Records, retention and legal requests

FamCheck is operated by Oak Forest Robotics LLC. This page describes what we hold and how to ask us for it. Last updated 19 September 2026.

What we hold

• The family's calendar: parenting-time entries, events and appointments.
• Recorded changes of plan, each with the name of the parent who recorded it and a timestamp.
• The children's care instructions, if the family chose to add them.
• Any documents the family uploaded. If an upload never made it onto the calendar, because the tab was closed before it saved, a nightly sweep deletes it once it is two days old.
• Observer access records: who was given read-only access, by which parent, against which case reference, when, every time they opened it, and who removed it.
• Account records: a peppered hash of the sign-in email address, not the address itself, and device session labels.
• If the family arrived from a search ad, or from any other tagged link, what that address carried, held on the family record and deleted with it: the click id Google or Microsoft put there, where the link said it came from, the campaign tag, the keyword we bid on (the word we paid for, never what you typed), how it was matched, and the time of the click. No advertising script runs on any page.
• If the family subscribed, two ids from Stripe, the company that takes the payment: one for the customer and one for the subscription, with whether the family is paid up and the date the period ends. The card is typed on Stripe's own page and the number never reaches us.

What we do not hold

• No third-party analytics and no advertising or tracking script on any page. The only advertising identifier we hold that points at a visitor is the search-ad click id named above, and only for a family that arrived by clicking one. The other fields beside it, where the link said it came from, the campaign tag, the keyword, the match type and the time of the click, describe the ad and the moment it was clicked, not the person who clicked it.
• No location data. The application is barred from requesting location at the browser permission level.
• No message content, because there is no messaging feature.
• A notice carries no detail. Told that somebody was given access, that today's plans changed, or that a handover was confirmed, a phone shows only that it happened and to open the app. Some notices do say more, on purpose, and these are all of them: a changeover nudge names the parent taking over and the time; a reminder for something on the day names that entry and its time, because a reminder that will not say what it is for is not a reminder; and the notice sent the day before a free week ends names the date and the amount, so nobody is charged by surprise. Nothing from the children's care notes is ever sent in a notification.

How long

For as long as the family keeps the account. Either parent can export everything at any time, and deletion is available to them without payment. When a family deletes its record, we delete it and keep no copy, including uploaded files, observer access records, and any billing relationship, which is cancelled in the same act.

One thing outlives that deletion, on purpose. On the way out we ask three questions, and a family that chooses to answer them leaves those answers behind. They are the only way we learn whether this helped anybody. Each answer is stored on its own with nothing that points back to the family: no account, no case reference, nothing derived from the family's record, dated to the day rather than the minute and marked only with roughly how long the family had been here. That cuts both ways and we would rather say so: because we cannot tell whose answers they are, we cannot find them and take them out later if you ask us to.

One other row outlives a deletion, for a shorter time. If the family arrived from a search ad, the conversion rows behind the file we hand to Google or Microsoft are not removed with the family, because nothing in them points back to it. Each row holds the click id, the name of one step such as "First payment", the date, the amount, and the keyword we bid on with how it was matched. The file itself carries only the first four. They expire by themselves within 120 days.

Operational counts (how many people opened a page on a given day) are whole numbers only and are not associated with any person or family. The same is true of referrer domains, campaign tags in the address (utm, including which search keyword we paid for, the word we bid on, never what you typed), card-page outcomes, countries and device types: whole numbers per day, never a person. Those same campaign tags also sit beside a click id on the record of a family that arrived from an ad, as the section above says. Questions typed into the Ask box on the front page are kept for 90 days with nothing that identifies who asked; a question we could not answer is kept for 180 days so the missing answer can be written.

Legal requests

Written requests, subpoenas and court orders: records@famcheck.co.

• Identify the family by the account email address or the observer case reference. We cannot search by a child's name.
• We will notify the account holders that a request has been received, unless we are prohibited from doing so by law or by court order.
• We produce what we hold. We will not reconstruct, interpret or characterise it.
• We are a small company. Requests are handled by a person, and we will tell you honestly how long it will take.

What this record is, and is not

It is a calendar two parents keep themselves. Entries are made by the parents. Nothing in it has been verified by us, and nothing in it is a finding of fact. FamCheck is not a court-approved product and no court has ordered its use.