Deleting your account and data

How to delete your account

What happens, and when

1. Immediately. You are signed out on every device, and your password, your passkeys and any connected Google, Facebook or Apple logins are removed. Your calendar subscription link stops working. Your profile photo is deleted. We email you a confirmation with a link to cancel.
2. Within a few minutes. Any paid membership is cancelled, with the unused part of the term you already paid for refunded, and your saved cards are removed from our payment processor.
3. After 30 days. Everything listed below is erased, and we email you once more to say it is done. Copies already inside our encrypted database backups are not edited; they expire on their own, the last of them 12 months later.

The 30 days exist so a deletion pressed by mistake, or by somebody else who had got into your account, can be undone. Use the link in the confirmation email. Cancelling restores your account and all of its data — but it cannot restore your password, your passkeys, your profile photo, a cancelled membership or a removed card, because those were genuinely destroyed on day one. You would sign back in with an emailed code.

What we erase

• Your name, email address, phone number and the location on your profile, including the approximate coordinates we hold for it
• Your profile photo
• Your notification settings, saved activities, followed organizations and location alerts
• Your password, passkeys and social login connections (Google, Facebook, Apple), and every signed-in device
• Your membership of every organization you belong to
• Children's health and safety data — the allergy note and tags, medical notes, the special-needs note and tags, medications, dietary restrictions, the emergency contact, the pick-up note, the list of people authorized to collect a child, and the free-text note field. Each child's name, birthdate, grade and photo answer are cleared from your family's record too. An organization's own educational records can still name a child; see What we keep.
• Any answers you gave when applying to join a group
• Any unused account credit, which is forfeited. The exact amount is shown to you before you confirm.

One exception, and it exists for a child's safety rather than for our convenience: if a child is still registered for an activity that has not happened yet, erasure waits until after it. Organizers read a roster live, so erasing an allergy the day before a field trip would leave the adult supervising your child without it. See Section 9.4 of the Privacy Policy.

What we keep, and why

Some records are not only about you, and we will not destroy somebody else's copy of them. Most of these stop identifying you once your account has been erased. An organization's own educational records do not, and we say so below.

• What you paid, and to whom. Bookings and membership records stay with the organizations you booked with. They are those organizations' financial and attendance records, and are retained for seven years for tax purposes. Your name is removed from the booking itself; the receipt PDF keeps it (see the next item).
• An organization's own educational records. Course records and transcripts an organization wrote about your child, with the name and birthdate as they were when it wrote them; the receipt PDFs it sent you, which name you and your child; and notes its staff wrote at check-in. These stay with that organization, with the names on them, because they are its records of what it taught and what it was paid. Ask the organization if you want one changed.
• Messages you sent stay in the conversations they belong to, shown as coming from a deleted account. They are also the other person's record of a conversation they took part in. Photos you sent are deleted — in messages and in announcements — and the conversation shows that a photo was removed.
• Records that a consent was given, and records that an organizer opened a child's safety details. These cannot be edited or deleted by anyone, including us — that is what makes them worth having. The reveal record keeps the name of the person who looked, which may be you if you ran a group.
• Agreements you signed for an organization — a waiver, a release, a photo permission. Each is kept until its retention date: the later of 7 years after the class's last date (or a longer period the organization chose) and the 22nd birthday of the child it was signed for. That is the period in which a claim about the child could still be brought, and the record is the organization's evidence. Your account's link to each record is cut when your account is erased, but the record keeps the name you typed, the email address you signed with and your child's name, because without them it would prove nothing. It contains no health data. Famlo keeps these on the organization's behalf, so a request to delete one sooner goes to that organization; we will pass it on. You keep the PDF copies we emailed you.
• Scholarship invoices between an organization and a scholarship program.
• Support tickets you opened, which are a shared record with our team.
• A note not to email an address that bounced. If mail to you ever hard-bounced, we keep that address on a do-not-send list. Deleting it would mean we started emailing it again.

Your account row itself is not removed from our database. Too much of other people's history — an organization's attendance record, a conversation you were part of, an audit that must not be editable — refers to it. Instead every part of it that identifies you is erased or replaced, so what remains names nobody and cannot be signed in to. We say this plainly rather than claiming an erasure our database will not perform.

Stripe, our payment processor, keeps its own records of payments under its own retention policy. We remove your saved cards from it; we do not control what it retains about completed transactions.

Your privacy rights

California residents (CCPA/CPRA)

• The right to delete your personal information is provided free of charge
• We will not discriminate against you for exercising your privacy rights
• You may designate an authorized agent to submit requests on your behalf

Getting a copy of your data

Before you delete anything, you can download it: Account settings > Privacy & data > Download my data. You get a JSON file containing your profile, your family's records, your bookings, your memberships, the messages you have sent and your sign-in history. It includes your children's allergies, medical notes and emergency contacts in plain text, so store it accordingly. Card numbers are not included — Famlo never receives them.

Or open a ticket at famlo.co/support and we will send it to you.

If you signed in with Facebook, Google or Apple

Deleting your Famlo account removes the connection and everything we received through it, immediately rather than after the 30 days:

• The provider profile information we were given (name, email)
• The provider user ID we stored to recognize you
• The profile picture we copied from the provider

This does not delete your Facebook, Google or Apple account, or anything they hold. To manage that, use their own settings.

When we will refuse

We will not delete an account when doing so would take something away from somebody else. You will be told which, and what to do about it:

• You are the owner of an organization that has other members. Transfer ownership or delete the organization first — deleting it has its own 30-day grace period, and its members are told.
• An organization you own has paid bookings for activities that have not happened yet.

Records under a legal hold. When an organization or Famlo places a litigation hold on signed agreements because of a claim or an investigation, nothing deletes them while the hold lasts: not their retention date, not an early deletion, and not the organization leaving Famlo. Deleting your account still goes ahead and still cuts its link to those records; the records themselves wait for the hold to be released.

An organization you own that has no other members and no upcoming paid bookings is scheduled for deletion alongside your account, on the same date.

Deleting a child's data without deleting your account

You do not need to delete your account to remove a child. Remove them from Family and their health and safety data is erased 31 days later, by a job that runs daily.

Agreements you signed for that child are not erased with it. They hold no health data, and the child's name stays on each agreement signed for them until its retention date, as described under What we keep.

If you are a parent or guardian asking about a child on somebody else's account, email support@famlo.co with "Child Data Deletion Request" in the subject, your relationship to the child, and the child's name. We will verify parental authority before acting.

Questions?