Famyuni makes family help visible within groups. This policy explains which data is used on famyuni.com and in the Android application, why it is used, who it is shared with and how to exercise your rights.
1 Data controller
Nicolas VIGNY is responsible for the processing described in this policy, as part of the Famyuni project, which is currently published in a personal, non-professional capacity. Personal data contact: contact@famyuni.com.
2 Data used and its sources
- Account: first name, last name, email address, password stored as a hash, optional photo, identifier, creation and login dates, language, country, currency and time zone.
- Group life: membership and role, invitations, contribution capacities, stated availability, completed or planned contributions, time, distances, expenses and declared support.
- Shared content: news, comments, votes, notes, uploaded photos and documents, and any names, contact details or other information they contain.
- Technical operation: sessions and login tokens, IP address or its hash, browser or device information, notification identifiers, usage dates and events.
- Communications and choices: messages sent to support, communication preferences and evidence of choices concerning the newsletter, partner emails and, where applicable, link tracking.
Age information is requested when the account is created to check eligibility from age 15. Data comes from you, your device and, for invitations and family content, other members. Last name, first name, email and password are required to create an account; registration is not possible without them. Photos, documents and additional information are optional.
If a member invites you or enters information about you when you do not have an account, you can contact me to find out its source and exercise your rights. I will provide the information required by the GDPR within the applicable time limits.
3 Purposes and legal bases
Each use serves a specific purpose. The table below distinguishes the operation requested by members, security and optional communications.
Use of data | Legal basis |
|---|---|
Creating the account, authenticating the member, managing groups, contributions, votes and requested content. | Performance of the requested service and the contractual relationship with the member, even when the service is free (Article 6(1)(b) of the GDPR). |
Sending messages necessary for the account and group; delivering service notifications according to the member’s settings. | Performance of the requested service (Article 6(1)(b)). Technical permission from the browser or phone is still required to display push notifications. |
Sending an invitation and processing the contact details of people mentioned in a group who do not have an account. | Legitimate interest in enabling mutual help and contact requested by a member, within the limits of the person’s expectations and rights (Article 6(1)(f)). |
Preventing abuse and securing access, including through reCAPTCHA; diagnosing incidents and producing internal usage statistics. | Legitimate interest in protecting the service and improving its operation (Article 6(1)(f)), subject to the specific rules applicable to trackers. |
Sending the Famyuni newsletter and partner information or offers based on two separate choices. Measuring link clicks when the applicable tracking conditions are met. | Consent for each category of marketing communications (Article 6(1)(a) of the GDPR). Tracking subject to tracker rules requires specific consent, separate from receiving messages. |
Responding to requests concerning rights and legally grounded requests from authorities. | Legal obligations (Article 6(1)(c)). Retention strictly necessary to defend a right is based on legitimate interest (Article 6(1)(f)). |
4 Calculations and sensitive information
Balance indicators are calculated from contributions and the group’s rules. They help make assistance visible and suggest support.
Internal usage events may be linked to an account or group: they are not all anonymous. In a vote presented as anonymous to members, a technical link to the account may remain.
Members must not publish a diagnosis, treatment, prescription, medical report or other information revealing a person’s health. Free-text fields, photos and documents are not intended to hold this data. This instruction also applies to information whose context indirectly reveals a health condition. If such content is reported, I may restrict access to it or remove it, and I will examine the request of the person concerned.
5 People who can access the data
Group members access information shared in that group according to their role and visibility settings. Trusted guests have the access assigned to them. An invitation link or QR code must only be sent to the people concerned.
The publisher and people authorised to administer or maintain Famyuni may access the data needed for these tasks. Technical providers perform the functions below. Data may be disclosed to an authority when a legal obligation requires it.
Commercial partners receive neither members’ email addresses, individual tracking data nor family content. If I provide them with statistics, these are aggregated so that recipients cannot be identified.
A group may contain information about a person receiving help who does not use Famyuni. The member who enters this information must inform that person, orally or in writing, indicating in particular the existence of the group, the nature of the information shared and the possibility of contacting me. This action by the member does not remove my responsibility to provide information as the data controller. The person receiving help may write to me at contact@famyuni.com to find out whether personal data about them is being processed and, subject to the legal conditions, request access, rectification or erasure.
To locate the data, I invite them to provide whatever details they have, for example their name or the name of a member who may belong to the group. They do not need to know the group’s exact name. If there is reasonable doubt about their identity, I may request proportionate verification details; a copy of an identity document is requested only if necessary.
I normally respond within one month. Disclosure of data takes account of other people’s rights and privacy. I examine erasure or rectification requests according to the applicable rules; they do not automatically lead to deletion of the entire group. A person acting on behalf of the person receiving help must provide evidence of a mandate or their authority to represent them.
6 Hosting and service providers
OVHcloud
Famyuni’s main hosting is provided in France by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. OVH also handles email sending. To deliver emails, the mail service processes recipients’ addresses, message content and technical delivery information.
Google Firebase Cloud Messaging
Firebase Cloud Messaging is used only to deliver notifications. Google processes installation and notification identifiers in particular, along with the information needed for delivery. The title and text may mention the group or a member’s first name, for example that a member has published a news item. They do not contain the text of posts. However, the content and technical identifiers transmitted may reveal group activity.
Google reCAPTCHA
reCAPTCHA is used on account creation, login and password recovery forms to detect abuse. Google may analyse technical information about the device, browser and interactions, including the IP address. A check may prevent a form from being submitted; if you believe you have been wrongly blocked, write to me at contact@famyuni.com.
7 International transfers
Main hosting in France does not mean that all processing stays in France. Google services may process data in other countries, including outside the European Economic Area. Recipients’ email services may also operate in other countries.
When my providers arrange transfers outside the European Economic Area, I examine the applicable mechanism (an adequacy decision or appropriate safeguards, as applicable) and the information they make available. You can ask me at contact@famyuni.com for the available information on these transfers and safeguards.
8 Newsletter and partner emails
At registration, two separate boxes, unchecked by default, let you choose the Famyuni newsletter and, separately, partner information or offers sent by Famyuni. These choices are optional and can later be changed in the account preferences. Declining them does not limit family features.
Famyuni newsletter
I only send the newsletter to people who have agreed to it. Messages may contain links that measure clicks. This measurement and the associated technical data must be explained and, where separate consent is required for tracking, enabled only after that choice. The newsletter can still be sent without optional tracking.
Partner offers sent by Famyuni
I may send information or offers from partners identified in the message only to people who have agreed to this category of emails. I send the messages myself: their addresses are not passed to partners. These messages may contain links that measure clicks, under the same transparency and tracking consent conditions as the newsletter.
Link and open tracking
A tracking link may show whether a recipient clicked a link and when. If an open-tracking pixel is added later, its use will be explained before activation. A separate choice will be offered for any tracking that requires specific consent: agreeing to receive emails does not automatically mean agreeing to their trackers.
Depending on the technology used, tracking may process an identifier linked to the message or recipient, the click or loading date, the IP address and technical information about the device or email service. This data is not disclosed individually to partners.
Both subscription choices are offered without preselected boxes and can be changed separately in “My account”. Each email includes a simple way to unsubscribe. Any tracking subject to specific consent must be capable of being declined or withdrawn independently of the choice to receive messages.
Withdrawing a subscription choice stops new mailings in the relevant category. Withdrawing any tracking consent stops new records related to that tracking, including when old messages are reopened and the recipient is identifiable. Withdrawal does not affect lawful processing already carried out.
9 Access from age 15
Creating a Famyuni account is restricted to people aged at least 15.
From age 15, users can choose the newsletter and partner emails separately, subject to the rules applicable in their country. These choices are optional, disabled by default and revocable. Any tracking requiring specific consent needs a separate choice. Declining these options does not prevent use of family features. No advertising targeting is carried out based on family content.
A minor or their representative may contact me to exercise their rights. If an account opened before age 15 is reported, I examine its circumstances and close its access after verification. Information about children mentioned in a group remains protected even without an account.
10 Retention periods
Data is retained for as long as necessary for each use, then deleted or made effectively anonymous. The expiry of a link or session does not, by itself, mean that the corresponding record has been erased.
Data | Retention period or criterion |
|---|---|
Account and profile | While the account exists. After more than one year without activity, I may notify the member by email and give them the opportunity to keep their account before deleting it. |
Group content and history | While the group exists, subject to the rights of the people concerned. Automatically deleted when the last member leaves the group or deletes their account. After more than one year of group inactivity, I may notify members and delete the group after that reminder. |
Invitations and account recovery | Invitations valid for 7 days; recovery links valid for 1 hour. These links are erased between 24 and 48 hours after expiry. |
Sessions and mobile access | Web session configured by default to 8 hours, capped at 12 hours outside the local environment; Android login token valid for 180 days, unless revoked. |
Form protection | 24-hour checking window; older entries are purged during a new check. This rule does not cover all service logs. |
Communications and tracking | Preferences and subscriptions while the account exists, until the choice is withdrawn. Tracking data, when tracking is authorised, is retained for a period to be set and published before activation. |
11 Cookies and data stored on your device
A session cookie keeps you logged in and protects access. The browser also stores display preferences and application resources. You can delete them in its settings; this may log you out or reset your preferences.
Storage strictly necessary for the requested service may be exempt from consent. reCAPTCHA and Firebase also use their own mechanisms. Any tracker that does not meet the exemption conditions requires prior consent.
12 Android application permissions
The camera is used to scan QR codes. Access to contacts lets you add a selected contact card to a note; the contact details are sent to the group when saved. Selected files are uploaded when you share them.
Android manages biometrics: Famyuni receives an authentication result, not your fingerprint or face. The application retains a session and cached content. You can withdraw permissions in Android. Uninstalling the application or erasing its local data does not delete the server account.
13 Account deletion and shared content
You can delete your account from its settings or write to me at contact@famyuni.com. Deletion closes your access and erases profile data, tokens and technical links that allow your contributions to be reassigned to you. Content published in a group that is still active follows the rules below.
If other members remain in the group, contributions, news, notes, photos, comments and other shared content may remain accessible, subject to the rights of the people concerned. In the interface, the deleted account’s name becomes “Former member”. The technical link to the account is deleted: even if you create a new account with the same email address, you do not recover your old contributions. This display change does not guarantee anonymity if the content or context still allows you to be identified. If you were the last member, the group and its data are deleted.
If you only leave a group, your contributions remain displayed under “Former member” while the group exists, but their link to your account is retained: if you rejoin that group with the same account, you recover them. If the last member leaves the group, it and its data are automatically deleted. You may request erasure of specific content about you, even if another member added it. I examine this request taking everyone’s rights into account. Copies already downloaded or received by other members are separate from the data I retain.
14 Your rights and how to exercise them
Under the conditions set out in the GDPR, you can access your data, have it rectified or erased, request restriction of processing and object to processing based on legitimate interest for reasons relating to your situation.
You can object to marketing at any time and withdraw consent as easily as you gave it. Portability applies to data you provided that is processed automatically on the basis of a contract or consent. You can also give instructions on what should happen to your data after your death, under the conditions of French law.
Send your request to contact@famyuni.com. Provide details that allow your account or the relevant content to be located. I only ask for additional information to verify your identity if there is reasonable doubt; do not routinely send an identity document.
I respond within one month. If the complexity or number of requests warrants it, this period may be extended by two months; I will inform you and give the reasons within the first month. Requests are normally free of charge.
You can also lodge a complaint with the CNIL, in particular at www.cnil.fr/fr/plaintes, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
15 Data security
Famyuni uses access controls by account and group, passwords stored as hashes and encryption of certain stored data, including names and email addresses. The keys needed for operation are managed on the server side: this is not end-to-end encryption.
Communications with the service use HTTPS in production. Notification content may appear on a locked screen depending on the device’s settings. You can limit this preview or disable notifications. Any incident involving your data can be reported to contact@famyuni.com.
16 Changes to this policy
I update this policy if processing or service providers change. I explain any new purpose before implementing it and request new consent when necessary. The version date appears at the top of the document.
Back to top ↑