English · 简体中文 · Terms of Service
This Privacy Policy explains what Fambook ("the App", "we", "us") collects, why, where it is stored, and what control you have over it. Fambook is an independent app developed by Bingyan Dou. Contact: dosmallnw@gmail.com.
Bingyan Dou, individual developer, is the data controller for the purposes of the EU/UK General Data Protection Regulation (GDPR). You can reach the controller at dosmallnw@gmail.com.
| Data | Why | Where it is stored | Legal basis (GDPR) |
|---|---|---|---|
| Email address | To create and authenticate your account, and to sync your ledger across your devices. | Supabase (United States, West US region). Never stored in plain text on our side beyond what the authentication service requires. | Performance of a contract (Art. 6(1)(b)) |
| Apple ID identifier (only if you use Sign in with Apple) | To authenticate your account without a password. If you choose Apple's "Hide My Email", we only ever receive the relay address. | Supabase (United States) | Performance of a contract (Art. 6(1)(b)) |
| Transaction records — amount, type (expense/income), category and sub-category, your note, timestamp, source, and an optional place name | This is the core function of the App: your ledger. | Your device (local SQLite) first; then synced to Supabase (United States) when you are signed in. | Performance of a contract (Art. 6(1)(b)) |
| Family member labels — a name, colour and avatar you type in yourself | So you can tag which family member a transaction belongs to. | Your device, then Supabase (United States). | Performance of a contract (Art. 6(1)(b)) |
| Budgets and savings plans | To calculate budget progress and savings check-ins. | Your device, then Supabase (United States). | Performance of a contract (Art. 6(1)(b)) |
| Approximate location (optional — see §4) | To automatically fill in the name of the place where you spent money. | GPS coordinates are used on your device only and are discarded. Only the resulting place name (e.g. "Whole Foods Market") is saved with the transaction. | Consent (Art. 6(1)(a)) — you can withdraw it at any time |
| Receipt photos (optional — see §5) | To read the amount and category off a receipt so you do not have to type it. | Sent for processing and discarded. Not stored by us, not saved into your ledger. | Consent (Art. 6(1)(a)) |
| Voice input (optional — see §5) | To let you record a transaction by speaking instead of typing. | Audio is handled by your device's operating system and never reaches our servers. Only the resulting text is processed. | Consent (Art. 6(1)(a)) |
| Pasted bill text (optional) — e.g. a bank SMS or a payment app export you paste in yourself | To extract the amount and category automatically. | Sent for processing and discarded. Only the extracted result is saved. | Consent (Art. 6(1)(a)) |
| AI usage counter — your account ID, a date, and a number | To enforce a fair-use daily limit on AI features and prevent abuse of our API costs. | Supabase (United States). | Legitimate interest (Art. 6(1)(f)) |
| Subscription status (only if you purchase a subscription) | To unlock paid features and restore purchases across your devices. | RevenueCat and Apple. We never see or receive your payment card details. | Performance of a contract (Art. 6(1)(b)) |
Despite the name, Fambook does not currently have multi-user shared ledgers. "Family members" are simply labels you create inside your own account so you can tag who a transaction belongs to. Your data is scoped to your own account and is not visible to any other user of the App. This is enforced at the database level with row-level security.
When you record a transaction, the App can automatically fill in where you were, so you do not have to type it.
Three optional features use artificial intelligence. All of them run through our own server function on Supabase, which forwards the request to Anthropic's Claude API. You are never charged for AI beyond your subscription, and a daily fair-use limit applies.
If you take or choose a photo of a receipt, the image is sent to Anthropic's Claude API to extract the amount, category and a short description. The photo is processed in transit and is not stored by us — we operate no image storage, and the photo is not attached to your ledger entry. Only the extracted text fields are saved.
Your audio recording never reaches our servers and is never sent to Anthropic. Speech is converted to text by your device's own operating-system speech recognition. On iOS, depending on your device and your iOS settings, Apple's speech recognition may process the audio on-device or on Apple's servers; that processing is governed by Apple's Privacy Policy. Only the resulting text (for example, "coffee twelve dollars") is then sent to Anthropic's Claude API to be turned into a transaction.
The App can generate a one-sentence reflection on your spending for the day. To do this, we send Anthropic only aggregate statistics, never your individual transactions: the date, the number of entries, your total spend and income for the day, which category was largest and its percentage, the difference versus the same weekday last week, and which categories are over budget. Your notes, member names, place names, and individual transaction lines are not sent.
We use Anthropic's commercial Claude API. Anthropic does not train its models on data submitted through this API, per Anthropic's commercial terms. Anthropic may retain the request for a limited period for trust-and-safety purposes. See Anthropic's Privacy Policy and Commercial Terms. Your email address and account identity are not sent to Anthropic — the request carries only the content described above.
Every AI feature is optional. You can record every transaction manually by typing it. If you never take a receipt photo, never use voice entry, and never paste bill text, no content of yours is ever sent to Anthropic. Daily review is generated only when you open that feature; if generation fails or is unavailable, the App falls back to a summary computed entirely on your device.
| Provider | What it does | What it receives | Privacy policy |
|---|---|---|---|
| Supabase Inc. | Account authentication, database and cloud sync. Hosted in the United States (West US). | Your email address, your ledger data, and your AI usage counter. | supabase.com/privacy |
| Anthropic PBC | AI processing for receipt recognition, voice/bill text parsing, and daily review. | Receipt images, transcribed text, pasted bill text, and aggregate daily statistics. No email address, no account identity. | anthropic.com/legal/privacy |
| RevenueCat, Inc. | Manages subscription entitlements and restore-purchase. | An app-specific user identifier and your subscription receipt status. No payment card details. | revenuecat.com/privacy |
| Apple Inc. | Sign in with Apple, App Store purchases, and the operating-system speech recognition and geocoding used by the App. | Your Apple ID identifier (if you use Sign in with Apple), payment processing, audio for speech recognition, and coordinates for geocoding. | apple.com/legal/privacy |
Our servers are in the United States. If you use the App from the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to and processed in the United States. These transfers rely on the European Commission's Standard Contractual Clauses, which our processors (Supabase, Anthropic, RevenueCat) incorporate into their data processing agreements.
All network traffic uses HTTPS/TLS. Your session tokens are held in the iOS Keychain via Secure Store, not in general-purpose storage. Every cloud table enforces row-level security so that a request can only ever read or write rows belonging to the authenticated account. Our AI API keys live only on the server and are never shipped inside the App. No system is perfectly secure, and we cannot guarantee absolute security.
To delete your account and all associated data, email dosmallnw@gmail.com from the email address registered to your account, with the subject "Delete my Fambook account". We will verify the request and delete your account within 30 days, and confirm by email when it is done. There is no charge and no requirement to give a reason. If you signed in with Apple using "Hide My Email", send your request from the relay address so we can match it to your account. To also remove the local copy, delete the App from your device.
If you are in the EEA, the UK or Switzerland you have the right to: access your personal data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; object to processing based on legitimate interests; data portability (the in-app CSV export satisfies this in a machine-readable format); and withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. To exercise any of these, email dosmallnw@gmail.com. We respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.
We do not carry out automated decision-making that produces legal or similarly significant effects about you. The AI features generate text suggestions and commentary only; you always review and confirm what gets saved.
If you are a California resident, you have the right to know what personal information we collect and why (set out in §2 above); the right to delete it; the right to correct it; and the right to non-discrimination for exercising these rights.
We do not sell your personal information, and we have not sold it in the preceding 12 months. We do not share your personal information for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes other than those permitted under the CPRA. Because we do not sell or share, we do not offer a "Do Not Sell or Share My Personal Information" link; there is nothing to opt out of. The categories of personal information we collect are identifiers (email address, account ID), commercial information (your transaction records), geolocation data (a coarse place name, only if you enable it), and audio/visual information (receipt photos and speech, both processed transiently and not retained). We collect these from you directly. To exercise your California rights, email dosmallnw@gmail.com. You may use an authorised agent to submit a request on your behalf.
Fambook is not directed to children. It is rated for users aged 4+ in the App Store only because it contains no objectionable content, not because it is designed for children.
You must be at least 13 years old to create an account, and at least 16 if you are in the European Economic Area or the United Kingdom (or the higher minimum age set by your country's implementation of GDPR Article 8). We do not knowingly collect personal information from children under those ages, as required by the U.S. Children's Online Privacy Protection Act (COPPA) and GDPR Article 8. We do not ask for age or knowingly build profiles of minors.
If you are a parent or guardian and you believe your child has created an account or provided us with personal information, please email dosmallnw@gmail.com and we will verify and delete the account and its data promptly, and in any event within 30 days.
If we change this policy we will update the "Last updated" date at the top of this page. If a change materially affects how we handle your data, we will give notice inside the App before it takes effect, and where the law requires it, ask for your consent again.
Questions, requests, or complaints about privacy:
dosmallnw@gmail.com
We aim to reply within 7 days, and always within the 30 days required by GDPR and the CCPA.