Privacy Policy
FamilyWell is where your family keeps its lists, money, plans and paperwork, so we take that data seriously. This policy explains what personal data we collect, why, who helps us process it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Who we are
The data controller for your personal data is:
DRAGOMIR M BOGDAN-VIOREL PFA
Sat Pietrosani, Comuna Puchenii Mari, Nr. 816, C1, Prahova, Romania
Email: hello@familywell.org
In this policy "FamilyWell", "we" and "us" mean this operator. We are established in Romania and subject to Romanian law and the GDPR.
No Data Protection Officer (DPO) is required: our processing is small-scale and is not a core activity within the meaning of Art. 37 GDPR. For any privacy question, write to hello@familywell.org.
2. What this policy covers
This policy covers:
- the hosted FamilyWell app at familywell.co, including the public demo family;
- this website, familywell.org, including the module pages and the public module requests board;
- the connection that lets AI assistants you authorise reach your family: our MCP server at
mcp.familywell.co, used by the FamilyWell app in ChatGPT, the FamilyWell connector in Claude and other MCP clients.
Self-hosted installs are not covered. FamilyWell's source code is published on GitHub, and anyone can run their own copy. If you use a FamilyWell install that someone else runs, that person or organisation is the controller of your data, and their own privacy terms apply, not this policy. We have no access to self-hosted installs.
3. Data we collect and why
The table below lists each category of personal data we process, why we process it, and the legal basis under Art. 6 GDPR.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, the one-time sign-in codes we email you (stored only as a keyed hash, valid for 10 minutes), and a password if your account has one (stored only as a hash, never in plain text) | Creating your account, signing you in, verifying your email address | Contract (Art. 6(1)(b)) |
| Sign in with Google or Apple: your name, email address and the provider's account identifier | Letting you sign in with that provider instead of a password | Contract (Art. 6(1)(b)); you choose to use it |
| Family membership: the families you belong to, your role in them and their sharing settings | Organising data per family and showing each member what the family's settings allow | Contract (Art. 6(1)(b)) |
| Family content: to-dos, shopping lists, expenses, notes, recipes, birthdays, calendar entries, contacts, projects, inventory, vehicle records, and files you upload (such as recipe or vehicle photos and documents) | The core service: storing, syncing and showing this content to your family | Contract (Art. 6(1)(b)) |
| Billing data: Stripe customer ID, plan, subscription status, invoices and payment records | Running the paid hosted plan, and keeping accounting records | Contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c)) |
| AI assistant connections: the assistant's name, the family and per-module permissions you granted, access and refresh tokens and when they expire; the inputs of each tool call the assistant makes, and the family data we return to it (listed per tool in Section 6) | Operating the assistant connection you authorised and answering its requests (Section 6) | Consent (Art. 6(1)(a)), withdrawn by revoking the connection |
| Content sent to an AI feature: shopping item names, quantities and notes; expense details; receipt photos; typed or spoken grocery lists | Guessing aisles and categories and filling in forms for you (Section 6) | Contract (Art. 6(1)(b)) |
| Push notification subscription (a browser-issued endpoint and keys) | Sending web push notifications, only if you switch them on | Consent (Art. 6(1)(a)), withdrawn by switching them off |
| App usage analytics: page views and key actions, including the name of each tool an AI assistant calls, linked to a random pseudonymous ID (never your name or email, and never the content of what you or the assistant entered) | Understanding how FamilyWell is used, improving it, and helping you when you contact support | Legitimate interest (Art. 6(1)(f)); you can object (Section 8) |
| Website analytics on familywell.org: aggregated page views, referrer, browser, device type and country, without cookies | Knowing which pages are useful | Legitimate interest (Art. 6(1)(f)) |
| Module requests board: your family's display name, optional city, the requests, comments and votes you post | Running the public board (Section 7) | Contract (Art. 6(1)(b)) |
| Session, CSRF and sign-in state cookies | Keeping you signed in and protecting forms against forgery | Strictly necessary for the service you asked for (Art. 6(1)(b)) |
| Technical data such as IP address, browser type and request times, processed by our hosting providers | Delivering pages, preventing abuse, and keeping the service secure | Legitimate interest (Art. 6(1)(f)) |
| Name and email address, for product update emails (new features and changes to how FamilyWell works) and for account, security and billing notices | Keeping you informed about the service you use. These are not marketing emails. | Contract (Art. 6(1)(b)) for account, security and billing notices; legitimate interest (Art. 6(1)(f)) for product updates, which you can unsubscribe from in any of them |
| Email address, for marketing emails, only if you opt in | Offers and news beyond how the product works | Consent (Art. 6(1)(a)), withdrawn at any time with the unsubscribe link or by emailing us |
| Messages you send us (email address, what you write) | Answering you and handling support requests | Contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
We do not sell personal data, we do not use it for advertising, and we do not run advertising pixels or build advertising profiles. We never receive or store your card details: payments are handled entirely by Stripe.
4. Families and shared data
FamilyWell is organised around families. When you add something to a family, the other members of that family can see it and, depending on the family's sharing settings, change it. What each member sees is governed by those settings, which the family manages in the app.
Families often keep details about people who don't have an account themselves, such as a grandparent's birthday or a plumber's phone number. When you add information about someone else, you are responsible for having a reason to keep it and for treating it with care. For most families this is ordinary household use. If someone asks us to remove information about them that a family stores, we will pass the request to that family or act on it where the law requires.
The public demo family on familywell.co can be opened by anyone. Anything typed into it is visible to other visitors, so please don't enter real personal information there.
5. Children
You must be at least 16 years old to create a FamilyWell account, consistent with Romanian Law 190/2018 implementing the GDPR.
Families include children, so a family's content will often mention them (a school pickup, a birthday, a chore). A child may also be a member of a family where a parent or guardian creates and manages that child's family profile. In that case the parent or guardian decides what is recorded about the child and is responsible for it, and can ask us to access, correct or delete the child's data at any time.
If you believe a child under 16 has created an account themselves, contact us at hello@familywell.org and we will delete it.
6. AI assistants and AI features
Connecting an AI assistant
You can connect an AI assistant (for example ChatGPT or Claude) to your family. It talks to our server at mcp.familywell.co over the Model Context Protocol (MCP). This is off by default. Nothing is shared until you connect an assistant yourself.
When you connect, you sign in to FamilyWell and see a consent screen. There you choose:
- one family the assistant may act in (never your other families);
- for each module that family uses, no access, read (look only) or write (look and change).
The assistant acts as you. It sees only what you could see in that family, following the family's sharing settings, and only in the modules you allowed. To change what you granted, connect again.
What the assistant can send us and what we send back
An assistant uses "tools": small actions such as "list my shopping lists" or "add an expense". When it calls a tool, it sends us the tool's inputs. We answer with the result. The table lists every tool group, the data it takes in and the data it returns to the assistant.
| Tools | Data the assistant sends us | Data we send back to the assistant |
|---|---|---|
| Family overview (get_family), always available | Nothing | The family's name and ID; your name and user ID; each member's name, user ID and role in the family; the modules the family uses; what this connection may read or change. Not members' email addresses. |
| Today (get_today), always available | Nothing | Open items due today, overdue or due later this week (tasks, shopping items, project tasks, calendar to-dos and events): title, the list or place they belong to, due date. Items you recently opened in FamilyWell: title, short description, module. Only from modules this connection may read. |
| Tasks (tasks_*) | List name, colour and icon; task title, note, due date, who it is assigned to, sub-tasks; "important" and repeat settings if the family uses them | The same, plus done or not, the assignee's name and user ID, and whether a list is private, shared or family-wide |
| Shopping (shopping_*) | List name and shop; item name, quantity, note, shop and other shops that sell it | The same, plus the aisle, bought or not, due date and the list's visibility |
| Spending (spending_*) | Amount, currency, what it was, category, shop, date, who paid, which list; names of guests added to a list (people without an account) | Expenses with amount, currency, amount in the list's currency, title, category, shop, date and the payer's name; lists with their currency and participants (member and guest names); totals for a period by category and by shop; the family's categories |
| Notes (notes_*) | Note title, text, folder, pinned, and search words | Title, folder, pinned, visibility, last change time, and the full note text (lists and searches return the first 160 characters) |
| Contacts (contacts_*) | A person's name and contact details: phone numbers, email addresses, postal addresses, websites and other details, each with an optional label such as "work" | The same names and contact details |
| Birthdays (birthdays_*) | A person's name, birth day and month, and birth year if you know it | The same, plus the next birthday, days until it, current age and the age they are turning |
| Calendar (calendar_*) | Event title, notes, dates and times, repeat rule, the members and contacts it involves, a linked project; event to-dos with note, due date and assignee | The same, with people's names; plus dated items from other modules this connection may read (such as birthdays, tasks, project dates and vehicle reminders) |
| Projects (projects_*) | Project name, description, owner, status, progress, start date, what it is waiting on; tasks with note, due date and assignee; links to spending lists and contacts | The same, with the owner's and assignees' names; things the project depends on; linked shopping lists (name, items bought of total), spending lists (name, total spent) and contacts (name, phone number), each only if this connection may read that module |
| Recipes (recipes_*) | Title, description, ingredients, steps, servings, prep and cook times, tags, source web address, notes; a recipe photo | The same, scaled amounts, and a time-limited link to the recipe photo |
| Inventory (inventory_*) | Item name, quantity and unit, low and full levels, category, storage place, usual shop, expiry date, notes | The same (without notes), plus its state (such as low or expired) and whether it is on a shopping list |
| Vehicles (vehicles_*) | Mileage readings; fuel fills (litres, cost, date, station, note); services and repairs (date, mileage, cost, garage or provider, notes); maintenance plans; documents (type, title, expiry date, notes) and their files; other car costs | Make, model, year, version, transmission, colour, licence plate or registration number, VIN, fuel type, mileage, the owner's and main driver's names, insurance company, notes; maintenance plans and what is due; documents (type, title, expiry, whether a file is attached, but not the file itself); fuel use and cost per km; history of services, repairs, fuel, tyres, mileage and costs; a download link to a PDF of the car's history, valid 24 hours |
| Deleted items (*_list_deleted, *_restore) | Which item to restore | Items in the trash, with the date they were deleted and the date they will be removed for good |
Every result also contains item IDs and url links to the matching page on familywell.co. These links only open for someone signed in to the family. Two kinds of link work without signing in, for a short time: the vehicle history PDF (24 hours) and recipe photos (up to 2 days), so the assistant can show them to you.
Files. Three tools accept a file: adding a vehicle document, attaching a file to a repair or document, and setting a recipe photo (PDF or image, up to 12 MB). The assistant can pass a file you attached in ChatGPT (as a download link from OpenAI), a public web address, or the file's contents. If it passes a link, our server downloads the file from that address. We store the file with your family's other uploads. We never send file contents back to the assistant.
Some results appear as small views (cards for your shopping lists, a car, a recipe and so on) inside the assistant. They show the same data as the table above. They load nothing from other websites; only recipe photos load from our server.
What the connection does not do
- It does not ask for, receive or store your chat history. We only see the tool calls the assistant makes and their inputs.
- It never returns passwords, payment details, members' email addresses, or anything from a family or module you did not grant.
- We do not use your data, or what the assistant sends us, to train AI models.
Who receives this data
- The assistant's provider, such as OpenAI (ChatGPT) or Anthropic (Claude). It receives every tool result, as described above. You chose this provider; it is not our processor. Once FamilyWell data is in your chat, the provider handles it under its own privacy policy, together with what you type to it.
- Our service providers (Section 10): DigitalOcean runs the server and database; Cloudflare carries the traffic to
mcp.familywell.coand stores uploaded files (R2); TypeSafe makes aisle and category guesses (below). - Other members of the family. A change made through an assistant shows up for them like any other change, and may send them a push notification (for example "Ana added: milk"), delivered by their browser's push service.
- The website a file comes from, when the assistant gives us a link to download a file from.
Is a tool call logged?
We do not log the inputs or results of tool calls. We do record:
- an analytics event for each tool call, holding only the tool's name (for example "shopping_add_item"), linked to your pseudonymous analytics ID (Section 8);
- an analytics event when you connect, holding only how many modules you shared;
- for the three file tools, one technical log line: the tool's name, your user ID, how the file was passed, the host name of the download link, the file's type and size, and whether it worked. Never the file's contents or name;
- the standard technical data our hosting providers process for every request (Section 3).
How long assistant data is kept
- What the assistant creates or changes is ordinary family data. It is kept until you or a family member delete it. Deleted items stay in the trash for 30 days, then they are removed for good, together with their files.
- Access tokens stop working after 1 hour. The assistant renews them with a refresh token, which stops working after 30 days without use; after that you need to connect again. Revoking a connection stops both at once.
- Links that work without signing in: vehicle history PDF links expire after 24 hours, recipe photo links within 2 days.
Your controls
- Choose the family and each module's access (none, read or write) when you connect. Connect again to change it.
- See every connected assistant, its family and its access in Settings > Connected apps, and revoke it there. Access ends immediately. You can also remove FamilyWell in the assistant's own settings.
- Delete any item in the app or through the assistant, and restore it within 30 days.
- Delete your account in the app's settings.
- Ask for a copy of your data, a correction or deletion, or object to analytics, by emailing hello@familywell.org (Section 13).
AI features inside FamilyWell
Some features use AI to save you typing. Only the content each feature needs is sent:
- Aisle guesses: when a shopping item is added (in the app or through an assistant), its name, quantity and note are sent to TypeSafe to guess the aisle.
- Category guesses: when an expense is saved without a category (in the app or through an assistant), or you ask to sort expenses, its title, amount and currency, the payment method's name, the list's name and the date are sent to TypeSafe to guess the category.
- Receipt scanning and quick grocery entry: when you scan a receipt photo or type or speak a list of groceries, the photo or text is sent to Google Gemini to fill in the form.
Suggestions are produced automatically and can be wrong, so check them before relying on them. We do not use AI features to make decisions that have legal or similarly significant effects on you (Art. 22 GDPR).
7. The module requests board
The module requests board on familywell.org lets signed-in families post ideas for new modules, comment on them, and vote. To use it you sign in with your FamilyWell account.
Requests and comments are public. Anyone can read them, together with your family's display name and, if you add one, your city. Please don't include private details in them.
Your votes are tied to your family so each family gets a fair number. Posts are checked automatically by TypeSafe for spam and abuse before or after they appear, and we may moderate them by hand. Public requests may also be copied to the FamilyWell GitHub repository as issues, where GitHub's own terms and privacy policy apply. We never put email addresses or contact details into those issues.
8. Analytics, cookies and notifications
Analytics
We use Umami, an analytics tool we host ourselves. It uses no cookies and does not track you across other websites. On familywell.org your browser keeps a random visitor ID and where you first came from (for example a search engine or a campaign link) in its local storage, never in a cookie. If you then create an account, that ID becomes your account's analytics ID (below), so we can see which pages and channels lead people to FamilyWell. We only store this if you allow it in the banner, and choosing “No thanks” deletes it. Whatever you choose, a link from familywell.org to the app carries the source of the page you are on (for example “google”), which does not identify you and is not stored on your device. Change your choice.
In the app, page views and key actions (for example "created a shopping list") are linked to a random pseudonymous analytics ID for each user. That ID is never your name or email address. When an AI assistant calls one of our tools, we record the tool's name the same way (never its inputs or results; see Section 6). It lets us understand how people use FamilyWell, find what's confusing, and look at what happened when you ask us for help. We rely on our legitimate interest in running and improving the service. You can object at any time by emailing hello@familywell.org, and we will stop linking your usage to an analytics ID.
Cookies
We only set strictly necessary cookies: a session cookie that keeps you signed in, a CSRF cookie that protects forms against forgery, and short-lived cookies that hold your sign-in state while you sign in (including on the requests board). These are exempt from consent under Romanian Law 506/2004 and the EU ePrivacy Directive, which is why we show no cookie banner. We do not use advertising, social media or cross-site tracking cookies.
Push notifications
If you switch on web push notifications, your browser gives us a subscription endpoint so we can send you alerts (for example a reminder that's due). Your browser vendor's push service delivers them. You can switch notifications off in the app or in your browser settings at any time.
Emails
When you create an account we may email you product updates: new features and changes to how FamilyWell works. They are about the product's functionality, not commercial or marketing offers, and every one has an unsubscribe link. Account, security and billing emails (for example verifying your address, resetting your password, payment receipts or changes to our terms) are part of the service and can't be switched off while you have an account. Marketing emails are separate: we only send them if you opt in, and you can withdraw that consent at any time with the unsubscribe link or by emailing hello@familywell.org.
9. Who at FamilyWell can see your data
For support and operations, authorised FamilyWell staff can see account-level information: your name, email address, the families you belong to, subscription status and when you were last active.
Staff do not look at the content your family stores (lists, expenses, notes, files and so on), except when it is needed to investigate a problem you or another member reported, or suspected abuse or a security incident. When that happens we look only at what the investigation needs.
10. Service providers
We use the following service providers (processors) to run FamilyWell. Each processes personal data only on our instructions and under a data processing agreement or equivalent terms.
| Provider | What they do for us | Location |
|---|---|---|
| DigitalOcean | Hosting the app and its database | DigitalOcean data centres; app servers in Frankfurt, Germany |
| Cloudflare | Hosting familywell.org, content delivery and network security in front of the app and the assistant connection (mcp.familywell.co), file storage for uploads (R2), the requests board database (D1) | Global network |
| Resend | Sending account emails (verification, password reset, notices) | United States |
| Stripe | Checkout, subscriptions, invoices and the billing portal | United States / EU |
| Gemini API for receipt scanning and quick grocery entry; Sign in with Google | United States | |
| Apple | Sign in with Apple | United States |
| TypeSafe (typesafe.ai) | Aisle guesses for shopping items and category guesses for expenses (also for ones an assistant adds), and moderation of public board posts | United States |
| GitHub | Hosting public copies of module requests as issues | United States |
AI assistant providers you connect yourself (Section 6) are not on this list: they act on your instructions and under their own terms. We may change providers over time; this list will always show the current ones.
11. International transfers
Some of the providers above are based in, or may process data in, the United States. Transfers to the US rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses in all other cases, as required by Chapter V GDPR.
12. How long we keep data
- Account and family data: kept for as long as your account exists. You can delete your account in the app's settings or by emailing us.
- Deleted items: when you delete something in FamilyWell, in the app or through an AI assistant, it goes to the trash, where it can be restored for 30 days. After that it is purged permanently, together with its uploaded files.
- Backups: we keep backups so we can recover from failures. They rotate on a fixed schedule, so deleted data disappears from backups as older copies are replaced.
- Billing records: invoices and payment records are kept for as long as Romanian tax and accounting law requires, even after you close your account.
- AI assistant connections: access tokens expire after 1 hour and refresh tokens after 30 days without use. Revoking a connection in Settings > Connected apps ends both immediately. Links that work without signing in expire after 24 hours (vehicle history PDF) or within 2 days (recipe photos). Details in Section 6.
- Sign-in codes: valid for 10 minutes, and only the latest one counts.
- Push subscriptions: deleted when you switch notifications off or the browser withdraws the subscription.
- Board posts: public requests and comments stay on the board while it exists; you can ask us to remove yours. Copies on GitHub are removed on request where we control them.
- Cookies: session cookies expire when you sign out or the session ends.
When you delete your account, content you added to a family that still has other members (for example an item on a shared list) may remain part of that family's records. Tell us if you want specific items removed.
13. Your rights
Under the GDPR (Arts. 15 to 22) you have the right to:
- Access (Art. 15): get a copy of the personal data we hold about you.
- Rectification (Art. 16): correct inaccurate or incomplete data.
- Erasure (Art. 17): ask us to delete your personal data.
- Restriction (Art. 18): ask us to limit how we use your data in certain cases.
- Data portability (Art. 20): receive the data you gave us in a structured, machine-readable format.
- Object (Art. 21): object to processing based on our legitimate interests, including usage analytics.
- Withdraw consent (Art. 7(3)): at any time, without affecting processing that happened before.
- Complain to a supervisory authority (Section 15).
To exercise any of these rights, email hello@familywell.org. We may ask you to confirm your identity first. We reply within one month, as required by Art. 12(3) GDPR; if a request is complex we may extend this by up to two further months and will tell you within the first month.
14. Security
We protect your data with technical and organisational measures appropriate to the risk, including:
- all traffic encrypted in transit with HTTPS/TLS;
- passwords stored only as one-way hashes;
- uploaded files kept in private storage and only served to signed-in members of the family they belong to, or through short-lived signed links a member or their assistant asked for (Section 6);
- assistant access limited to one family and the permissions you granted, and revocable at any time;
- staff access limited to account-level data, as described in Section 9;
- network protection (DDoS and firewall) provided by Cloudflare.
If a personal data breach occurs, we will notify ANSPDCP within 72 hours where required (Art. 33 GDPR), and affected people without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR).
15. Supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. Our lead authority in Romania is:
Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral Gheorghe Magheru 28-30, Sector 1, 010336, Bucuresti, Romania
Website: dataprotection.ro
Email: anspdcp@dataprotection.ro
We'd appreciate the chance to sort out any concern first, so please consider writing to us at hello@familywell.org.
16. Changes to this policy
We may update this policy as FamilyWell changes. If a change materially affects how we use your data, we will tell you by email or with a notice in the app before it takes effect. The "Last updated" date at the top always shows the latest revision. See also our Terms of Service.