privacy policy

our promise

beanies.family is built on a simple belief: your family's data belongs to you. we don't collect it, we don't store it on our servers, and we don't sell it. ever. this isn't just a policy — it's the foundation of how we built the app.

how beanies.family works

beanies.family is a local-first application. this means your family data — finances, activities, goals, to-dos, and everything else — lives on your device. it is never transmitted to our servers because we don't have servers that store your data.

• local storage: all family data is stored in your browser's IndexedDB, encrypted at rest
• no accounts on our servers: we don't maintain user accounts, databases, or profiles on any server
• no cloud dependency: the app works fully offline — no internet connection required after initial load

data we do not collect

to be absolutely clear, we do not collect:

• your financial data (accounts, transactions, balances, budgets)
• your family information (names, relationships, activities)
• your goals, to-do items, or travel plans
• your passwords or encryption keys
• your location data
• your contacts or address book
• your personal information beyond the limited technical diagnostics described below

the one thing that does reach us is a small amount of technical diagnostics, covered in diagnostics & error reporting below.

analytics

we use Plausible Analytics, a privacy-friendly, cookie-free analytics service, on this website and in the iOS and Android apps — the same aggregate counts either way, so we can see how beanies is used without tracking anyone. Plausible does not use cookies, does not collect personal data, and is fully compliant with GDPR, CCPA, and PECR. it tells us aggregate information like:

• how many people visit the site
• which pages are most popular
• what countries visitors are from (approximate, based on anonymised IP)
• which features are used most (aggregate counts only)
• how often people sign in (aggregate login counts, not individual tracking)
• what devices and browsers are used
• whether beanies was used on the web or in the iOS or Android app
• which screens are opened (some in-app screen addresses include a random id for a family member or recipe — that id is generated on your device and is never connected to a name or email)

no individual user can be identified from this data — on the web or in the apps. nothing is stored on your device to recognise you, and none of it can be linked to you across other companies' apps or websites. Plausible's full privacy policy is at plausible.io/data-policy.

diagnostics & error reporting

to keep beanies.family reliable, the app sends us a small amount of technical diagnostic and error information. this never includes your family content (finances, activities, names, goals, documents), only what we need to find and fix bugs.

• error reports: when something breaks in a way that could affect your data, the app sends an error report to our maintainer alerting channel. because we may need to contact you about a serious problem, that report includes the account owner's email address
• diagnostic logs: a stream of technical events (error messages, the screen or route where an error happened, timings, browser and network type, a build id, and — on the phone apps — whether your reminders were successfully set and whether you granted notification permission) helps us spot and reproduce issues. a few of these events include the calendar date of a repeating activity you edited and which option you chose (just this one, this and future, or all), so we can tell whether a session ended up on the right day. when you use magic beans to read a recipe, it also records which method worked (a photo, a web page, a video) and two counts — how many ingredients were found and how many values beanies filled in itself — so we can tell how often the reader guesses. it never records the link you gave us, the page or video it read, or anything from the recipe. when you share something to beanies from another app, it records how it arrived and what KIND of item it was — the technical type, such as a png image or plain text — along with how many items came through and, on iPhone, whether the app was able to open or notify you, so we can tell when sharing quietly fails. it never records the link you shared, the file's name, or anything inside it. this stream is PII-free: it carries dates, counts and yes/no answers, never the name or content of an activity, reminder, payment or recipe, no family content at all, and is correlated only by a random family id, not by your name or email
• what we do with it: we use it solely to diagnose and fix problems and keep the app working. we do not sell it, use it for advertising, or build profiles from it
• retention: we keep this information only for as long as we need it to investigate issues

you can ask us to delete any error report tied to your email at any time. see delete your data.

google drive integration (optional)

if you choose to enable Google Drive sync, your family data file (.beanpod) is encrypted on your device before it leaves your browser, using AES-GCM encryption with a key that only you control. Google never sees the unencrypted contents, and we never see them either.

• encryption: your .beanpod is encrypted locally using the Web Crypto API (AES-GCM) before any byte leaves your device
• your key, your control: the encryption key is derived from your password and never leaves your device — not even to us
• OAuth scope: we request only the drive.file scope. this is a per-file scope - it grants access to a specific .beanpod only when you explicitly select it via Drive's file picker, drag and drop it into the app, create it with the app, or open it via Drive's "Open with beanies.family" menu. we cannot list, search, browse, or access any other files in your Drive
• file metadata: we read the file name, modified time, and the encrypted contents of .beanpod files you've explicitly granted access to. we do not read any other Drive metadata
• what's in a .beanpod: family member profiles, accounts, transactions, activities, goals, to-dos, and other family planning data — all encrypted at rest, unreadable to anyone without your password (including us, including Google)
• revocable: you can disconnect Google Drive at any time from Settings, and revoke access entirely from your Google account at myaccount.google.com/permissions

google workspace marketplace

beanies.family is listed on the Google Workspace Marketplace. the listing enables the "Open with beanies.family" entry in Google Drive's right-click menu for .beanpod files. when you use it, Drive grants the app per-file access to that specific .beanpod using the same drive.file scope described above. no broader Drive access is granted, and no additional data is collected by being listed.

the marketplace listing itself is purely a discoverability shortcut - it does not change how the app handles your data, and removing the listing would not change your data flows.

google authentication

when you sign in with Google for Drive sync, we request only your email address from Google's OAuth service (userinfo.email scope). we do not request your name, profile picture, friends list, calendar, contacts, or any other profile data.

your email address is:

• used solely to label which Google account is connected to which family pod, so you can recognise it in the app's settings
• stored locally in your browser (IndexedDB), alongside the rest of your family data
• never transmitted to or stored on our servers
• cleared when you sign out of beanies.family or revoke the Google authorisation

cookies

beanies.family does not use cookies. we don't use tracking cookies, advertising cookies, or any third-party cookies. Plausible Analytics is also cookie-free.

third-party services

the only third-party services the app connects to are:

• Google Fonts: to load the Outfit and Inter typefaces
• Plausible Analytics: privacy-friendly, cookie-free analytics — on the website and in the apps
• Google Drive: only if you explicitly enable it — encrypted data only
• Google OAuth: only when you choose to sign in
• ExchangeRate API: to fetch currency exchange rates — no personal data is sent

data portability & deletion

• export: you can export your family data file at any time from Settings
• delete: clearing your browser data removes all local data. if you use Google Drive sync, you can delete the .beanpod file from your Drive
• no lock-in: your data is yours — we provide export functionality so you're never trapped

children's privacy

beanies.family is designed for families, which may include children. since all data is stored locally on the parent's or guardian's device and we collect no personal information, there is no data processing of children's information by us. the family owner controls all data.

security

• encryption at rest: local data is encrypted in IndexedDB
• encryption in transit: Google Drive files are AES-GCM encrypted before upload
• your family data stays with you: your family content lives only on your devices and your own Google Drive, never on our servers. the only information that reaches us is the limited diagnostics described above
• open source: our code is publicly auditable on GitHub

changes to this policy

if we make changes to this privacy policy, we will update the "last updated" date at the top of this page. since beanies.family is open source, you can also review changes in our GitHub repository.

contact

if you have questions about this privacy policy, please reach out via our homepage or open an issue on GitHub.