Family app privacy

Accounts and access

We use your name, email, contact details you provide, account reference and approved family role to manage access and records. Accounts are by invitation and approval; signing in alone does not grant family access. A secure sign-in cookie keeps you signed in.

Signing in with Google

If you choose Google sign-in, Google shares basic information, such as your name, email address and a reference to your Google account. This lets us confirm that you control that Google account and connect it to an approved family account. It does not give us access to Gmail, Drive, Google location history or your contacts. Google sign-in does not prove a family relationship or that you visited a land.

Optional connected profiles

Separately from signing in, you can choose an available Google, Apple, Facebook or Snapchat connection to preview the basic name, photo or profile link that the provider actually supplies. Some providers do not supply every field. Personal Instagram profiles use a link you enter yourself. Connecting a profile does not change your family admission, reviewed name, sign-in email or permissions, and does not prove your identity or presence on a land.

Imported details stay in your private preview until you select individual fields and apply them. An applied display name and photo are visible to approved family members; the reviewed family name remains visible when it differs. Imported profile links follow your contact-sharing preference. Disconnecting removes that provider’s imported details and selected presentation from the app, while your family account remains.

We retain a protected reference to your connected account, the supplied display details and when you connected. The temporary access details used to complete the connection are not retained or sent to your browser. We do not request posts, contacts or location history. Opening a provider’s permission page, or displaying a preview or applied profile photo, sends requests to that provider or its image host, including connection information such as your IP address. The address of the family-app page you are viewing is not sent with requests for profile images.

Visits and location are your choice

Opening the app does not request your location. The location button asks for one device reading to help you find the land; that action alone does not save a visit or share your status. Submitting a visit requests a fresh reading and records its coordinates and accuracy, the time recorded by your device and the time the app receives the visit, chosen land, purpose and any optional note or photo. There is no background tracking or stored route history. Photos and family witness statements are optional.

What relatives can see

Family access depends on the approved role. When you explicitly share an eligible check-in, relatives see your name, land, purpose, last confirmed time and witness count. Exact visit coordinates, private notes, photos and full visit receipts are limited to the visit author, designated owner and nazir. A shared trip shows the chosen land and purpose with its reported time, without your starting point or route. These statuses expire and can be ended early; they describe last-reported activity, not continuous observation.

Land care, shared photographs and expenses

Care issues, jobs, inspection notes, schedules and ordinary access guidance are shared with approved family members. A care photograph is uploaded for family sharing only when you explicitly choose that option. Embedded camera, location and text metadata are removed before image storage; the visible photograph itself is not redacted. Private visit evidence is never copied into the shared care timeline automatically. A care observation does not request your device location or certify attendance.

Expense amounts, decision notes and privately uploaded receipt photographs are limited to the submitter, designated owner and nazir. An existing document linked to an expense keeps its original access permissions, so a document already shared with the family remains available in the document library. Restricted access instructions in a land guide are visible only to the designated owner and nazir.

Uploading and reviewing surveys

The owner and nazir can upload a survey and review a draft before adding a land. Choosing Extract sends that survey to OpenAI for a draft transcription; uploading alone does not send it to OpenAI. Image metadata is removed from the copy sent for extraction; PDF content and visible information are included. The original remains in private document storage. You can enter details manually instead. Drafts, source files and extraction results are limited to the owner and nazir; reviewed land details become available to approved relatives after you save them. An approximate survey outline is a viewing aid until its coordinate system and position are checked; it does not verify a visit.

Family map annotations

Saving a pin, path or area records its title, notes, coordinates, author and edit times for approved family members to see. These drawings do not change surveys or entrances and do not prove a visit. Archiving removes an annotation from the active map; its saved versions and edit history remain in private records and backups. You can choose to download active annotations as a separate GeoJSON copy, without Google imagery or private visit evidence. Opening the satellite workspace loads Google Maps and imagery directly, sending the connection and map-area information described below.

Downloads and copies you choose to make

A land-care handover contains only the records available to the account downloading it, including any expenses that account may read. Restricted access instructions, private visit evidence, identity files and sign-in details are excluded. Document and photo links still require app access. Downloaded handovers are separate copies on your device. A calendar export includes the selected land’s name and plan notes and is shared with a calendar service only if you choose to import it there.

Maps and navigation

Opening a Google map sends requests to Google, including technical information such as your IP address and the map area being viewed. Navigate with Google Maps passes the saved entrance as the destination. Google Maps handles your starting location and route on its own service; the family app does not append your identity or visit coordinates to the navigation link. Opening directions does not record a visit or start a shared trip. Google handles its services under its privacy policy.

Private records and storage

Land information, original surveys, visit records, care observations, expenses, profile imports and attachments support family land management. Records, documents and backups are stored with encryption, and access is restricted according to each account’s approved role. Personal information is stored and processed outside Saudi Arabia, including in the United States. Services that keep the app running and support sign-in also use connection information, such as your IP address, to operate and protect the service. Private land and visit records are not published on the family-history website.

Keeping and correcting records

Visits, witness statements and the history of changes to records form a family management history. A saved visit receipt helps compare a record with a retained copy; it does not certify physical attendance. Ending a shared status does not delete the saved visit. Backups and document versions can retain earlier records, including care records and imported profile details after they are changed or disconnected in the live app. Requests to correct or delete information are reviewed alongside the need to preserve family records and other people’s statements; deletion is not automatic.

Your requests and questions

For access, correction, deletion or privacy questions, contact sulaiman@datasitr.com. We may need to confirm your account before handling a request. You can also decline device location permission, choose whether to share a visit, and end your own shared status in the app.