What we keep, and what we will never do with it.

The family account: family name, the parent's email and password (hashed with bcrypt), a family code, and each member's name, avatar, colour and 4-digit PIN (also hashed).

What the family creates: habits and completions, pocket-money transactions, savings and deposits, goals, wishes, meals, calendar events, lessons passed, family posts and awards earned.

Health entries, only when a parent turns the tracker on: the condition chosen for a child, blood-sugar readings with their times and how they were taken, carbohydrates counted, insulin doses with the pen used, food eaten outside planned meals, and the two notes a parent types — the doctor's plan and what to do for a low.

Technical basics needed to run it: a session cookie, and a push subscription for each device where reminders or alerts were switched on.

No advertising, no ad trackers, no analytics that follow anyone around, and no selling or sharing of family data with anyone.

No profiling of children. Health entries are used for your family's own screens and the report you print for your doctor, and for nothing else.

No staff access to your family unless a parent creates a support key. Keys are scoped, expire, are revocable in a tap, and every single use is written to an audit trail you can see.

No dosing advice. FamCoin records the numbers a person decided; it never calculates one.

A child's account is created and controlled by a parent or guardian, who consents on the child's behalf. Children have their own PIN so their pocket money and health log are not open to the whole household.

Health data is sensitive personal data under India's Digital Personal Data Protection Act 2023 and, where it applies, the UK/EU GDPR. It is stored to provide the service to your family, kept for as long as the account exists, and deleted with it.

A parent can delete any member from Settings → Family, and with them every habit, transaction, reading and dose belonging to that member.

Low and high alerts are sent to the parents of that family only, on devices where a parent switched notifications on.

Access and portability: the bank statement and the 30-day health summary download as CSV from inside the app, and a full copy of your family's data can be requested at any time.

Correction: everything is editable in the app by a parent — readings, doses, goals, wishes and the plans you have typed.

Erasure: deleting the family deletes everything. No shadow copy is kept for marketing, because there is no marketing.

Withdrawing consent: turn the health tracker off and no further readings or doses are recorded; delete the member or the family to remove what is already there.

Notifications: push is off until someone turns it on for a device, and can be turned off again on that device.

Data is held in a PostgreSQL database on a server the family that runs FamCoin controls, in India, with daily encrypted backups kept for fourteen days.

Traffic is served over HTTPS only. Session and staff cookies are HttpOnly and marked Secure whenever the connection is encrypted.

Staff can see account-level facts — family name, plan, counts of habits or readings — without a support key. They cannot see the content of a reading, a note, a message or a dose without one.

The health features are a family log and a habit tracker. They do not diagnose, do not suggest doses or treatment, and never replace your doctor or diabetes team. Targets, ratios and routines come from them.

The timings shown next to a pen — for example that a regular human insulin is given some minutes before food — are the values a parent entered after being told them by a clinician. FamCoin repeats them; it does not decide them.

For a data request, a correction or a complaint, use Settings → Help inside the app, which reaches the people who run FamCoin directly. Under the DPDP Act you may also complain to the Data Protection Board of India if you are not satisfied with the response.