Familyzap
Privacy policy
What we collect, why, for how long, and how to take back control. No ad trackers, no cookie banner to click.
Updated on 30 September 2026
In short
- One account per home, held by an adult: first name, e-mail, password (hashed).
- Children have no account: a profile created by a parent, with a first name, a colour, and if the parent wishes a photo, a birth date and a code.
- Everything in a home is visible only to that home. No public page, no ranking between families.
- No advertising cookie, no analytics tool, no data sold.
- Everything is hosted in France by OVH SAS.
1. Data controller
DAHULAB, SAS. For any question about your data: contact [at] familyzap [dot] com .
2. What data, for what purpose
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Home account: first name, e-mail, password (hashed, never readable), language, home name and address, time zone | Identify you, find your home, reset your password | Performance of the contract (Terms) | As long as the account exists. Without any login for 3 years, the home may be deleted after a reminder e-mail |
| Profiles: first name, role (parent or child), colour, optional photo, optional birth date, optional code (hashed) | Know who holds the phone, adapt the screen, protect a profile | Performance of the contract; for children, under the responsibility of the parent account holder | As long as the profile exists; deleted by a parent at any time |
| Pets: name, species, optional photo | Attach chores to the pet | Performance of the contract | As long as the record exists |
| Organisation: quests, steps, assignments, activities, unavailability, points, streaks, badges, rewards requested and granted | Run the app: share, validate, count, reward | Performance of the contract | As long as the home exists |
| Proof photos: picture uploaded to show a chore is done | Let the parent validate | Performance of the contract | As long as the quest exists; deleted with it |
| Room: messages, pictures, topics, author, time | Talk within the home | Performance of the contract | As long as the home exists; a parent can delete a message |
| Account security: two-factor secret, recovery codes, passkeys (public key only) | Protect the account if you enable these options | Performance of the contract | As long as the option is active |
| Session: session id, active profile, parent lock, IP address, browser (user-agent) | Keep you signed in, know which profile acts, protect against abuse | Legitimate interest (security) and performance of the service | 120 min of inactivity; parent lock 30 min; "stay signed in" cookie: until logout |
| Server logs: IP, URL, date, response code, errors | Diagnose failures, detect attacks | Legitimate interest (security, legal obligation to retain connection data) | 12 months at most |
| Contact: what you write to us by e-mail | Answer you | Legitimate interest | While the request is handled, then 12 months |
We ask for no surname, phone number or postal address. We make no automated decision with legal effects on you: rotation, points and the hero of the week are simple calculations internal to the home, with rules set by the parents.
3. Children
Familyzap is made to be used by children, but a child never creates an account. The account is opened by an adult aged 18 or over, who creates the profiles, decides whether there is a photo or a birth date, and remains the service's only contact. A child's data (first name, photo, chores, points, messages) is visible only to the members of their home, is not used for any other purpose, and is deleted by a parent whenever they wish.
If you believe a home was created by a minor, write to us: we will delete it.
4. Photos
Profile, pet, proof and room photos are stored on our servers under a random name and shown only to the members of your home. A profile photo is deleted when you choose another one or remove the profile; a proof or room picture goes with the quest or message. Nothing is public.
Do not use the photo of a person outside the home without their consent.
5. What others can see
- Inside the home: all members see first names, photos, today's quests, points, badges, the week board and the room. Settings, validation and granting rewards are behind the parent lock.
- Outside the home: nothing. A home's address (for example
martin.familyzap.com) requires being signed in with the home's account; someone from another home is refused.
No page of the app is indexable by search engines apart from the home page and these pages.
6. Cookies and local storage
Familyzap only uses cookies and storage that are strictly necessary for the service, exempt from consent under CNIL guidance. So there is no banner to accept.
| Name | Type | Role | Duration |
|---|---|---|---|
familyzap-session | Cookie | Session: your login, the active profile, the parent lock. Shared between the home page and your home's address | 120 min of inactivity |
XSRF-TOKEN | Cookie | Protection against forged requests | Same as session |
remember_web_… | Cookie | "Stay signed in on this device" if you tick the option | Until logout |
fq-mode | localStorage | Light or dark mode chosen on the device | Until you clear it |
| PWA cache | Service worker | Show an offline page and load faster | Until update or clearing |
No Google Analytics, no pixel, no third-party cookie, no audience measurement. Real time (notifications within the home) goes through a WebSocket connection to our own servers.
7. Recipients and processors
Your data is processed by DAHULAB and by the following technical provider only:
- OVH SAS (2 rue Kellermann, 59100 Roubaix, France): hosting of servers, files and database, in France (Union européenne).
No data is sold, rented or passed on for advertising. We do not transfer your data outside the European Union. We may have to disclose data upon request from a competent judicial or administrative authority.
8. Security
- Encrypted connections (HTTPS) across the site, including real time.
- Passwords and codes hashed with a modern algorithm (never stored in clear text, never sent by e-mail).
- Two-factor authentication (TOTP) and passkeys available on the account.
- Each home is isolated: every request is filtered on the signed-in account's home.
- Administration access restricted to team members.
In the event of a data breach likely to put you at risk, we will inform you and notify the CNIL within the legal time limits.
9. Your rights
Under the GDPR and the French Data Protection Act, you have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to set instructions about their fate after your death. The account holder exercises these rights for the children's profiles of the home.
- Correct first names, photos, profiles, pets, quests, rewards: directly in the home settings, behind the parent lock.
- Delete a profile, a photo, a message, a quest: in the app, by a parent.
- Delete the home, get a copy of your data, object to a processing: write to contact [at] familyzap [dot] com from the account's address. Answer within one month.
If you believe your rights are not respected, you may lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris, France).
10. Changes
This policy may change with the service. The update date appears at the top of the page; for a substantial change (new processor, new purpose), the account holder will be informed by e-mail or by a message in the app.