Privacy Policy for MyLivin

Effective Date: 19 June 2026 Last updated: 16 October 2026

This is an English translation of the Dutch privacy policy ("Privacybeleid"). The Dutch version is the primary, authoritative version. In case of any discrepancy, the Dutch text prevails.

MyLivin ("we," "us" or "our") provides the MyLivin app (also referred to as "Livin," the "App"). This Privacy Policy explains which personal data we process when you use the App, for what purpose, on what legal basis, how long we retain it, and what rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

MyLivin is a family and household app (calendar, tasks, budget, meals, kid mode, baby mode and co-parenting). Privacy is a design principle: we collect as little data as possible, host in the EU, use no tracking and no advertising, and never sell your data.

By using the App you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

1. Information We Process

Information You Provide Directly

• Account information: you sign in with Sign in with Apple or Sign in with Google. In doing so we receive your email address (with Apple, optionally a private relay address provided by Apple) and, if you allow it, your name. In addition, you choose a display name for use within your household. We do not store your Apple or Google sign-in password; signing in itself is handled by Apple or Google. This information is required to authenticate you and to make you recognizable within the household.
• Household and membership data: who belongs to a household, each person's role (for example parent, child, administrator) and the links between them.
• Content you create: content you enter in the App, such as calendar events, tasks, shopping and meal plans, budget entries, notes, documents and (in baby mode) information about a child.
• Child profiles: children's profiles are created and managed by a parent or guardian (see Section 7).
• Support requests: if you contact us for support, we process your email address and the content of your message.
• Recovery bundle (after setup): a bundle of keys for chat and protected family data, encrypted on your device and linked to the family and a revision identifier. By default, the combined recovery code used to open this bundle is not sent to MyLivin. We receive and store that code only after separate, explicit consent to storage with MyLivin. See section 2 for storage and recovery choices.
• Personal reminder (optional): a short note about where you keep your recovery code, linked to your account and family membership. This text is readable on the server so you can retrieve it after signing in even without your recovery code. MyLivin can technically read the text. Other family members cannot access it in the App and it is not included in invitations. Do not enter a password, recovery code or invitation code. You can edit or delete the note; deleting the membership, account or family removes the active note. Section 8 applies to historical backups. A reminder does not replace the recovery code.

Information Processed Automatically

• Technical account metadata: creation time, last activity and similar data needed to run the service.
• Subscription records (when you make a purchase): to link the correct plan to your family, we verify the product, transaction identifier, validity period and subscription status with Apple. We store these records with a random identifier linked to your household. We do not receive payment card details or send your family's content to Apple for this purpose.
• Linked calendars (if enabled): if you link your phone calendar or a calendar link (ICS), the App reads those events only on your device and shows them in your planning, with their source. They are not sent to our server and your family does not see them. Your device fetches a calendar link itself; the link is secret and is kept in your device's secure keychain. If you turn on write back (off by default), the App also puts events you create, change or delete in MyLivin into the chosen calendar on your device, with only the title and times (never the location or the checklist); only your device remembers which event belongs to which. From that calendar they may, depending on your own settings, reach your calendar provider (for example iCloud, Google or Outlook).
• Push token (if enabled): if you allow notifications in iOS, we register your device's Apple Push Notification service (APNs) device token, together with your notification preferences, your quiet hours (with your device's time zone), the language and the app version, as long as at least one family notification is on. They are on by default; you can turn each type off in Settings > Push notifications. We use it to send you a short alert when a family member does something that concerns you, such as a new poll, a changed appointment or a task completed by a child, even when the App is closed; for a shared appointment or a proposal from the other parent this can also come from a linked household. A push notification never contains content: only the type of event (for example "appointment changed") and technical identifiers; the App then fetches the content itself over a secure connection. If you turn off all family notifications or sign out, including via "Log out everywhere" on another device, we delete the token from our server. Family screens and child devices without their own account do not register a token; a child with their own account only receives alerts that concern them, such as a new poll, a task or a request.
• Feature usage and time in the App (can be turned off): to see which parts of the App are used, we record which feature was opened (for example "agenda", "tasks" or "health"), together with your account, your household and the time, and in addition how often and how long the App is open (number of times opened and whole minutes on screen, without per-screen timestamps). We never record the content of that feature: not what is in your calendar, not what you write in the chat, and not what you enter in the health or baby module. You can turn this off in Settings > Privacy > Help improve the app. We record nothing for members with the child role and for family screens (kiosk).

We use no third-party analytics, advertising or crash SDKs. The feature-usage recording described above is entirely our own and stays on our own servers in the EU; we share that data with no one. To run the service we do rely on a small number of service providers (hosting, domain management, forwarding and securing the traffic to our server, sign-in via Apple or Google); these are listed by name and purpose in section 4. There is no behavioral profiling, no tracking pixel and no advertising identifier.

Information We Do NOT Collect

• We do not collect advertising identifiers and we do not build advertising profiles.
• We do not track you across other apps or websites (no cross-app tracking).
• We do not sell or rent your data.
• We do not use external analytics or crash-reporting services.

2. Encryption and What the Administrator Can and Cannot See

Privacy and security are built into the App's design. Important points:

• Family chat is encrypted on your device. Random chat keys protect new messages. The combined recovery bundle contains these keys and the earlier keys needed for recovery, encrypted with a key derived from the recovery code on your device. Moving existing chat history to this system requires existing local keys or the old chat recovery password; that history is not silently reset.

Baby log without family encryption. New baby entries in the current Apple app are saved without a family recovery key. This includes feeding amounts, nappy details, growth measurements, milestones, milk stash details and notes. MyLivin can technically read this content on the server, along with the linked child, entry type and start and end times. The connection is secured, and sign-in and family permissions still determine access in the App. Older encrypted entries may still require the correct family recovery key until they have been safely converted; after conversion, those entries are also readable on the server. The fever and symptom log within Health continues to use content encryption as described in section 9.

One recovery code for family and chat. A parent or manager can create one random recovery code on a device that holds the correct keys. The code is generated on the device. By default, the server stores only the recovery bundle encrypted with it, plus information needed to link the correct bundle and revision to the family. Without a recovery copy stored with MyLivin, MyLivin does not receive the code and cannot open this bundle. Keep the code safe: if the code, every accessible device and all saved copies are lost, this bundle no longer provides a way to recover the content.

Keep it yourself or with your chosen provider. The code is kept locally on your device. You can also keep it somewhere safe yourself. Only if you explicitly choose this, the App writes an extra copy to iCloud Keychain for syncing through your own Apple Account. This does not send the code to MyLivin; syncing depends on your iCloud settings and Apple's security. The app copy does not automatically appear as a separate entry in Apple Passwords. You can also manually copy the code and save it as a separate entry in Apple Passwords, Google Password Manager or another password manager. Copying the code or opening a provider does not mean it has already been saved there. That storage and any syncing use your own account and settings and are governed by the provider's privacy policy. Signing in to MyLivin with Apple or Google does not automatically enable this storage.

Optional storage with MyLivin. This separate choice is off by default and applies to the whole family. Only a direct owner or parent can enable it after explicit consent. The App then sends the same combined recovery code to MyLivin. We store the code encrypted with a key that is also held on our server. This does not protect it from MyLivin itself: MyLivin and anyone with full access to our database or a complete backup can use it to open the recovery bundle and decrypt the associated family content and available chat history. The server copy allows direct owners, parents and children in the family to restore after signing in; guests, caregivers, family displays and members linked only through co-parenting have no access. If you renew the code in the current App while this option is enabled, the active server copy is also renewed under the consent already given. Turning it off removes only the active server copy. It does not undo earlier access, existing device copies or historical backups. Backups may retain the code and associated key material for up to six months (see section 8).

Access checks still apply. The server provides the encrypted bundle only to a signed-in account with direct owner, parent or child membership in this family. Only an owner or parent can set up or renew the bundle. Guests, caregivers and family displays do not receive it. A co-parenting link does not provide access to the other household's bundle or family key. Having a code does not replace the membership check. However, a key already obtained or content already saved cannot be remotely taken back. You can remove the extra iCloud app copy; existing devices keep their local access. Delete an entry you added to a password manager separately in that manager.

Older recovery methods and copies. An existing 16-character family code or a chosen chat recovery password may be needed once during the transition. Any previously enabled server copy of only the old family code is separate from the combined recovery code. Such an active old server copy must be explicitly disabled before switching; this does not automatically enable storage of the combined code with MyLivin. Historical server backups may retain the old copy and its key material for up to six months (see section 8); the associated protected data and older chat messages could still technically be decrypted using it. Switching does not undo earlier access.

3. Purposes and Legal Bases for Processing

We process your data only for clear purposes and always on a valid legal basis under the GDPR:

Where we rely on consent, you can withdraw it at any time (see Section 11). Withdrawing consent does not affect processing that took place before the withdrawal.

We do not use your data to make automated decisions that have a significant effect on you, and we do not carry out profiling.

4. Hosting and Transfers Outside the EEA

The App runs on a self-hosted Supabase backend (PostgreSQL) on a server within the European Union. Your family data is stored and processed in the EU. We do not use cloud analytics or advertising services.

To operate the service we rely on the following service providers. There are no others.

Cloudflare as an intermediary. The App does not connect directly to our server, but to Cloudflare. Cloudflare decrypts the secure connection (TLS), fends off attacks and abuse, and forwards the traffic to our server over a new secure connection. In doing so, Cloudflare processes your IP address and sees what our server also receives, insofar as it has not already been encrypted on your device: for example your name and email address, the titles of events and tasks, and the other data that section 2 describes as readable by the administrator. Cloudflare processes this data solely on our behalf, to forward the traffic and to secure the service. Traffic passes through a Cloudflare location near you; for users in Europe this is normally a location in Europe, but this is not guaranteed. The transfer arrangements below therefore also apply to Cloudflare.

Transfers outside the EEA. Google and Cloudflare are US companies. Insofar as they process data outside the EEA, this takes place under the EU-US Data Privacy Framework, under which both are certified, and under the Standard Contractual Clauses (SCCs) included in the terms we have entered into with them. Other storage and processing by MyLivin takes place in the EU. For recovery code storage you choose with Apple or a password manager, that provider’s locations and safeguards apply.

Encrypted content and recovery. Protected content and the recovery bundle leave the device as ciphertext. Unless you separately choose storage with MyLivin, the combined recovery code is not sent to MyLivin or Cloudflare. When saving or restoring through MyLivin, the code does travel over the secured connection to or from our server. Cloudflare terminates that connection as an intermediary and can technically process the code while forwarding it. The consequences and retention period in sections 2 and 8 apply to server copies. Cloudflare can also process data not encrypted on the device while forwarding it. Signing in with Apple or Google does not itself give those providers access to family content or the recovery code. If you separately choose iCloud Keychain or a password manager, your code is stored with that provider according to your settings.

Apple's and Google's processing is governed by their own privacy policies. To the extent Apple processes data outside the EEA in that context, this takes place under the safeguards Apple applies.

5. Sharing of Data

We do not sell, rent or trade your personal data. We share data only in these limited cases:

• Within your household: content you create in a shared household is visible to the other members of that household, in line with the roles and the encryption described in Section 2.
• Co-parenting (opt-in only): if you and the other parent both explicitly choose to, selected data about a shared child can be shared between two households, and you can record exceptions to the custody schedule and handovers together. What the other household then sees of yours is set out in Section 6.
• Processors/service providers: only the parties listed by name and purpose in Section 4. We have a data processing agreement with each of them and they may use the data solely for the task described there.
• Legal obligations: where we are legally required to, for example under a valid order from a competent authority.
• Safety: to protect the safety, rights or property of MyLivin, our users or the public.
• Business transfer: in the event of a merger, acquisition or sale of assets, data may be transferred. We will inform you in advance of any such change and its consequences.

6. Co-Parenting

MyLivin offers a co-parenting feature that lets separated parents share data about a shared child between two separate households and agree together on exceptions to the custody schedule. It is built with privacy as a starting point:

• Fully opt-in. Co-parenting is off by default. Sharing only happens if you enable it yourself.
• Mutual consent. Sharing only starts after an invitation and acceptance by both parents.
• Granular per module. You choose which modules are shared (for example calendar, tasks, childcare/care days, costs). Sensitive modules such as budget, documents, health data and the end-to-end encrypted family chat are not shared across the household boundary.
• Child-scoped; shared data is read-only. Across the household boundary, only items linked to the shared child are shown, not the entire calendar or task list of the other household. Shared events, tasks, care days and costs remain read-only for the other household.
• Per-item control. An event or task only crosses the boundary if it is explicitly shared; there is also a per-item private marker. For a shared event the other parent sees the title, the times and the travel time, not the location or the checklist.
• Agreeing together on the custody schedule. If the child is shared with the calendar module, the owners and parents of both households can propose an exception to the custody schedule to each other: a swap, an extra day, a different handover time, a holiday split or undoing an earlier agreement. An agreement only applies once the other household agrees, and undoing it is also done together; without an answer a proposal expires after 72 hours (a holiday after 14 days). For each handover both households can record the handover with a packing list, and confirm that the child was dropped off and picked up (with the time of our server). These are the only write actions across the household boundary. Our server fetches the school holidays for the holiday planner once a month from the Dutch government's open data; your device gets them from us and does not contact a third party for this itself.
• These fields are not encrypted on your device. Because the other household needs to read them, these fields are protected by an encrypted connection and access rules, but not encrypted on your device; the administrator can technically access them: the note on a proposal (at most 500 characters), the reply note on "not now" (at most 200 characters), the handover place on a proposal and on a handover (at most 120 characters), the default handover place and default handover time on the custody schedule, the handover note (at most 500 characters) and the packing list (at most 30 items). In addition, the agreement itself: the type, the days, the handover time, which household the child is with, the status, and when and by whom it was proposed, answered, dropped off or picked up. Only enter practical facts in these fields, no sensitive data.
• Who sees what. While sharing is active, the owners and parents of both households see the proposals with their note, reply note, places, handover note and packing list. Children, the family screen and a babysitter never see the negotiation, the note, the reply note or a place: only the outcome (when the child is with which household and the handover time) and the packing list of a handover. Push notifications about this contain no content and only go to the owners and parents of the other household.
• Agreement log. Every step (proposed, agreed, declined, withdrawn, expired, undone, sharing stopped) is recorded in a log that cannot be changed afterwards. The log only contains the agreement itself (type, periods, households, status and times), no note, reply note or place.
• When sharing stops. If sharing of a child stops, the other household can no longer see the notes, reply notes, places, handovers and log. Open proposals and future agreements for that child end, reply notes are erased and future handovers that have not been confirmed are deleted. Your own proposals remain in your own history.
• Revocable at any time. You can stop sharing at any time.
• Sharing register as a log. The sharing register acts as a processing and consent log: it records which modules were shared with whom and when this was changed or revoked.

The co-parenting feature is a tool for mutual coordination. See Section 10 and the Terms of Service: records in the App do not replace any legal document, parenting plan or court order.

7. Children and Minors

MyLivin is used by families with children. The App includes a kid mode and a baby mode and is intended to be managed by parents and guardians.

• GDPR context. Under the GDPR, children's data is processed on the basis of consent and/or the exercise of parental responsibility by the parent(s) or guardian(s). Child profiles are created and managed by a parent or guardian.
• Managed by a parent. A child uses the App under the responsibility of a parent or guardian. The parent manages the child's profile and data and can view, correct or delete it.
• Data minimization. We do not collect more data about a child than is needed for the feature you use.
• No advertising, no tracking. No behavioral advertising is shown to children and there is no tracking.

For users in the United States (COPPA): the App is primarily aimed at the EU. To the extent the US Children's Online Privacy Protection Act (COPPA) applies, data from children under 13 is processed only under verifiable parental consent and only for the operation of the App. A parent can review the child's data, request its deletion and refuse further collection via support@my-livin.com.

If you believe a child has provided us with data without the appropriate consent, contact support@my-livin.com so we can review it and delete it where necessary.

8. Retention Periods

We do not keep personal data longer than necessary for the purposes for which it was collected:

• Account and household data: as long as your account is active. After a request to delete your account, a 30-day grace period applies, after which the data is deleted (see Section 11).
• Backups: we make an encrypted backup of the database twice a day (encrypted on our server; the key never leaves the server), stored with Cloudflare R2 in the EU. Backups are kept for at most six months. Deleted data may remain in a backup until then; backups are used only to restore the service after a failure, never to retrieve deleted data.
• Content you create: as long as your account is active. You can change or delete content in the App at any time.
• Co-parenting agreements: proposals, the agreement log and handovers as long as both households exist; if a household is deleted, they are deleted with it. If sharing stops, Section 6 applies.
• Push notifications: the notification queue (only type, family and identifiers) for a maximum of 7 days; a push token that Apple reports as invalid for a maximum of 30 days, after which it is deleted; a token you turn off or sign out with is deleted immediately.
• Feature usage: a maximum of 12 months, after which we delete the individual records. What remains are aggregated totals from which no individual can be identified.
• Security logs: web server access data and failed login attempts are kept for 90 days. That period is needed to recognise a slow attack spread over months. Legal basis: legitimate interest (securing the service).
• Support correspondence: for as long as needed to handle your request and any follow-up questions.
• Data we are legally required to keep: for the statutory retention period.

Encrypted content for which we hold neither a key nor a usable recovery copy cannot be viewed or recovered by us separately; when the account is deleted, the associated storage is removed.

9. Security

We take appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) for all network communications.
• On-device encryption of family chat and the new recovery bundle; section 2 explains the consequences of optional recovery code storage with MyLivin and of any old server copies.
• Client-side encryption of certain module content (locations, checklists, budget titles and amounts, document titles and notes, and temperature, symptoms, notes and recorded medication/doses within the fever and symptom log) before storage. The baby log is excluded, as explained in section 2.
• Row-level access control in the database, so members only see the data they are entitled to.
• EU hosting on our own self-managed server in Germany, without external analytics or advertising SDKs.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we take reasonable measures to protect your data. You are responsible for carefully safeguarding your family code and access to your Apple or Google account, and for making backups of important data.

10. No Advice, Your Own Responsibility

The App provides no medical, legal, financial or parenting advice. Features such as baby mode (fever, symptoms, medication), the budget and the co-parenting records are tools for your own administration and coordination. They do not replace professional advice, and the records do not replace any legal document, parenting plan or court decision. You are responsible for the accuracy of the data you enter and for making backups.

11. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Access: request a copy of the personal data we process about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure ("right to be forgotten"): have your data deleted.
• Restriction: have the processing of your data restricted.
• Data portability: receive a portable copy of your data. This request goes through support@my-livin.com; we compile the copy for your household.
• Objection: object to processing based on a legitimate interest.
• Withdraw consent: withdraw previously given consent at any time.

Delete your account in the App. You can delete your account directly in the App. After the request, a 30-day grace period applies, after which your data is permanently deleted.

To exercise any of these rights, contact support@my-livin.com. We will respond, in principle, within 30 days.

Complaint to the supervisory authority. If you disagree with how we handle your data, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, https://www.autoriteitpersoonsgegevens.nl) or with the supervisory authority in your EU member state.

12. For California Residents (CCPA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). The GDPR is the leading framework for MyLivin; in addition:

• Right to know: you can request which categories and which specific pieces of personal data we have collected about you.
• Right to delete: you can request deletion of your personal data.
• No sale: we do not sell your personal data. Should this ever change, we will provide a "Do Not Sell or Share My Personal Information" option.
• Non-discrimination: we will not treat you differently for exercising your rights.

To exercise these rights, contact support@my-livin.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For significant changes we will:

• update the "Last Updated" date at the top of this document;
• notify you through the App or by email (for material changes);
• publish the updated version at https://my-livin.com/privacy.

By continuing to use the App after a change has been published, you accept the updated Privacy Policy.

14. Contact

If you have questions or concerns about this Privacy Policy or our practices, contact us:

• Email: support@my-livin.com
• Website: https://my-livin.com