Privacy Policy

Last updated: 11 October 2026

Famipics is built so that your family's photos and videos can be seen by your family only. This policy explains what that means in practice: what we can never see, what we do process, why, and what you can do about it.

1. Who we are

Famipics is operated by JUJUTECH, a sole proprietorship registered in Japan (the "operator", "we"). For any question about this policy or your personal information, write to support@famipics.com. The operator's name, address and telephone number are disclosed without delay on request.

2. What we can never see

Everything you put into your family's album is locked on your phone before it leaves it, with keys that exist only on the phones of your family's members. Our servers store and pass along the locked form only. This covers:

• photos and videos, and their smaller preview copies;
• captions, comments and reactions;
• the display names of its members;
• children's names and birth dates;
• the names of the groups its admins create.

We cannot read, view, search, recover or hand over any of it — not to you, not to a court, not to ourselves. Location data and the rest of the camera information a photo carries — the device that took it, the settings it was taken with — are not removed: they are locked together with the photo on your phone, and only the phones of your family's members can read them. The one exception is the date and time the photo was taken, which we also hold in readable form so that the album can be sorted by month (section 3.4). Notifications carry no content: the wording you see ("Grandma commented on a photo") is composed on your phone; what reaches our notification provider says only that something happened — and, for new photos, how many — to which family and which photo, comment or reaction, and who did it, as an account identifier.

3. Information we do process

Running the service needs some information in readable form. This is the complete list. Each of these records also carries identifiers, which tie it to the account, family, phone or item it concerns.

3.1 Your account

You sign in with Apple or Google. Through Firebase Authentication (a Google service) we receive an account identifier and the email address the provider shares with us — with Sign in with Apple you may choose to share a relay address instead of your own — together with sign-in times. We record when you first signed in to Famipics and, if you delete your account, when (section 7). We do not take your name or picture from the provider; the name your family sees is one you type in the app, and it is locked like the rest.

3.2 Your devices

For each phone you use: an identifier; two public keys, one that lets other members lock things for that phone and one against which the requests it signs are checked (section 10); the platform (iOS or Android) and device model; when it was added and whether it has been disconnected; and a notification token so we can deliver notifications to it. The recovery key of section 10, and the backup key your phone keeps with your Apple or Google account, are recorded the same way, by their public keys. We also record which of these phones and keys hold a locked copy of each family's keys, and when that copy was written.

3.3 Your family's structure

Which accounts belong to which family, each member's role, when they joined and when they left or were removed, the invitation each one joined through, the family's name and when it was created, each member's notification settings for it, that a child's record exists and when it was added (the child's name and birth date are locked, section 2), and the counts the plan's limits are measured against: how many photos the family holds and how many minutes of video. A family's admins may sort its members into groups: we hold which members belong to each group and when the group was made (its name is locked, section 2). For each invitation: who made it, the role it gives, which member it brings back when it is for someone already in the family, the groups it will put its member in while it is pending, and when it was made, expires, was used or was cancelled. An invitation's record is kept until the family is deleted.

3.4 Records about each photo and video

The date and time it was taken (so the album can be sorted by month), whether it is a photo or a video, a rough duration bracket for a video, the sizes of its locked files and whether each has finished uploading, when it was added and by which member, who it is shown to — the whole family, the admins only, or chosen groups — and whether a member's addition is still waiting for an admin's approval. For comments and reactions: which photo they belong to (a reaction may also belong to a comment), who wrote them and when — never what they say. The family's history of changes, which keeps its members' phones in step, notes which record changed and when, and, for a photo or video that was deleted or that an admin declined, its identifier, which of the two happened, and when. Each entry of that history is kept for up to 180 days.

3.5 Subscriptions

Purchases are made through the App Store or Google Play. Through RevenueCat we receive the plan you bought, its renewal and cancellation events and a purchase identifier, tied to your account identifier; we record which family the subscription pays for, its status and when it ends. We never see your card or bank details.

3.6 Usage and crash data

The app sends usage and crash data to Firebase Analytics and Firebase Crashlytics (Google services): which screens are opened, which features are used (for example "a photo was added" — never the photo), the app version, the phone's model and operating system, per-installation identifiers, and crash reports. This data is tied to your account identifier, so it is not anonymous. Google derives a coarse region from the connection's address. There is no advertising identifier, no advertising and no tracking across other apps or websites. This collection cannot be turned off inside the app; it is a condition of using Famipics. What it can never contain is listed in section 2: no photo, no video, no comment, no name.

3.7 Server logs

Our servers keep, for seven days, technical records of errors and summaries of the notifications and alerts they send and of the scheduled tasks they run; they keep no record of each request. Cloudflare, which runs our servers, may also record connection data for security purposes under its own policy. Our records never contain the address of a page, content or a device's identifier. They contain the identifier of a family, or of a photo or video, in one case only: when removing the locked files of a deleted photo, video or family from our storage fails, the record names the family and, for a photo or video, the item, so that the removal can be found and completed.

3.8 Support

When you write to us, we keep the correspondence for as long as needed to help you and to keep a record of what was agreed.

3.9 Technical records

The counters and dates the service runs on: version numbers that keep each family's keys and history in step, and whether its keys are due to be renewed; how many items each account added in the day, against the daily limit; how much a family added in the day, and when its storage passed one of the thresholds we monitor; the dates of a grace period and of its warnings (section 7); the single-use challenge of a restore with the recovery key or the backup key; notifications waiting to be grouped and sent, and the marks that keep one person's reactions to the same item from being announced twice, each for a day at most; the counts and times of our scheduled tasks, which concern no account or family; and the list of deleted files still to be removed from our storage, which names the family and, for a photo or video, the item, kept for about a week after the files are gone.

4. What we use it for

• to run the service: keep the family's album in step across its members' phones, deliver notifications, enforce roles and plan limits;
• to bill subscriptions and apply what they unlock to the family;
• to keep accounts safe and prevent misuse;
• to find and fix crashes and to understand how Famipics is used, so we can improve it;
• to answer you when you contact us;
• to meet our legal obligations.

We use nothing for advertising, and we sell nothing to anyone.

5. Who handles it for us

We rely on a small number of providers, each acting on our instructions for the purposes above:

• Google (Firebase Authentication, Analytics, Crashlytics, Cloud Messaging) — sign-in, usage and crash data, notifications.
• Cloudflare — the servers, the database (with its 30-day history, section 7) and the storage that hold the locked files and the records of section 3.
• RevenueCat — subscription status and purchase events.
• Slack — alerts to us about the running of the service: the health of its scheduled tasks and, when a family's storage passes one of the thresholds we monitor, that family's identifier with its plan and figures.

Apple and Google also process your purchase and your sign-in under their own terms, as independent operators of their stores and sign-in services.

We may disclose information when the law requires it. What we can disclose is limited to what we hold: never the content of section 2.

6. Where it is processed

The providers above process information in the United States and in the other locations of their networks. Under Japan's Act on the Protection of Personal Information (Article 28), you are entitled to know that: each provider is bound to us by contractual terms requiring safeguards equivalent to those the Act asks of us, and each operates a published privacy programme. Information about the personal-data regime of the United States, and about the measures each provider takes, is available on request.

7. How long we keep it

• Your family's content stays as long as the family keeps it. Deleting a photo or video removes its record from our database and its locked files from our storage; deleting a family removes everything it held from both. What remains is: the identifier of a deleted photo or video in the family's history of changes (section 3.4); the identifier of a deleted photo, video or family in the list of files to remove (section 3.9) and, for seven days, in any server record of section 3.7 that names it; the alerts of section 5 that were sent to us and name the family; and the database's history below.
• A free family's memories are never deleted by us. When a free family reaches its limits it can no longer add, but everything stays viewable and can be saved to a phone, indefinitely.
• After a subscription lapses or is lowered, photos and videos beyond the current plan's limits are kept for one month, during which the family is warned repeatedly and can save them to a phone; after that month, the newest ones beyond the limit are deleted.
• When you delete your account, your devices are disconnected, their keys are destroyed, you leave every family — a family you own is deleted for all its members, as if you had deleted it yourself — and your account record is marked deleted. The locked copies of those keys that our database held stay in its history for up to 30 days (below). We then ask Apple or Google to withdraw the access you granted Famipics when you signed in, and delete your sign-in account with Firebase Authentication — the identifier, email address and sign-in times of section 3.1. Photos you had added to another family belong to that family's album and stay there for its remaining members.
• The database's history: our database provider keeps a point-in-time history of the database for 30 days, so that it can be restored after a failure. A record deleted or changed in the database — a photo's record, a whole family, the locked keys of a disconnected phone — therefore stays in that history, in the form the database held it (locked, or readable as section 3 describes), for up to 30 days; it can be reached only through our account with the provider, never through the service, and is then gone. The locked files themselves are kept in no such history: once removed from our storage, they are gone.
• Usage and crash data are kept for 14 months from collection, after which they expire. We do not run an earlier purge on account deletion; the same 14 months apply.
• Server logs: seven days.
• Purchase records: as long as the stores and tax law require.

8. Your choices and rights

Most of what you may want to do, you can do in the app itself:

• delete a photo, a video, a comment or a reaction;
• leave a family, or delete it if you own it;
• turn notifications on or off per family;
• delete your account, from the settings screen.

You may also ask us, at support@famipics.com, to tell you what personal information we hold about you, to correct it, to stop using it or to delete it, as the Act on the Protection of Personal Information provides. We will ask you to confirm you are the account holder, and answer without undue delay. Two limits follow from how Famipics is built: we cannot give you a copy of, or act on, the content of section 2, because we cannot open it; and a photo added to a family's album is that family's, so its removal is a matter for the family's members.

9. Children

Famipics is used by adults, or by minors with the consent of a parent or guardian. Children who appear in photos are not users: their photos are added by family members, who are responsible for doing so appropriately, and the names and birth dates recorded for them are locked like everything else. We do not knowingly collect personal information directly from a child under 13.

10. Security

The locking described in section 2 is the core of our security, and it means the keys are yours: the recovery QR code shown when you create a family, and the recovery code it contains — the same key in two forms, either one of which is enough — are the only way back into an album if every phone of the family is lost, and we cannot replace them. Beyond that, every connection to our servers is encrypted in transit, and every request the app sends to our servers carries proof of your Apple or Google sign-in. The following requests, and only these, are also signed by the phone that makes them: creating or deleting a family; inviting someone and accepting an invitation; removing a member or leaving a family; renewing a family's keys; fetching the keys locked for a phone; registering a phone, listing the phones of a family's members and disconnecting a phone; and setting up the recovery key or the backup key of section 3.2, or restoring with one of them. A phone being restored, whose own key is not registered yet, signs with the recovery key or backup key it holds, and the restore registers its own. The locked photo and video files travel between the phone and our storage over time-limited links our servers issue for each file.

11. This website

famipics.com sets no cookies, runs no scripts and carries no analytics. It is served by Cloudflare, which may record connection data for security purposes under its own policy.

12. Changes

When this policy changes, the new version is published here with a new date, and the app tells you when a change matters to you.

13. Contact

JUJUTECH — support@famipics.com

This policy is written in English, which is the governing text. The Japanese and French versions are translations provided for convenience.