Privacy

Last updated September 27, 2026

The framily app helps a group of friends see when they're all free. It stores only what it needs to do that. There are no ads, no analytics or tracking, and nothing is sold or shared with anyone for marketing.

What framily stores

• Your display name, the one you type when you join. Free members do not need an account. You do not need an email address, phone number or password to join.
• Your framily: its name, its invite code and when that code expires, its time zone, which member started it, and the time of its last reminder to add availability. That's only a time: it doesn't say who asked for it or who was reminded. Only the latest one is kept, and it's deleted with the framily.
• Your availability: the times you mark as free or busy, any standing weekly rules, and when you last updated them. Your time zone is stored so times line up. Vacay trip days are stored separately as dates marked Free or Maybe; marking them does not change when your week was last updated.
• Plans and answers: plans people propose (time, optional title, note and host), who proposed them, and each member's answer (in, maybe or can't), including whether you actually answered or were assumed to be in because you were free. Repeating plans also store their schedule and your optional every-time answer; trips store their first and last calendar date.
• "When's good?" polls: the times someone in your framily offers as a link for a group chat, the poll's optional title and who made it, and each answer: the name the person typed, or their name in the framily if they answered in the app, and which times work for them. Answering from the link needs no account. The browser keeps a random id for that poll, so answering again changes the answer rather than adding one; a different poll gets a different id.
• A device token: a random secret created when you join. It's how framily knows it's you. In a browser it's kept in this site's local storage; on iPhone it's kept in the Keychain, where the framily widget can also read it to send an answer you tap. The Keychain copy is saved in your iCloud Keychain, so a new iPhone on the same Apple ID can pick your framily groups back up; it's protected by your Apple ID and passcode, and Apple, not framily, holds it.
• A push notification token, on iPhone only and only while notifications are on, including quiet ones that go straight to Notification Center, so framily can tell you when someone proposes or changes a plan, and remind you to add your availability. Anyone in your framily can ask framily to remind the others who haven't added availability for this week, at most once every 24 hours per framily. Any free or busy time you've marked in My week for this week, or a standing weekly rule, counts as added. Vacay trip days don't. The reminder goes only to people who haven't added any and have notifications on. It skips anyone who has blocked the person asking or whom they've blocked, and it doesn't say who asked.
• Lock Screen card tokens, on iPhone only and only while Live Activities are on for framily. One lets framily put a plan you're going to on your Lock Screen four hours before it starts, in your mood's three colours, which are stored with it. Each card then has its own token, so it can change when plans do and leave on time with the app closed. A card's token is deleted when the card ends. A card you swipe away keeps its token, so framily doesn't put it back, and so does one whose ending didn't reach your iPhone. Both are deleted a day after the plan starts. A note of which cards were started and ended, kept so none is sent twice, is deleted a day after the plan starts.
• A person key: a random secret this browser or phone makes once and keeps (in this site's local storage, or the iPhone's Keychain). It links the framily groups you're in on this device, so that when you're going to a plan in one framily, you show as busy at that time in your others. The service never stores the key itself, only a one-way hash of it, which can't be turned back into the key. A different device gets a different key, so it isn't linked, except an iPhone that gets the key back through your iCloud Keychain, which is you on a new phone.
• A recovery code: if you make one in Settings, the service stores only a one-way hash of it. It brings your framily groups back on a new phone, works once, and is deleted when it's used, when you make a new one, or when you leave the group you made it in.
• Invite credit: a random code for you, the r= part of the invite links you share. When someone new to framily joins through one of them, framily notes it: the hash of their person key and of yours, when they joined, and whether they marked their week within 7 days. You see only counts, never who. When five count, you pick a framily group to get framily+ for a year, and framily keeps a note that you've had it. To tell who's new, framily also keeps the hash of every person key that has been in a framily group. If you move a membership to another device, your invite credit goes with it.
• An install id: a random id this browser or app makes up and sends with each request. It identifies a device, not a person, and is used only to limit wrong invite and poll code guesses.
• Short-lived abuse counters: when someone enters an invite or poll code that doesn't exist or has expired, framily counts it against the network address and install id it came from, in one-hour buckets, to stop people guessing codes. Correct codes aren't counted, and a counter isn't used after its hour ends.

Optional framily+ buyer

Buying framily+ needs no account and no sign-in. The purchase carries a random buyer token that your iPhone generates and keeps, and that token is the only thing identifying a buyer. It travels with the subscription, which is how Restore Purchases finds the same buyer on another device. We store a buyer ID, verified subscription records, and the framily groups the buyer chooses to upgrade. We never receive your name or email address, and Apple handles payment, so framily does not see payment card details. Deleting your buyer record removes all of it; it does not cancel the Apple subscription, which you cancel in your Apple account.

Widgets and the iMessage extension read a protected local snapshot of upcoming plans. That snapshot contains no membership credentials. Sharing a plan in Messages reveals its title, date and framily name to the recipients you choose; message delivery is handled by Apple.

Who can see it

Everyone in your framily can see your name, when you last updated your availability, the plans in the framily and everyone's answers. They can also see how many others in it haven't added availability for this week, and how many of those could get a reminder. That's a count with no names, and each person's count leaves out anyone they've blocked or who has blocked them. Your free times are used to find when people overlap and to build a plan's guest list. Anyone holding a current invite code can see the framily's name and its members' display names, so they know what they're joining. A "When's good?" poll is made for a group chat, so anyone with its link can see its title, who made it, the framily's name, its times, and the name of everyone who answered with the times that work for them; nothing else about the framily is shown there. Nobody else outside your framily can see any of it.

Member blocking stores which member you chose to block. Blocking hides plans between the affected people and keeps them out of matching results together; it does not delete their membership or content. Existing commitments still keep time unavailable without exposing hidden plan details. You can unblock people from the framily member list.

When a plan you're going to makes you busy in your other framily groups, the people in those framily groups see only that you aren't free then, the same as any busy time. They don't see the plan, which framily it's in, or that your framily groups are linked. Only you see why you're busy.

Your Vacay calendar is not shown to other members. Trip matching shows who can make a suggested stretch and which of those days they marked Maybe; it does not share their full calendar.

Support reports

Report a problem opens an email draft for you to review. Nothing is sent automatically. If you send it, the support mailbox receives your sender email address and anything you include, such as your message, app version, and a visible group, plan or member reference. Please leave out information you do not want to share with support.

Where it lives

The framily service runs on Cloudflare, which stores the data above and handles every request. Cloudflare processes network addresses to deliver the service. Operational and error logs help us diagnose problems and protect the service; they can include request metadata and URLs containing group, plan or invite identifiers. These are separate from analytics or advertising tracking. Cloudflare retains these logs under its hosting policies. On iPhone, notifications are delivered through Apple's push notification service.

Deleting your data

• Leave a framily (framily tab, then Leave framily) to delete your membership along with your availability, your answers, your push and Lock Screen card tokens and any plans you proposed or polls you made. This browser or phone then loses access.
• Delete a framily: the person who started it can delete it for everyone. That removes every member, every availability entry, every plan, poll and answer, and every push and Lock Screen card token belonging to it.
• The person who started a framily can also remove any member, which deletes that member's data the same way.
• Delete a buyer account in Settings → framily+ to remove its buyer identity, subscription records and chosen coverage from framily. This keeps free memberships and group data. Cancel Apple billing separately in Manage Subscription before deleting if you want payments to stop.
• In a browser, clearing this site's data removes the device tokens, person key, install id and poll answer ids from the browser.

How long it's kept

Your membership data, including availability, trip days and answers, is kept while you're in the framily. That membership data is deleted when you leave, when the person who started the framily removes you, or when the framily is deleted. A linked membership in another framily keeps its own copy until you leave that framily too. Invite credit, and the note that a person key has been in framily, belong to a person, not a membership, so they stay when someone leaves or a framily is deleted: that's how each new person counts once and each year of framily+ is given once. They hold no names, only the name of the group a year of framily+ went to. Invite-code counters are only used during their hour and are then deleted. A poll, with every name and answer on it, is deleted 30 days after it closes: a week after its last time, or sooner if it's closed early in the app. Deleted data can stay in the hosting provider's database recovery history for up to 30 days before it's gone completely. Buyer-account records are separate and are removed through buyer-account deletion. Membership deletion does not immediately erase hosting logs or support correspondence. You can contact support about deleting support messages.

Children

The framily app isn't directed at children under 13.

Changes

If what framily stores changes, this page changes first, with a new date at the top.

Contact

If you can't reach the Leave button any more, for example because you cleared this browser or lost your phone, ask the person who started your framily to remove you. That deletes your data the same way leaving does.

For anything else, including deleting data nobody in your framily can remove, email justin@districtmapper.com.