Aventra Family Privacy Policy

1. Information we collect

Depending on the features and permissions you use, we may collect:

• Account information: name, email address, authentication identifier, and optional profile photo. Sign in with Apple may provide a private relay email address. Passwordless email sign-in uses Firebase Authentication and Kenersoft email delivery. We process your email address and short-lived verification data to send a one-time link and code, prevent abuse and verify access. Aventra does not read your Gmail mailbox or request permission to do so.
• Location and motion information: precise or approximate location, accuracy, timestamps, motion state, speed, heading, saved places, arrivals and departures, confirmed stays and their last-confirmed times, and trip routes. With permission, this can be collected while the app is in the background.
• Family and safety information: family names, membership, roles, invitations, saved-place names, Quick Nudge activity, trip information, safety activity, legacy Check-in records, and emergency or roadside contact names and phone numbers you choose to enter.
• Family schedule information: schedule entries you create (the family members involved and their roles, the saved place, dates, times, and recurrence) and any notes you add to an entry.
• Connected calendar information: if your family connects Google Calendar, Microsoft Outlook, or TeamSnap, we import events read-only, and only from the calendars, teams, and events your family selects: event titles, dates and times, locations, and recurrence. We receive no mailbox, message, contact, or file content from those services.
• Optional Apple Calendar import: Apple requires full Calendar permission to read events; it does not offer read-only permission for this access. For a selected import, Aventra reads the chosen calendar and date range locally, and nothing is selected by default. You can instead explicitly enable automatic updates for one chosen calendar, including future supported events. Neither mode reads event notes, attendees, organizer details, URLs, or attachments.
• Optional Siri event drafts: when you use the Aventra Siri action, Aventra receives the event details supplied to that action, such as the title and date or time, and opens a draft for you to review and Save. Aventra does not record microphone audio or receive the full Siri conversation. A dictated event title can be part of the draft. Apple handles Siri voice processing under its own settings and privacy policies.
• Account reliability evidence: private operational records describe observed foreground sessions, limited onboarding error categories and first successful location publication. Error reports use a rotating daily account reference. These records exclude location coordinates, event content and messages; they do not add an account identifier to Analytics. Private service records remain associated with the account for reliability and deletion controls.
• Driving information: detected drives and routes, speed, driving events, and interaction with Aventra Family while driving. Older versions may collect driver or passenger roles and driving scores; legacy records remain subject to our existing retention and deletion controls. The updated Aventra 1.0.4 no longer asks who drove or produces a driving score. It offers conditional tips from validated road-driving events without identifying the driver. Aventra cannot observe your use of other apps.
• Subscription information: product, entitlement status, purchase and expiration dates, and Apple transaction identifiers. Apple processes payment-card and billing details.
• Device, usage, and diagnostics: user and device identifiers, device and app version, notification token, battery context, permissions, app interactions, crash reports, and error context.
• Product analytics: starting with the updated Aventra 1.0.4, limited usage events help us understand app use and signup abandonment, including which signup steps are reached, completed, or left unfinished. Events use a random analytics reference, separate from your account, family, and device identifiers. They contain predefined action names and limited categories such as sign-in method, screen category, outcome, platform, and app version. They do not contain names, email addresses, precise locations, street addresses, calendar text, messages, verification codes, sign-in links, purchase receipts, or raw error text. We do not record screens or sessions for this analytics.

2. How we use information

We use information to authenticate accounts; display family-shared locations; detect chosen place arrivals and departures; create chronological journey history and trip summaries; deliver invitations, alerts, and Quick Nudges; compare shared locations with the family schedule to send leave-by reminders and expected-arrival alerts; build schedule entries and their reminders from events in calendars the family chooses to connect; provide safety features; manage Family Plus; secure and operate the service; measure basic product use; diagnose errors; improve reliability; and respond to support requests.

Aventra Family does not use this information for third-party advertising or cross-app tracking.

3. How information is shared

PostHog product analytics: PostHog processes these limited events in the United States to help Kenersoft evaluate feature use and signup funnels. We disable person profiles and GeoIP enrichment and configure PostHog to discard client IP data. Delivering events necessarily exposes the IP address and ordinary network metadata to the receiving service; disabling GeoIP does not mean the IP address is never processed. We do not use this analytics for advertising, identifying you across apps or websites, or screen recording.

Information you choose to share is visible to members of your Aventra family. Depending on permissions and settings, family members may see your profile, current or recent location, update recency, battery context, confirmed stays and journey history, Quick Nudge activity, and trip information. Family schedule entries, including their notes, are visible to every member of the family, including the member an entry is about.

We use providers including Google Firebase and Apple platform services for authentication, databases, notifications, subscriptions, diagnostics, and infrastructure. For Family Plus, completed trip coordinates are automatically sent to Aventra’s private Valhalla service where road matching is available. The service uses OpenStreetMap road data to align the route with roads.

Optional calendar travel estimates: Planned for the updated Aventra 1.0.4, after you enable leave-by reminders and while existing family membership and location-sharing authorization permit it, Aventra sends origin and destination coordinates and the scheduled arrival target from its servers to the Apple Maps Server API. Automatic uses the traveller's latest reliable location already shared with the family; an authorized event editor can instead select a saved starting place. Requests do not include Aventra account, family or member identifiers, names, event titles or notes. This feature does not collect additional GPS or request another OS location permission. Route locations are not sent to product analytics. Apple receives the routing request and ordinary server network metadata and handles it under Apple Maps & Privacy. This planned feature is not a statement that the update is already publicly available.

Optional NOAA storm radar: after a Family Plus member chooses to enable radar and confirms the provider disclosure, the iOS app requests visible weather-map tiles directly from the National Oceanic and Atmospheric Administration’s (NOAA) nowCOAST service. NOAA receives the originating IP address, ordinary HTTP metadata, and the geographic tile bounds for the map area being viewed. The request does not include an Aventra family, member, device, or account identifier; a credential; a name; a saved place; or a raw member coordinate. No radar request occurs while the layer is off, and Aventra does not route or store these weather requests on its servers. NOAA handles the request under its own privacy policy.

If your family connects a calendar, imported events become family schedule entries and are visible to the family exactly like entries created by hand. For connected Google Calendar, Outlook, or TeamSnap imports, the OAuth access tokens are stored server-side, are never placed on other family members’ devices, and are never readable by apps or clients.

For a selected Apple Calendar import, only after you confirm Import are the selected calendar label, event titles, dates and times, location text, and hashed source and occurrence identifiers sent to Firebase and shared with your Aventra family, together with the family settings you choose. If you explicitly enable automatic updates, supported events from that chosen calendar and later supported additions are shared within the configured import window. Aventra does not modify Apple Calendar. Apple updates run when the app is active or during iOS background opportunities; timing is controlled by iOS and is not real-time or guaranteed. Google Calendar, Outlook, TeamSnap and saved calendar links can use periodic server updates independently of whether the iPhone app is open; these also do not guarantee immediate freshness. Files and selected snapshots remain one-time imports unless you explicitly update them. Each automatic source can have an optional default saved place for events without a matched place; you may leave it unset.

Aventra Family’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We may disclose information when legally required or reasonably necessary to protect rights, security, or safety.

We do not sell personal information or precise location, and Aventra Family does not include third-party advertising.

4. Location and safety limitations

Location, stays and their durations, trips, arrivals, departures, driving status, schedule reminders and expected-arrival alerts, and safety information can be delayed, incomplete, or inaccurate because of permissions, signal conditions, battery restrictions, network availability, operating-system scheduling, or sensor error. Missing coverage can appear as a gap. Aventra Family is not an emergency response service.

5. Retention, export, and deletion

We retain account and family information while needed to provide the service. Journey history, including confirmed stays and recorded trips, is available for up to 2 days on Free and up to 30 days on Family Plus. Current-location records, operational events, and other detailed data can have different, shorter retention periods. Crash reports and diagnostic logs are kept only as long as needed to diagnose and fix problems, typically no more than 90 days. Security, fraud-prevention, backup, transaction, and legally required records can be retained longer where reasonably necessary. Check-ins are retired; legacy Check-in records remain readable only where needed for export, deletion, and family cleanup.

For these planned estimates, the temporary route cache contains the origin and destination, travel duration and distance, provider check time and derived leave time needed for the event, plus minimal identity, authorization and event-revision metadata needed to secure and validate the cached result. Access stops when the result expires, the event starts or authorization is withdrawn. Bounded cleanup removes cached results, with an asynchronous lifecycle deletion backstop. Physical deletion can be delayed by failures or a cleanup backlog; inaccessible results are not treated as current. This separate private temporary cache is not included in the long-lived Firestore backups. These limits describe Aventra's route cache, not Apple's retention or the retention of other account, calendar, diagnostic, security or legally required records.

Account session and onboarding error receipts are scheduled for expiry 30 days after receipt. Deletion after expiry is asynchronous, so 30 days is not an exact deletion deadline. Minimal first-observed milestones are retained while the account exists and deleted with it. Minimal account-deletion safeguards can remain while deletion is being completed. A private local monitoring summary covers the first 7 days after signup. These periods are separate from the diagnostic-log policy above and do not remove the backup, security or legal exceptions described here.

You can leave a family, request an export, or delete your account using Privacy & Data in the app. Deletion removes or de-identifies personal information except where retention is needed for security, fraud prevention, legal obligations, subscription records, backups, or another family member’s legitimate records.

6. Your choices

Product analytics is enabled by default. You can turn off Usage analytics in Aventra’s Privacy & Data controls, including from the sign-in screen. This stops future product events on that installation and discards pending events; it does not affect sign-in, family sharing, subscriptions, or essential operational diagnostics. Signing out, switching accounts, or changing the analytics choice starts a separate random analytics reference, rather than linking the earlier activity to an account. Product analytics events are retained for up to one year under our current PostHog plan. Turning analytics off does not delete events already received. These events are separate from journey history and account-linked diagnostics, and account deletion cannot reliably locate earlier events by your account because they do not carry its identifier.

You control iOS location, background location, motion, photo, Calendar, and notification permissions in Settings. Features requiring a permission will not work when it is disabled. You can stop family sharing by changing the corresponding permission, leaving the family, or deleting your account. Your family can connect or disconnect Google Calendar, Outlook, or TeamSnap at any time in the app. Disconnecting deletes the stored access tokens, and the family chooses whether entries already imported are kept as ordinary schedule entries or removed.

You can revoke Calendar permission in iOS Settings to stop future Apple Calendar reads. Revoking permission does not delete events already imported into the family schedule. Pause stops future automatic updates for that source; Resume requires review of the current source and settings. Apple automatic sharing is bound to the account and selected iPhone; moving it to another phone requires explicit review and confirmation. Remove from this phone removes the local automatic selection, while Disconnect stops the family connection and offers Keep or Remove for its imported events. Keep retains accepted events in the family schedule; Remove deletes events imported only by that source, including prior family edits to those events; events still retained by another connected source remain. Existing export, account-deletion and retention controls still apply. If you explicitly ask Aventra to resolve an address or create a place, Apple’s geocoding service may receive that address; browsing Apple Calendar events does not automatically geocode. This import does not request Contacts, Reminders or microphone access.

7. Children

Aventra Family is intended for family use. A parent or legal guardian should create or supervise accounts used by children and provide any consent required by applicable law. A child’s location is collected and shared only within a family that a parent or guardian set up and consented to during family setup; Aventra records that guardian consent. A parent or guardian can stop collection at any time by turning off the child’s sharing, removing the child from the family, or deleting the associated account, which removes the child’s personal information as described in Section 5. The service is not intended for a child to use independently without guardian involvement.

8. Security and international processing

We use administrative, technical, and organizational safeguards designed to protect information, including authenticated access and encrypted network transport. No system can guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant authorities as required by applicable law. Providers may process information in the United States or other places where they operate.

9. Changes and contact

We may update this policy as Aventra Family changes. We will post the revised policy here and update its effective date. For privacy, access, export, or deletion questions, email [email protected].