Privacy notice
Last updated: 2026-11-15
Who is responsible
The controller is FlxCode. Contact for privacy: hello@tavi.casa. We have no data protection officer.
What we keep, why, and for how long
Tavi is a family organiser. We keep only what it needs to work. We don't collect email addresses or passwords. We have no ads and no analytics.
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Member display name and language | Show who did what | Contract (GDPR art. 6(1)(b)) | Until the member is removed (7 days to undo) or the family is deleted |
| Passkey: public key, credential id, name, last use | Sign in | Contract | Until you remove it, or the member is gone for good |
| Family recovery code | Get back in if every device is lost | Contract | Only a hash is stored, never the code. Until a member makes a new code or the family is deleted |
| Device: name, kind, settings, last seen (once an hour), hash of the session token | Keep you signed in, show the device list | Contract | Until the family is deleted |
| Calendar events, tasks, lists, items, notes, trips, categories | The service itself | Contract | Until you delete them, then 30 days, then erased. Done tasks are erased 60 days after they were done |
| Photos on items and notes | Show them to the family | Contract | As long as the item or note. They are erased with it |
| Feedback you send: your text | Read it, fix faults, answer you | Legitimate interest (art. 6(1)(f)) | 24 months, or until you delete it, or the family is deleted |
| Feedback you send: a screenshot and technical details, only if you add them | Understand and fix the fault | Your consent (art. 6(1)(a)), given by adding them and pressing Send | 90 days, or until you delete the report, or the family is deleted |
| Family name, time zone, language, home place (rounded to about 1 km) | Settings and weather | Contract | Until the family is deleted |
| Push subscription: address and keys of the device's push service | Send notifications | Contract | Until you log out, switch it off, or the push service says it is dead |
| Notification queue: ids and times. For shopping, a count and up to three item names | Send notifications | Contract | 24 hours after sending |
| Hashed IP address (the hash changes every day) | Limit abuse and bots | Legitimate interest (art. 6(1)(f)) | A few hours. The sign-up counter lasts until the day ends, plus 2 hours |
| Short technical logs: request id, route, status, time. No names, no content, no IP address | Security and fixing faults | Legitimate interest | A short time, set by Cloudflare's log service |
| Sign-up bot check (Cloudflare Turnstile) | Stop automated sign-ups | Legitimate interest | Handled by Cloudflare |
If you don't give the data marked as contract data, we can't run your family space.
On your device
The app keeps a cookie that signs you in, and a saved copy of your family's data in the browser, so it opens fast and also works offline. Logging out of a device removes both. We use no cookies for tracking and no advertising storage. This website sets no cookies at all.
Feedback you send
Send feedback is in every screen and in Settings. Nothing leaves your device until you press Send. You see the text, the screenshot and the technical details before they go. The screenshot is optional, and you can remove it, cover parts of it with black boxes, or use a photo from your gallery instead. Names of family members are hidden in it where the app can do that. Technical details are off unless you turn them on, or open the form from an error.
Technical details are plain text: the app version, browser, system, screen size, language, time zone, whether you are online, the sync state, and the last 20 lines of errors and failed calls (the route with ids removed, the status and the time). They never hold list, note, event or name content. The app keeps those 20 lines in memory only, and drops them when you log out.
The text is read by the person who runs Tavi. When a report arrives, our server emails the operator's mailbox with the kind, the first 200 characters of the text and a link to a page that only the operator can open. The screenshot and the details are not in the email. The mailbox is a Gmail account, so Google receives that email. Nobody else in your family sees your report. You see your own reports in Settings, Feedback, with their status and our reply, and you can delete them there. A reply reaches you as a notification that says only that you have one.
We keep screenshots and technical details for 90 days and the text for 24 months. Deleting a report erases all of it. When the family is deleted, its reports are erased with it, and the export contains your own reports.
Who receives data
Processor: Cloudflare, Inc. hosts Tavi (Workers, the D1 database, R2 file storage, Durable Objects) and runs the sign-up bot check. Our contract with Cloudflare includes its data processing agreement. Cloudflare is also a controller for some network and security data.
Bot check: when you open the Set up Tavi screen, your browser loads Cloudflare Turnstile. Cloudflare sees what its widget collects to tell people from bots, under its own terms. Our server only gets the result. Nothing else in Tavi, and nothing on this website, loads from Cloudflare's check.
Push services: when we send a notification, it goes through Apple, Google, Mozilla or Microsoft, depending on your device. They see your device's push address, the time, the size and a contact address of ours. The content is encrypted and they can't read it.
Other services, always called through our server. They see our server's address, and no family id or member name:
- Open-Meteo, for weather: the home place rounded to 2 decimals, its time zone name, and the town text you type when you search for a town. It isn't kept.
- Open Food Facts, for product lookup: the barcode.
We don't sell data and we don't share it for ads.
Transfers outside the EU
Cloudflare is a US company. Transfers to it rely on the EU-US Data Privacy Framework where it applies, and on standard contractual clauses in its data processing agreement. Push services in the US may also receive the push address. Our server's address may reach Open-Meteo and Open Food Facts.
Backups and deletion
When a family is deleted, we keep it 7 days so anyone in the family can undo it. After that we erase the rows and the photos. The database also keeps copies for up to 7 days for recovery, so those copies disappear within 7 more days.
Your rights
You can ask for access, correction, deletion, restriction and a portable copy, and you can object to processing based on legitimate interest. In the app, any member can export lists, calendar, tasks, notes and photos as one zip file, and any member can delete the family. For anything else write to hello@tavi.casa. We answer within one month. We may ask you to show that you belong to the family, because we can't tell who a person is from the data alone.
Children
Tavi is meant for families, and a family can include children. Only an adult may set up a family and accept these texts. A child can have a profile without a device: an adult adds it. By accepting the terms, that adult confirms they are the child's parent or guardian, or have the guardian's permission. We don't ask for birth dates. In Italy the age for consent to online services is 14, in Poland 16. Below that age the parent or guardian decides. Any member can remove a child's profile, and you can ask us to delete the child's data.
Complaints
You can complain to the Italian authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live. In Poland that is the UODO.
Changes
If we change this notice in a way that matters, we tell you in the app before it applies.