Privacy Policy

The data controller responsible for data processing on this website is:

Email: support@famflow.de

Phone: +49 (0) 9278 3132 - 380102

2.1 Upon Registration

When registering for FamFlow, we collect the following data:

• Name
• Email address
• Password (stored in encrypted form)

This data is required to enable you to use the app and to manage your account. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

2.2 During Use of the App

During the use of FamFlow, the following data is processed:

• Names of family members (children)
• Media time entries and limits
• Tasks and rewards
• Profile pictures (optional)

This data is stored on our servers and is only accessible to authorized family members.

FamFlow offers the ability to retrieve play time data from Nintendo Switch consoles via the Nintendo Switch Parental Controls interface. When using this feature, the following data is processed:

• Nintendo session token (stored in encrypted form)
• Play time statistics of linked Nintendo accounts
• Names of Nintendo players
• Games played and their usage duration

Nintendo access credentials are used exclusively for synchronizing play time data and are not shared with third parties. You can unlink the Nintendo connection at any time in the settings.

FamFlow offers the ability to retrieve play time data from Steam (PC gaming platform) via the official Steam Web API. When using this feature, the following data is processed:

• Steam API key (stored in encrypted form)
• Steam ID of linked accounts
• Steam usernames and profile pictures
• Play time statistics (games played and their usage duration)

The Steam API key is used exclusively to query play time data. No data is transmitted to or modified on Steam. Communication is exclusively read-only via the official Steam Web API.

You can unlink the Steam connection at any time in the settings. Upon unlinking, all stored Steam access credentials will be deleted.

FamFlow uses LocalStorage in your browser to:

• Store your login credentials (session ID)
• Remember your family ID for quick access
• Store your design preferences (dark mode)
• Store your cookie preferences

This data does not leave your browser and is used exclusively for the functionality of the app. You can delete this data at any time through your browser settings.

FamFlow uses Google Analytics, a web analytics service provided by Google LLC ("Google"). Google Analytics uses cookies that enable an analysis of your use of the website.

Data Collected

• Pages visited and time spent
• Device information (browser, operating system, screen resolution)
• Approximate location (country/region, based on IP address)
• Referrer (how you arrived at our site)

Legal basis: Art. 6(1)(a) GDPR (consent). Data collection only occurs after your explicit consent via our cookie banner.

Opt-out: You can object to data collection by selecting "Only necessary" on the cookie banner. Consent already given can be revoked at any time by deleting your browser cookies.

For more information about data protection at Google, please visit: policies.google.com/privacy

Your personal data will not be sold or shared with third parties for marketing purposes.

Data is only disclosed in the following cases:

• Hosting provider: Our servers are operated by a professional hosting provider. This provider processes data exclusively on our behalf and in accordance with our instructions.
• Provider: Stemago (Plesk)
• Server location: Germany
• Legal obligation: When we are legally obligated to do so (Art. 6(1)(c) GDPR).

FamFlow sends automated emails as part of account management to the email address provided during registration.

8.1 Inactive Accounts

To ensure data security and clean up data that is no longer needed, inactive parent accounts are handled in stages:

• Unverified accounts (pending email verification) are automatically deleted after 7 days.
• After extended inactivity, reminder emails are sent to inform you about new features and improvements.
• After 90 days of inactivity, you will receive a warning email with the option to reactivate your account and export your data.
• After 180 days of inactivity, your account will be deactivated (login no longer possible).
• 90 days after deactivation, all data will be permanently deleted.

These time periods may change. You will always be informed in advance by email. Any login resets the inactivity counter.

8.2 Email Communication

FamFlow sends the following automated emails:

• Reminder emails during inactivity (with information about new features)
• Warning emails before account deactivation (with reactivation link and data export option)
• Confirmation upon account deactivation

You can unsubscribe from reminder emails (not from warning emails) via a link in the respective email.

The legal basis for warning emails is Art. 6(1)(f) GDPR (legitimate interest in informing users before data deletion). The legal basis for reminder emails is Art. 6(1)(f) GDPR (legitimate interest in maintaining the business relationship).

8.3 Data Export

You can request a complete export of your personal data in JSON format at any time. The export includes profile data, media time entries, tasks, achievements, and gaming assignments. The export is available via the settings or via a link in the warning email.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You may request information about your data stored with us.
• Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You may request the deletion of your data, provided no statutory retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR): Under certain conditions, you may request the restriction of processing.
• Right to data portability (Art. 20 GDPR): You can download your data at any time via the data export feature in the settings in a commonly used format (JSON).
• Right to object (Art. 21 GDPR): You may object to the processing of your data.

To exercise your rights, please contact: support@famflow.de

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The supervisory authority responsible for us is:

www.lda.bayern.de

We employ technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons:

• Encrypted transmission (HTTPS/TLS)
• Encrypted storage of passwords (bcrypt)
• Regular security updates
• Access control and authentication

Your personal data will only be stored for as long as is necessary for the fulfillment of the contractual purpose or as required by statutory retention periods.

In case of account inactivity, a staged process applies: After 180 days without login, your account will be deactivated; after an additional 90 days, all data will be permanently deleted. You will be informed in advance by email and have the opportunity to reactivate your account or export your data.

Unverified accounts (pending email verification) are automatically removed after 7 days.

We reserve the right to amend this privacy policy to adapt it to changes in legislation or modifications to the service and data processing. The current version can always be found on this page.