UrusFamily privacy notice

Recent changes

Updated 2026-10-29 (1.0.7): optional Family map. Location is shared only if each person turns it on, with your family only, and history is deleted after 7 days. See What we store and Storage and retention.

Updated 2026-10-12 (1.0.2): optional home screen and lock screen widgets show a summary of your family on your phone. See Storage and retention.

In 1.0.1: new notes, Cards, Diary entries, Gallery photos and documents are stored without a family key. Privacy is still enforced by member and family role. Older items may need a one-time recovery code to open.

Who we are

UrusFamily is a family app for housework, points and shared goals. For the data you keep in the app, UrusFamily is the data user under the Personal Data Protection Act 2010 (Act 709).

This notice explains what data we process, why, who can see it, how long it is kept and your rights.

What we store

Account: email and password (stored hashed, we cannot read it). If you sign in with Google or Apple, that provider shares only your name and email with us, never a password. Apple private relay emails work too.

Family: the family name, each member's display name and avatar, role, daily target, profile PIN (hashed), and a birthday if you enter one.

Activity: chores, points, badges, goals, the virtual wallet, grocery lists, notes, the calendar and other features your family switches on.

Family faith (optional): if a parent chooses it, the family faith is stored to tailor festive seasons and practices in the app. Only members of your family can see it, and it is not used for anything else.

Kid's savings (optional): parents can record a child's savings kept outside the allowance, such as duit raya amounts, gold weight and purity, and the type of account such as ASB. No account numbers, IC numbers, receipts or photos are stored.

We do not collect biometrics, phone contacts, or a child's email or phone number. Location is stored only if you yourself turn on sharing in Family map (below).

Family map (optional, off by default): if a parent turns it on, each person chooses their own sharing mode: off, check-in only, while the app is open, or always (in the background, every few minutes), and can pause it at any time. A parent or adult can set it for a kid profile. We store the latest location point, 7 days of history, accuracy, battery level, and arrive or leave events for family places such as Home and School. Location is visible only to members of your family with the parent, adult, teen or kid role (not relatives or helpers), is never sent to third parties, and is never used for ads or analytics. To turn a point into a street name, the coordinates go to your own phone's geocoder (Apple on iPhone, Google on Android). Notifications name the person and the kind of place only, never coordinates. Pressing SOS records one point even when sharing is off, and the family can see it for 24 hours.

Cards (optional): if your family switches Cards on, we store the card name, number or barcode, code type, notes, card type, owner, visibility, colour and an expiry date if there is one. Access follows the owner and sharing choices. Apple Wallet pass files and card images are never uploaded.

Family moments (optional): one picture can be attached to each moment. It is re-encoded on the phone first to drop EXIF details such as GPS location and camera model. It is reachable only by your family members, and deleting the moment removes the picture within 15 minutes.

Family gallery (optional): you can add or share a photo with your family. Each photo is re-encoded on the phone first to drop EXIF details such as GPS location, camera model and orientation. The full photo, thumbnail and caption are stored in private family storage. We also keep who added it, added and taken times, storage paths and file sizes. No filename, location or EXIF is stored. Parents, adults and teens can open the gallery; extended family and a helper cannot.

Diary (optional): we store the entry date, an optional mood from 1 to 5 and text. Only the author can see an entry. An entry for a kid without an account is written on a parent phone while that kid profile is active.

Notifications (optional): if you switch notifications on, your phone gives us a delivery token from Apple or Google so a message can reach that phone. The token belongs to your login, so a kid profile, which has no login, never has one. A notification says only what happened and who did it, from a fixed list of words. Chore titles, task titles, reward names, points, ringgit amounts and anything a member typed are never put in one.

Optional fingerprint or face sign-in keeps a sign-in token in the phone's secure storage, protected by the phone's biometrics. The operating system checks your biometrics and the app receives only a yes or no. The app never receives or stores biometric data, and that data never leaves the phone.

Password reset: when you request one, our authentication provider sends a reset email to your account email address.

PIN recovery: resetting a forgotten PIN through account recovery requires a fresh sign-in. The reset is recorded in family activity.

How you found us (optional): at the end of setup, the person who creates the family can tell us where they heard about UrusFamily. On Android we also read only the campaign labels of the Play Store link (utm_source and utm_campaign). A parent or adult can also give a short answer, with an optional note, on why they stopped using the app. These are used only to learn which channels work, are deleted with the family, and are never shared.

Purpose

Data is used only to run the app for your family: showing chores, counting points, syncing between family members' phones, sending the reminders and notifications you choose and supporting your account.

We never use family data for advertising and never sell it to anyone.

Children's data and parental consent

Kid profiles have no account or email. A kid profile is created only by a parent or legal guardian, who consents on the child's behalf. The date and time of that consent is stored on the kid profile.

Kid screens show no ads and send no child data to third-party analytics tools.

Her health data

Her health (menstrual cycle and pregnancy) is sensitive personal data. It is stored only after its owner agrees inside the module, and the time of that consent is recorded.

Only the owner can read this data, behind her profile PIN. She may choose to share a read-only summary with one other parent in the family; symptoms, mood and notes are shared only if she chooses. Other members, including children, relatives and helpers, cannot see it.

Period reminders never show health words on the lock screen. She can delete all of her health data at any time in Her health > Settings.

Family emergency card

If your family fills it in, we store the home address, doctor, preferred hospital, insurer or takaful company and policy number, mosque or place of worship, and the emergency contacts you type in yourself. We do not read your phone contacts.

Blood type, allergies, conditions and medication are sensitive personal data. They are stored only after the person saving them agrees, and who agreed and when is recorded.

Only the parents, adults and teens of your family, and the member themselves, can see this health information. A helper or relative cannot. A parent or adult can delete it at any time.

Disclosure

Through normal app access, family data is seen only by your family members according to role. For example, extended family do not see wallets or notes.

We disclose data to service providers who run the app for us, such as database hosting, under contracts that require confidentiality. Where servers are outside Malaysia, we only use providers with comparable data protection.

If you switch notifications on, Expo receives the delivery token and that short line of text. Apple Push Notification service delivers it on iPhone, while Google Firebase Cloud Messaging delivers it on Android. They act as delivery processors for us and receive no encrypted content, no free text, no points and no ringgit amounts. Quiet hours are applied before anything is sent, so a notification that falls inside your quiet window is not handed to them and is not sent later either.

We do not disclose data to anyone else unless the law requires it.

Premium subscriptions are paid through Google Play or the App Store, which handle your payment details; we never receive card numbers. RevenueCat, our service provider, receives a random family ID and the store purchase record (product, dates, renewal status and transaction) so Premium opens for the whole family. Subscription event records are deleted after 90 days; payment records are kept as described below.

Storage and retention

Family map: location history and place events are deleted automatically after 7 days. Turning sharing off deletes that person's latest point, history and place events at once. Turning Family map off deletes them for the whole family, and everyone has to agree again if it is turned back on.

Widgets (optional): if you add an UrusFamily widget to your home screen or lock screen, a summary of your family's tasks, shopping list, calendar, goal, kids' points, meals and special days is copied onto your phone so the widget can show it. Anyone who can see your phone screen can see it. On iPhone, a widget can also mark a task done using a key made for that phone; we keep only a hashed copy of that key. Signing out clears the widget data and cancels the key; removing the widget stops showing it.

Data is kept while your family or account is active. When the owner deletes the family, data is removed from the main database immediately and from backups within 30 days.

After deletion we keep only anonymous counts (number of members and the age of the family) as proof the deletion happened.

A chore proof photo is deleted as soon as it is checked, and at most 72 hours after upload. A share proof screenshot is deleted after review, and at most 14 days after upload. One Documents vault copy stays on the phone that added it and one copy is kept in private family storage so parent phones can restore it. Deleting the document removes that copy within 15 minutes.

A gallery photo stays until someone in your family deletes it. Deleting one removes the full photo and thumbnail within 15 minutes. Deleting the family removes every gallery photo.

Diary entries are kept while the author profile and family are active. They are deleted when the author profile is deactivated or its account is unlinked, and all entries are deleted with the family; backup copies roll off within 30 days. Switching the Diary module off does not delete entries.

A notification delivery token is deleted when you sign out, when you switch notifications off, when you withdraw permission in your phone settings, and when Apple or Google tell us that device is gone. Records of notifications sent, and of ones quiet hours held back, are deleted after 14 days.

Daily ibadah logs are kept for 13 full months, then combined into monthly totals for each member and the daily logs are deleted. A hafazan teacher's name is kept only on the phone that recorded it.

Other records are kept only as long as they are needed, then deleted automatically: "Check in" check-ins after 7 days; invites 30 days after they expire or are used; app usage and error records after 90 days; problem reports 180 days after they are handled; referral link opens after a year; a rejected or withdrawn share post link after 90 days. Usage and error records carry only a random app id that changes every year, never your name or email.

For affiliates, bank details are asked for only when a payout is due. The account number is deleted after 90 days without payout activity, and the name and MyKad number are deleted 15 months after the tax form (CP58) deadline for the last payout. Payment records with no family details are kept for 7 years because tax law requires it.

Security

Data travels over encrypted connections. Each family is isolated on the server, so other families cannot read your data.

Personal notes and Diary entries are behind the active member's PIN. A parent's PIN can also unlock a kid profile's notes and Diary. Family notes, Gallery photos and shared content are available only to permitted family members. Older items that used the retired family key can be opened from Account > Older notes.

Access and correction

You can view and correct most data directly in the app. Parents can export a copy of the family data from Settings.

You can also ask for access or correction by email. We will reply within 21 days.

Your choices

You can withdraw consent at any time by deleting your account or, for the owner, deleting the family. Without consent we cannot run the app for you.

Contact us

For questions, access or correction requests, or complaints about personal data: hello@urusfamily.com

Changes to this notice

If this notice changes in substance, the app will ask for your consent again. If the BM and EN versions differ, the BM version applies.