Privacy Policy

Last updated: October 23, 2026

This Privacy Policy explains what personal data the We family app ("We", "the Service", "we", "us") collects, why we collect it, who processes it on our behalf, how long we keep it, and the rights you have over it. The Service is operated by TZ Develop Team (Tomer Zaguri), Israel ("the Operator"), the controller of the personal data described here. Contact: info@wefamilyapp.com.

This policy is written to describe what the app actually does — nothing more and nothing less. If a translated version of this policy conflicts with the English version, the English version prevails.

1. Scope and applicable law

This policy applies to the We mobile app (Android and iOS), its web version, and the wefamilyapp.com website. We process personal data in accordance with the Israeli Protection of Privacy Law, 5741-1981 (including Amendment 13) and, where it applies to you, the EU General Data Protection Regulation (GDPR). For the purposes of the GDPR, the Operator is the data controller.

Notice under section 11 of the Israeli Protection of Privacy Law. You are under no legal duty to provide us with any personal data; providing it is voluntary. Without account details we cannot open an account for you, and without a device permission (contacts, location, camera, microphone, photos, calendar) the one feature that needs it stays unavailable while the rest of the app keeps working. The data is processed for the purposes listed in section 3, is shared only with the recipients listed in section 5 (and in the cases listed in section 7), and you may inspect and correct it as described in section 10.

If you live in a country not mentioned here, you may have additional rights under your local law — contact us and we will honour them where they apply.

2. Data we collect

Account and identity

• Email address and password, or a verified phone number — one of them is how you sign in. An account created with a phone number has no email and no password; the number is verified by a code we text you at every sign-in. Authentication is handled by our own self-hosted identity server (Keycloak); passwords are stored only there, hashed, and are never visible to us in plain text.
• Sign-in with Google or Apple — if you choose social sign-in, we receive your name, email address, and profile picture from that provider. When you create your account with Google and allow it on Google's consent screen, we also receive your gender, your date of birth and a phone number from your Google profile that Google has verified; they fill the matching fields of your new profile.

Profile

• First and last name, profile photo, gender, date of birth, and residential country and city — all optional except your name.
• Verified phone number — optional. You verify it once with a code we text you, or it comes from your Google profile when you create your account with Google (see above); the number is held by our identity server, shown on your profile only to you, and offered as a call button to the family members you share a chat with. We also keep a hash of it so that relatives who have you in their phone contacts can find your account (see "Contacts" below). You can use We without ever verifying a number.
• Email hash — for every account with a verified email address (including one received from Google or Apple), we keep a hash of that address so that relatives who have it in their phone contacts can find your account (see "Contacts" below).
• Memorial profiles may include a date of death for deceased relatives.
• A search index of spelling variants of your name (including transliterations across scripts) that we generate to make family search work across languages. See "AI features" below.

Contacts

• Finding family in your contacts — only after you allow the device's contacts permission from the family search. From then on, each time you open the family search your address book is read on your phone; the numbers and email addresses in it are hashed on the phone and the hashes are sent to us to answer which of them belong to We accounts. Contact names stay on the phone: names you type in the family search are matched against your contacts there. We do not keep the hashes, the numbers or the addresses, and no contact of yours is added to anything.

Family graph

• The family relationships you declare (parent, spouse, child), family groups, and invitations.
• Managed ("linked") profiles — profiles you create and maintain for relatives who don't have their own account — mainly those without a phone of their own, such as young children, elderly relatives, deceased relatives and pets. These may include a name, photo, date of birth, gender and city. If you invite that person to take the profile over as their own account (see section 11), we also collect the email address you give us for them, in order to send that invitation. You are responsible for having the authority to create such a profile (see the Terms & Conditions).

Content you share

• Chat messages, including photos, videos, documents and voice messages, plus reactions, read receipts, @mentions, link previews, polls and votes (visible to the chat's participants with your name), and game invitations.
• Voice message transcripts — voice messages are automatically transcribed (see "Processors" below) and the transcript is stored with the message.
• Location — when you choose to share a location in a chat or attach a place to a family event, we store the precise coordinates you shared. Location is read only at the moment you attach a place, and only for that action.
• Feed posts, comments, reactions, polls and votes (votes are visible to your family with your name), events, vacations and scheduled posts.
• Status — a short status you post appears on your profile and in the family tree for 24 hours, and your family is notified of it. It is kept until you replace or remove it, or delete your account.
• Stories (family memories), including who viewed each story, who is tagged in it, and public replies to it (visible to the story's audience). After its 24-hour window a story remains part of the life story on your profile, visible to the audience you chose for it; you can hide any story from your profile or delete it.
• Family tasks, task assignments and leaderboards, and the photo you attach to a task; talk reminders you set.
• Family games you play with relatives — the moves you make, match results, standings, and your daily-challenge results.

Device and technical data

• Push notification token, device name and model, platform, app version, language and timezone.
• Online/offline presence status shared with your family.
• Standard operational records (timestamps of when records were created or changed, and by whom).

Usage and lifecycle records

• Account lifecycle events — we keep our own record of when an account was registered, when you sign in, sign out or your session is refreshed, when a device is registered, and when an account is deleted, together with the platform and app version. These entries are keyed to your user ID only: they contain no name, no email address, no phone number, no IP address and none of your content.
• In-app usage analytics (iPhone and Android apps) — the app reports to Google Firebase Analytics which screens you open, your first steps in the app (signing in, accepting the terms, and the introduction to the family tree and its guides), that you invited a relative, added a family member's profile or shared a sign-in link for one (that it happened only, not who it was for), which app you share an invitation to We through (for example WhatsApp), whether you allow notifications, that a push notification reached the app while it was open (the notification's identifier and time, not its text), when the app runs into an error (the error's message with identifiers removed, and the screen it happened on), when your sessions start and how long they last, and, on Android, the store campaign link that led to the install. These events carry a random identifier that Firebase assigns to the app installation, together with your device model, operating system, app version, language, and an approximate country and region that Google derives from your IP address. They are not linked to your We account, name or contact details. The web version sends no analytics.
• We use these records to understand how many people use We, which features they use, how the Service is performing, and where it is failing. They are never sold, never shared for advertising, and never used to build a profile of you or to target you.
• We also import aggregate download and install counts from the Apple App Store and Google Play. Those reports are anonymous, arrive as totals, and are not linked to any individual account.

Support data

• Feedback and bug reports you submit, including an optional screenshot you attach.
• Reports you file about other users or content (report title and description).

Analytics and tracking: usage data is the lifecycle record kept on our own servers and the in-app usage analytics described above, processed by Google Firebase Analytics with its advertising features switched off. The app does not read your device's advertising identifier (IDFA on iPhone, Advertising ID on Android) and does not track you across other apps or websites. Your contacts are read only after you allow the contacts permission (see "Contacts" above), and the "only if we haven't talked" reminder option is based solely on activity inside WE's own chats.

3. Why we process your data

• To provide the Service (performance of contract): operating your account, your family tree, chats, feed, stories, tasks, reminders and notifications.
• With your consent: camera, microphone, photo library, precise location, calendar and contacts access are used only after you grant the corresponding device permission, and only for the action you initiated (taking a photo, recording a voice message, dictating a message or a question to the assistant, attaching a location, adding an event to your calendar, looking for family in your contacts). Phone verification runs only when you start it.
• Legitimate interests: keeping the Service secure, preventing abuse, handling reports and blocks, fixing bugs from feedback you send, and measuring how the apps are used so we can improve them.

Personal data is used for these purposes only: it is never sold and never used for advertising, and the AI providers listed in section 5 process your content under terms that exclude training on it. We do read a limited, access-controlled sample of assistant conversations in order to fix and improve the assistant itself — see section 4.

4. AI features

Most AI features in We are powered by the Microsoft Azure OpenAI Service (see "Processors"). When you use one of them, relevant data is sent to that service to generate the response:

• The in-app assistant — when you talk to the assistant, your conversation with it is processed by the AI service, together with context the app provides so answers are useful: your family tree (names, relationships, birth dates), and — when the assistant looks something up for you at your request — content it retrieves on your behalf, such as feed items, stories or profile details, and for chats — their metadata: which chats you have, their participants, unread counts and when they were last active; and when you ask for a summary of a chat you are in, its latest messages (up to 50: their text, poll questions and the transcripts of voice messages and videos), which are used to write that summary — the summary becomes part of your conversation with the assistant. An automatic redaction step attempts to mask personal identifiers in your typed messages before they are sent; it works best for English text and does not cover context the app supplies. We also store your conversation with the assistant — your messages and its replies — on our servers, so you can return to it and continue where you left off. Conversations are kept for up to 90 days from their last message and are then deleted automatically. Within that window our development team may read conversations, in limited and access-controlled fashion, to find and fix problems with the assistant and improve its answers. This is done under our legitimate interest in providing a working Service — never to profile you and never for advertising. Storing a conversation is not training: neither we nor Microsoft use it to train AI models. You can delete a conversation at any time from the conversation history in the assistant panel, or all of them at once from the same screen; deleting your account deletes them all immediately.
• Name search — your first and last name are processed by the AI service to generate spelling and script variants so relatives can find you in any language.
• Status suggestions — when you open the status sheet, we send your first name, gender, country, locale, local time and the names of upcoming holidays (and, without naming anyone, that a relative has a birthday) to suggest statuses you could post.
• Conversation openers — to suggest a warm opener in a quiet chat, we send both participants' first names, genders, family relationship, locale and the time of day (never your message history).
• Voice transcription — voice messages are transcribed by Microsoft Azure Speech.
• Dictation — when you choose to dictate a message or a question to the assistant instead of typing it, your speech is turned into text by your phone's speech-recognition service (Apple on iPhone, Google on Android; in a browser, the browser's own speech service). On iPhone, the first and full names of your family members (when dictating to the assistant) or of the chat's participants are passed along as hints so the recognizer spells them right. The audio and those hints go to that provider for recognition under its terms and are not sent to us; only the text you then send reaches the Service.

Azure OpenAI and Azure Speech process this data to provide the feature; per Microsoft's terms, data processed by these services is not used to train their models. Microsoft may keep prompts and responses for up to 30 days for abuse monitoring, inside the same EU data zone and accessible only to authorised Microsoft staff. Assistant answers can be wrong — don't rely on them as professional advice.

Birthday greeting suggestions work differently: the celebrant's first name, gender and family relationship to you are passed to an AI model built into your phone's operating system. That step sends nothing off your device — the greeting is written locally and we never receive it.

5. Processors and third parties

We share personal data only with the service providers below, only to operate the app:

Authentication (Keycloak) and the PII-redaction step (Presidio) run on our own infrastructure. The identity server keeps a log of sign-in events, including the IP address each sign-in came from, for 7 days, for security. Our over-the-air update mechanism asks our own server for the current app version and sends the app, OS and updater versions, the platform, whether the device is an emulator, and a random installation identifier.

Link previews. When someone shares a link in a chat, the feed or a story, our server fetches that page's title and preview image once; the preview image is then loaded in your app directly from the linked website, so that website sees your device's IP address, as it would if you opened the link.

Some of these providers process data outside Israel and the EU (including the United States). We rely on the providers' standard data-protection commitments (including EU Standard Contractual Clauses where applicable) for such transfers.

6. Cookies and local storage

We uses storage on your device only to make the app work:

• In the app and its web version — your sign-in tokens, your language, display preferences (backgrounds, haptics, snoozed suggestions), your push-notification token and the app's own state (for example which family-tree view you last used) are kept in the app's local storage on your device. In the web version this is the browser's local storage for wefamilyapp.com. The iPhone and Android apps also keep the random installation identifier that Firebase Analytics uses (section 2).
• On our identity server (identity.wefamilyapp.com) — when you sign in through a browser, the server sets its own session cookies (Keycloak: AUTH_SESSION_ID, KC_AUTH_SESSION_HASH, KC_AUTH_STATE, KC_RESTART, KEYCLOAK_IDENTITY, KEYCLOAK_SESSION, KEYCLOAK_REMEMBER_ME, KEYCLOAK_LOCALE, and the KEYCLOAK_3P_COOKIE pair that checks whether your browser blocks third-party cookies) so that you stay signed in and it remembers your language.

All of these are strictly necessary for the Service, which is why the app shows no cookie banner: there are no analytics or advertising cookies and no tracking pixels. The one third party that may set cookies on its own domain is Google, when you open a map or an address field in the browser version (section 5). Clearing the app's data or your browser's storage signs you out and resets these preferences.

7. When we may disclose data

Beyond the processors above, we may disclose personal data only in these cases:

• Legal requirements — when required by law, a court order or a valid request of a competent authority, or in good faith where necessary to protect the safety of users or the public, to investigate abuse or fraud connected to the Service, or to establish or defend legal claims.
• Business transfer — if the Service is involved in a merger, acquisition or transfer of assets, personal data may be transferred as part of it; we will notify you before your data becomes subject to a different privacy policy.

Links shared by users (in chats, the feed or stories) may lead to external websites we do not operate; their privacy practices are governed by their own policies.

8. Who can see your content

• The Service is built around your family: your profile, tree, feed, stories and tasks are visible to your family members. Chat messages are visible only to the participants of that chat.
• Everything you share is visible only to your family members or, for chats, to the chat's participants. The only ways someone outside your family can find you are name search and the contact matching described above (relatives who have your phone number or email address in their contacts). Profile photos are the one exception — see the next point.
• Profile photos are stored on cloud storage at unlisted web addresses — anyone who has the exact link can open the photo. Other media (chat, feed and story media, and task photos) requires an authenticated, time-limited link. Screenshots you attach to feedback are stored in our private issue tracker, accessible to the development team only.
• We staff do not read your family chat messages; assistant conversations may be read in limited, access-controlled fashion to fix and improve the assistant, as described in section 4. Operational access to production data is limited to what running and debugging the Service requires.

9. Retention and deletion

• Deleting your account is immediate and permanent. When you delete your account (Settings → Delete account, or by emailing us), your identity, profile and profile photo, stories, tasks, reminders, device registrations, notification preferences and mutes, your updates inbox and assistant conversations are hard-deleted from our systems, together with managed profiles that only you maintained. Messages you sent in chats, and posts, comments and reactions you shared in the family feed, stay in those chats and feeds for the family members who took part, with their photos, videos and transcripts; your name, profile photo and phone number are removed from them and replaced with an anonymous placeholder. You can delete any of these items yourself before deleting your account. There is no recovery window.
• You can also delete individual items (messages, posts, comments, stories, tasks, reminders, family members, linked profiles) at any time from within the app.
• Assistant conversations are kept for up to 90 days from their last message and are then deleted automatically. You can delete a conversation earlier from the conversation history in the assistant panel, or all of them at once from the same screen, and they are deleted together with your account.
• Updates inbox — the in-app list of the notifications you received (the notification text and who or what it was about) is kept for up to 90 days and is then removed automatically; it is deleted together with your account.
• Exceptions: feedback you previously submitted (including its screenshot) is kept in our development issue tracker and is not automatically removed when your account is deleted — email us if you want a specific feedback item removed. Reports filed about abuse are retained as long as needed to handle them. Copies of data inside our internal message queues and backups age out on a schedule of days to weeks. In-app usage analytics are not linked to your account; Google removes the event-level data after 2 months. The account lifecycle records described in section 2 — that an account with your user ID registered on a date, signed in, and was later deleted — are kept after deletion so that our counts of how many people joined and left stay accurate over time; they hold no name, contact details or content. The moves recorded in family games you played with others are likewise kept as part of those games' history.
• Contact hashes sent to find family are matched and discarded in the same request; nothing about your contacts is retained.
• Stories are kept by design after their 24-hour window — they become part of the life story on your profile. Deleting a story removes it permanently.

10. Your rights

• Access and correction — view and edit your profile in Settings → Profile. For anything else we hold about you, email us and we will provide it or correct it. We answer requests within 30 days and may first verify that the request comes from the account holder.
• Source of your data — everything we hold about you was provided by you, generated by your use of the Service, or entered by a family member (a relationship they declared, a managed profile they created, a tag or a mention). You may ask us which of these applies to a specific item.
• Restriction, objection and withdrawal of consent — you may object to processing based on our legitimate interests, ask us to restrict processing, and withdraw any consent you gave (for example by revoking a device permission) at any time.
• Deletion — Settings → Delete account, or email us from your registered address. See our account deletion page.
• Data export — there is currently no self-service export; email us at info@wefamilyapp.com and we will provide a copy of your data within 30 days, in a common machine-readable format.
• Objection and complaint — you may contact us about any processing, and you may lodge a complaint with the Israeli Privacy Protection Authority or, if the GDPR applies to you, your local data protection authority.

11. Children and managed profiles

Anyone aged 13 or older can create their own We account (see the Terms & Conditions); where local law sets a higher age for using online services on one's own (up to 16 in some EU countries), a parent or guardian's permission is required until that age. A child's account works like any other account: their content is shared with their family as described in section 8. Younger children and other relatives without a phone of their own appear through managed (linked) profiles, maintained by the family member who created them. That family member is responsible for having the authority (including parental authority) to share the person's details, and can edit or delete the profile at any time.

Handing a profile over. There is one exception: the family member who created a managed profile may invite the living person it describes to take it over as their own account. This is available only to the profile's creator, and only for a profile of a living person — never for a pet or a deceased relative. The creator either gives us an email address for that person, to which we send the invitation, or asks for a one-time link to pass on personally; either way it is a single-use sign-in link that expires after 7 days, and whoever opens a passed-on link enters their own email address there; we store only a cryptographic hash of that link, never the link itself. Anyone holding the link can see the profile's first and last name before claiming it, so it should be sent only to the person it belongs to. Once the profile is claimed it becomes a full account under that person's own control, and the relative who created it can no longer edit or delete it. This cannot be reversed. Until the invitation is claimed, the creator can cancel it at any time, and it is revoked automatically if the profile is marked as deceased.

12. Security

All traffic is encrypted in transit (TLS). Data is stored in access-controlled databases and storage on Microsoft Azure, with authentication handled by a dedicated identity server. Access to production systems is restricted to the development team. No system is perfectly secure — if we become aware of a breach affecting your data we will notify you as required by law.

13. Changes to this policy

When we change this policy we will update the date at the top and, for material changes, notify you in the app. Continued use of the Service after a change means the updated policy applies.

14. Contact

TZ Develop Team — Israel
info@wefamilyapp.com