Who runs this

FamilyMap is built and operated by CacheSleuth (Jason Fox, Oklahoma, USA), and it is used by the developer's own family. The server, the database and the file storage run on Cloudflare's infrastructure in the United States. There is no company behind it and no investor to answer to; the only reason it exists is so a family can see where each other is.

Location

Location is what the app is for, so it is the first thing to be clear about.

• What is sent. While you are sharing, the app on your phone sends your position (latitude and longitude), how accurate that position is, your speed and direction of travel, your altitude, your battery level and whether it is charging, and the time of the reading. It sends these while the phone is moving and much less often while it is still.
• Background location. The app asks for iOS "Always" location and Android "Allow all the time" so the map stays current with the phone in your pocket and the app closed. That is the whole point of a family map, and it is why the app asks. If you grant only "While using", the app still works, but your family only sees you move while the app is open on screen, and the app tells you so.
• Motion activity. With your permission (iOS Motion & Fitness, Android Physical activity) the app also sends what your phone thinks you are doing, such as walking, driving or still, and today's step count, so your family sees "walking since 4:10 PM" and so a drive can end when you get out of the car. Declining this permission changes nothing else.
• Who sees it. The members of the circles you belong to. Each circle is invite-only, created by one owner, and you choose per circle whether you share your live position, only alerts, or nothing.
• Share links. You can also create a temporary link to your live position, for one, four or eight hours or until the end of the day. Anyone who has the link can see your display name, avatar, current position, its accuracy, your battery level and when it last updated, without signing in, until the link expires or you revoke it from the You tab. It shows nothing else about you or your circle. Only share a link with someone you want to see where you are.
• Your controls. From the You tab you can pause sharing for an hour, until tonight or until tomorrow; hide behind a rough one kilometer "bubble" instead of an exact spot; switch a circle to alerts only; or stop sharing with a circle entirely. Revoking the location permission in your phone's settings stops all reporting at once.

What is kept, and for how long

• Your current position: one row per person, overwritten by each new report. There is no permanent log of every position.
• A 24 hour trail of your positions, on by default so a family member can see where you have been today. Turned off from the You tab; older points are deleted automatically after 24 hours.
• Drives: a recorded route with its top speed, hard stops and whether the phone was unlocked while it was moving, kept for 28 days and then deleted. Also on by default and switchable from the You tab. The driving summary that the circle sees is built from these.
• Places (home, school, work) that circle members create, with their arrive and leave events, kept until a member deletes them, the place reaches the expiry its creator set, or the circle is deleted.
• Private alerts a member sets up about another member: "tell me when they leave here", "tell me when their phone is reachable again", and "tell me if they have not arrived by a set time". Each holds who set it, who it is about and, where it has one, the place and the deadline. Only the person who set it is told, and it is deleted when it fires, when it is canceled, when it expires, or when either person leaves the circle.
• The activity feed of arrivals, departures, drives, check-ins, SOS and low battery alerts, kept until the circle owner deletes them or the account is deleted.
• Chat: messages, reactions and the photos, videos and files attached to them. Messages stay until the sender or the circle owner deletes them. Attached files are removed from storage 60 days after they were sent.
• Your account: email address, display name, the avatar you chose (an emoji or a small photo), your time zone, and your notification preferences.
• Your phones: each phone that signs in gets its own credential, with the phone's model name, app version, its location permission state, and, if you enabled notifications, a push token. You can see and revoke each phone from the You tab.
• Share links you created, deleted two days after they expire or are revoked.
• Sign-in codes and the IP address that requested them, kept only until the code expires (ten minutes).
• Safety events: a "possible crash" check-in and its outcome, SOS alerts, and hard-braking events, kept 35 days.

Sessions last 30 days and are refreshed while you use the app. Signing out everywhere ends them all.

Chat

Chat is between the members of a circle, and it is stored on the FamilyMap server so it reaches phones that were off when a message was sent. Anyone can delete their own messages; a circle owner can delete any message, remove a member, or delete a whole conversation. If a message troubles you, hold it and choose Report to the circle owner: the owner gets an email with who sent it and what it says, and decides what to do. You can also mute a member's alerts for yourself.

SOS and the possible-crash check-in

The SOS button and the possible-crash check-in notify your family circle. They do not contact emergency services, and FamilyMap is not an emergency service. The crash check-in is a guess made from a sudden drop in GPS speed: the app asks you if you are OK, and if there is no answer within a few minutes it tells your circle where you are. Anyone who needs help should call their local emergency number.

Network connections the apps make

FamilyMap talks to these services, and no others:

• family.cachesleuth.com, the FamilyMap server, hosted on Cloudflare. Cloudflare is the processor for the database and file storage and sees the traffic the way any host does. Cloudflare does not use it for anything of its own.
• Map tiles. The default map is drawn from OpenFreeMap vector tiles, built from OpenStreetMap data. The street view and share links use OpenStreetMap's own tiles, and the satellite view uses Esri. Your phone fetches those tiles directly, so whichever provider draws your map sees your phone's IP address and which part of the map you are looking at, which is usually where your family is. They do not receive your account or your reported position. The small map pictures inside the app are fetched by the FamilyMap server from Geoapify, which sees only the map area, not your phone or who is looking.
• Map software. The map drawing code (Leaflet, and MapLibre for the default map) is loaded from the unpkg.com public code library, which sees your phone's IP address and nothing else. Each file is checked against a fixed fingerprint before it runs.
• Reverse geocoding. To turn a position into a street or a place name ("near Oak Street"), the server sends the coordinates, and only the coordinates, to Geoapify and to OpenStreetMap's Nominatim service. Neither receives who the position belongs to.
• Weather and severe weather alerts for a member's area come from Open-Meteo and the US National Weather Service, again by coordinates only.
• Notifications. On iOS, alerts are delivered through Apple Push Notification service; the content of an alert (for example "John arrived at Home") passes through Apple to reach your phone. On Android the app fetches its alerts from the FamilyMap server directly, and no Google service is involved. Web notifications, if you enable them in a browser, go through that browser's push service. If you choose to add Pushover or ntfy on the You tab, alerts also go to the service you configured.
• Email. Sign-in codes, "your phone stopped updating" reminders and message reports are sent through Resend, an email delivery service, to your email address.

No analytics, no tracking, no selling

The apps and the website contain no analytics library, no advertising, no crash-reporting service and no third-party SDK of any kind. Nothing about you is sold, rented, shared with data brokers, or used to build a profile. Your data is used for one purpose: showing your family where you are and what you chose to tell them.

Deleting your data

Open the You tab and choose Delete my account, in the app or at family.cachesleuth.com. This removes your account, your position, trail, drives, safety events, activity events, chat messages, reactions and attachments, your conversation memberships, share links, every private alert you set up or that someone set up about you, your phones' credentials and your push tokens, immediately. A circle you own passes to its longest-standing other member; if you are its last member, it is deleted with everything in it. Places and group conversations you created stay with the circle, without your name on them. To remove one phone only, revoke it from the You tab. If you would rather have it done for you, email the address below.

Children

FamilyMap is for families, and a family includes children. Accounts are created by the adult who owns a circle, who invites each member by email; there is no open sign-up. A parent who adds a child's phone to a circle is choosing to see that child's location and messages, and is responsible for that choice under the children's privacy laws that apply to them. FamilyMap collects nothing from a child beyond what it collects from every member, and uses it only to show the circle. The app is not directed at children and is not marketed to them.

Changes

If this policy changes, the date at the top changes with it, and anything that affects what is collected will be announced on the You tab before it takes effect.

Contact

Questions, a data request, or a report about content in a circle: jason@cachesleuth.com. This address is also the support contact for the apps.