FamilyChaosFamilyChaos

Privacy Policy

Effective date: 2026-08-22 · Version 1.3

1. Who We Are

FamilyChaos is operated by Justin Robinson (“we”, “us”, “our”). For privacy questions, contact us at privacy@familychaos.ca.

2. What Data We Collect and Why

We collect the following personal data:

  • Account data: display name, email address, hashed password — needed to create and authenticate your account.
  • Family content: calendar events, lists, chore assignments, bills, notes, meal plans, and recipes — the core service you signed up for.
  • Vault entries: passwords and secure notes stored in the Vault are end-to-end encrypted on your device. We store only encrypted ciphertext and never have access to the contents.
  • External calendar connections: if you choose to connect Google Calendar, Microsoft Calendar, iCloud, or an ICS feed, we store encrypted OAuth credentials or the ICS URL and import event data (titles, descriptions, times, and locations) from those services. We do not access your external account beyond the calendar data you specifically grant access to.
  • Child member data: display name, date of birth, parental consent record — required to comply with COPPA, GDPR Article 8, and PIPEDA when a child joins the family. See our Children's Privacy Notice.
  • Billing data: payment information is processed by Stripe. We do not store your card number.
  • Technical data: IP address (used briefly at child invite time to determine applicable privacy law — not stored), device session metadata (user agent, last active time).
  • Website analytics: when you visit our marketing website (familychaos.ca), Google Analytics collects page views, approximate location (country/region derived from IP — not stored by us), browser type, device type, and referring URL. This data is used solely to understand which pages are visited and improve the site. It is not linked to your account and does not apply to your in-app activity.

3. Legal Basis for Processing

  • Contract performance (Art. 6(1)(b) GDPR): account data, family content, billing data.
  • Parental consent (Art. 6(1)(a) + Art. 8 GDPR / COPPA / PIPEDA): child member data.
  • Legitimate interest (Art. 6(1)(f) GDPR): IP-based jurisdiction detection (brief, in-flight, non-stored); website analytics (aggregate, non-account-linked page-view data used to improve the site).

4. Who We Share Data With

  • Stripe — payment processing. Subject to a Data Processing Agreement.
  • Hosting provider — database and compute infrastructure. Subject to a Data Processing Agreement.
  • AWS SES — transactional email delivery (invites, consent emails). Subject to AWS's Data Processing Agreement.
  • Google LLC — (a) if you connect Google Calendar, event data is retrieved via the Google Calendar API; (b) our marketing website uses Google Analytics 4 to collect aggregate, anonymised page-view data. Both are subject to Google's Data Processing Terms. Google Analytics data is not linked to your account and is not collected within the app.
  • Microsoft Corporation — if you connect Microsoft Calendar, event data is retrieved via Microsoft Graph. Subject to Microsoft's Data Processing Terms.
  • Apple Inc. — if you connect iCloud Calendar, calendar data is retrieved via Apple's CalDAV service.
  • We do not sell your data. We do not share your data with advertisers. We do not share your in-app account or family data with any analytics provider.

5. International Transfers

All personal data is stored, processed, and backed up in Canada (OVHCloud, Quebec). Transactional emails are delivered via AWS SES in the ca-central-1 (Montreal) region. No personal data is transferred outside Canada for storage or processing purposes.

Canada has an EU adequacy decision under GDPR Article 45, meaning transfers of personal data from the European Economic Area (EEA) to FamilyChaos are permissible without additional safeguards.

6. How Long We Keep Your Data

  • Active account data: retained for the duration of your subscription.
  • After cancellation or trial expiry: data retained for 90 days, then permanently deleted. You may request immediate deletion at any time from Settings → Account → Delete family.
  • Parental consent records: retained indefinitely with the child's name removed, as required by law.
  • Backup copies: deleted within 7 days of the active data being deleted (automated backup expiry).

7. Your Rights

Depending on where you live, you have the right to:

  • Access the personal data we hold about you — Settings → Members → Export
  • Correct inaccurate data — Settings → Profile
  • Delete your account and data — Settings → Account → Delete
  • Restrict or object to processing — contact us at privacy@familychaos.ca
  • Data portability — request an export at privacy@familychaos.ca
  • Withdraw consent (children only) — Settings → Members → Withdraw Consent
  • Lodge a complaint with your supervisory authority (GDPR: your national DPA; Canada: OPC; US: FTC)

8. Cookies and Tracking

In the app: we use a refresh token stored in localStorage to keep you signed in. The app does not set any tracking, advertising, or analytics cookies.

On this website (familychaos.ca): we use Google Analytics 4, which sets the following cookies:

  • _ga — distinguishes unique visitors; expires after 2 years.
  • _gid — identifies a browsing session; expires after 24 hours.
  • _ga_* — maintains session state for GA4; expires after 2 years.

These cookies collect aggregate, anonymised data (pages visited, session duration, approximate location). They do not track you across other websites, are not used for advertising, and are not linked to your account. You can opt out at any time using the Google Analytics opt-out browser add-on.

9. Contact Us

Privacy Officer: Justin Robinson
Email: privacy@familychaos.ca
We will respond within 30 days.