Privacy policy

Last updated October 24, 2026.

Short version: Famstamp is a family travel log run by parents. Your trips stay on your phone unless a parent turns on Family Sync. Kids only add things inside their own family's log, with a parent's OK. We don't sell data, show ads or use third-party trackers or advertising IDs, and you can delete everything.

On this page: Kids and parents · On your device · In the cloud · Photos and location · Usage counts and errors · Sharing · Launch waitlist · Invites and referrals · How long we keep data · Deleting

Who we are

Famstamp (the app and this website) is made by Dark Lighthouse Solutions ("we"). Questions about this policy or your family's data: privacy@darklighthousesolutions.com or support@darklighthousesolutions.com.

Kids and parents (notice to parents)

This part is our notice to parents under the US Children's Online Privacy Protection Act (COPPA) and similar laws.

• The parent owns the account. The family log belongs to the parent or guardian who sets it up. Kids can't create an account, and we never ask a child for an email, phone number, address, school or full name.
• What a parent adds about a kid: a name or nickname, an optional birth year and an avatar, plus the trips, stamps, journal pages, drawings and photos the family records.
• What a kid can add themselves: if a parent turns on Family Sync and makes a kid code, the kid can join the family from their own device. They can then add journal pages (short answers and notes), drawings, stamps and photos to their family's log, and react to family posts. Before the first kid code is made, the parent sees this notice and must confirm they are the child's parent or guardian and agree. Kids join with a sign-in that has no email or name.
• How we use it: only to store the family's log and show it to that family's members (and to anyone a parent chooses to share a follow link or Cousin Cup with). Never for ads, profiling or selling. We don't share kids' information with anyone except the service providers below that store it for us.
• Teens 13 and older can move to their own sign-in only when a parent makes a one-time code and confirms the teen is 13 or older. Their profile stays in the family.
• Parents stay in control. A parent can see, change, export or delete anything about their kids at any time, remove a kid member, cancel kid codes, and stop any further collection by turning off Family Sync or deleting the family (see Deleting). To ask us to review or delete your child's information, email privacy@darklighthousesolutions.com. We'll answer within 30 days.
• We don't knowingly collect personal information from children beyond what's described here, we don't require more than the app needs, and children can't make their information public.
• If you think a child gave us personal information without a parent's OK, tell us and we'll delete it.

What stays on your device

By default, everything you add (people, trips, places, stamps, journal pages, drawings, time-capsule notes and photos) is stored only in your browser's or app's storage on your phone or computer. We can't see it. Removing the app or clearing site data erases it, so keep a backup (Back up, or Help & feedback > Export everything).

What's stored in the cloud (only with Family Sync)

If a parent turns on Family Sync, a copy of the family's log is kept in a private database so family members' phones can share it. It is hosted by our database provider, Supabase, in the US. Photos are uploaded as smaller copies; full-size originals stay on your phone. It holds:

• the sign-in email of adults (and of teens who moved to their own sign-in), or a Google sign-in if an adult chooses it; people who join from an invite code can use an anonymous sign-in with no email;
• an account id for each sign-in (a random number the database makes), the family name, members and their roles (organizer, adult, kid);
• people, trips, places, stamps, journal pages, drawings, time capsules and settings you add;
• copies of your photos, in private storage only family members can open;
• if you turn on reminders, a push "subscription" address from your browser so we can send the notification.

Only members of your family can read your family's data; database rules enforce this. Optional features like a grandparent "follow" link or a Cousin Cup share only what they say on screen, are made by an adult, and can be turned off.

Photos and location

• You pick photos yourself; the app doesn't scan your photo library. When you add a photo, the app shrinks it and saves a new copy. That copy doesn't keep the camera's hidden details (EXIF), such as GPS location or camera model.
• If you pick photos to find trips, their dates and places are read on your device to suggest trips. Only the trips you keep are saved.
• Places come from what you type or pick on a map. If you tap "near me", your device's location is used on your device to find nearby places and isn't stored by us. The app never tracks location in the background.
• To show weather for a trip, the app asks Open-Meteo (a free weather service) about the place and date. It doesn't send your name or anything else about you.

Anonymous usage counts and error reports

To fix bugs and see which features get used, the app can send:

• Usage counts: how many times each screen was opened per day, added up across everyone (for example "passport: 12"). No names, ids or locations.
• Error reports: the app version, the error message (with emails, long numbers and ids removed), which kind of screen, and the device type such as "Android Chrome".

Neither includes a user id, device id, advertising id or anything you entered. We don't store IP addresses with them. You can turn both off in Help & feedback.

Who we share with

We don't sell or rent personal information, and we don't use it for ads. There are no ads, ad networks or third-party analytics in the app. We use a few service providers only to run it: Supabase (database, sign-in, photo storage), our web host, your browser's push service (if you turn on reminders), Google (only if an adult chooses Google sign-in), and Open-Meteo (weather, no personal data). If you buy a paid plan in future, the checkout provider (Polar, as merchant of record) handles payment and receives your billing details. We'd only disclose data otherwise if the law requires it.

Emails

We email you only for sign-in codes and, if you joined the launch waitlist, launch news. We don't send marketing emails from the app.

Launch waitlist (website)

If you sign up on our "get notified" page, we keep your email address, the date, and a short tag for which page you came from (for example "home"). The sign-up is for adults (18 or older) only.

• We use it only to email you when Famstamp launches (and, if the launch slips, at most one short update). It isn't shared, sold or added to any other list.
• To stop the emails or remove your address, email support@darklighthousesolutions.com with "unsubscribe". Every launch email will say this too.
• To limit abuse, the sign-up form counts tries per network per day using a scrambled code that changes daily; no IP address is stored, and the counts are deleted after a day.
• We delete the whole waitlist within 3 months after the launch email goes out, or sooner if you ask.

Invites and referrals

Family invite codes record who made them, for which role, and when they were used. If you share your "invite a family" link and another family starts their own log with it, we record that one family invited the other (no names or emails). When paid plans start, both families get 1 free month of Premium; we use the record only for that.

How long we keep data

• On your device: until you delete it or clear the app's storage.
• Family Sync data, photos and sign-ins: for as long as the family uses Family Sync; deleted from the live database right away when the organizer deletes the family or an adult deletes their sign-in. Our provider's backups expire within 30 days.
• Invite and graduation codes: they stop working after 7 days (3 for teen codes) and are deleted with the family.
• Referral records: deleted with either family.
• Error reports: up to 90 days. Usage counts: daily totals with nothing personal, kept to see trends.
• Waitlist emails: see above.
• Emails to support: kept only as long as needed to help you.

Seeing, exporting and deleting your data

• Export: Help & feedback > Export everything downloads a zip of all your data and photos.
• Delete single things: any trip, stamp, journal page, photo or person can be deleted in the app, without deleting the account.
• Delete in the app: the family organizer can choose Family > Leave or delete > Delete my account and data. This deletes the family's cloud copy, photos and the organizer's sign-in. Other adults can delete their own sign-in or leave.
• Delete by email: see how to request deletion. We'll do it within 30 days.

Security

Data is sent over encrypted connections, cloud data is protected by per-family access rules, photos are in private storage, and only the people who run the service can reach the database. We keep what we collect to a minimum. No system is perfect; if something goes wrong we'll tell affected families.

Changes

If we change this policy, we'll update the date above and, for important changes, tell you in the app first. If a change would let us use kids' information in a new way, we'll ask parents again first.