The short version
DepositGO has no account, no ads and no tracking, and we do not sell data. Your tenancy records (addresses, names, photos, notes, meter readings, signatures, reports) are stored on your iPhone or iPad and, if you use iCloud, in your own iCloud account. We run no server that holds them and cannot see them. Apple handles your purchase. Anonymous usage analytics and crash reports are off until you turn them on.
1. Who we are
DepositGO is made by an independent developer ("we", "us"); the developer's name is shown as the seller on DepositGO's App Store page. We are the controller for the limited data described in sections 4 and 5. Contact for anything about privacy: info@familygo.app. Website: https://familygo.app.
2. What stays on your device and in your iCloud
DepositGO documents the condition of a rental home when you move in and out. In the app you may enter or create:
- the address of the property and rooms;
- your name and the names, roles and signatures of the landlord, agent or other people who sign;
- photos you take or import, notes, meter readings, key counts, repair issues and, optionally, a deposit amount;
- the PDF reports and a manifest of photo fingerprints (SHA-256 hashes) made from this data.
None of this is sent to us. It is stored on your device, protected with iOS Data Protection ("Complete").
Other people's data. Names, addresses and signatures of landlords, agents and co-tenants are personal data of third parties that you type in or collect. You decide whether to enter them and who receives the report. Tell people whose details you record why, and avoid photographing people. We are not the controller of the content you create; you decide what happens to it.
iCloud. The app stores its records with SwiftData and syncs them through Apple's CloudKit private database when you are signed in to iCloud. That data is in your iCloud account and is processed by Apple under Apple's terms. We cannot access it. Some files, such as locked report PDFs, may stay only on the device that made them, so export reports you need. If you are signed out of iCloud or sync fails, data stays on the device only. iCloud sync uses silent system notifications from Apple to tell your devices that data changed; we send no push messages.
Sharing and export. Nothing leaves your device unless you share it. When you export, the iOS share sheet lets you send the PDF (and optionally a ZIP of original photos) through Mail, Messages, AirDrop, Files or another app. The recipient then handles the file under their own policies. "Export all data" creates a ZIP with your reports, manifests, original photos and report data in JSON.
3. Permissions and how evidence is sealed
- Camera: to take dated, sealed photos in the app. Photos are processed on the device.
- Photo library: when you import a photo, you pick it in Apple's photo picker. The app sees only the photos you choose and marks them "imported". It does not ask for access to your whole library.
- Notifications (optional): asked only when you turn on a reminder (for example a repair date or the comment window after move-in). Reminders are scheduled on the device and their text is generic, so a locked screen does not show the address or names.
- The app does not ask for contacts, microphone or location.
Sealing. When you take a photo in the app, the device computes a SHA-256 hash of the original and stores it with the capture time. A display copy gets the date, time and room printed on it; the original is kept unchanged. The report PDF is created on the device with a random owner password that is not kept, so common PDF programs will not edit it. Your signatures (finger or Apple Pencil) are stored as images with the typed name, role, time and the report hash.
Clock check. When you capture photos and you are online, the app sends one HEAD request to https://www.apple.com/ and reads the time in the answer, to compare it with the device clock. The request carries no body, cookies or identifiers (Apple still sees your IP address).
4. What reaches us, and only if you allow it
During onboarding and in Settings you can turn on two separate choices. Both are off until you turn them on.
- Anonymous usage analytics (Firebase Analytics, Google). Events only, with grouped values: move type (move-in or move-out), country profile, number of rooms (band), paywall viewed, purchase completed, restore tapped, inspection completed (kind, duration band, photo-count band), report signed (one or two parties, refused yes/no), report exported, move-out comparison used. Never addresses, names, amounts, photos, notes or hashes.
- Crash reports (Firebase Crashlytics, Google). If on, a crash sends the technical crash log, device model, iOS version, app version and a random installation identifier. Never your records or anything you wrote.
- Identifiers. Firebase assigns a random app-instance identifier, not your name, e-mail or Apple ID. It is not linked to your identity, and we have no accounts to link it to. Google sees technical data such as your IP address on any request. The app does not use Apple's advertising identifier (IDFA) or ask for tracking permission, and Google ad storage and ad personalisation are off.
- Remote Config (only with usage analytics on). If you have turned on usage analytics, the app also fetches report-format updates (JSON describing country profiles) from Google Firebase Remote Config. The request carries a random Firebase installation ID, the app version and the device language, and nothing about you or your entries. If usage analytics is off, the app does not make this request and uses the report formats built into it. Turning analytics off stops the fetching. No tenancy data is sent.
Why and legal basis (GDPR / UK GDPR). To fix crashes and see which parts of the app are used. The basis is your consent (Art. 6(1)(a)), which you can withdraw at any time.
Who processes it for us: Google (Google Ireland Ltd and Google LLC), for Firebase Analytics, Crashlytics and Remote Config, under Google's data processing terms. It processes the data only on our instructions.
5. What reaches us without a choice
Purchases. Purchases are sold and billed by Apple. We never see your card or Apple Account details. The one-time purchase is handled entirely by Apple through StoreKit. The app checks your purchase entitlement with Apple on the device. Apple's own privacy policy applies to your payment and Apple Account.
E-mails you send us. If you write to info@familygo.app, we use your message and address to answer you. Legal basis: our legitimate interest in answering (Art. 6(1)(f)).
6. How long we keep it
- Your app data: we hold none. It stays on your device and in your iCloud until you delete it.
- Firebase Analytics event data: 2 months, then deleted.
- Crashlytics crash reports: 90 days.
- Support e-mails: deleted 12 months after the conversation ends, unless the law requires longer.
- Anything you already shared or exported is outside our control.
7. International transfers
Google may process data in the United States. Transfers are covered by the EU-US Data Privacy Framework (Google is certified) and the European Commission's Standard Contractual Clauses. Apple handles iCloud, App Store and Apple Maps data under its own policies.
8. Your choices and rights
- Change your consent at any time in Settings (Privacy). Turning a choice off stops sending at once.
- Export your reports and data in the app first; Delete all data cannot be undone.
- Delete everything in Settings > Delete all data. It removes tenancies, photos, reports, signatures, cached copies, export files and reminders from the device, and iCloud follows through sync. Your purchase stays with your Apple Account. It also resets the analytics identifiers, so nothing sent later can be joined to anything sent before. Deleting the app removes the data on the device; iCloud data can be removed in iOS Settings, your name, iCloud, Manage Storage.
- Your rights under GDPR and UK GDPR: access, rectification, erasure, restriction, objection, data portability, and withdrawing consent without affecting what was done before. Your records are on your device and in your iCloud, so you control them directly in the app. We hold no records linked to you, and analytics identifiers are random and not linked to your identity, so we usually can't find data about you. Turning analytics off and Delete all data reset them. You can write to info@familygo.app and we will help where we reasonably can, within one month.
- Complaints: you can complain to the data protection authority where you live or work.
- US residents (including California): we do not sell or share personal information and do not use it for targeted advertising. You can use the rights above in any US state.
- Legal bases for running the app: the app runs on your device, so we mostly don't process that data as a controller. Where we do, the basis is performing our contract with you and our legitimate interest in providing a working app.
9. Children
The app is not directed to children under 13 (under 16 in the EEA where that age applies). We do not knowingly collect data from children. Do not use the app if you are below that age.
10. Changes
If we change this policy, we update the date at the top and, for changes that affect what is sent, ask again in the app before anything new is sent. The current version is at https://familygo.app/depositgo/privacy/.
Changes: 9 November 2026: first version.