This is a translation. In the event of any discrepancy, the Spanish version prevails.
Privacy policy
Last updated: 24 October 2026.
Who the data controller is
VICXELCODE, S.L., calle Doutor Casares 164, 27400 Monforte de Lemos (Lugo), Spain. Contact: hi@vicxelcode.com.
What data we process
- Your account: name, email and password (stored encrypted with a one-way algorithm). If you sign in with Google or Apple, we receive your name, your email and an identifier for that account; we never access your email or any other data.
- Your groups: the groups you create or join, their name and icon, the email of the service account if you provide it, and who is a member of each one.
- The codes: from each forwarded verification email we store only the code, its type and when it arrived. If the email contains a link to get the code, we store it encrypted and it is shown only to the group’s members while it is valid.
- The home’s login details: if the creator of a home chooses to keep the service account password or the profile PINs in FamiKey, they are encrypted on their phone before being sent and can only be decrypted by the phones of the people they give access to. We only store that encrypted data: FamiKey cannot read it.
- Your subscription: if you go premium, payment is handled by the App Store or Google Play. We receive only the subscription status (plan, purchase date and end date); never your payment details.
Sign-in with Google
If you sign in with Google, we request only the basic identity permissions (openid, email and profile): your name, your email and an identifier for your account. We use them solely to create your FamiKey account and sign you in. We do not access Gmail or any other data in your Google account. The use and transfer to other applications of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What we do with forwarded emails
Messages arrive at a private VICXELCODE mailbox on Microsoft 365. An automated process checks that they come from the service (DKIM signature), extracts the code and permanently deletes the email within seconds. We do not store the content of the messages or their account management links. No person reads those emails.
What we use them for
Only to provide the service: to identify you, manage your groups and invitations, and show the codes to authorised members. We do not use your data for advertising, we do not build profiles, and we do not sell or share it. The legal basis is the performance of the service you request.
How long we keep them
- Forwarded emails: deleted as soon as they are processed.
- Codes: 7 days; after that they are deleted automatically.
- Account and groups: for as long as you have the account. If you delete it, we delete your data.
Who else is involved
FamiKey’s servers are located in Spain. We use Microsoft 365 to receive forwarded emails and, if you choose to sign in with them, Google and Apple to identify you. Phone notifications are sent through Expo, Firebase Cloud Messaging (Google) and Apple Push Notification service, and do not include the code. If you subscribe, RevenueCat (United States) manages the subscription status using your internal FamiKey identifier, without your name or email; the transfer is covered by the safeguards required by the GDPR (EU-US Data Privacy Framework or standard contractual clauses). Each of them processes the data under its own terms as a processor or service provider.
Your rights
You can request access to, rectification, erasure or portability of your data, and object to or restrict its processing, by writing to hi@vicxelcode.com. You can delete your account and all its data from the app (Profile → Delete account) or as explained in Delete your account. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Minors
FamiKey is not intended for children under 14 and we do not knowingly collect their data.