Privacy Policy
What FamilyBeacon shares, who can read it, what our relay server can and cannot see, and how to delete everything.
Effective October 9, 2026 (last updated October 10, 2026: being in more than one family)
Who we are
FamilyBeacon is made by Harborline ("we", "us", "our"). You can reach us at harborlineapps@protonmail.com.
How FamilyBeacon works
A family is formed by people scanning a QR code from each other's phones, in person. During pairing the phones swap public encryption keys. From then on, each phone encrypts what it shares separately for each family member, using that member's key. We never receive anyone's name, phone number, email address or password, because the app doesn't ask for them and has no account to put them in.
Messages travel through a relay server. The relay stores sealed messages under random mailbox addresses until the recipient's phone collects them. The encryption uses libsodium (X25519 keys with XSalsa20-Poly1305), and the keys never leave the family members' phones.
What family members can see
Only the people in your family, as shown on the app's "Your sharing" screen, can read what your phone shares:
- Your location, at the precision chosen for each person: exact, neighborhood (about half a mile) or city (about 6 miles). Adults choose their own; a child's precision is set by the family's parents. The coarsening happens on your phone before anything is encrypted. An SOS always sends your exact location to everyone, and the app tells you this before you send one.
- Your battery level and whether the phone is charging, and whether it seems to be moving.
- Arrivals and departures at family places. Your phone checks the places itself and sends only "arrived" or "left", not the path you took.
- SOS alerts, "Are you OK?" requests from a parent, and your "I'm OK" replies. A check-in is only ever sent as a reply to a parent's request.
- When your phone can't share, for example because location is switched off in settings, a "Location off" status, so nobody mistakes an old position for a current one.
- The name you chose in the app, your role (parent, child or adult, set by the family owner or a parent), and the family's list of members and places.
What our relay server can see
The relay is the only part of FamilyBeacon we run. It can see:
| Data | What it is | How long it is kept |
|---|---|---|
| Mailbox addresses | Random 256-bit values each phone creates for its inbox. They aren't linked to your name, phone number, device ID or Google account. Phones replace them whenever someone leaves the family. | Only while messages are waiting for that mailbox |
| Encrypted messages | Sealed content the relay can't open, padded so that its size gives little away. | Deleted when delivered, and in any case within 24 hours |
| Timing | When messages arrive and are collected. | Not recorded |
| IP addresses | Needed to answer a connection. Used only to limit how many requests one connection can make, held in memory as a keyed hash, never written to disk or logs. | Up to 10 minutes after the last request |
The relay keeps no access logs. It records only that it started and how many messages are queued. It never sees names, locations, places, battery levels or what kind of message something is.
Cloudflare. Our relay is reached through Cloudflare, which carries the connection between your phone and our server. Cloudflare handles the same technical details as the relay (IP address, mailbox address, encrypted message) under its own privacy policy. It can't read the encrypted content either.
Your own relay. A family can use a relay run by someone else, because the relay's address is part of the QR code. In that case that relay's operator, not us, handles the details above. Everything a relay holds is still encrypted the same way.
What stays on your phone
All of the following is stored only on your phone, encrypted with a key held in the phone's Android Keystore:
- Your private encryption key and your inbox's secret.
- The family list: members' names, public keys, inbox addresses and who the family owner is.
- Family places (name, location and radius).
- History of the locations your phone has received from family members. It is kept for 7 days by default (you can choose 1 to 30) and then deleted automatically. Nobody can recover it from anywhere else.
- The Today timeline: a list of what happened in the family, such as who arrived at or left a family place, check-ins and "Are you OK?" requests, SOS alerts, low battery, location switched off, and people joining or leaving. It holds names, place names, times and battery levels, but no coordinates: an SOS or a check-in is noted as the fact, not the position. It is kept for the same window as your history (7 days by default) and at most the latest 500 entries.
- Settings, such as the precision you chose for each person.
Your notification choices (which kinds of alert you want, arrivals and departures per person and place, and whether the sharing notice is quiet) are kept in the app's private storage on your phone. They aren't encrypted, because they contain only random identifiers and on/off switches, never names, places or locations. SOS alerts and "Are you OK?" requests always show, and the sharing notice can be made quiet but never removed.
None of this is included in Android cloud backups or device-to-device transfers. All of it is deleted when you leave the family, are removed from it, or the family is disbanded. On a phone in several families, each family's part is kept separately and deleted on its own.
Driving reports (a trial, from app version 0.4)
Driving reports are off unless they are turned on. Parents and adults turn them on for themselves; a family's parents can turn them on for a child. The person reported always sees that they are on: on their "Your sharing" screen, in the permanent sharing notification, in a notification when someone turns them on or off, and in a notification after each report is sent. There is no hidden mode.
While they are on, your phone works out each drive itself, from the GPS speed it already uses for sharing, and from its own screen-on and unlock signals. No extra permission is used. After each drive it sends your family one encrypted summary: start and end time, where it started and ended (a family place, or an area of about half a mile or coarser, never an exact point), distance, top speed, time above one speed limit chosen in the app (the app has no road speed-limit data), and how many times it saw hard braking, rapid acceleration or the phone in use while moving. The phone can't tell a driver from a passenger, and navigation with the screen on counts as phone use.
Nothing is sent during a drive beyond the usual location updates. The summary passes through the relay like any other sealed message and is deleted once delivered. Family members' phones keep summaries for 30 days, encrypted like the rest of their history, and anyone can delete them sooner. Your own phone doesn't keep a copy. Turning driving reports off stops new summaries at once.
Being in more than one family (from app version 0.5)
One phone can be in up to five families, for example your household and your parents'. Each family is kept fully separate, as if it were on another phone: your phone makes a separate encryption key, inbox and relay connection for each family, and nothing from one family is ever put in a message to another. Members of one family can't see your other families, their people, places, history, timeline or driving reports, or even that you have other families.
- Your location goes to each family at the precision chosen for that family. An SOS goes to every family you are in, with your exact location, and the app says so before you send one.
- Place alerts go only to the family the place belongs to, and an "I'm OK" reply only to whoever asked, in their family.
- The names you give your families in the app ("Home", "Grandparents") stay on your phone and are never sent to anyone.
- If the families use the same relay, that relay sees the same IP address for both, as it would for two phones on one Wi-Fi network. It still can't read anything or tell which messages belong together.
- Leaving one family, being removed from it, or it being disbanded deletes only that family's keys, places, history, timeline and drives from your phone. Your other families keep working.
Other services the app uses
- Google Play services provides the phone's location and place geofences. The app estimates whether you're moving from your speed, on the phone, to decide how often to update. These run on your phone under Google's own settings and privacy policy. FamilyBeacon doesn't send anything to Google itself.
- Map tiles. During the beta, the map images come from OpenStreetMap's tile servers. Like any map, they receive your IP address and which map squares you are looking at, under the OpenStreetMap Foundation's privacy policy. We plan to serve our own map tiles before the public launch, and this policy will be updated when we do.
- Address search. When a parent adds a family place by typing an address and tapping Search, what they typed is sent to OpenStreetMap's Nominatim search service (nominatim.openstreetmap.org), along with the ordinary details of any web request: your IP address, your phone's language setting and the app's name and version. Nothing is sent while you type, only when you tap Search. It doesn't include your location, your history or anything about your family, and the app doesn't store the search. Nominatim handles it under the OpenStreetMap Foundation's privacy policy. You can also skip the search and move the map to the place by hand, which sends no search at all.
What we never collect
- No account, sign-in, email address or phone number.
- No readable locations, places, names or messages. The relay only ever holds encrypted copies.
- No analytics, crash reporting or usage statistics.
- No advertising, and no ad or tracking software.
- No contacts, photos, messages or browsing.
- We never sell or share data, and we never pass it to data brokers or insurers.
Why the app asks for the permissions it does
- Location (precise or approximate). This is what the app shares with your family.
- Location "Allow all the time" (optional). Lets place arrival and departure alerts work, and lets sharing come back after the phone restarts. The app explains this on its own screen before Android asks you.
- Notifications. The permanent "Sharing location with N people" notice, plus SOS and family alerts. The app won't share your location unless that notice can be shown.
- Camera. Only to scan a family QR code. The image is processed on the phone and is never saved or sent.
- Internet and network state. To reach the relay and to reconnect when your network changes.
- Run at startup. To resume sharing after a restart, only if it was on before.
You are always in control
- While your phone shares its location, it shows a permanent notification saying how many people can see it. The app can't hide it, and it has no hidden or disguised mode.
- The "Your sharing" screen lists everyone who can see your location and at what precision.
- Parents and adults can leave the family in two taps, at any time, without anyone's PIN or approval. The family owner first hands the family to another parent or adult, or disbands it; the app warns clearly before either.
- The family owner can remove a member, for example a lost phone. A removed phone stops sharing and deletes everything, just as if its owner had left. Disbanding the family wipes every phone.
- A child's sharing settings are chosen by the parents and shown to the child as read-only. A child's phone is managed by the parents: a child can't invite people, edit places or leave the family on their own. To leave, the family owner (always a parent) removes the child's phone. The child still sees exactly who can see them, the permanent sharing notice stays on, and the app can always be uninstalled.
- You join a family only by scanning a QR code in person, and only after your phone has shown you the name of everyone who will see your location.
Deleting your data
Leaving the family deletes your keys, the family list, places, history, the Today timeline and your notification choices from your phone, and tells the other members you have left. Uninstalling the app, or clearing its storage in Android's settings, also deletes everything on the phone. Anything still waiting on the relay is unreadable and is deleted within 24 hours. We hold no other copy, so there is nothing else to request. Locations other members' phones received from you stay in their on-phone history until it expires, 7 days by default.
Children and teens
FamilyBeacon is meant for families, including teenagers aged 13 and over, and it is not directed at children under 13. A parent or guardian may set it up on a younger child's phone. Either way, we don't collect personal information from anyone, and a family's data can only be read on its own members' phones.
Security
All traffic to the relay uses HTTPS, and everything a family shares is also end-to-end encrypted. Keys are generated on the phone and protected by the Android Keystore. If you find a security problem, please email us.
This website
This site is hosted by Netlify. Like any web host, Netlify's servers see the ordinary technical details of a visit, such as your IP address, when they deliver a page. We don't use analytics, tracking or advertising on this site. The light or dark theme you pick is remembered only in your own browser. Fonts and images are served from this site, so your browser doesn't contact Google Fonts or any other third party.
Google Play
You install FamilyBeacon through Google Play, which handles installation, and any purchase, under its own privacy policy.
Changes to this policy
If this policy changes, the new version will be posted here with a new effective date. Because the app has no account and no way to contact you, this page is the place to check.
Contact
Questions about this policy: harborlineapps@protonmail.com.