AXFamily Privacy Policy

1. Summary

• AXFamily lets a family see and share events, to-dos, birthdays and material. Only adults aged 19 or older can create an account; children are added as profiles that never sign in.
• The default sharing scope is Only me. Even the family admin cannot see another adult's private items.
• We never send family data, children's data, content or screen context to the ad SDK (Google AdMob). You see personalized ads only if you agree on the ad consent screen.
• AI features (organizing notices, asking about your family, trip and weekend planner, organizing family memories, weekly brief summary) send data to Google Gemini (paid tier, not used for training) only for adults who agreed to AI processing and overseas transfer, and only when they ask or turn a feature on. Records about children under 14 (facts, person cards and photos) are never used by the assistant, planner, memories or brief AI (events and trips a child joins are included with an age group instead of a name), and health records are included only if you turn this on for yourself. Every basic feature works with manual entry without AI.
• Photos are uploaded only as reduced copies with location and other metadata removed on the device. Originals never reach our servers.
• You can delete your account and data in the app or on the deletion request page. Only payment records are kept for 5 years, as the law requires.

2. Purposes

• Sign-up, sign-in and adult confirmation (self-declared 19 or older; the birth year is not stored)
• Creating a household, invitations, member management and sharing by scope
• Storing and syncing events, to-dos, birthdays, material, photos and comments within the family
• On-device reminders and family activity push notifications (we send no advertising notifications)
• AI features you ask for or turn on: suggested events and to-dos from your material, asking about your family (answers with sources and approval cards), trip and weekend plan drafts, a family memory index with person card and album suggestions, and the weekly brief summary (Family Plus)
• Verifying, renewing and refunding the Family Plus subscription
• Showing the banner ad on the free plan
• Crash diagnosis (if you agree), blocking abuse and tampered apps, handling reports and support

3. Personal data we process

We do not collect precise location (GPS), contacts or the device calendar. The app never asks for health or medical data. Records you type yourself, such as a clinic visit or check-up in an event, note or person card, may be health information; we store them as family records, declare them as optional "Health info" in Google Play's data safety form, and leave them out of AI by default (9-5). The app does not ask for location permission. The ads SDK (Google AdMob) can, however, estimate approximate location (country or city level) from the IP address of an ad request (9-4. Ads). Photos are picked with the Android system photo picker; we do not ask for access to all your photos.

4. Retention

• Account, household, records and material: until you delete them or delete the account or household. We aim to delete operational data within 72 hours of a request.
• Trash (deleted items): removed automatically after 30 days.
• Private items of an adult who leaves a household: hidden from the family immediately and deleted after 30 days.
• Deleting a household that has other adults: members are notified during a 7-day grace period, then it is deleted.
• AI suggestions (organizing, assistant, planner, memories): unsaved suggestions and plans are deleted after 7 days. Assistant chats are deleted after 90 days and weekly brief summaries after 30 days. The memory index is deleted when the original is deleted, its sharing changes, or you withdraw AI consent. AI processing records are kept 90 days after completion.
• Reports: 180 days after submission.
• Invitation links: expire after 24 hours by default (7 days at most).
• Crash logs (Crashlytics): 90 days.
• Payment records: 5 years under the Korean E-Commerce Act Enforcement Decree, Article 6 (pseudonymized, separate from family data, kept even after account deletion).
• Backups: we currently keep no backups of operational data. If we turn backups on, we will first add their retention period here.

5. How we destroy data

When a retention period ends or you ask for deletion, our server functions delete the database documents and everything under them, and the reduced files in storage, so they cannot be read again. A file still used by other material is deleted when that material is deleted. Caches on devices are cleared on the next sync. Payment records kept by law are stored separately and deleted automatically when their period ends.

6. Disclosure to third parties

We do not sell personal data. We provide it to third parties only in these two cases.

• Google LLC (AdMob): for the banner ad on the free plan, the ad SDK sends your advertising ID, IP address, ad interactions and device info directly to Google. This is based on the consent you give on the personalized ads screen. Before you choose, the screen tells you that whichever you choose, [Agree] or [Don't agree], the data needed to show ads and prevent invalid clicks goes to Google, and that choosing means you agree to this. Choose [Agree] and Google uses this data to show personalized ads; choose [Don't agree] and we request only non-personalized ads. If you close without choosing, we request no ads. For users who see ads, a Google consent status check (UMP) may be sent before you choose, to decide which consent screen to show. See 9-4. Ads and the overseas transfer table.
• Under a legal request, only as far as the law requires.

7. Processors

We use these companies to run the service. Their data processing terms include security measures and limits on sub-processing.

• Google LLC: authentication, database and server functions, push notifications, app integrity checks, crash reporting, AI features (Vertex AI Gemini generation and embeddings), Google Play purchase verification
• Cloudflare, Inc.: storing and serving reduced copies of photos and material

8. Overseas transfers

Because these companies process or store personal data outside Korea, we disclose the following under Article 28-8 of the Personal Information Protection Act (PIPA). Adults' data is transferred as entrustment needed to perform the contract (Article 28-8(1)(3)(a)); ads rely on the consent given on the personalized ads screen (Article 28-8(1)(1); choosing either option agrees to the transfer needed to show ads, and personalized ads only with [Agree]) and children's data on guardian consent.

9-1. Children (under 14) and the rights of legal guardians

• Children do not create accounts. A guardian (an account holder aged 19 or older) adds them as profiles.
• When creating a child profile, the guardian must agree in the app to the processing and overseas transfer (table above) of the child's data before material about that child can be organized with AI. Material involving a child without consent can only be entered manually.
• Guardians can withdraw consent at any time in settings. After withdrawal, material about that child is no longer sent to AI.
• Regardless of guardian consent, records about a child under 14 (facts, person cards and photos about the child) are never used as input to the assistant, planner, family memories or weekly brief AI. Events and trips a child joins are included with an age group (e.g. elementary) instead of a name (titles, dates and destinations are included; notes are left out), and a child's health records are never included under any setting. Child profiles have no assistant input.
• Guardians can view, correct and delete a child's data in the app or by contacting us below.

9-2. Your rights and how to use them

You can ask at any time to access, correct, delete or stop processing your personal data, and withdraw consent. Most of this can be done right in the app (Settings > Data and privacy > Data and connections). Account deletion can also be requested on the deletion request page. Requests by email are handled within 10 days after we confirm your identity, and we tell you the result. Items created by other members and other adults' private items belong to them, so we do not delete them at your request alone.

9-3. Automatic collection and how to refuse it

• Push token and Firebase installation ID: used to deliver notifications. Removed when you turn off notifications in system settings or sign out.
• App integrity check (App Check, Play Integrity): blocks tampered apps from our servers. It cannot be refused.
• Crash reporting (Crashlytics): off by default and on only if you agree. You can turn it off in app settings.
• Advertising ID: used by the ad SDK. See Ads below for how to refuse.
• The app uses no web cookies and includes no usage analytics SDK such as Google Analytics.

9-4. Ads

The free plan shows one banner ad at the bottom of the screen (Google AdMob). The ad SDK sends your advertising ID, IP address, ad interactions, and device and diagnostic data directly to Google. We never put family data, children's data, event titles, content or screen context into ad requests. Before the first ad request, we show a personalized ads screen once. Choose [Agree] for personalized ads or [Don't agree] for non-personalized ads (non-personalized ad requests). You see the same number of ads either way, and either way the data needed to show ads goes to Google (the screen tells you this and asks for consent before you choose). We request no ads until you choose. For users who see ads, a Google consent status check (UMP) may be sent first to decide which consent screen to show. If you close without choosing (Choose later), we request no ads and ask again a day later. In the European Economic Area, the UK and Switzerland, Google's consent form (UMP) asks instead of this screen. Families on Family Plus and users who don't see ads never get this screen.

• Change your choice anytime in App settings > Data and privacy > Ad privacy options. When you change it, we take down the ad on screen and request a new one with your new choice (shown to users who see ads).
• Your choice is stored on this device for each account. On another device or after reinstalling, we ask again.
• Delete the advertising ID in Android Settings > Privacy > Ads.
• With Family Plus, no one in the family sees ads.

9-5. AI features and sending data to a third-party AI

The AI features below go through our server to Google Gemini (Vertex AI paid tier, Google Cloud global infrastructure; processing may take place outside Korea). Google does not use this data to train models. The first time you use an AI feature we ask separately for consent to AI processing and overseas transfer. When the consent text changes, no AI feature runs for you (including scheduled organizing and briefs) until you agree again. If you agree, family records you already saved are also processed for these purposes (for example, the memory index). If you don't agree or withdraw, every basic feature still works with manual entry.

• Organizing notices: when you tap AI organizing, a reduced copy and the text of that material, plus family members' display names (excluding children without guardian consent), are sent to create suggested events and to-dos.
• Ask your family (assistant): your question and summaries (titles, dates, who is responsible and similar) of the family records you can see that are needed for the answer. Other adults' private records are removed by the server first, so they never reach the AI. Each sentence of an answer shows its source, and creating events or to-dos is only suggested as an approval card.
• Trip and weekend planner: destination, dates, participants, preferences, daily rhythm as free time slots built from wake, nap, bed and meal times (dates, start and end times, no child names) and summaries of records that every participating adult can see, to draft a plan. Opening hours, prices and travel times are never stated as facts; they are marked as estimates or "check needed". Events and to-dos are created only after every participating adult accepts.
• Organizing family memories: summary text of events, to-dos, memory cards, trips, albums and material is turned into a search index (embeddings), and person card facts, trip and event groups and album titles are suggested. Suggestions take effect only after approval.
• Weekly brief summary (Family Plus): a three-line summary of this week's items the recipient can see. The free brief list is made on your device without AI.

• The assistant, planner, memories and brief replace names with aliases (for example Adult1, Child1: elementary) before sending, and your device turns them back into names on screen.
• Records about children under 14 are never used as input to these four features (9-1).
• Health and medical records are left out of AI by default. If you turn this on in Settings > AI and health info, only records about you are included. Emergency and medicine questions get a fixed notice (call 119 or ask a medical professional) instead of an AI answer.
• AI-written text (assistant answers, plans, brief summaries, suggestions, album titles) is labeled "AI-generated" and becomes a record only after you review and save it. You can report a wrong or inappropriate result from the menu on each result.
• We never use AI for birthdays, reminders, permissions, payments or usage decisions. AI features may be paused at times; while paused, nothing is sent to AI.

9-6. Other people's data in your material

School notices and screenshots may contain names and contact details of people outside the family, such as teachers or other parents. AI results do not store the names or contact details of people outside the family. They may remain in the uploaded reduced copy, so delete that material if needed. Anyone whose data appears in material can ask us to delete it using the contact below.

10. Security measures

• All traffic is encrypted (HTTPS), and stored data uses the cloud providers' encryption at rest.
• Database security rules limit access by household and sharing scope, and server functions accept only requests that pass app integrity checks.
• Photo copies are separated per user and shown only through our server.
• Operator access is kept to a minimum, and server logs never contain content, photos or inputs.
• If personal data is leaked, or a leak is likely, we notify affected users within 72 hours.

11. Privacy officer and contact

Privacy officer: Simpest
Email: sugarmount21@gmail.com

You can also contact the Korea Internet & Security Agency's Privacy Infringement Report Center (privacy.kisa.or.kr) or the Personal Information Dispute Mediation Committee (kopico.go.kr).

12. Changes to this policy

We announce changes in the app and on this page 7 days before they take effect (30 days for changes unfavorable to you). We also update this policy before turning on any new feature.

October 17, 2026 edition (before launch). What changed: wording now matches what the app actually does. Section 3 says records you type yourself, such as a clinic visit or check-up, may be health information, and we declare them as optional "Health info" in Google Play's data safety form. Section 9-1 says trips a child joins are also included with an age group instead of a name, with titles, dates and destinations included. Section 9-5 says the planner receives free time slots built from your daily rhythm, not the times themselves. Purposes, items, processors and overseas recipients did not change.

Version before that: October 13, 2026 (before launch). What changed: AI features now include asking about your family (assistant), the trip and weekend planner, organizing family memories (embedding index) and the weekly brief summary, so the purposes, items, retention, overseas transfer table and 9-5 AI features were updated. We added the rule that keeps records of children under 14 out of AI (9-1) and your own choice for health records (9-5). The in-app AI consent text changed too, and no AI feature runs until you agree to the new text.

Version before that: October 11, 2026 (before launch). Earlier edition of the same day (October 11, 2026, before launch). What changed: the location sentence in section 3. The app does not collect precise location (GPS), but the ads SDK can estimate approximate location from your IP address (the same as our Google Play data safety form).

Version before that: October 10, 2026 (before launch). What changed: the Ads section now matches how the app works. We show a personalized ads screen before the first ad request, request only non-personalized ads if you don't agree, and let you change your choice anytime in settings. The third-party section now describes what goes to Google (AdMob) and its legal basis (the consent given on the personalized ads screen).

Earlier version: October 9, 2026 (before launch). What changed: the processing location for AI organizing is now Google global infrastructure (may be outside Korea) instead of the Google Cloud Seoul region, because the model we use is not offered in the Seoul region.