privacy policy

our promise

beanies.family is built on a simple belief: your family's data belongs to you. we don't collect it, we don't store it on our servers, and we don't sell it. ever. this isn't just a policy — it's the foundation of how we built the app.

how beanies.family works

beanies.family is a local-first application. this means your family data — finances, activities, goals, to-dos, and everything else — lives on your device. your family content is never transmitted to our servers.

• local storage: all family data is stored in your browser's IndexedDB, encrypted at rest
• no accounts on our servers: there are no usernames, passwords or profiles on our servers. we keep one short directory entry per family so the app can find your family file again on a new device, described in the family registry below
• no cloud dependency: the app works fully offline — no internet connection required after initial load

the family registry

there is one thing we do keep on our servers: a short directory entry for each family, called the family registry. it lets the app find your family file again when you sign in on a new device, and tells us roughly how many families use beanies.family. it never contains your family content, and nothing in it can open your family file.

each entry holds:

• the family owner's email address, taken from the owner's profile, so we can reach the owner about a serious problem with their family, and to send the owner occasional emails about beanies.family (product news, offers, asking for feedback); every one has a one-click unsubscribe
• your family's name, as you typed it when you created the family
• where the family file lives: whether it's kept on your device or in Google Drive, the file's name and, for Google Drive, its file id
• whether the owner opted in to our newsletter (sent by Substack). this is separate from our occasional owner emails, which go to every family owner and each carry a one-click unsubscribe
• your country, if you set one in Settings
• usage signals: the date the family was created, the date of the most recent sign-in (a date, not a time), which platform the family signed up on (web, iOS or Android), the approximate size of the encrypted family file, and how many members the family has (a number only, never names)
• random ids for the family and its owner, generated on your device
• the campaign tag from the link that first brought you to beanies.family, if there was one (for example which of our own ads or posts); it identifies the ad, not you
• your answer to "how did you hear about us", if you answered (which option you picked, never anything you typed in)

we use it to run the app and to understand how beanies.family is used overall. we don't sell it or use it for third-party advertising. it is stored with Amazon Web Services.

unsubscribing: every owner email has a one-click unsubscribe. when someone unsubscribes we keep a one-way fingerprint of their email address (not the address itself), the date, and how they unsubscribed (from the email or from the unsubscribe page). we keep it indefinitely, including after the family is deleted, so the unsubscribe keeps being honored. if you re-subscribe from the unsubscribe page, the record is deleted.

retention and deletion: the entry has no automatic expiry, because it is what lets a returning family find their file on a new device. when you delete your family from Settings, we remove the family name, the file location, the newsletter opt-in and the usage signals, and keep only the owner's email, country, creation date, signup platform and campaign tag, so the family can't be mistakenly registered again under someone else. to have those removed too, contact us via the homepage and we'll delete the entry entirely.

data we do not collect

to be absolutely clear, we do not collect:

• your financial data (accounts, transactions, balances, budgets)
• your family members' names, relationships, or activities
• your goals, to-do items, or travel plans
• your passwords or encryption keys
• your contacts or address book
• your personal information beyond the family registry entry above and the limited technical diagnostics described below

the only things that reach us are the family registry entry above and a small amount of technical diagnostics, covered in diagnostics & error reporting below.

analytics

we use Plausible Analytics, a privacy-friendly, cookie-free analytics service, on this website and in the iOS and Android apps — the same aggregate counts either way, so we can see how beanies is used without tracking anyone. Plausible does not use cookies, does not collect personal data, and is fully compliant with GDPR, CCPA, and PECR. it tells us aggregate information like:

• how many people visit the site
• which pages are most popular
• what countries visitors are from (approximate, based on anonymised IP)
• which features are used most (aggregate counts only)
• how often people sign in (aggregate login counts, not individual tracking)
• what devices and browsers are used
• whether beanies was used on the web or in the iOS or Android app
• which screens are opened (some in-app screen addresses include a random id for a family member or recipe — that id is generated on your device and is never connected to a name or email)

no individual user can be identified from this data — on the web or in the apps. nothing is stored on your device to recognise you, and none of it can be linked to you across other companies' apps or websites. Plausible's full privacy policy is at plausible.io/data-policy.

campaign tags: when a link to beanies.family carries a campaign tag (for example from one of our own ads or posts), the tag is kept on your device for 30 days and recorded with your family registry entry when you create your family, so we know which of our own ads and posts actually work. it is first-party and cookie-free, it is never shared with the ad platform, and it identifies the ad, not you.

first-party event record: when you first arrive on beanies.family (from an ad or otherwise) and when you tap an App Store or Google Play badge on our website, our own server records one small event: the campaign tag (if there was one), which store you chose, the kind of device (phone, tablet or desktop) and its operating system family (never the version), and the time. it holds no IP address, no cookie and nothing that identifies you, and it is kept for up to 13 months. we use it only to work out which of our own ads bring families.

google play install referrer: on Android, the ad's own utm tags (never any ad or click id) travel through the Google Play install and are read once, on first launch after install (and ignored when the install is older than 30 days or the device already has a family). Google's own marker for installs that did not come from one of our links is ignored.

weather

the weather is the one place the app uses a location, and only with your consent: it is collected only when a pod manager in your family explicitly types a home town for the weather. what is sent is the typed town (to find it) and its rounded coordinates (about a kilometre), from your device to Open-Meteo only, never through our servers. your device's location services and GPS are never used. turning Show Weather off stops every lookup, and weather readings are cached on your device only.

diagnostics & error reporting

to keep beanies.family reliable, the app sends us a small amount of technical diagnostic and error information. this never includes your family content (finances, activities, names, goals, documents), only what we need to find and fix bugs.

• error reports: when something breaks in a way that could affect your data, the app sends an error report to our error log on AWS, from which a page can be sent to the team's Slack channel. because we may need to find your family's report, it includes the family's display name and an anonymous family id, never an email address
• diagnostic logs: a stream of technical events (error messages, the screen or route where an error happened, timings, browser and network type, a build id, and — on the phone apps — whether your reminders were successfully set and whether you granted notification permission) helps us spot and reproduce issues. a few of these events include the calendar date of a repeating activity you edited and which option you chose (just this one, this and future, or all), so we can tell whether a session ended up on the right day. some calendar events also carry the random id of the activity they are about (never its title, who it is for or when), so we can find the one record that caused a problem. when you use magic beans to read a recipe, it also records which method worked (a photo, a web page, a video) and two counts — how many ingredients were found and how many values beanies filled in itself — so we can tell how often the reader guesses. it never records the link you gave us, the page or video it read, or anything from the recipe. when you use magic beans to read a bank statement, it records counts — how many pages and lines were read, and how many lines were added, merged, skipped or looked like ones already in beanies — so we can tell how well the matching works. it never records an amount, a date, a payee, an account number or anything else from the statement. when you share something to beanies from another app, it records how it arrived and what KIND of item it was — the technical type, such as a png image or plain text — along with how many items came through and, on iPhone, whether the app was able to open or notify you, so we can tell when sharing quietly fails. it never records the link you shared, the file's name, or anything inside it. if you use the beanie wall, it records the size of the screen you opened it on, so we can tell which tablets it fits and which it turns away — four numbers describing the screen, nothing about what is on your wall. when the weather is on, it records whether a weather lookup worked and how many minutes old the reading on screen is (a whole number), so we can tell when a wall is showing stale weather. it never records the town you typed, its coordinates or the forecast. so we can tell when a trial ends or a plan lapses as it should, it also records which plan state your family is in on this device (beta, trial, active or read-only), which plan it is on (basic or full), and whether the app acted on that state. it never records a price, a payment detail or anything you typed. while a pod is being set up, these events also carry a random identifier for that one set-up attempt, so we can see where an attempt stalled; it is not linked to your name or email. this stream is PII-free: it carries dates, counts and yes/no answers, never the name or content of an activity, reminder, payment or recipe, no family content at all, and is correlated only by a random family id, not by your name or email. if your device is offline when these events are recorded, they wait on your device for up to 7 days and are sent the next time you open the app
• what we do with it: we use it to diagnose and fix problems and keep the app working. one narrow exception: we look at a single number per family, how many times the app was used in the last 30 days, to decide whether its owner gets one of our occasional "we miss you" emails. that number says nothing about what you did, who did it, or what is in your family's data (which we never see). we do not sell it, use it for third-party advertising, or build profiles from it
• retention: we keep this information only for as long as we need it to investigate issues

you can ask us to delete any error report tied to your email at any time. see delete your data.

google drive integration (optional)

if you choose to enable Google Drive sync, your family data file (.beanpod) is encrypted on your device before it leaves your browser, using AES-GCM encryption with a key that only you control. Google never sees the unencrypted contents, and we never see them either.

• encryption: your .beanpod is encrypted locally using the Web Crypto API (AES-GCM) before any byte leaves your device
• your key, your control: the encryption key is derived from your password and never leaves your device — not even to us
• OAuth scope: we request only the drive.file scope. this is a per-file scope - it grants access to a specific .beanpod only when you explicitly select it via Drive's file picker, drag and drop it into the app, create it with the app, or open it via Drive's "Open with beanies.family" menu. we cannot list, search, browse, or access any other files in your Drive
• file metadata: we read the file name, modified time, and the encrypted contents of .beanpod files you've explicitly granted access to. we do not read any other Drive metadata
• what's in a .beanpod: family member profiles, accounts, transactions, activities, goals, to-dos, and other family planning data — all encrypted at rest, unreadable to anyone without your password (including us, including Google)
• revocable: you can disconnect Google Drive at any time from Settings, and revoke access entirely from your Google account at myaccount.google.com/permissions

google calendar integration (optional)

if you connect Google Calendar, beanies keeps your family activities in step with a calendar you choose. this section describes exactly what it reads, because the honest answer changed when we added the one-time import.

• OAuth scopes: we request calendar.events.owned (read and write the events you own), calendar.calendarlist.readonly (the names of the calendars in your account, so you can pick which one to use and which to import from), and userinfo.email (to label the connection). the calendar list includes any calendar shared with you, which is what lets you import a family calendar someone else owns - we read its name, and its events only if you tick it for the one-time import
• what we write: beanies creates and updates events for your beanies activities, and it only ever deletes an event it created itself. an event that existed before beanies is never deleted by us
• what we read, normally: when the clash nudge is on, we ask only whether you are busy at a given time. we request times, not content
• what we read during a one-time import: if you choose to import your existing events, we read the title, description, place, times and repeat pattern of events on the calendars you tick, for the next 12 months. this happens only when you ask for it, and you review every event before anything is imported
• guest lists are never read: we do not request the attendee list of any event, at any time. other people's email addresses never enter your family file
• nothing is stored on our servers: imported events become ordinary activities inside your encrypted .beanpod, which we cannot read
• what disconnecting does: disconnect from Settings at any time, or revoke access entirely at myaccount.google.com/permissions. disconnecting removes the events beanies put there, which is the same rule as above - beanies cleans up after itself and touches nothing else. events that existed before beanies, including ones you imported with the one-time import, stay exactly where they are

google workspace marketplace

beanies.family is listed on the Google Workspace Marketplace. the listing enables the "Open with beanies.family" entry in Google Drive's right-click menu for .beanpod files. when you use it, Drive grants the app per-file access to that specific .beanpod using the same drive.file scope described above. no broader Drive access is granted, and no additional data is collected by being listed.

the marketplace listing itself is purely a discoverability shortcut - it does not change how the app handles your data, and removing the listing would not change your data flows.

google authentication

when you sign in with Google for Drive sync, we request only your email address from Google's OAuth service (userinfo.email scope). we do not request your name, profile picture, friends list, calendar, contacts, or any other profile data.

your email address is:

• used solely to label which Google account is connected to which family pod, so you can recognise it in the app's settings
• stored locally in your browser (IndexedDB), alongside the rest of your family data
• never sent to our servers. (separately, the email on the family owner's profile is kept in the family registry.)
• cleared when you sign out of beanies.family or revoke the Google authorisation

cookies

beanies.family does not use cookies. we don't use tracking cookies, advertising cookies, or any third-party cookies. Plausible Analytics is also cookie-free.

third-party services

the only third-party services the app connects to are:

• Google Fonts: to load the Outfit and Inter typefaces
• Plausible Analytics: privacy-friendly, cookie-free analytics — on the website and in the apps
• Google Drive: only if you explicitly enable it — encrypted data only
• Google OAuth: only when you choose to sign in
• Amazon Web Services: hosts the family registry, our diagnostic logs and the first-party event record, and sends our occasional owner emails (Amazon SES)
• Substack: receives the owner's email address if they opt in to our newsletter at sign-up
• Google Play's install referrer: Android only; Google passes our own utm tags from the Play link to the app on first launch
• Stripe: only if you choose a plan, from the website. Stripe takes the payment and keeps your card details, a customer record (your email) and your receipts; beanies.family never sees your card, and stores only which plan your family is on
• ExchangeRate API: to fetch currency exchange rates — no personal data is sent
• Open-Meteo: only if a pod manager in your family chooses to type a home town for the weather. The town you type (to find it) and its rounded coordinates (about a kilometre) go from your device to Open-Meteo, and nowhere else, to fetch the forecast. Your device's location services and GPS are never used. Nothing else about your family is sent, turning Show Weather off stops every lookup, and Open-Meteo deletes its request logs after 90 days

data portability & deletion

• export: you can export your family data file at any time from Settings
• delete: clearing your browser data removes all local data. if you use Google Drive sync, you can delete the .beanpod file from your Drive
• no lock-in: your data is yours — we provide export functionality so you're never trapped

children's privacy

beanies.family is designed for families, which may include children. family data is stored locally on the parent's or guardian's device, and the only personal information we hold is the family owner's email and the family name in the family registry. the registry records only how many members a family has, never their names or ages, so no information about children reaches us. the family owner controls all data.

security

• encryption at rest: local data is encrypted in IndexedDB
• encryption in transit: Google Drive files are AES-GCM encrypted before upload
• your family data stays with you: your family content lives only on your devices and your own Google Drive, never on our servers. the only information that reaches us is the limited diagnostics and the family registry entry described above
• open source: our code is publicly auditable on GitHub

changes to this policy

if we make changes to this privacy policy, we will update the "last updated" date at the top of this page. since beanies.family is open source, you can also review changes in our GitHub repository.

contact

if you have questions about this privacy policy, please reach out via our homepage or open an issue on GitHub.