Pifamy Privacy Policy

Effective date: 2026-10-12, upon publication. Version: launch-review-2026-10-12-r2.

P1 Who we are and what this policy covers

Pifamy is operated by Mustafa Bas, an individual operating in New Jersey, United States ("Pifamy," "we," "us"). This policy explains how we handle personal information through the Pifamy app, our related websites, and support and safety communications. Our initial service is intended for adults in the United States. The policy also covers information about people included in content or invitations by our users, even if those people do not have a Pifamy account.

For privacy questions or requests, email privacy@pifamy.com. General support is available at support@pifamy.com, and security or safety concerns at security@pifamy.com.

P2 Information you and other people provide

Account and profile. We collect your email address to send sign-in codes, your display name, an optional profile photo and profile cover photo, and account identifiers. We record your acknowledgement that you are at least 18, the Terms and Privacy Policy versions presented to you, and acceptance or acknowledgement times. The age acknowledgement is a self-declaration; it is not independent age verification or a request for your date of birth or identification document.

Families and sharing. We process Family names, membership and permission records, relationship labels, invitations, selected audiences, and joining or leaving history. For invitations, this can include a recipient email address or a name supplied by the inviter, as well as expiration, acceptance and revocation information. We do not upload your address book to create a contact directory.

Content and interactions. We store and process Moments, captions and other text, original photos and videos (including recorded audio), Albums and saved references, Stories and their archive settings, comments, reactions, poll questions, options and votes, shared links, and Family calendar entries. We also process the author, audience, dates and other information needed to organize and authorize these interactions. We do not read your device calendar simply because you use a Family calendar.

Messages. We process message text, message photos, participants, conversation history and delivery or synchronization information, along with your read/unread, mute, archive, block and Clear chat choices.

Support and safety. We receive the information you choose to include in requests, reports, feedback or emails, such as an explanation and relevant screenshots. Avoid sending unnecessary sensitive information. Other users may provide information about you in Family content, invitations or reports.

Family storage purchases. Apple processes your in-app payment. Pifamy receives and verifies subscription information, including products, transaction and original transaction identifiers, an app-specific Apple purchase identifier, purchase and expiry dates, renewal choices, and billing, cancellation, refund or revocation status. We associate these records with the paying Pifamy account and the selected Family. The app-specific identifier helps us correlate eligible purchases for this app; it is not your Apple Account email address or payment-card number.

We keep purchase-to-Family associations and relevant history, including unfinished purchase attempts, verification results and any explicit confirmation needed to assign an eligible new paid period to a different Family after a previous subscription has ended. If a purchase changes while confirmation is pending, we may require a refreshed confirmation. These records help us provide the correct capacity, restore purchases, prevent duplicate or misassigned benefits, and resolve billing support requests. Purchase history is not erased simply by canceling an unfinished screen or changing the selected Family. We do not provide these billing identifiers or Family assignment records to AdMob as advertising targeting inputs.

P3 Media, permissions and information stored on your device

We use the camera, microphone and photo-library permissions relevant to the features you choose. We process uploaded media to validate files and create playable videos, display images, posters and thumbnails.

Uploaded originals may retain embedded metadata, such as capture time, device information or location recorded by your camera. Generated display derivatives remove metadata, but that does not remove it from the original file. We do not operate a separate feature that actively extracts GPS coordinates from your uploads. Review a file's metadata before sharing if this matters to you; do not assume every copy has had location information removed.

The app stores session information, preferences, cached content and drafts on your device. A photo chosen only as your personal Pifamy background is stored locally in the device/account context. Your profile avatar and optional profile cover photo are different: they are uploaded and can be shown to members authorized to view your profile through an active shared Family. They are not a public web profile. Removing or replacing a cover starts the applicable access and cleanup process; previously saved copies cannot be recalled. Device and operating-system backups may have their own settings. Signing out or deleting an account does not delete the original photos in your device library or recall copies you saved elsewhere.

P4 Authentication, security and technical information

We and the providers delivering the service process authentication and session records, IP addresses, user-agent information, platform information, timestamps, request metadata, errors and media-processing measurements. These help us sign you in, restrict access, prevent abuse, diagnose failures and keep the service working. An expiring sign-in code does not mean the email containing it or every associated security record is immediately erased.

Our app and relevant web flows use storage needed for sessions, preferences and security. Versions that show advertising also use the advertising technology described in P6A. Pifamy’s optional usage-analytics preference is separate from advertising privacy choices and essential security processing.

Where our sign-in protection uses Cloudflare Turnstile, Cloudflare processes network, browser and device security signals, such as IP address, user agent, connection characteristics and the site using the challenge, to distinguish legitimate requests from bots. We do not supply your message text, captions or media to the challenge. This is anti-abuse processing, not Pifamy advertising analytics. Cloudflare also uses these signals to improve its bot detection as described in its Turnstile Privacy Notice.

P5 Why we use information

We use information to provide accounts and private sharing, deliver and synchronize content and messages, manage invitations and preferences, process media, respond to support and privacy requests, prepare exports, enforce deletion, maintain recovery copies, investigate legitimate safety concerns, prevent abuse, and comply with applicable legal obligations. We also use the limited product measurement described below to understand whether Pifamy is useful and reliable.

We also verify purchases and provide the advertising described in P6A. We do not use private Family photos or messages to advertise Pifamy or as advertising targeting inputs. Service-provider processing described here is separate from sharing your content with other Pifamy users. Advertising-related disclosures and choices are described separately below; a non-personalized ad request is not a claim that no information is disclosed.

P6 Essential measurement and optional analytics

Essential first-party product measurement applies to admitted accounts regardless of the optional analytics setting. It measures aggregate growth, active use by day, week and month, initial use of core features, user and Family retention, and basic product health. Records can initially be linked to an account or Family through identifiers; they are not anonymous when collected. We later combine records into aggregate statistics and remove account links according to the retention and deletion practices below.

This measurement does not collect message or caption contents, media files or URLs, contact lists, precise location, advertising IDs, device fingerprints, sign-in codes or secrets. Background polling, automated worker activity and notification delivery are not counted as meaningful Family activity. The private Owner Dashboard presents aggregate metrics, not a browser for private content or individual members' behavior.

Optional usage analytics is a separate preference, OFF by default. If you enable it, we collect limited feature-interaction events to help understand feature use. You can turn it off later. Doing so stops future optional collection; it does not disable essential measurement or immediately erase all previously collected records. Anti-abuse signals processed by Turnstile and the advertising-provider processing in P6A are separate from both kinds of first-party product measurement. Turning off optional Pifamy analytics does not turn off every provider’s necessary diagnostics or advertising processing.

P6A Advertising in free Family spaces

Free Family spaces may show clearly labeled ads in Home, Albums and Moments. When an active paid storage plan is verified for a Family, ads are removed from that Family's supported screens for its members. A paid plan in one Family does not remove ads from other free Families. Ads are not placed in private Messages, Safety or the Download Center.

We use Google AdMob and Google's User Messaging Platform to provide ads and manage relevant privacy choices. We request non-personalized ads and enable Google's Restricted Data Processing setting. Google's publisher first-party ID feature is disabled in our app. These settings do not mean that no information is processed. Advertising technology may process IP addresses and approximate region, device or app identifiers, ad views and interactions, and crash or performance information for advertising, measurement, diagnostics and abuse prevention. See Google's partner-services explanation.

Depending on the configured advertising buyers and applicable privacy choices, Google may send advertising requests to other advertising buyers. Requesting non-personalized ads alone does not establish that all buyer processing is disabled. Restricted Data Processing applies within Google's applicable processing and terms; it is not a claim that every other advertising buyer's processing is disabled. We do not provide private Family photos, videos, messages, captions, Family names or account email to AdMob as targeting inputs. Private Family content is not used to choose ads. Advertisers' websites and apps have their own practices when you choose to visit them.

Use Ad privacy choices in Settings, where available, to review or change advertising choices. For additional requests, contact privacy@pifamy.com. Changing a choice affects future processing as supported by the advertising system; it does not itself delete all previously collected records. Advertising preferences are separate from Pifamy's optional usage analytics.

P7 Who can see private content and Messages

"Private" describes the audience and authorization rules. Published content is available to the people permitted by its Family, selected audience, membership and feature rules. Family administration does not give someone access to other participants' private direct messages. Saving someone else's Moment in an allowed shared-Family Album does not transfer ownership or independently authorize a wider audience. A pending video is not made available to recipients before publication.

Messages are not end-to-end encrypted. We protect transport and use storage and access controls, but authorized service systems can process message content when necessary to operate the service, carry out export or deletion, protect security, or investigate a legitimate report. Authorized personnel access is limited to legitimate responsibilities; private sharing is not a promise that no Pifamy system or service provider can technically process the content.

Previously authorized direct-message history can remain available read-only after a Family relationship ends; Family group access follows its membership rules. Clearing a chat changes your view, not the other person's view or permanent server storage. Stories normally leave the Family-facing view after 24 hours, but your private Story archive is on by default and may keep them until you delete them or disable archiving.

People who receive content may download, photograph, screenshot or copy it. We cannot recall those copies. Protect invitation links too: anyone to whom you forward a usable invitation may try to use it. External links you choose to open are subject to the destination's practices.

P8 Notifications and device Push

In-app notifications use your account, relevant activity and read/unread state. Where device Push is available and enabled for your app version, it requires your explicit Enable action and operating-system permission; default category settings alone do not register your device.

For versions supporting device Push, after you enable it, the initial category settings are Messages ON, Family activity/Moments ON, Invitations ON, and Comments/reactions OFF. You can disable optional categories or device notifications later. We process device routing tokens and delivery information for this purpose. Expo and Apple/APNs help deliver generic notifications, such as a new-message or new-update notice. The normal Push payload does not include the sender's name, Family name, message text, caption, photo or media URL. A notification may still reveal that you use Pifamy. Delivery, timing and freedom from duplicate notifications are not guaranteed.

P9 Reports, blocking and safety review

Use Report or contact security@pifamy.com for safety concerns. Blocking can limit communication and applicable shared content; it does not itself remove someone from a Family or erase earlier copies.

Authorized reviewers may examine the reported item and limited relevant evidence to investigate abuse, privacy concerns or policy violations. A report can include your explanation, target identifiers, a bounded text snapshot and references to reported media. We may remove content, restrict access or suspend an account when justified. The Owner Dashboard is not a moderation content browser. We do not continuously inspect all private communications or promise automated unlawful-content detection, round-the-clock review or a universal response time for every report. These limitations do not extend a deadline imposed by applicable law, including applicable intimate-image removal duties.

For immediate danger, contact emergency services. Do not email illegal material to us; describe the concern and identify it within Pifamy if possible. Applicable legal reporting or preservation duties are separate from ordinary report retention.

Scoped copy review. For an authorized safety case, systems may generate comparison signatures and candidate matches from permitted files. A candidate is not a legal finding. This is not a general license to search every Family or message, and a similarity match alone does not authorize account punishment or indefinite retention. Access to source material and decisions remains purpose-limited.

Nonmember submissions. You may use our Safety support page without a Pifamy account. A limited tracking credential can show the submission reference, status and received time; it does not expose the report body. The current tracking credential lasts seven days, with a short-lived single-use authorization for each lookup. Losing tracking access does not withdraw your complaint or restart any legal deadline. You can contact the relevant support address for help.

P10 Service providers and other disclosures

We use providers for hosting, databases, authentication, media processing, delivery and recovery. They process information needed for those functions:

Supabase and DigitalOcean: account, database, private-media and service-processing infrastructure.
Cloudflare: web delivery and security, email routing, Turnstile where used, and encrypted off-site recovery storage in R2.
Resend: transactional emails, including sign-in codes, storage notices and delivery information.
Google/Gmail: copies of messages sent to our safety and privacy email addresses are forwarded to an operator-controlled Gmail inbox. Those copies are separate from the encrypted Safety case system and are also subject to Google's applicable terms and practices.
Expo and Apple/APNs: app building, distribution and, where enabled, notification delivery, including relevant device identifiers and generic Push payloads. Build services receive app source and build artifacts; they are not used as a repository for your private Family uploads.
Apple In-App Purchase: payment processing and purchase/subscription verification. Apple handles payment information under its own terms and privacy practices; Pifamy receives the verification records described in P2.
Google AdMob and UMP: advertising delivery, privacy choices and related device/usage processing described in P6A. This is separate from the operator Gmail mailbox.
Healthchecks.io: limited operational health and alert information rather than Family content.

Third-party safeguards. We require third parties receiving personal information from Pifamy to protect it to a standard at least equivalent to this Policy and the privacy requirements applicable to our app. Providers processing on our behalf must use the information only for agreed service purposes, apply appropriate security and confidentiality controls, and support applicable deletion and privacy-rights requests. We are responsible for assessing these protections through the terms and safeguards applicable to each service and our own access and data-handling controls, and for restricting or stopping sharing where those protections are inadequate. This is an ongoing obligation, not a claim that every recipient has a separately signed agreement or acts only on our instructions.

We limit service access according to its purpose. Some providers also process information under their own policies, including Turnstile's bot-detection improvement and Apple's distribution services. Although our launch is United States only, this is not a promise that every provider or support operation processes information exclusively in the United States.

We may disclose information when required by valid legal process, or where legally permitted and reasonably necessary to address fraud, unlawful conduct or threats to safety or security. Disclosure of message contents is subject to applicable communications laws, not a general right to disclose any private conversation. We may also disclose information at your direction, such as to the recipients you select or the destination where you save an export.

P11 How long we retain information

We retain account information, content and messages while needed to provide the service, until the applicable deletion or account lifecycle, or for another necessary service or lawful purpose. There is no automatic age-based deletion of every published message or Family Moment.

Storage capacity after a plan ends or decreases. If a Family loses paid capacity and exceeds its available limit, new uploads pause. We notify the Family's current authorized managers and provide at least 15 days to renew, reduce storage or download material they are authorized to access. The deadline does not precede 15 days after the initial notice is recorded as delivered; delayed delivery extends it. The deadline shown in the storage controls is the applicable deadline, subject to later extensions or renewed entitlement. This storage period is different from any Apple billing grace period.

Authorized managers can choose eligible files to keep within the available capacity. A management role does not reveal restricted-audience files or other members' private libraries. Existing keep selections for restricted files remain protected. If no selection is made, the default removal order is newest uploads first. We select only enough eligible media to bring the Family within its limit; deleting whole files can leave some unused capacity. When no paid plan remains the limit is 1 GB; a downgrade to a smaller paid plan uses that plan's capacity. Content is not removed merely because renewal was canceled while paid access is still valid.

Removal may end the affected Family's access without deleting an independently authorized placement in another Family. Physical copies are eligible for cleanup only when no remaining authorized reference or applicable preservation requirement needs them. Renewal, changed permissions, lawful preservation and unavailable or uncertain verification can delay or stop removal. Restricted backups follow P12. Downloaded copies and independent recipient copies cannot be recalled.

Purchase and notice records. We retain transaction associations, entitlement evidence, notice delivery and deletion-integrity records as needed to administer subscriptions, prevent reassignment or duplicate benefits, handle disputes and refunds, and apply deletion correctly during recovery. They do not all expire when an individual subscription month ends. Retention remains purpose-limited and subject to applicable rights and preservation duties.

Some records have shorter schedules. Closed in-app support tickets normally remain for 90 days after closure. Ordinary moderation evidence expires after 14 days, report metadata and explanations after 30 days from creation, and moderation action records after 90 days. These schedules do not promise that referenced media survives deletion of its source or that an unresolved report is held indefinitely.

Optional raw analytics events have a 45-day window and Family aggregates a 180-day window. Essential daily activity has a 60-day window and deduplication receipts a 90-day window; other linked account or Family measurement records remain until the relevant lifecycle removes them. Historical aggregate statistics can remain longer after account linkage is removed.

Security/session records, some diagnostic records, open support requests and limited deletion or integrity records do not share one universal time limit. Retention depends on the service purpose, security, legal obligations, dispute handling and recovery needs, and should be no longer than reasonably necessary. Providers and your email or device backups may have separate retention. Scheduled cleanup can be delayed by an outage; restricted recovery copies follow the rules below.

Specialized Safety records. The ordinary moderation schedules above are distinct from the specialized Safety case system. Necessary submission bodies and attachments in that system are ordinarily retained for 90 days after final case closure; minimum decision and access records are kept for 24 months. A valid preservation duty, legal hold or open appeal can suspend relevant deletion. We limit preserved material to what the applicable purpose requires.

Temporary processing copies are removed after processing and required preservation checks. Unreviewed candidate matches are not deleted just because 96 hours have passed; they are flagged for review and periodic necessity assessment. After review, separation of necessary evidence and an explicit deletion approval, unneeded temporary signatures and results follow a 96-hour cleanup period. Confirmed-content recurrence signatures follow a separate 24-month schedule. A newly verified recurrence may restart that period; a mere candidate, scan or unverified complaint does not. Reversed findings and expired purposes must be considered when retaining or removing a signature. These are service retention choices, not a statement that the law requires the same period for all reports.

The Safety schedule does not by itself erase independently forwarded email copies. Our operator-mailbox policy calls for review of unnecessary, exactly matched copies after 90 days from verified final case closure. An open case, appeal, preservation duty, unresolved capture gap or unique material not preserved in the case system prevents cleanup. Mailbox cleanup is not currently automated; deletion in the case system does not establish deletion from Gmail or provider recovery copies.

P12 Deletion and recovery copies

Deletion has several stages. Removing a Moment or account can promptly stop new normal access and new media authorizations. Background work then removes or redacts active records and cleans original and derived files. A previously issued short-lived media link can remain usable for its remaining lifetime, normally up to 60 seconds. Previously downloaded material cannot be recalled.

Deleting your own Moment removes its Family placements and saved references. Deleting an Album alone does not delete the original Moments. Account deletion removes or redacts your authored material through the applicable lifecycle, while limited neutral identifiers, integrity records and other members' independently authored information can remain. This does not make all server records disappear immediately.

We use encrypted recovery backups with an ordinary rolling seven-day model. The last verified recovery copy or objects still needed by retained checkpoints may remain longer during outages or failed backup/pruning. Deletion and revocation records are reapplied before a restored service is reopened. Recovery copies are restricted and are not intended as an alternative source for ordinary access to deleted content. We cannot promise immediate physical destruction in every backup or control copies kept by recipients, their devices or independent email providers.

P13 Downloads, export and your privacy rights

Web Download Center. At pifamy.com/download, eligible existing account holders can sign in with their account email, complete the security and email-code checks, and view and download their own eligible photos and videos. Access is checked for the signed-in account; Family membership alone does not grant access to another person's private library. The website processes the file names, types, sizes, dates and previews needed to present your files. Downloads are normal media files, not the separately encrypted account-export package. Protect the computer, destination folder and any downloaded files; signing out cannot delete copies you saved. The Download Center is a convenience for your media, not a complete response to every personal-information access request. Use privacy@pifamy.com for a broader request.

Settings / Privacy → Export My Data → Request Export provides a convenient export of specified information, including your profile name, selected settings and acceptance receipt, and your own authored content and media that remain authorized for export. Preparation runs in the background; return to the export screen to see Preparing, Ready or a failure state. A recent sign-in verification is required for sensitive export actions. Download access expires 24 hours after the request, not 24 hours after preparation finishes. The encrypted package uses a separate package key and short-lived download authorization. Keep the downloaded package and key private.

The product export is not a complete copy of every category of personal information. For example, it does not provide a comprehensive account-email, session or IP history, Family membership or Album record, invitation list, reaction/vote record, or linked analytics and support history. It does not include another member's private archive merely because you share a Family. Losing content access may limit the product export; it does not automatically settle a broader legal access request.

For broader access, correction, deletion, portability or other privacy requests, email privacy@pifamy.com. You may contact us without creating or retaining an account, including about information another user supplied about you. We may need proportionate information to verify your identity and authority and protect other people's privacy. Do not send passwords or sign-in codes. Where applicable law permits an authorized agent, we may verify that agent's authority.

Depending on your state and the law that applies to Pifamy, you may have rights to access, correct, delete or obtain a portable copy of information, and to appeal a denied request. You can request a review by replying to our response or emailing privacy@pifamy.com with "Privacy appeal." We will handle applicable rights and response periods as required by law and will not unlawfully discriminate against you for exercising them. Exceptions may apply, for example to protect another person's rights or retain information required by law. If we cannot fulfill a request, we will explain as required by law. You may contact your state's privacy regulator or Attorney General.

We may also honor reasonable requests voluntarily when a particular state-law right does not apply. We do not require you to use the product export as your only way to request personal information.

Advertising opt-out requests. Where applicable law gives you a right to opt out of the sale or sharing of personal information or its use for targeted advertising, you can submit that request to privacy@pifamy.com. You do not need to create or retain an account. You can also use Ad privacy choices in Settings when the advertising system makes that control available. An unavailable in-app form does not prevent you from contacting us. We will review and apply applicable requests to the processing within our responsibility, including relevant provider controls. The non-personalized ad settings described in P6A do not replace applicable rights, and changing a setting does not itself erase information already collected.

Assisted Privacy responses. Separately from the product export, an authorized reviewer may prepare a case-specific response after identity and scope checks. For a verified active member, the current controlled flow selects that member's own eligible posts, sent messages and media; it does not give general access to Family storage or other people's received messages. Delivery requires authorization for the intended recipient and can be revoked or expire. Narrow product tools do not limit information that we must provide in response to a valid broader legal request; such requests are reviewed through the privacy contact. Do not forward download credentials or keys.

P14 Adults and information about children

Accounts are for people aged 18 and older; Pifamy is not a children's account service. Adults may share Family content that includes children and must have appropriate permission or authority to do so. Do not create an account for a child or share material that violates another person's rights. Adult eligibility does not remove our responsibilities concerning children's information.

If you believe a person under 18 has an account, or have a concern about a child's information, contact privacy@pifamy.com or security@pifamy.com. We will assess the concern and take appropriate steps, including restricting or deleting an ineligible account and handling the information as applicable law requires.

P15 Security and beta testing

We use safeguards such as encrypted transport, private storage, access and session controls, limited service permissions, monitoring and encrypted off-site recovery backups. No service can guarantee absolute security or uninterrupted availability. Protect your email account and device, and notify security@pifamy.com of suspected unauthorized access.

If you use Pifamy through Apple TestFlight, Apple separately collects beta installation, device, usage and crash information and can share it with us. Feedback you submit may include screenshots and comments. Apple's TestFlight collection is not controlled by Pifamy's optional analytics setting. See Apple's TestFlight privacy information. We use beta diagnostics and feedback to investigate and improve the app; avoid including unnecessary private content in feedback.

P16 Changes and contacting us

We will identify this policy by version and effective date. For material changes, we will give notice through the app or an account communication before the change takes effect where required, and request a new acknowledgement or consent when appropriate or legally required. Acknowledging this policy is not blanket consent to every optional use or a waiver of privacy rights.

Operator: MUSTAFA BAS. Privacy and data requests: privacy@pifamy.com. General support: support@pifamy.com. Security and safety: security@pifamy.com.