FamilyPilot Privacy Policy

Version: privacy-au-v1

Approved for production: 29 August 2026

Effective date: Upon first publication in FamilyPilot or on LifePilot's website

Last updated: 29 August 2026

1. Who we are and what this policy covers

FamilyPilot is a family and household organisation application provided by LifePilot Pty Ltd ("LifePilot", "we", "us" or "our"). This Privacy Policy explains how the current FamilyPilot mobile application and its supporting services collect, use, store, disclose and delete information.

FamilyPilot v1 is available only in Australia. LifePilot Pty Ltd's public identifier is ABN 70 693 176 680. Privacy enquiries and complaints can be sent to admin@lifepilot.com.au. Our website is https://www.lifepilot.com.au.

This policy applies to information processed through FamilyPilot. It does not apply to a website, app or service that a user deliberately opens or shares information with outside FamilyPilot.

FamilyPilot is a shared household service. Information entered by one household member may be made available to other authorised members of that household or to a co-parent or other person with whom the user deliberately shares it.

2. Information FamilyPilot processes

FamilyPilot processes the following information when it is provided or when the relevant feature is used. Most household features are optional.

Account, authentication and household information

email address, display name, account and user identifiers, account status and authentication records;
declared date of birth, calculated age and capability band, the time and version of the declaration, and age-transition status used to enforce account eligibility, consent and household permissions;
authentication tokens held on the device so that a signed-in session can be maintained;
household name, household identifiers, household roles, membership status, authorised users and ownership information; and
invitation email addresses, invitation messages, invitation status and security-protected invitation tokens.

Amazon Cognito processes passwords for password-based sign-in. FamilyPilot's application database does not store a copy of the password. During authentication, Cognito and the Amplify authentication SDK can process device-context information linked to the sign-in request, including the device platform, application version, operating-system details, language, screen size, source IP address, device-fingerprint context and platform device identifiers such as Android ID or identifier for vendor.

Family, child and profile information

Depending on what users choose to enter, profiles may contain:

name, nickname, profile type, gender, date of birth, birthday, email address, phone number, home address, avatar reference and family relationships;
guardian, co-parent and external contact names and contact details;
school information, routines, responsibilities, points, rewards, grounding, wishes, friends and friends' or parents' contact details;
car and pet information associated with a profile; and
notes and other free-form profile information.

FamilyPilot supports adult, teen, child and baby profiles. A profile is not a separate login unless it is connected to its own authenticated account.

Health, emergency and other sensitive information

Users can choose to record information that may be sensitive, including:

medications, dose, frequency, schedules and whether and when a dose was recorded as taken;
allergies, allergy severity, diagnosed or suspected conditions, health notes, vaccination details, doctors, temperature, weight and height;
baby birth date, feeding, sleep, nappy, growth, milestone and health records;
emergency contacts, relationships, phone numbers, document names and locations, meeting points, and fire, flood or cyclone plans; and
dietary requirements and allergy notes for family members or party guests.

FamilyPilot does not obtain this information from a medical provider. It is entered by users and is not a substitute for professional medical or emergency advice.

Household organisation and user-created content

Depending on the features used, FamilyPilot processes:

calendar events, dates, times, recurrence, reminders, attendees, responsibilities, notes, school details, companies, event locations and addresses;
tasks and chores, including titles, descriptions, assignees, rooms, due dates, completion records, points, recurrence, illness skips and photo proof;
shopping lists and items;
meal plans, meal sets, recipes, source website addresses, ingredients, instructions, preparation times, costs and allergy conflicts;
party plans, guest lists, contact details, dietary requirements and notes;
budget information, including income descriptions and amounts, bills, contributions, savings transfers, shared expense amounts and account names;
co-parenting notes, requests, event shares, child and co-parent details, handover locations and times, school holiday arrangements, approvals, expense amounts and receipt file references;
pet names, species, breed, sex, birth date, microchip details, habitat, medication, vaccination, health and care records;
vehicle registration, state, service information and work kilometres;
household layout, room information, bedroom count and home address;
notification settings, application preferences, notification read or dismissed state, an optional school-calendar feed address, and feature activity needed to synchronise changes; and
other text or structured content users choose to enter.

FamilyPilot does not collect payment card numbers or online-banking credentials. FamilyPilot Premium is a monthly auto-renewable subscription offered for launch in Australia at the current Australian launch price of AUD $10.00 per month. Apple or Google processes the purchase and billing information for the relevant platform. FamilyPilot receives provider transaction references and verified subscription, renewal, grace-period, cancellation, refund and revocation state needed to administer Premium access, restore purchases and reconcile billing. The store-displayed price and transaction terms control the transaction. No introductory offer or free trial is offered for v1, and Apple Family Sharing is off.

Photos, camera and photo library

With permission, users can select or capture images. Current uses are:

task and chore images, which can be uploaded to private household storage and shared with authorised household members;
recipe or meal images, which are read on the device to extract text; and
feedback screenshots, which can be uploaded to the same private household media storage when the upload succeeds. If a feedback screenshot upload is unavailable or fails, the feedback can still be submitted without the screenshot.

If a task or chore image upload fails, a temporary local preview may remain on the device and is not synchronised as a cloud image. FamilyPilot does not synchronise device-local image file paths as feedback attachment references.

Address and location information

FamilyPilot processes addresses and place names that users type into profiles, household information, calendar events, co-parenting arrangements and travel tools. Address search and routing can send a typed query, selected address or place, derived coordinates, travel mode and departure time to Amazon Location Service. Coordinates used only for a search or route are processed for that request. When a user selects a place and saves it to a calendar event, FamilyPilot stores and synchronises the selected place's latitude and longitude with that event so the place can be shown and reused later.

FamilyPilot does not request the device's GPS or operating-system location permission and does not collect background location.

Device, notification and diagnostic information

When relevant services are used, FamilyPilot processes:

a randomly generated installation identifier, device platform, operating system version, device class, application version and build, backend environment and application lifecycle state;
Firebase installation and push-notification identifiers, Apple Push Notification service tokens on Apple devices, Firebase Cloud Messaging tokens, token hashes, registration status, last-seen time and an optional device label;
notification title, body, category and identifiers required to deliver or open a notification; and
where production operational reporting is configured, for an unhandled application error, an event identifier, time, error classification, cryptographic stack fingerprint and sanitised application or Dart stack-frame locations.

The crash-reporting source code is implemented, but the checked-in production configuration does not currently contain the reporting endpoint required to upload those reports. Without that endpoint or an approved build-time override, crash envelopes remain on the device and delivery fails closed. The custom crash report excludes exception messages and household content when production reporting is activated. FamilyPilot does not use Firebase Analytics, Firebase Crashlytics, advertising SDKs or cross-app tracking.

Support, feedback and account-deletion requests

FamilyPilot processes a feedback or support message, whether the sender permits follow-up, the account email or other contact email, household and user identifiers, and any private household media reference for a successfully uploaded feedback screenshot. Account-deletion requests process the account identifier, authentication result, request status and timing, and short-lived verification records. Amazon Simple Email Service delivers account-deletion verification messages.

Legal, consent, authority and safety evidence

FamilyPilot records the document identifier, version, SHA-256 content hash, acceptance action, time, account identifiers, app version, platform and acceptance surface for Terms acceptance, Privacy Policy acknowledgement, youth assent, guardian approval, owner acknowledgements and feature-specific sensitive-information consent. Guardian records also include the claimed relationship, verified-account reference, linked household, invitation and profile, authority attestation, and approval status.

Safety features process reports, report categories, optional narratives, reported account or content references, evidence references and hashes, block relationships, moderation status, enforcement actions and content-minimised audit events. These records are used to operate blocks, prevent prohibited interaction and notifications, investigate reports, enforce service rules and preserve legitimate safety or legal evidence. FamilyPilot does not promise to monitor every household record.

3. How information is collected

Information is collected:

directly from a user when they create an account, enter or import content, choose an image, send feedback, configure notifications, or request deletion;
from another authorised household member, guardian or co-parent when they add or share information through FamilyPilot;
automatically from the application and device where needed for sign-in, synchronisation, security, notification delivery and, only when configured, sanitised crash reporting; and
from Apple, Google or Firebase only to the extent needed for application distribution, push delivery, and the current configuration of those services.

4. Why information is used

FamilyPilot uses information to:

create and secure accounts and households;
provide, personalise and synchronise the features a user chooses to use;
apply household roles and authorisation rules;
send invitations, reminders, local notifications and requested push notifications;
process images selected for task, chore, recipe, meal or feedback features;
provide address suggestions, geocoding and travel estimates;
support offline use and reconcile changes safely when a device reconnects;
respond to feedback and account-deletion requests;
diagnose application failures using content-minimised crash reports when production reporting is configured; and
protect the service, rate-limit public endpoints, prevent duplicate changes and operate monitored backend services;
determine and enforce age-specific account capabilities, obtain and verify guardian approval, and preserve evidence of legal acceptance and consent; and
operate reporting, blocking, filtering, moderation and enforcement controls.

FamilyPilot does not use household, child, health, financial or co-parenting information for advertising. The current implementation contains no path that sells personal information or shares it with data brokers.

5. Where information is stored and processed

On the device

FamilyPilot keeps account and household data needed for offline use in storage protected by the device's secure facilities. On Apple platforms this uses the Keychain with a device-only accessibility class. On Android it uses the Android Keystore with encrypted shared preferences. Authentication tokens and pending synchronisation work are protected through the same secure-storage boundary.

Ordinary sign-out removes normal in-memory state. Encrypted pending changes may remain across sign-out so an interrupted synchronisation can recover, but they remain scoped to and inaccessible outside the original account and household. Account deletion clears that account's local secure-storage namespace. Local previews and picker files are temporary device files and may also be cleared by the operating system or when the application is removed.

FamilyPilot disables Android backup and excludes its application data from Android and Apple device backups configured by the application.

FamilyPilot's AWS backend

Cloud account and household data is processed in FamilyPilot's Amazon Web Services environment in the Sydney (ap-southeast-2) region using:

AWS Amplify and Amazon Cognito for authentication and session management;
AWS AppSync, AWS Lambda and Amazon DynamoDB for authorised application data, synchronisation and backend workflows;
Amazon S3 for private household images;
Amazon Location Service for address, place and route requests;
Amazon CloudWatch for content-minimised operational logs, metrics and alarms;
Amazon Simple Notification Service for operator alarms; and
Amazon Simple Email Service and Amazon EventBridge Scheduler for verified, delayed account deletion.

AWS Secrets Manager protects backend service credentials. It is not an application-content database.

Amazon S3 objects are encrypted at rest, access is household-authorised and temporary signed links are used to upload or view them. Backend databases use AWS-managed encryption and production recovery protections. Network requests use encrypted transport.

Notification and on-device text-recognition services

Firebase Cloud Messaging processes push tokens and delivery information. Notifications on Apple devices are delivered through Apple Push Notification service. On supported Android devices, Google Play services components support Firebase messaging. Firebase Core, Firebase Messaging, Firebase Installations and Google Data Transport SDK components can process installation and device identifiers, app/version/user-agent metadata, messaging tokens and diagnostic transport metadata on Google's global infrastructure for push delivery and SDK operation. Google ML Kit text recognition runs on the device: recipe or meal images and recognised text are not sent to Google by FamilyPilot's ML Kit integration. When the OCR feature is used, the ML Kit SDK can send diagnostic and usage telemetry such as device and app information, per-installation identifiers, performance measurements, image-format or resolution configuration, feature version, event type and error codes. On Android, ML Kit's documented telemetry also includes input and output size. The FamilyPilot repository does not include custom ML models, ML Kit translation, language identification, smart reply, entity extraction, digital ink recognition, barcode scanning, pose detection, face detection or object detection features.

Services a user chooses to contact

If a user imports a recipe from a web address or configures a school-calendar feed, FamilyPilot contacts the public HTTPS destination selected by the user. The destination receives ordinary information associated with a web request, such as the requesting service's IP address and the requested address. For these retrievals FamilyPilot rejects HTTP and credential-bearing addresses, local, private, link-local and reserved destinations, insecure downgrade redirects, and redirects to destinations that do not pass the same checks.

If a user shares an invitation or other content through the system share sheet, the selected app or recipient processes what the user chooses to share under its own privacy terms.

6. Who can access information

Access depends on the feature and household roles:

the account holder can access their own account and authorised household information;
authorised household members can access shared household information;
household owners and administrators can manage memberships and the shared records allowed by their role;
a co-parent or other recipient can access information deliberately shared with them through a supported sharing or transfer flow;
a recipient may receive an invitation email address, invitation message or code sent by a user; and
safety operators can access the limited report, block and enforcement information needed to investigate and operate service safeguards; and
LifePilot's service providers process only the information needed to provide the services described in this policy.

Operational access to production services is restricted to authorised operators. Logging controls are designed to exclude household payloads, medical, child, financial and co-parenting content, email addresses and display names. FamilyPilot may retain or disclose information where LifePilot is required to do so by applicable law, but the repository contains no routine disclosure path for law-enforcement, advertising or data-broker access.

7. Children, young people and guardian responsibilities

FamilyPilot uses five account capability bands:

under 13: dependant profile only and no independent authenticated account;
ages 13–14: authenticated account only through an invitation to an adult-managed household, youth assent and verified approval from an authenticated parent or guardian aged 18 or over;
age 15: self-acceptance where capacity is not in doubt, with participation in an adult-managed household;
ages 16–17: self-acceptance and the ability to create and manage a private household; and
age 18 or over: standard adult account and household capabilities.

A household containing an authenticated user aged 13–15 must retain an active eligible owner or administrator aged 18 or over. Household ownership is an app role, not proof of adulthood, custody, tenancy, parental responsibility or authority over another person.

An authorised parent, guardian or other authorised person may create dependant profiles. They are responsible for deciding what information is appropriate to enter, having lawful authority, keeping important information accurate, and choosing who may access it. A guardian approving a 13–14-year-old must use an authenticated account with a verified email, attest to an accepted parent/guardian relationship and approve the exact invited household/profile context. FamilyPilot records the approval evidence described in section 2.

Child and dependant information is protected through household and person-specific authorisation controls and is not used for advertising or tracking. Users should provide only information reasonably needed for the features they choose.

8. Sensitive information consent and authority

Health, medication, emergency and other protected person information is optional. Before a protected feature can process it, FamilyPilot requires specific consent for the identified person, feature and data scope from the person where permitted, or from an authenticated user with verified parent/guardian or co-parent authority recognised by FamilyPilot. A 13–14-year-old cannot independently enable a protected sensitive feature for their own information.

Consent can be withdrawn in Settings for that scope. Withdrawal makes the consent ineffective for future access and collection. It does not erase the consent evidence, undo earlier lawful processing, or automatically delete a valid shared record another authorised person is entitled to retain. A new sensitive-data purpose or materially changed scope requires fresh specific consent. Authority and consent can be revoked or disputed and do not determine custody or legal rights outside FamilyPilot.

9. Security

FamilyPilot uses layered controls that include authenticated access, household role checks, encrypted network transport, AWS encryption at rest, private media storage, short-lived signed media links, secure device storage, scoped offline data, sanitised operational logging, rate limits and deletion barriers intended to prevent an old offline device from restoring deleted records.

No method of storage or transmission is completely secure. Users should protect their device and credentials, use an email account they control, and promptly remove household members who should no longer have access.

10. Retention and deletion

FamilyPilot keeps active account and household information while it is needed to provide the account and features selected by users. A user can delete many records in the relevant feature and can request account deletion in the app.

Feature and operational retention

New notification-delivery history receives server-side expiry according to the household's selected period, which is 30 days by default and can be set to 30, 60, 90 or 120 days. This deletes notification history only; it does not delete the Calendar, Task, Chore or other source record or an active scheduled reminder. Changing the setting applies to newly created history; the app immediately filters its view to the selected window.
A deleted synchronised record may leave a non-content tombstone for at least 365 days. Before eligible tombstones are removed, a permanent deletion barrier is created so an old offline device cannot recreate that record.
Backend mutation receipts are retained for 400 days to detect duplicate or uncertain offline changes. They contain operational identifiers and results, not the household record payload.
Completed encrypted offline work is normally retained for at least 30 days and the newest 500 completed items per household after an authoritative synchronisation, subject to dependency safety. Account deletion clears it.
Production Lambda and AppSync logs have finite retention of one month by default. CloudWatch service metrics containing counts and ages, not household content, may be retained under CloudWatch's standard metric retention.
When custom crash reporting is activated in production, crash duplicate-control records expire after 7 days and rate-limit counters after 2 hours. Sanitised crash logs follow the finite production log retention described above.
Youth safety acknowledgements are deleted with the account. Active authority, guardian approval, consent, legal acceptance, block and enforcement states involving a deleted account are revoked or made ineffective. Legal, compliance, moderation, report, block and enforcement history may be pseudonymised and retained for up to 2557 days so another person's legitimate evidence is not destroyed. Direct account access, authority and active consent are not retained. DynamoDB expiry removes this evidence after the retention period.
A successfully completed account-deletion job is promptly minimised and its operational evidence is retained for 365 days before automatic expiry. Accepted ownership-transfer evidence may instead follow the 2557-day pseudonymised compliance-evidence period.
Short-lived subscription purchase contexts expire automatically at the context expiry already used to validate the purchase. Active subscription ownership is retained while needed to administer and reconcile the service. Provider transaction and notification evidence is retained according to its accounting, refund, dispute, reconciliation, security and replay-prevention purpose; FamilyPilot does not apply one arbitrary retention period to every subscription record.

AWS backup and point-in-time recovery may preserve a prior encrypted version of database information for the service's recovery window, which is up to 35 days. Backups are not used as active application data and age out under the recovery configuration.

Account deletion

Deletion can be requested in the app or through the public verified deletion page. After ownership requirements are resolved, a seven-day grace period applies. The user can cancel while the request states cancellation is available, but not after processing begins. Household owners must first transfer ownership to an accepting capable authenticated account holder aged 16 or over or close the household. A retained household containing an authenticated user aged 13–15 must retain an active eligible owner or administrator aged 18 or over.

After the grace period, FamilyPilot revokes the user's access and active authority, deletes the user's private account data and unreferenced media, removes all versions of media that are being deleted, removes FamilyPilot's server-side push registrations for the account, and deletes the Amazon Cognito identity. Shared household records needed by remaining members are not automatically removed; instead, the deleted user's attribution and email are replaced with a generic or pseudonymous former-user value where the deletion workflow identifies them. Records involving another account are not destroyed merely because one party deletes. Information about a child shared with another authorised guardian may remain available to that guardian. Media that is still referenced by retained shared records is retained with those records.

On a device that detects permanent deletion while the deleted account's session is still available, FamilyPilot requests deletion of that device's current FCM token and, on supported Apple and Android builds, its current Firebase Installation. FamilyPilot cannot directly issue a client-side Firebase Installation deletion request to other offline or uninstalled devices. It removes all server registrations associated with the deleted account, so those remaining installations are no longer targetable by FamilyPilot. Firebase and device-platform providers then handle their own provider records under their documented deletion and retention processes; FamilyPilot does not guarantee a provider completion time.

Closing a household deletes its private household records and associated media during processing. If a household is retained, dependant relationships, co-parent records and ownership-transfer history are deleted, revoked or pseudonymised according to whether another authorised user has a legitimate shared or evidentiary interest. Deletion never grants authority to another account.

Deleting a FamilyPilot account does not cancel an Apple App Store or Google Play subscription. Store billing must be cancelled separately through the relevant store. FamilyPilot minimises subscription account references where direct identification is no longer needed without breaking provider reconciliation, refund, revocation or restore processing.

11. Required and optional information, choices and rights

An email address, verified authentication information, date of birth and the required legal/guardian evidence for the applicable age band are required for an authenticated account. FamilyPilot cannot activate or continue an account when those requirements are not supplied. A household name and required membership information are needed to use shared household features. Most profile content, sensitive information, photos, addresses, notifications, feedback and household feature records are optional; declining them means the related feature may be unavailable or less useful.

Users can:

review and correct information through the relevant FamilyPilot feature;
delete feature records where the feature provides deletion;
manage household membership and sharing subject to their role;
deny or withdraw camera, photo-library and notification permission in device settings, understanding that the related feature will no longer work;
sign out and remove the application from a device; and
request account deletion from FamilyPilot's Settings screen.

Australian users may ask to access or correct personal information and may ask questions about deletion, consent or handling. To make a request that cannot be completed in the app, contact LifePilot below. LifePilot may need to verify the requester's identity, account or authority over another person's information. If we cannot provide access or correction, we will explain the applicable reason where required by law.

12. International processing

FamilyPilot's primary application backend—including its Cognito, AppSync, Lambda, DynamoDB, S3 and Amazon Location infrastructure—is hosted in AWS's Sydney region in Australia. Apple (including APNs and the App Store), Google (including Firebase Cloud Messaging, Google Play and supporting delivery services) and their subprocessors operate global infrastructure, so limited information may be processed outside Australia. Likely countries or regions are identified where practicable, but provider routing and infrastructure can change and an exhaustive country list is not practicable; LifePilot will update this disclosure when verified arrangements materially change.

A recipe or calendar website selected by a user may be located anywhere the user chooses. A share-sheet destination likewise depends on the app, service or recipient selected by the user. These user-directed destinations are separate from FamilyPilot's primary hosting. Technical routing through another country does not necessarily mean every routing event is a legal cross-border disclosure.

13. Changes to this policy

LifePilot will update this policy when FamilyPilot's data practices materially change. The version and effective date at the top identify the policy that applies. FamilyPilot will give prominent notice or require acknowledgement for a material privacy change where appropriate. A new sensitive-information purpose or materially changed consent scope requires fresh specific consent. Editorial or non-material changes do not require unnecessary forced reacceptance.

14. Privacy complaints and contact

To lodge a privacy complaint, email admin@lifepilot.com.au with a description of the concern, the FamilyPilot account or household involved, relevant dates and the outcome requested. Do not email passwords, medication details or other sensitive household content unless we specifically provide a secure way to do so. LifePilot will acknowledge and review complaints, may ask for identity or authority verification, investigate the relevant systems and respond with the outcome or next steps. No fixed response-time SLA is promised by this policy.

If you are not satisfied with LifePilot's response, you may be able to complain to the Office of the Australian Information Commissioner at oaic.gov.au.

For privacy questions, support, or a rights request, contact:

LifePilot Pty Ltd

ABN: 70 693 176 680

Email: admin@lifepilot.com.au

Website: https://www.lifepilot.com.au