Privacy policy · Northstar Family

Version 1, effective 14 November 2026.

About this policy

Northstar Family is an app that lets the members of a family share their location with each other and make a lost device ring. This policy explains which personal data we process for that, why, where, for how long, who can see it and what your rights are (Art. 13 and 14 GDPR).

It covers the Northstar Family server, the app and the website northstarfamily.app. By “our server” we mean the Google Firebase services we use for Northstar Family.

This policy describes only what works this way today. The server is already running. The app is not yet available on Google Play. What the app still has to learn, we add to this policy before it is used, in a new version (see Changes).

A few words we use below:

A family is the people who share their location with each other. Members of one family never see another family.
A member is a person in the family. A member is a parent or a child. These are roles in the app: they say nothing about anyone’s age. A parent has full rights in the family.
A device is a phone or tablet of one person. A member can have several devices, and a device can be in two families.
A location is one position of a device at a moment in time. A device’s history is its newest 720 locations.

Who is responsible

The controller (Art. 4(7) GDPR) is:

Nathalie Eeckhout, trading as Belle Perlette
Volkershouw 19a, 9230 Wetteren, Belgium
Enterprise number 0765.341.678
VAT BE 0765.341.678
Email: privacy@northstarfamily.app

We have not appointed a data protection officer. You can send any question about your data to privacy@northstarfamily.app.

In short

Our server accepts locations only in the form of an encrypted package. It has no place for readable coordinates or for the keys to read them.
Children never give an email address. For parents, we keep the email address of their Google account. We never use it for marketing.
No ads. We don’t sell data and don’t give it to advertisers.
Almost everything is stored in Belgium, in Google’s europe-west1 region. Two Google services also work outside the EU: sign-in (Firebase Authentication, in the United States) and the delivery of messages to devices (Firebase Cloud Messaging, worldwide). The website runs on a server in London, in the United Kingdom.
The website sets no cookies and uses no analytics or third-party scripts.
You can have your data deleted, also without the app: see Delete account.

What data we process

Family and members

the family’s name, and when it was created;
for each member: their name, emoji, role (parent or child), whether they are still in the family, and when they joined or left;
for each parent: the email address of the Google account the parent signs in with, and a hash of that account’s Google ID (a code derived from that ID; we don’t keep the ID itself). Also when, and from which device, the Google account was linked. We don’t keep whether Google has confirmed the email address, nor your name or photo at Google.

Children never give an email address and never sign in with Google.

Devices

the name (for example “Emma’s Pixel”) and the model (for example “Pixel 8”);
the app version;
the permissions on the device: notifications on or off, location (none, approximate or precise), location in the background, and full-screen notifications;
the pause state: whether sharing with this family is paused, since when and until when;
when the device joined, when it was removed, and when it last updated these details;
technical identifiers: a random ID per device at Firebase Authentication, an ID derived from the device’s key, the device’s public keys, and an FCM token: the address at which Google delivers messages to the device.

Locate now and Ring

With Locate now you ask a device for a fresh, precise location right away. With Ring you make a device ring loudly so you can find it. For each command our server keeps: which member and which device gave it, to which device, which command (Locate now, Ring or Stop ringing), when, whether the message could be delivered, and the result the device reports back (for example “ringing” or “notifications are off”). A command never contains a location.

Join codes

A join code links a new device to the family. While the code is valid, our server keeps which member it is for, with which role, that member’s name, which parent’s device made it, when, and which device used it. Our server has no place for the secret code itself: it works only with a value derived from it, which lets it recognise the code.

Subscription

For each family we keep the state of the subscription, how many devices it covers, until when it runs, which member pays, which Google Play product it is, and the purchase token: a code our server uses to ask Google Play for the current state. Google Play handles the payment. We receive no payment details, no billing address and no email address of whoever pays. Our server links a purchase only to the family whose ID the purchase carries in Google Play.

Security and operation

counters against abuse: how often a device, a family, a Google account or an IP address called a function of our server. They are stored under a hash, without the ID or IP address itself;
the logs of our server functions: family, member and device IDs, reasons for a refusal or an error, and timings. Never names, email addresses, tokens or locations;
the request logs of Google’s platform: the IP address and user agent (details about the app or browser) of whoever called a function, which function, the result and the duration;
Firebase Authentication processes the IP address and user agent of each device sign-in and each refresh of it;
Google’s audit logs: who changed our project’s settings. They name only our project’s administrators.

What our server has no place for

Readable locations, private keys, the keys locations are encrypted with, and the secret join codes: our server has no place for them, and our server functions refuse any request with a field that looks like a position, a key or a secret code. Nor do we receive payment details, or anything on your device the app doesn’t need: contacts, photos, messages, files.

Locations

Our server accepts a location only in the form of an encrypted package, with a separately wrapped key for each device allowed to read it. There is no place for readable coordinates: our server refuses a location that doesn’t come in that form. Nor does our server have any place for the keys to read locations.

What our server can read:

when a location was taken and when it arrived;
which devices it is encrypted for.

From those times, someone with access to our server could tell when a device sent locations.

Our server decides who may fetch a location:

a device’s current location: every device of the family;
a device’s history: the parents’ devices, and all devices of the member it belongs to. So a child can fetch only the history of their own devices.

The history is a device’s newest 720 locations in a family, however old they are. Older locations are deleted.

When a device’s sharing with a family is paused, our server refuses a Locate now from other members of that family, without sending the device anything. Only the same member’s other devices can then locate it. Ring keeps working for everyone in the family.

Why, and on what legal basis

Purpose	Data	Legal basis
Providing the service: the family, its members and their devices, sharing locations, Locate now and Ring, join codes, and the notice to parents when sharing stops	Family and members, devices, encrypted location packages, commands, join codes, FCM token, device IDs and keys	Necessary for the contract: the service your family takes and that you use on your device (Art. 6(1)(b) GDPR)
Recognising a parent by their Google account, so they can take their place again on a new phone and can delete the family or devices	Parents’ email addresses and Google ID hashes	Necessary for the contract (Art. 6(1)(b) GDPR)
Checking the subscription with Google Play	Subscription details, purchase token	Necessary for the contract (Art. 6(1)(b) GDPR)
Securing our server and your family, and preventing abuse	Counters against abuse, logs, request logs with IP addresses	Legitimate interest: a safe, available service for every family (Art. 6(1)(f) GDPR)
Showing and securing the website	The web server’s logs	Legitimate interest (Art. 6(1)(f) GDPR)
Handling deletion requests and other privacy requests	What you enter in the form or your email, and our replies	Legal obligation (Art. 6(1)(c), with Art. 12 and 15 to 22 GDPR)

We don’t use your data for any other purpose. We build no profiles, and no decision about you is made solely by automated means within the meaning of Art. 22 GDPR.

Who sees the data

The members of your family see the family’s name, the members’ names, emojis and roles, each device’s name, model, permissions and pause state, and the locations as described under Locations. Other members don’t see a parent’s email address. Someone with a valid join code sees, before joining, the family’s name, the member’s name and the role.

We, as the administrator of our server, can see: the family’s name, the members’ names, emojis and roles, the devices’ names and models, the times of all locations, the pause state, the permissions and the app version, who wanted to locate or ring which device and when (for 7 days), the subscription details with the purchase token, parents’ email addresses and Google ID hashes, and technical IDs and IP addresses in the logs. Of positions, we see only the encrypted package: our server has no place for the keys to read it. We look at these details only when that is needed to keep the service working, to handle a question or request of yours, or to fix a fault or abuse.

Processors that process data on our behalf, under a data processing agreement (Art. 28 GDPR):

Google (Firestore, Cloud Functions, Pub/Sub, Cloud Scheduler, Cloud Logging, Firebase Authentication, Firebase Cloud Messaging), under Google’s Cloud Data Processing Addendum and the Firebase Data Processing and Security Terms;
OVHcloud (OVH B.V., the Netherlands), which hosts the website’s server, in a data centre in London (United Kingdom), and our mailbox privacy@northstarfamily.app, in France. The server holds the web server’s logs. The mailbox holds the deletion form’s emails, other emails to that address, and our replies.

Independent controllers:

Google Play, for the payment of the subscription. Google Play keeps the payer’s Google account, payment method and billing address; we don’t receive them.
Google, as the provider of the Google account a parent signs in with.

Otherwise we pass data on only when the law requires us to.

Where the data is

In Belgium (Google, region europe-west1): the database (Firestore), our server functions (Cloud Functions), Google Play’s messages about subscriptions (Pub/Sub), the scheduled tasks, and our logs.
In the United States: Firebase Authentication runs only from US data centres. It holds each device’s random ID and the times of sign-in and refresh, and processes the IP addresses and user agents of those sign-ins. Names and email addresses are not there: we keep those in the database in Belgium.
Worldwide: Firebase Cloud Messaging delivers messages to devices from any Google location. It processes each device’s FCM token and the messages themselves. They contain only IDs, except the notice to parents that sharing has stopped: that one contains the family’s name.
Worldwide: Google’s audit logs of changes to our project’s settings. They name only our project’s administrators.
In France (OVHcloud): our mailbox privacy@northstarfamily.app, with the deletion form’s emails, other emails to that address, and our replies.
In the United Kingdom (OVHcloud, data centre in London): the website’s server, with the web server’s logs. What you enter in the deletion form passes through that server to our mailbox in France. The server keeps none of it.

For the United Kingdom, the European Commission has decided that the country protects personal data adequately (Decision (EU) 2021/1772, extended until 27 December 2031 by Decision (EU) 2025/2574; Art. 45 GDPR). We rely on that for the website’s server.

For what Google processes outside the European Economic Area, Google relies on the EU-U.S. Data Privacy Framework (European Commission Decision (EU) 2023/1795, Art. 45 GDPR), which Google states it complies with, and otherwise on the European Commission’s standard contractual clauses (Decision (EU) 2021/914, Art. 46(2)(c) GDPR). For the payment, Google Play relies on the same standard contractual clauses. You can ask us for a copy of these safeguards.

How long we keep data

What	How long
A family that a parent deletes	Deleted at once, with everything that belongs to it.
A family whose subscription ended	Deleted 30 days after the subscription ended.
A family that never had a successful purchase	Deleted 7 days after it was created, with the device and the Google details of the parent who started it.
A family whose payment failed, or whose payer paused the subscription in Google Play	Nothing is deleted while Google Play keeps the subscription in that state. Sharing, Locate now and Ring are off meanwhile.
A device’s history	The newest 720 locations per device per family, however old. Older ones are deleted. A phone that joined again after losing its keys, and a parent’s new phone that replaces a lost device, share one history of 720 with the old device. The old device’s current location is then deleted at once.
A device’s current location	Overwritten by every new location.
Locations during a pause, for the member’s own devices only	Deleted after the pause ends, at the latest about 2 hours later.
A device that is removed	Its current location, history and pause locations deleted at once. Its name, model, permissions and app version cleared at once. Its IDs, dates and public keys stay for as long as the family exists: the other devices need them to check signatures.
A member who leaves or is removed	Name and emoji cleared at once. A parent’s email address and Google ID hash deleted at once, as are join codes still open for that member. A place without a name (IDs, role, dates) and the key records stay for as long as the family exists.
A parent who becomes a child	Email address and Google ID hash deleted at once.
A member for whom a join code was made that was never used	Deleted 24 hours after it was created.
A join code	Usable for 15 minutes. After that the database deletes it, usually within a day.
Locate now, Ring and Stop ringing commands	7 days. After that the database deletes them, usually within a day.
A device’s random ID at Firebase Authentication and its FCM token	Deleted when another device removes it from its last family, or with that family. Otherwise 180 days after it was last used, once the device is in no family any more.
The link between a purchase and a family	With the family.
The Google Play purchase token	Until a new one replaces it, and at the latest with the family: the subscription’s lifetime plus 30 days.
Counters against abuse	Until the end of their time window, at most 30 days, plus up to a day before the database deletes them.
Logs of our server functions	30 days, in Belgium.
Request logs with IP addresses	7 days, in Belgium.
IP addresses and user agents at Firebase Authentication	A few weeks, by Google, in the US. We don’t control this.
Google’s audit logs of changes to our project	400 days, by Google. They name only our project’s administrators.
The web server’s logs (access logs and Windows’ error log)	7 days, plus at most 2 hours, on the website’s server in the United Kingdom.
Emails with a request, through the deletion form or straight to privacy@northstarfamily.app, and our replies	30 days after the request is closed.
Backups	We make no backups or exports of the database and cannot go back to an earlier point in time: what is deleted is gone. Nor do we make backups of the website’s server. Google deletes deleted data from its own backups within 180 days.

Deleting your data

How to have a device, yourself or a whole family deleted is on the Delete account page. What happens then:

Removing a device: that device’s locations and history are deleted from the family at once. If it is your last device in that family, you also leave the family.
A member who leaves or is removed: their name disappears at once, and for a parent also the email address and Google details. The last parent can’t leave the family this way: they first make someone else a parent, or delete the whole family.
Deleting a family can only be done by a parent. Everything of the family is deleted at once.
What is already on other members’ devices, we cannot delete from those devices.
The subscription keeps running until whoever pays for it cancels it in Google Play, also when the family has been deleted: play.google.com/store/account/subscriptions.

What stays for a while after a deletion (logs, Google’s backups) is in the table above.

Children

In Northstar Family, “child” is a role, not an age. What is different for a member with the child role:

A child never gives an email address and never signs in with Google.
A child can fetch only the history of their own devices. The parents’ devices can fetch the history of every device in the family.
When a parent becomes a child, we delete that member’s email address and Google details at once.

Are you under 18 and do you have a question about your data? Email us at privacy@northstarfamily.app, on your own or together with someone you trust. You have the same rights as everyone else.

Your rights

You have the right to:

ask which data we hold about you and get a copy (Art. 15 GDPR);
have incorrect data corrected (Art. 16 GDPR);
have your data erased (Art. 17 GDPR);
have the processing restricted (Art. 18 GDPR);
receive the data you gave us in a common format (Art. 20 GDPR);
object to processing based on our legitimate interest (Art. 21 GDPR).

Email privacy@northstarfamily.app for this, or use the Delete account page for deletion. We reply within one month. If a request is complex, it can take two months longer; we then tell you so within the first month (Art. 12(3) GDPR).

Northstar Family has no accounts with a password. So we check who is making a request by details only you and your family know, and by a reply from the same email address (Art. 12(6) GDPR). We never act on a name alone. Our replies contain no data about your family beyond what happened with your request.

If you disagree with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be (Art. 77 GDPR). Feel free to tell us first: then we look for a solution together.

The website

The website northstarfamily.app sets no cookies and uses no analytics, ads or third-party scripts.

The web server’s logs. The web server, at OVHcloud in London (United Kingdom), records for each visit your IP address, your browser, the page requested (without anything after a question mark), the time, and technical details of the request and the response, such as the status and how long it took. It doesn’t record which page you came from. If Windows refuses a request before it reaches the website, for example because it is invalid, it records your IP address, the address requested, the time and the reason in a separate error log. We keep both for 7 days, to secure the website and fix faults. Because we clear them every hour, a line can stay at most 2 hours longer.
The deletion form. What you enter goes through the web server as one email to our mailbox at OVHcloud, in France. The website keeps none of it. We delete the email and our replies 30 days after your request is closed. The form’s fields are listed on the Delete account page.
The join link page. If a join link doesn’t open in the app, the website shows a page with an explanation. The part of the link after # is the join code: the page sends it nowhere, not even to our web server.

Security

All traffic between the app, the website and our server is encrypted (TLS).
Each family is shielded from the others: our server lets a device read data only from the families it is in.
Each device has its own sign-in at our server and can be removed on its own. A removed device can’t read anything afterwards.
Our server functions never write names, email addresses, tokens or locations to their logs.
If something goes wrong with personal data all the same, we report it to the Data Protection Authority and, if it poses a high risk to you, to you as well (Art. 33 and 34 GDPR).

Changes

We update this policy when the app, the server or the website changes, and before anything new is used. Each version gets a number and the date it takes effect, at the top of this page. You can ask us for an earlier version.

Contact

Nathalie Eeckhout, trading as Belle Perlette, Volkershouw 19a, 9230 Wetteren, Belgium
Email: privacy@northstarfamily.app

Northstar Family privacy policy