Privacy Policy

Last updated: 25 October 2026

Who we are

The Family Pot is operated by Thomas Conlon in Northern Ireland, United Kingdom. Thomas Conlon is the data controller for personal information handled through The Family Pot. Contact details are provided below.

Information we handle

• Account information: email address, encrypted authentication credentials, account identifier and optional display name.
• Household content: information you choose to add, such as income, bills, spending, debts, savings goals, events, categories, household names and member labels.
• Device information: local preferences, restore points, app-lock settings and sign-in sessions. The installed iPhone app protects its PIN and sign-in session tokens in Apple Keychain. It does not store your account password. Face ID or Touch ID is evaluated by iOS; The Family Pot receives only the result. App lock controls on-screen access but does not encrypt household data or exported files with the PIN.
• Service records: timestamps, record revisions and limited hosting, authentication and security logs needed to operate and protect the service.
• Support information: information you choose to include when contacting support.

The app does not ask for bank login credentials, full card numbers or copies of identity documents. Please do not add unnecessary health information or other sensitive personal information to free-text fields.

How we use information and our lawful bases

• To provide an account, save and sync a household, recover access and answer support requests. This is necessary to perform our agreement with you or take steps you request.
• To secure the service, prevent misuse, diagnose faults and maintain reliable backups and syncing. This is based on our legitimate interests in operating a safe, dependable service.
• To meet legal obligations or respond to lawful requests where required.

We do not make automated decisions that produce legal or similarly significant effects.

Offline use and household sharing

You can use the core planner without an account. In that case, household content remains in browser or app storage on that device unless you export it. If you create an account, the household content is uploaded to our hosted database so it can sync. Invited household members can view and change the shared household. A “Personal” label organises a record but does not hide it from other members.

Change history and the iPhone widget

Shared change history records an editor’s account identifier, display name, time and the before-and-after values of supported records. Current household members can view the last 30 days, including edits to Personal spending records. Expired history is excluded from member access and scheduled for deletion. This device also keeps up to 100 local changes and 50 overlapping alternatives; signing out clears these lists. Exported files and separate restore points are controlled separately.

The optional iPhone Quick Spend widget shares selected category names and, only if enabled in widget settings, weekly budget remaining with the app’s widget extension on the same device. Amounts are hidden by default. Home Screen information may be visible to other people using or viewing the device. Sign-in tokens and passwords are never put in widget storage.

Optional pilot feedback

Pilot measurement is off by default. If enabled, the app keeps event names, dates and optional entry durations on that device for up to 29 days. It does not add names, emails, amounts, categories or purchase details to those measurements. Nothing is transmitted automatically. You can export and choose whether to share the measurements; turning the option off deletes them.

Service providers

We use the following providers only to operate The Family Pot:

• Supabase for account authentication, the shared household database and real-time syncing.
• Netlify for website hosting, delivery and basic security logs.
• Resend for account confirmation, password-recovery and enabled household update emails.
• Titan Mail to receive and answer messages sent to our support address.
• jsDelivr to deliver the public Supabase software library used by the web app. It receives ordinary connection information such as IP address and browser details, but we do not send household budget content to it.
• Apple for App Store and TestFlight distribution. On supported iPhones, Apple’s operating system performs Face ID or Touch ID authentication locally under Apple’s terms.

Providers may use approved sub-processors. We require providers handling information on our behalf to protect it and use it only for the contracted service.

Household update emails

When enabled for the service, current household members with verified account email addresses receive short summaries of confirmed saved changes. Each member can choose grouped updates, a daily digest, a weekly digest or off. Daily is the default. Digests include only periods with saved changes. Daily delivery is scheduled for 18:00 UK time and weekly delivery for Sunday at 18:00 UK time; outages and delivery queues may delay it. Summaries include the editor’s display name, the type of information changed and counts of additions, updates or removals. They do not include transaction descriptions, amounts, passwords or records labelled Personal. Each recipient can change frequency or turn these emails off in My account. Emails are sent separately to each recipient.

Supabase holds the delivery queue and Resend delivers the message. Completed queue records are normally cleared after 30 days while the scheduled service is running. Household membership and preferences are checked again before delivery. Removing an account or membership removes that member’s queued deliveries; emails already delivered to an inbox cannot be withdrawn.

International transfers

Some providers are established, or use sub-processors, outside the United Kingdom. Where UK personal information is transferred internationally, the transfer must be covered by UK adequacy regulations or appropriate contractual safeguards and any required transfer assessment.

Retention and deletion

Local information remains until you remove it, clear site or app storage, or remove the app. Synced household information remains while the relevant household account is active. Starting permanent account deletion removes your account from the live service; if other members remain, the shared household stays available to them. Limited security logs or provider backups may remain temporarily where reasonably necessary for security, recovery or legal obligations. Support correspondence is kept only while needed to deal with the request and reasonable follow-up.

Restore points and exported JSON or CSV files are under your control and must be deleted separately. We cannot delete copies saved in your Files app, email, spreadsheet software or another service you selected.

Your rights

Depending on the circumstances, UK data-protection law may give you rights of access, correction, deletion, restriction, objection and portability. You can edit and export household information in the app. Signed-in users can start account deletion from My account → Delete my account permanently.

You can complain to the Information Commissioner’s Office. We would appreciate the opportunity to address your concern first.

Children and security

The Family Pot is intended for adults managing a household and is not directed to children. Do not create an account for a child. We use encrypted connections, account and household access controls, app-lock controls and data-restoration safeguards. No service can guarantee absolute security, so protect your device, password, PIN and exported files.

Changes

We will update this policy before introducing materially different uses of personal information, optional analytics, advertising, paid features or bank connectivity. Important changes will be brought to users’ attention in the app where appropriate.

Contact

For privacy questions or requests, email support@thefamilypot.com or visit www.thefamilypot.com/support.html.