Effective date: 16 October 2026
HeyFam helps adults organise a family calendar, shifts, tasks, shopping and birthdays. You can subscribe, restore your subscription and plan on this iPhone without signing in. Guest plans stay on this device until you choose to sync and share. Planning requires an active subscription, or membership of a covered family.
Adults can sign in with Apple when they choose to sync and share, or join an invited family without purchasing. Signing in alone does not upload or replace the local planner. HeyFam verifies subscription coverage and checks the uploaded copy before switching to shared family storage. Joining keeps local plans separate. Children can be included as family profiles without creating accounts.
This policy describes the shared-family version, including its TestFlight preview. Earlier versions of HeyFam keep family information on the device and do not create accounts or upload that information to the HeyFam backend. Those versions continue to use local storage and local reminders.
When you sign in, HeyFam stores an account identifier for sign-in and family membership. Apple can provide a name and, where included in its sign-in response, an email address or private relay address. You can edit the name used for your family profile.
The app stores the information adults add to their family: profile names and roles, optional birthdays, plans, participants, cover arrangements, shifts, tasks, shopping items and the text entered with those records. It also stores the family's timezone and technical information needed to synchronise records, prevent conflicting changes and safely retry operations.
For subscriptions, HeyFam receives Apple-signed purchase information and stores the subscription product, transaction and app-download identifiers, an account-linking token, renewal status, expiry date and purchase environment. Guest purchase information can arrive through Apple's subscription notifications before you create a HeyFam account. It does not grant access to family information. When you choose sharing, the verified purchase is linked to your HeyFam account and the household it covers. They are used to verify purchases, restore coverage, process renewal and refund updates and prevent a purchase being used for more than one household. Apple handles payment; HeyFam does not receive payment card or bank details. Family members can see the household's plan, coverage dates and who pays, but cannot access the subscriber's transaction records.
The Firebase client starts when you choose sharing or restore a previously signed-in shared session. Apple App Attest and Firebase App Check provide technical evidence that requests come from the authentic app. Backend requests include technical metadata such as IP addresses and operation results. Operational logs use operation names and error codes; the app does not send family record content to those logs.
HeyFam does not include advertising or Google Analytics. It does not use family information for advertising or cross-app tracking.
HeyFam uses RevenueCat to understand subscription purchases, trial starts and conversions, renewals, cancellations, expirations and refunds. Apple's signed purchase notifications are forwarded by HeyFam's backend. They include purchase and subscription identifiers, account-linking tokens, products, dates, renewal information and purchase environment. RevenueCat may assign a customer identifier to group a subscription's events. HeyFam does not send family profiles, names, emails, plans, birthdays, tasks or shopping information to RevenueCat, and does not use this integration for advertising or cross-app tracking. Apple handles payment; RevenueCat does not receive payment card or bank details from HeyFam.
Adults can see and edit the shared records allowed by their family access settings. The family owner manages invitations, account access and ownership. An invitation grants the specified access when another adult accepts it. Invitation codes expire after seven days and can be accepted only once.
For sharing, HeyFam uses Google's Firebase Authentication, Cloud Firestore, Cloud Functions and App Check to provide sign-in, shared storage, synchronisation and access protection. Apple provides Sign in with Apple and App Attest. These providers process information needed to operate those services. Firestore and the app's backend functions use the Europe West region; authentication and other provider infrastructure can operate globally.
RevenueCat processes purchase information to provide subscription analytics. Its processing and storage infrastructure can operate outside the European Economic Area. See RevenueCat's privacy policy for information about its processing practices.
Onboarding drafts and guest plans use durable device storage. A purchase verified by Apple unlocks local planning immediately; HeyFam sign-in and the sharing service are not required. Restoring a subscription restores access, but reinstalling the app does not restore unsynced local plans. You can sign in to sync and share those plans before changing devices. The annual plan may include a seven-day introductory free trial for users Apple determines are eligible; the monthly plan has no trial. A verified trial supplies family coverage through its Apple expiry date. Shared families with active coverage use a local cache so ordinary edits work offline. When coverage expires, existing members retain their permitted views of saved records; editing and new invitations pause. Expiry does not delete the family or widen anyone’s access. Failed or interrupted edits can also remain as device-specific or account-specific drafts for review. Sign-out and detected access removal clear the displayed shared family and the shared-data cache. Access removal is detected when an offline device reconnects.
Reminders use the device's notification permission and local notifications. This version does not send remote push notifications.
When you choose to share your family, HeyFam verifies subscription coverage before uploading a snapshot and checks the uploaded records before switching to shared storage. Cancelling checkout preserves the onboarding draft. Cancelling or failing a sharing attempt returns to the local planner; cleanup of an abandoned upload can finish later. A verified import leaves an archived local copy on that device. The original database from an earlier HeyFam version is also kept intact. Joining a family does not automatically upload or merge local plans.
After signing out of a family activated from this device, starting a new setup creates a separate local family. The archived shared-family copy is not reopened for editing. An unrelated local setup kept when joining remains saved on this device. Editing it requires an active device subscription.
You can sign out, leave a family or delete your account from the app. Account deletion requires recent Apple authentication and revokes the Apple sign-in authorisation used by HeyFam. It removes your linked personal profile and clears that profile's assignments. Other adults' shared family records remain available to them.
Onboarding without sign-in has no HeyFam account to delete. Removing the app removes its local storage, archived copies and cached data from that device. Device backups may retain app information under Apple's backup settings and retention practices.
A family owner must transfer ownership before leaving or deleting their account while other adults still have access. The sole owner can explicitly delete the family. Family deletion blocks access immediately, then removes its backend records through a retryable cleanup process.
Deleting HeyFam, deleting an account or transferring family ownership does not cancel the Apple subscription. The subscriber can manage or cancel it in Apple subscription settings. Existing paid coverage stays with the original subscriber’s household after an ownership transfer. Subscription verification records can remain while an Apple subscription continues, including after account deletion, so remaining family members receive paid coverage and renewals or refunds can be processed.
Technical records used for security, safe retries and operating the service may have different retention periods from shared planning records. Provider backup and logging systems can retain information according to their service retention settings.
Signed notifications waiting for RevenueCat delivery are held in backend-only retry records. HeyFam removes their signed payloads after successful delivery and deletes delivered queue metadata after seven days. Failed deliveries remain available for investigation and retry. Subscription transaction history may remain with RevenueCat for reporting and ongoing subscription updates; deleting a HeyFam account does not cancel the Apple subscription or automatically erase subscription verification and reporting records.
For privacy questions, use HeyFam support. This policy will be updated when the app's data practices change.