Famlok Privacy Policy

This Privacy Policy explains how Jarnaljit Singh (“Famlok”, “we”, “us” or “our”) collects, uses, holds and discloses your personal information when you use the Famlok mobile application and related services (the “App”).

Famlok is a family location-sharing and safety app available to users worldwide. Please read this policy carefully, because the App collects precise, real-time location and other sensitive information and shares it with the people in your family circle. This policy is written from a United States baseline and includes additional sections for California, the European Economic Area and the United Kingdom, and the rest of the world; if you live in one of those regions, the relevant supplement below adds to, and where it conflicts prevails over, the general body of this policy. Please also read our Terms of Use and End User License Agreement, which govern your use of the App.

Contents

1. Who we are

Famlok is operated by Jarnaljit Singh, a United States–based individual developer (“we”), who provides the App to users worldwide. We are responsible for the personal information collected through the App. You can contact us at:

Jarnaljit Singh
Email: support@famlok.online

2. What personal information we collect

We collect the following categories of personal information. We only collect what we need to run the features you use.

2.1 Account & identity

• Your name, email address and profile photo (provided when you sign in with Google, or that you add yourself; a phone number is optional and is blank by default);
• Your Firebase account identifier and a randomly-generated device identifier (used to enforce single-device login for your security; stored in the iOS Keychain or in Android SharedPreferences);
• A push-notification token (Firebase Cloud Messaging on Android; Apple Push Notification service delivered via Firebase on iOS) so we can send you alerts;
• Your subscription status, product, purchase/transaction token, and trial and expiry dates;
• Account timestamps such as when your account was created, when you were last seen, and whether you are currently online.

2.2 Precise location — collected in the background

• GPS and network-based location: latitude, longitude, accuracy, speed and bearing/heading;
• Your device’s battery level and charging status (shown to your family so they know if your phone is running low);
• A street address derived from your coordinates (reverse-geocoded for display);
• The detected activity type (still, walking, running, on a bicycle, or in a vehicle), a platform tag (iOS/Android), and place/dwell timing;
• Location is updated frequently — roughly every 30 seconds in the background, and about every 500 milliseconds in the foreground while the map is open. Your location is written for every circle you belong to.

2.3 Motion and activity

• Activity type detected by your device (for example: still, walking, running, on a bicycle, or in a vehicle);
• Motion-sensor data (accelerometer and related sensors) used together with activity recognition to detect when a drive starts and to recognize driving events. This is used to provide drive features and to save battery — we do not use it for health or fitness profiling.

2.4 Driving information

• Drive routes and route points recorded during a trip (roughly every 2 seconds), along with distance and duration;
• Driving events such as speeding (over 80 mph), hard braking (over 0.4g), rapid acceleration (over 0.3g), and phone handling while driving;
• Per-drive summaries and scores, and weekly summaries and scores.

Drive scores are automated estimates produced for family awareness only.

2.5 Places and geofence history

• Places you save (for example Home, School or Work), including their coordinates and an alert radius (250 ft, 500 ft, 750 ft, 1 mi, 1.5 mi or 2 mi);
• Geofence events — a record of when you arrive at or leave a saved place — and how long you have been there.

2.6 Safety, SOS and messages

• SOS / emergency alerts you send, which include your name, profile photo, latitude/longitude, and reverse-geocoded street address, and are broadcast one notification per other circle member;
• “No-show” and other safety alerts;
• Quick messages you send to family members. Famlok uses 10 fixed quick-message types (Love, Doing, Where, Miss, Call, Home, Thinking, Morning, Night and Safe) — there is no free-text chat.

2.7 Neighborhood safety estimates

• To estimate the safety of an area, we send a coarse area only — your ZIP/postal code plus the surrounding area, state/region and country, and an approximate location at the level of country, region and city — not your name, account, or precise coordinates — to our AI provider, and store the resulting safety score and any related local-news items.
• Neighborhood safety estimates are a premium feature.

2.8 Subscription & billing

• Your subscription status, product identifier, purchase/transaction token and expiry/trial dates.
• We do not receive or store your credit-card or payment-card details — all payments are processed by Apple or Google.

2.9 Technical, diagnostic & support information

• Crash reports and analytics events (to keep the App working and to improve it);
• Diagnostic logs stored on your device, which may include information such as ZIP/postal codes, geofence events and drive activity;
• If you submit a bug report, the screenshot, device information and diagnostic log files you choose to attach.

3. How and why we use your information

We do not sell your personal information, and we do not use it for third-party advertising. The App contains no advertising SDKs.

4. Who we share your information with

4.1 Your family circle

The core purpose of Famlok is to share information with the people in your circle. When you join a circle, other members can see your real-time and historical location, your places, your drives and driving events, your battery level, your address, your online and safety status, your quick messages, and AI area-safety scores. Sharing is with your private circle only — there is no public sharing. Only share your location with people you trust, and only join circles run by people you trust.

4.2 Service providers (sub-processors)

We use the following trusted providers to operate the App. Each receives only the information needed for its role, and is located in the country shown. Your personal information is processed in more than one country — it does not stay in any single country.

Our AI safety and news scoring runs primarily on Cloudflare Workers AI (using the @cf/moonshotai/kimi-k2.5 model, hosted in the United States / globally). A secondary / legacy path sends requests directly to Moonshot AI (Kimi) at api.moonshot.ai in China. Either way, the AI provider receives only a coarse area — never your name, account ID, or precise GPS coordinates.

4.3 Other disclosures

We may disclose personal information where required or permitted by law, to protect someone’s safety, or in connection with a sale or transfer of the App (in which case this policy will continue to apply). We do not sell your personal information and we do not use it for advertising.

5. International data transfers

As shown in the table above, your personal information is stored and processed outside your country, including in the United States (Google/Firebase, Apple, Cloudflare, Cloudinary, Mapbox) and China (Moonshot AI / Kimi, which receives only a coarse area). Your information does not stay in any single country.

6. Children and young people

Famlok is a family app and is designed to be used by families, including children, with parental involvement.

• You must be at least 13 years old to create a Famlok account.
• Children under 13 (United States / COPPA): a child under 13 may not create their own account, and any collection of a child’s personal information requires verifiable parental consent. The parent or guardian who holds the account consents on the child’s behalf. We obtain separate consents: (a) consent to the collection and use of the child’s information, and (b) a distinct consent to any disclosure of that information to third parties or to other members of your circle. A parent or guardian may review the child’s information, refuse to permit further collection, and request deletion at any time by emailing support@famlok.online or by deleting the account in the App.
• Children under 16 (EEA / GDPR): where processing is based on consent, a child under 16 requires verifiable parental consent, unless the relevant EU member state has set a lower digital-consent age (which can be as low as 13). In the United Kingdom the age is 13. Below the applicable national age, a parent or guardian must provide consent (GDPR Article 8).
• Younger children generally: a child below the account-creation age may use Famlok only on a parent or guardian’s own device, set up and supervised by that parent or guardian, and with that parent’s consent.
• If you are a parent or guardian and believe a child has provided personal information without appropriate consent, contact us (section 13) and we will delete it.

When you sign in, both apps display an age-confirmation self-attestation checkbox that reads: “I’m at least 13 years old. If I’m under 13, my parent or guardian has set up and consented to my use of Famlok.” This is a self-attestation checkbox only — there is no date-of-birth field and no identity or age verification, and we do not claim to verify any user’s age.

7. How long we keep your information

8. How we protect your information

• Data is transmitted over encrypted (HTTPS/TLS) connections.
• Access to your stored data is restricted by server-side Firebase security rules so that, generally, only you and the members of your circle can read your data.
• We enforce single-device login to reduce the risk of unauthorized access.
• On your device, your device identifier is stored in the secure Keychain on iOS. Some information (such as cached subscription status, your area ZIP/postal code, and diagnostic logs) is stored in ordinary app storage and is not encrypted; for that reason we recommend you protect your phone with a passcode or biometric lock.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Information stored on your device

To work offline and start quickly, the App stores some information locally on your device, including your last-known status, cached subscription status, your area ZIP/postal code, your device identifier, and diagnostic logs. When you delete your account, the App clears these local caches and your device identifier from your device. Uninstalling the App also removes locally stored data.

10. Your privacy rights and how to exercise them

• Access & correction: you can view and update much of your information directly in the App. You may also ask us for a copy of the personal information we hold about you, or to correct it.
• Delete your account: in the App, go to Profile → Settings → Delete Account (Google users re-authenticate first). This permanently deletes — not merely deactivates — your account and associated data across our systems (see section 7 for the profile-photo exception). Account deletion is permanent and cannot be undone. If you cannot access the App, you can request deletion by emailing support@famlok.online from your account email.
• Stop sharing: you can pause location sharing, leave a circle, or revoke permissions in your device settings at any time.

Depending on where you live, you may have additional rights — see the California, EEA & UK and rest-of-world supplements below. To exercise any right, contact us at support@famlok.online. We may need to verify your identity before acting on a request.

11. Data breaches

We take reasonable steps to protect your information. If a data breach occurs that affects your personal information, we will assess it and, where required by the law that applies to you, notify affected users and the relevant data-protection authority or supervisory authority within the timeframes that law requires.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and change the “Last updated” date at the top of this page. Significant changes will be notified to you in the App or by other reasonable means. Your continued use of the App after an update means you accept the updated policy.

13. How to contact us

Jarnaljit Singh
Email: support@famlok.online

14. California privacy notice (CCPA/CPRA & CalOPPA)

This section applies to California residents and supplements the rest of this policy. It is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), and the California Online Privacy Protection Act (“CalOPPA”). Where this section conflicts with the general body above, this section controls for California residents.

14.1 Categories of personal information we collect

14.2 Sensitive personal information

We collect precise geolocation, which the CCPA treats as sensitive personal information. We use precise geolocation only to provide and secure the services you have asked for (live location-sharing, place alerts, drive detection and SOS) — we do not use or disclose it to infer characteristics about you. Because we use sensitive personal information only for these permitted business purposes, the CCPA “Limit the Use of My Sensitive Personal Information” right does not require us to offer a separate limitation control; you can nevertheless stop this processing at any time by pausing sharing, revoking location permission in your device settings, or deleting your account. To make a request about sensitive personal information, email support@famlok.online.

14.3 No sale, no sharing

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We do not offer financial incentives in exchange for personal information.

14.4 Your California rights and how to exercise them

• Right to know / access the categories and specific pieces of personal information we have collected;
• Right to delete your personal information;
• Right to correct inaccurate personal information;
• Right to opt out of any sale or sharing (note: we do not sell or share);
• Right to limit the use of sensitive personal information (see 14.2);
• Right to non-discrimination for exercising your rights.

To exercise these rights, use Profile → Settings → Delete Account in the App, or email support@famlok.online. We will verify your identity (for example, by confirming control of your account email) before acting on a request, and you may use an authorized agent where the law allows.

14.5 Retention

We retain each category of personal information for the periods described in section 7 (How long we keep your information). In summary: live location is continuously overwritten and kept while your account is active; drives and geofence history are kept until you delete them or your account, with a rolling ~30-day purge of your own drives; saved places until deleted; safety and local-news notifications for 24 hours; AI safety estimates for about 30 days; invite codes for 5 minutes; and on-device diagnostic logs until you clear them.

14.6 CalOPPA disclosures

The categories of personally identifiable information we collect, and the third parties with whom we share it, are described in sections 2 and 4 above. You can review and change much of your information in the App. We notify you of material changes to this policy as described in section 12, and the effective date appears at the top of this page. This page is reached through a conspicuous link labeled “Privacy” in the App. Do Not Track: Famlok is a mobile app that does not track you across third-party websites over time, and it does not respond to browser “Do Not Track” signals.

14.7 Automated decision-making technology (ADMT)

We use automated decision-making technology to generate drive scores and driving events and AI neighborhood-safety and local-news scores. The purpose is to give your family awareness of driving behavior and area safety. These outputs are estimates only and are not used for insurance, employment, lending, legal, or housing decisions, and they do not produce legal or similarly significant effects about you. Where required by California regulations, we maintain risk assessments for this processing.

15. EEA & UK privacy notice (GDPR / UK GDPR)

This section applies to individuals in the European Economic Area (EEA) and the United Kingdom (UK) and supplements the rest of this policy under the EU General Data Protection Regulation (GDPR) and the UK GDPR. Where it conflicts with the general body above, this section controls for EEA and UK individuals.

15.1 Controller and representatives

The data controller is Jarnaljit Singh (sole proprietor), California, United States, contactable at support@famlok.online.

Because we offer the App to individuals in the EEA and the UK, we act under Article 3(2) of the GDPR / UK GDPR. We have not designated a separate EU or UK representative under Article 27. Individuals in the EEA and the UK can contact the developer directly at support@famlok.online about any privacy or data-protection matter. This does not affect your right to lodge a complaint with your local supervisory authority (or, in the UK, the Information Commissioner’s Office (ICO)), as described in section 15.3.

15.2 Lawful bases for processing

You may withdraw consent at any time (for example by revoking location permission or pausing sharing); this does not affect processing carried out before withdrawal. We have conducted, or will conduct, a Data Protection Impact Assessment (Art 35) for high-risk processing such as continuous location tracking and the processing of children’s data.

15.3 Your rights

You have the right to access, rectification, erasure, restriction, data portability, and to object to processing, as well as to withdraw consent and rights in relation to automated decisions under Article 22. You also have the right to lodge a complaint with your local Data Protection Authority or, in the UK, the Information Commissioner’s Office (ICO). To exercise your rights, email support@famlok.online; we will respond within one month (extendable where the law permits).

Regarding automated decisions: the drive scores/events and AI safety/news scores described in section 14.7 are estimates for family awareness only and do not produce legal or similarly significant effects; you can ask us about them at any time.

15.4 International transfers

We transfer personal information out of the EEA and the UK to the United States (Google/Firebase, Apple, Cloudflare, Cloudinary, Mapbox) and to China (Moonshot AI / Kimi — coarse area only). These transfers rely on appropriate safeguards:

• United States: the EU–US Data Privacy Framework and its UK Extension where the recipient is certified; otherwise the EU Standard Contractual Clauses (SCCs) together with the UK International Data Transfer Addendum (IDTA) and a transfer impact assessment.
• China (which does not have an adequacy decision): the EU SCCs plus the UK IDTA and a transfer impact assessment.

UK adequacy was renewed in December 2025, and the Data Privacy Framework is operating in 2026 but remains subject to legal challenge, so we retain the SCC/IDTA fallback. You can request a copy of the safeguards we rely on by emailing support@famlok.online.

15.5 Children

For consent-based processing, the default minimum age in the EEA is 16; individual member states may lower this to as low as 13, and in the UK the age is 13. Below the applicable national age, a parent or guardian must consent (Art 8). Our retention schedule (section 7) applies, including the Cloudinary profile-photo deletion exception described there.

16. Other countries (rest of world)

If you are located outside the United States, the EEA and the UK, the general body of this policy applies to you, and your local data-protection or privacy laws may grant you additional rights (for example, rights to access, correct, delete, or object to certain processing). Where your local law gives you rights that cannot be waived, those rights are preserved and apply in addition to this policy. You may contact your local data-protection or privacy authority where one exists, and you can always contact us at support@famlok.online to exercise your rights or raise a concern.

See also our Terms of Use and End User License Agreement.