
How long we keep a child's data: for as long as their family uses the app, and not a day longer than that needs. If no device in the family opens the app for 12 months, we email the adults (if they have a verified address) and delete the whole family, children's profiles included, 30 days after the notice, unless someone in the family opens the app again first. An adult can delete a child's profile, or the whole family, earlier and at any time from the app.
5. Who it's shared with
Nobody who isn't needed to make the app work. Today that means:
| Who | What they get, and why |
|---|---|
| Supabase | Stores the family's log (it is the database) and manages each device's anonymous session. Like any server, it sees the IP address of each request in its technical logs |
| Resend | Sends the Weekly Postcard and the code emails — verification and sign-in — (United States). It sees the adult's address and the text of the email; the Postcard's includes the family's names, the code emails only the adult's; the consent confirmation, the adult's name and the child's nickname; the inactivity deletion notice, the adult's name and the family's |
| Cloudflare | Serves the app and this site; sees the request and the IP address. Also, the first time a device opens the app, its Turnstile check decides whether it is a person or an automated program: it looks at technical characteristics of the browser and the IP, sets no tracking cookies, and almost always passes without showing anything (occasionally it asks you to tick a box). This happens only that first time, never on every use |
| Open-Meteo | The weather shown in the app. It's requested with the town's fixed coordinates, never with your device's location; it does see the requesting IP |
Neither this website (smartfams.com) nor the app loads anything from anyone else: the
typefaces are hosted by us (since September 19, 2026 inside the app too, which used to download them
from Google Fonts) and the site doesn't have a single script. Once the app is published on the App Store,
Apple will handle the download and any payment under its own policies.
"Do Not Track." Neither the app nor this site tracks anyone over time or across websites, nor lets a third party do so through them. That's why your browser's "Do Not Track" signal changes nothing: there is no tracking to switch off.
We might also have to hand over data if a valid legal order required it. We will never sell it.
6. How long we keep it
The family's log is append-only by design: nothing is edited or deleted behind the scenes, so that the history the family sees is honest (a cancelled activity is recorded as cancelled, it doesn't vanish). We keep it for as long as the family uses the app: if no device in the family opens it for 12 months, we email the adults (if they have a verified address) and delete the family 30 days after the notice, unless someone opens the app again first.
Deletion happens from the app itself (Settings → "Delete my profile" or "Delete the family"; whoever leads the family can also delete another member's profile, and whoever invited a child, that child's) and is immediate. When a profile is deleted, its name, year of birth and avatar are replaced by "Deleted profile" throughout the log. If you'd rather ask us by email, we delete that family's entire log from the server within 30 days at the latest and confirm when it's done. To clear one device, clear the site's data in the browser or uninstall the app.
When we delete a family, its entire log and any stored addresses go with it. Four traces remain, and none carries a name or an address itself: the fingerprint of addresses that unsubscribed or bounced, which is what stops us emailing them again by mistake; the Postcard consent record — the fingerprint, what happened and when — which is the proof that someone asked us for the Postcard and of when they stopped asking; the record that we sent the consent confirmation for a child and, if there was one, the notice before an inactivity deletion — the address's fingerprint, the kind, the date and the provider's identifier — which is the proof that we gave notice; and the record of support actions and inactivity deletions — what was done and when. All four are kept indefinitely.
If you write to us at support@smartfams.com (a question, a request about your data, or the arbitration opt-out provided for in the Terms of Use), we keep that email and our reply for as long as needed to help you and, for the opt-out, for as long as your family is in the app, because it is what evidences your decision.
7. Your rights
- See and copy. The app's settings give you two things: a readable summary — a document with who you are, your goals and what you did week by week, to read, keep or print — and a JSON backup of the whole log, which is the one that can be loaded back into the app. Both are generated on your own phone. If you'd rather ask us for it, we'll send it.
- Correct. Almost everything can be fixed inside the app; whatever can't, we'll fix for you.
- Delete. From the app (Settings → "Delete my profile" or "Delete the family"; whoever leads the family can delete another member's profile, and whoever invited a child, that child's), or by writing to us.
- Recover the PIN. An adult with a verified email requests a code from the sign-in screen and chooses a new PIN; a child's PIN is changed by an adult in the family.
- Ask. What we hold about you and why, free and with no conditions.
If you live in the European Union or in California you also have the rights the GDPR or the CCPA give you. They're exercised the same way: an email to support@smartfams.com. And for the record: we do not sell or share personal data in the sense those laws mean.
8. Security, and its limits
- Everything travels encrypted over HTTPS.
- Each device has its own anonymous session, and the server only lets a family's log be read or written by devices linked to a profile in that family. A device is linked by typing the profile's PIN or, for an adult, with a code we send to their verified email followed by their PIN. No device from another family can read your log.
- The PIN is never stored or transmitted in the clear: the server holds only its bcrypt fingerprint, and five failed attempts in a row lock the profile for fifteen minutes.
- Each member's calendar (ICS) link works without a password, because calendar programs can't sign in. Anyone holding that link can see that member's activities, so share it carefully.
- No system is infallible. If something happened that affected your data, we would tell you.
9. Changes
If this changes we'll raise the version number and the date at the top, and if the change matters we'll say so inside the app. Older versions are available by email.
10. Contact
support@smartfams.com · support page
By mail: We Sync Global, LLC · 333 S. Grand Ave, Suite 3310, Los Angeles, CA 90071