Privacy Policy

Family Matrix is operated by SG PR Infotech LLP. We are the data controller for the information you enter into the app. For privacy questions, data-access requests or deletion requests, email us at sgprinfotech@gmail.com.

• Email address: used as your sign-in identifier and to send one-time sign-in codes or magic links.
• Google sign-in: if you choose Google, we receive your email address and basic profile information from Google. We do not receive your Google password.
• Authentication is handled by Supabase Auth, which stores your login credentials and session tokens on our behalf.
• Password resets are sent to the email address associated with your account.
• We do not ask for government IDs, phone numbers or payment information unless you explicitly choose to add them through the app's features.

• Profile details you enter: name, photo, life status (active, managed, deceased), dates and any notes you choose to add.
• Relationship data: the relationships you propose or confirm, their status (pending, confirmed, disputed, dissolved) and who initiated each change.
• Content you create: posts, comments, likes, stories, messages and uploaded media.
• Invites you send: recipient contact details you type, the invite token status and an audit trail of when the invite was created, opened and consumed.
• Operational records: activity log entries, achievements, credit-wallet transactions and basic technical logs needed to run and secure the service.

Family Matrix is built around mutual consent. A relationship someone proposes about you stays pending until you confirm it. You can dispute or dissolve a confirmed relationship at any time. For integrity of the shared family history, relationship records are never hard-deleted — their status changes and the change is written to your activity log.

You control who sees your profile, who can message you and who can see your feed through circle labels such as close family, extended family and friends. Blocking someone removes messaging and feed access in both directions immediately.

The app runs on Supabase (provided through Lovable Cloud), which acts as our data processor. Supabase hosts the database, authentication, file storage, server-side functions and email delivery for sign-in codes and invites. Your data is stored in a Supabase project located in a region chosen for the service.

• Supabase Auth processes your email and password or Google OAuth tokens for sign-in.
• Supabase Database stores profiles, relationships, messages, posts, media metadata, invites and activity logs.
• Supabase Storage holds uploaded photos and media in private buckets; access is enforced by per-path rules.
• Supabase Edge Functions and database functions run server-side logic such as invite claims, credit applications and daily reminder sweeps.
• Email delivery for OTPs and invite links is sent through Supabase's configured email provider.

We configure row-level security policies and storage access rules so that data is only returned when the requester is authorised by their circles and confirmed relationships. Supabase processes this data only on our instructions so the app can function.

Push notifications are opt-in. If you enable them on a device, the browser generates a push subscription that includes a device endpoint and encryption keys. This subscription is stored in our database so we can send you notifications for birthdays, anniversaries, reminders and other activity you have chosen to receive.

• You can turn push notifications on or off for each device in Reminder settings.
• You can also disable each reminder category (birthdays, anniversaries, memories, weekly digest, weekly ritual) independently.
• Disabling push on a device deletes that device's subscription from our database.
• Push messages are delivered through your browser's push service using VAPID keys; we do not receive your device location or contacts.

Visibility is controlled by circles — close family, extended, long relations and friends. Each circle separately governs profile visibility, direct messaging and feed access. Media you upload is kept in private storage and served only to people your circles permit. Blocking someone removes messaging and feed access in both directions immediately.

You can create a managed profile for a relative who is not yet on the app so the tree makes sense. Only add details you have a reasonable basis to share. When that person joins through an invite link, they can claim the profile and take over its content and visibility settings.

Your account content is kept while your account is active. You can edit or remove posts, comments, messages and media you created. Relationship edges and activity log entries are retained as history with their status rather than being erased, because they are part of the shared family record.

To request account deletion or a copy of your data, email sgprinfotech@gmail.com from the email address associated with your account. We will action it within a reasonable period, subject to records we must keep to preserve other members' family history.

A confirmed relationship can be ended, but the link is marked dissolved rather than erased. We keep the pair of profile references, the relationship type, the status history and the timestamps, because the same record belongs to two people and the other person's family history would otherwise silently change. A dissolved link stops appearing in the active tree and stops granting any visibility, messaging or feed access.

• Retained: who was linked, the relationship type, each status change, who made it and when.
• Not retained: any new access — a dissolved link shares nothing going forward.
• If you delete your account, live links are dissolved and your personal details are cleared, leaving an anonymous node so relatives' trees stay intact.

If you believe a relationship is wrong, you can dispute it. Both people see who raised the dispute, when, and the reason given; the link stays visible but marked, and a reminder is sent to both sides if it is unresolved after 14 days. Every transition is written to an audit record that cannot be edited or deleted by anyone, including our staff.

Blocking stops messages, comments and reactions between two accounts. Reporting sends the reported account, the reason you chose, any note you write and the identifier of the reported message or post to our moderation queue, where staff can review it and record a decision. Reports are visible to our staff only, and the reported person is not shown your report.

• Access and portability: download a machine-readable copy of your profile, confirmed relationships, messages, posts and activity from Profile → Your data.
• Correction: edit your profile details and visibility settings at any time.
• Erasure: close your account from Profile → Your data after a typed confirmation. This clears your personal details, photos, messages, posts and stories, and dissolves your live relationships.
• Objection and restriction: block anyone, narrow your circles, or switch off push notifications and reminders in settings.
• Complaints: write to us first; you may also contact your local data protection authority.

We use browser storage that is strictly necessary to keep you signed in and to remember your preferences (theme, tree layout, filters). We do not run advertising or cross-site tracking. Optional anonymous usage statistics are off by default and only start if you choose “Allow statistics” in the cookie banner; you can change your mind by clearing site data.

Access to data is enforced at the database level with row-level security policies, private storage buckets and per-path access rules, so requests are checked against your circles and confirmed relationships rather than trusted from the browser. No online service can promise perfect security; if you believe you have found a vulnerability, please report it to us before disclosing it publicly.

Accounts are intended for adults. A parent or guardian may maintain a managed profile for a minor relative, and remains responsible for the details they add.

We will update this page when the product's data handling changes, and update the date above. Significant changes will also be announced in the app or by email where appropriate.

For privacy requests, security reports or questions about this policy, contact:

SG PR Infotech LLP
Email: sgprinfotech@gmail.com