My Family Hub is operated by Steve Tingate, an individual trader based in Melbourne, Victoria, Australia ("we", "us", "our"). You can reach us at privacy@myfamilyhub.com.au.
The information we process depends on the features your family uses. It may include:
The app and its integrated software development kits may automatically collect:
Some of this information can identify or be linked to an account, household or device even if it does not contain a person's name.
We use your information to:
My Family Hub is designed for families and may hold profiles or accounts for children. Information added to a family space may be visible to other members of that family according to their role and the feature's sharing settings.
Parents and guardians should review what children add to the service and use the available family roles and settings. Technical permissions can vary by feature and app version. Contact us if you need help accessing, correcting or deleting a child's information.
If you are a parent or guardian and have a concern about a child's information, contact privacy@myfamilyhub.com.au.
We use PostHog to understand how the app is used and may use session replay to troubleshoot problems and improve the product. Depending on the production configuration, replay may capture interactions such as screens viewed, taps, scrolling, screen structure, app and device information, and the visible state of the interface. It may be linked to an account or session identifier.
Session replay can reflect information visible in the app, including user-generated family content. You should not assume that every screen, field or item of sensitive information is masked. People with authorised access to our PostHog workspace, and service providers supporting PostHog, may be able to view recordings for support, troubleshooting and product-improvement purposes.
Replay retention depends on our PostHog plan and settings. You can contact privacy@myfamilyhub.com.au to ask about a recording, request deletion linked to your account where we can identify it, or ask whether an analytics choice is available in your app version.
Providers receive information associated with the relevant features as described below. Optional means the provider is used only if you or your family chooses that feature; core and automatic services may operate when you use the app or website. A provider may process information outside Australia or allow support access from other countries. Provider practices can vary by our account settings, service plan and the provider's subprocessors.
| Provider | Purpose and information | When used | Retention, deletion and overseas processing |
|---|---|---|---|
| Supabase | Authentication, database and file storage. May process account, family and user identifiers, all content stored in the service, files, authentication and technical logs. | Core | Customer data is processed under customer instructions. Retention can include configured backups and logs, and international processing may occur. |
| OneSignal | Push notifications. May process push tokens, app/device identifiers, IP address, device and app information, notification activity and any notification content sent through the service. | Notifications; user can change device/app notification settings | OneSignal states paid-plan subscriber data is retained until the customer deletes it and describes processing in Europe, the United States and other countries. |
| RevenueCat | Subscriptions and entitlements. May process an app user ID, transaction and product information, subscription status, device/app information and customer attributes sent by the app. | When subscription features are used | RevenueCat provides customer deletion tools, but deleting RevenueCat data does not cancel an Apple or Google subscription. |
| PostHog | Product analytics and session replay. May process account/session identifiers, events, screens, interactions, device/app information, IP-derived information and replay content. | May operate automatically when analytics or replay is enabled | Cloud region, retention, masking and deletion depend on the service plan and configuration. |
| Sentry | Crash reporting and diagnostics. May process stack traces, errors, device/app information, IP address, user/session identifiers and data included in logs or error context. | Automatic when diagnostics is enabled | Retention, data scrubbing and processing region depend on the service plan and configuration. |
| OpenAI | Recipe processing and meal planning. May process prompts containing recipes, preferences, dietary or allergy information, plus generated responses and technical metadata. | Optional AI-assisted features | OpenAI states API data is not used for model training by default. Default API abuse-monitoring logs may be retained for up to 30 days, subject to OpenAI's applicable terms and settings. |
| Open-Meteo | Weather information. May receive coordinates or a place query, IP address and request metadata. | Optional weather feature | Open-Meteo states API logs may include coordinates and are deleted after 90 days. It is operated in Switzerland, so requests leave Australia. |
| Spoonacular | Recipe search. May receive search terms and filters, which could reveal dietary preferences or allergies if included, plus request metadata. | Optional recipe search | Its policy states information may be processed in countries where it operates. It does not publish a specific retention period for My Family Hub API requests. |
| TheMealDB | Recipe search. May receive recipe search terms, filters, IP address and request metadata. | Optional recipe search | Operated in the United Kingdom. Its public policy does not specify a retention period for My Family Hub API requests. |
| Google Calendar | Optional calendar synchronisation. Depending on the scopes approved, may process account identity, calendar metadata, events, attendees and reminders. My Family Hub may store OAuth tokens needed to maintain the connection. | Optional; requires Google authorisation and can be disconnected | Google may process information overseas under its policy. Disconnecting calendar access does not necessarily remove calendar data already copied into My Family Hub. |
| Expo Updates | Application updates. Expo states it may collect device operating system and a randomised update token, as well as IP, errors, performance and interaction information associated with its services. | Automatic app updates | Retention and processing location depend on the update service and project configuration. |
| Resend | Transactional emails. Processes recipient email address, message content and delivery metadata; optional tracking may add IP, device, location and interaction data. | Account, support, privacy and deletion emails | Resend states customer data is deleted within 90 days after account termination. Processing may occur in the United States. |
| Apple / Google | Platform sign-in, app distribution, push delivery and payments where applicable. May process platform account or relay identifiers, device/push identifiers, purchase and subscription information and diagnostics governed by platform settings. | As applicable to platform and chosen sign-in/payment method | Platform retention and international processing are governed by the user's platform relationship and the relevant policy. Deleting a My Family Hub account does not automatically cancel an app-store subscription. |
| Netlify | Hosts this website and its serverless functions and database. May process IP/request logs, support-form content, encrypted deletion-request email addresses and verification-flow records. | Website use | Retention varies by service and record type. Request records may be retained for security, audit and request handling. |
| Cloudflare Turnstile | Bot protection on the public deletion form. Processes technical and interaction signals needed to distinguish people from automated abuse. | When the public deletion form is used | Handled under Cloudflare's policy and may involve processing outside Australia. |
We use technical and organisational safeguards intended to protect information, including access controls and encrypted network connections. No service can guarantee absolute security.
Some providers are based outside Australia or use overseas infrastructure and personnel. The table above identifies known or possible overseas processing without asserting a fixed country where one is not known. Australian Privacy Principle 8 may apply to these disclosures if the Australian Privacy Principles apply to us.
You may ask us for access to or correction of personal information we hold about you, or raise a privacy complaint, by emailing privacy@myfamilyhub.com.au. We may need to verify your identity and authority to act for a child or another family member. We will respond within the period required by applicable law and will explain if we cannot fulfil a request.
You can also:
Whether My Family Hub is legally covered by the Privacy Act 1988 and the Australian Privacy Principles depends on matters including annual turnover and whether an exception to the small-business exemption applies. We aim to handle privacy requests fairly regardless. If the Act applies, you may also be able to complain to the Office of the Australian Information Commissioner after first giving us a reasonable opportunity to respond.
We retain identifiable information while it is needed to provide the service, meet security and support needs, handle requests, resolve disputes, and satisfy applicable legal, accounting or platform requirements. Retention periods vary by data type and provider. Some information may remain in backups or records that we must keep for security, dispute-resolution or legal purposes.
The public account-deletion page verifies the requester's email address and submits a request to the privacy team. The website does not itself delete the mobile-app account or Supabase records. Deleting an account does not cancel an Apple or Google subscription.
After a verified request is submitted, our privacy team reviews it and processes it through the applicable account systems. Submission does not mean that deletion has started or completed, and the website does not start an automatic 90-day deletion period. We will use the verified email address to communicate about the request.
Depending on the account and the information involved, deletion may include removing or de-identifying account details and content, closing access, and asking relevant providers to delete information they process for us. It may not remove:
We will explain the outcome of a request and any information we cannot delete. For current request status or to withdraw a request before it is processed, contact privacy@myfamilyhub.com.au. Cancellation or reactivation is not guaranteed.
If you use our website contact or deletion forms, we process the information you submit, request metadata and security-verification information to respond and protect the forms from abuse. Resend delivers the related emails. The deletion flow stores an encrypted email address and one-way verification digests in Netlify Database. Verification codes stop working after 10 minutes and verified sessions after 15 minutes. Associated request records may be retained for security, audit and request handling.
We may update this policy when our services or practices change. We will update the date above and provide any further notice required by applicable law.
For privacy questions, access or correction requests, complaints, or concerns about a child's information:
Email: privacy@myfamilyhub.com.au
Website: myfamilyhub.com.au
Location: Melbourne, Victoria, Australia