FAMILY CLOCK · PRIVACY
Privacy Policy
Your family’s information, with clear choices.
Who this policy covers
FamilyClock (家迹钟) is provided by Shandong Yichuang Zhiwei Intelligent Technology Co., Ltd. This policy explains the information used by the iOS app, Apple Watch app and their family service. Contact us at contact@etron.net.cn for privacy questions or requests.
Your account and family
Your verified App Store account identifies your member without a separate Sign in with Apple step. Devices sharing the same Media & Purchases account share that member’s family access, including management rights when the account owns the subscription. The app does not request contacts or an email address. Existing Apple sign-in records may be processed to migrate and clean up previously created accounts.
The family service stores your account identifier, the name and avatar you choose, member color, family membership, invitation and join-request records, and subscription verification records. Family members can see the profile you share and your current status. A valid invitation lets a prospective member with a verified account review the family name, subscriber name and member count before submitting a request. The subscriber receives the applicant’s chosen name and approves membership.
You import only a photo or sticker you select. The app prepares a small avatar and removes image metadata before sharing; it does not scan your photo library or automatically read your clipboard. Names you assign locally to other family members are device preferences, not changes to their shared profiles.
Automatic status stays in your control
When daily updates are enabled and you grant location access, your device uses saved places, geofences and city resolution to interpret status. Repeated location observations help distinguish movement from staying nearby. Optional Wi-Fi assistance uses the currently connected network. When you enable activity assistance and grant Motion & Fitness permission, system activity estimates can support the location-based assessment. Location recognition also works without Motion & Fitness permission. When confirmation passes the status-specific offline threshold, the last state and update time remain visible and are marked offline. A member without any observation waits for a state. While the source phone or tablet is in the foreground, low-frequency gyroscope and gravity-separated acceleration readings also assess prolonged complete device inactivity. A fully observed inactive period reaching the state threshold marks it offline even if location confirmations continue. These sensors do not run continuously in the background, and missing samples do not prove inactivity. Raw readings stay briefly on the device; only the last device-activity time and last observation time may accompany the encrypted state so other devices can show offline status. The app does not collect car-audio connection information, record audio or use the microphone.
Daily status does not upload live coordinates, private residence/work/school coordinates, Wi-Fi identifiers or raw motion readings to the family service. The service stores the last semantic state, source, confirmation time and recognition version, without a daily location trail. On the Move becomes offline after 30 minutes without confirmation, Staying Put after 60 minutes, and known places or Out of Town after two hours. The service may retain the last record until replacement or cleanup with the related family or account records; reading it still requires current access rights, which offline status never extends. The current activity city and an indication of multiple resident cities may be shared with the encrypted state. When several resident cities are configured, family cards show the activity city. Address, city and related-place lookups use Apple location, geocoding and Maps services. When needed, the saved place coordinate and a current location coordinate may be sent to Apple to resolve related places; these queries do not upload a daily location trail to the family service.
The subscriber’s shared Home location, brief address and available city information are stored encrypted and distributed separately to current family members. Only the subscriber can edit them. Leaving a family clears its home configuration. Each member manages their private residence, work and school. These personal places and their Wi-Fi rules are stored on their device and, when private-rule sync is enabled, in their private iCloud database for other devices using the same iCloud account. Shared-Home Wi-Fi bindings are excluded from private-rule sync. They are not sent to family members as daily status. The cities of Home, Residence, Work and School are all resident cities. Only the current activity city is shared, not the complete list of private addresses or daily coordinates.
In newer app versions, a fresh installation selects this device as the status source when it first connects to a family, provided the account has never selected a source. Automatic detection still requires system permission. Existing source choices and manual pauses are preserved. You may turn off optional assistance, revoke location or motion access in system settings, or pause updates on this device. A lack of permission is not treated as evidence that you are at home or asleep. The system can limit background updates, and a status may become stale.
Wi-Fi assistance reads the connected network name (SSID) and a SHA-256 fingerprint of its access-point identifier (BSSID), not internet traffic. The raw BSSID is not saved as a rule. Saved place bindings help interpret status; raw motion samples are not sent as daily status. Turning assistance off stops further readings but does not itself delete saved bindings.
Apple Watch can connect through its own network using the watch’s current App Store account and a family invitation code. Automatic sharing starts off and requires your choice and location permission; personal places are stored on the watch. The watch reads family profiles and current states, and sends account, device-verification and daily semantic status information to the family service, without daily precise coordinates. Disconnecting clears local data on that watch. Deleting the account affects family access on all its devices and does not cancel an Apple subscription.
System permissions and optional features
- Location: while-in-use access supports place setup, city and status recognition, and help-location sharing you explicitly enable. Always access supports system-permitted background place updates and may also support background location updates during a help request with location sharing enabled. Precise location improves place recognition and the accuracy of a location you deliberately share.
- Motion: optional activity assistance uses system activity estimates to support location-based assessment. Foreground inactivity detection on the source phone or tablet uses gyroscope and acceleration readings. If readings are unavailable, offline assessment uses the status-confirmation time alone. Neither feature reads Health data, and location recognition does not require optional Motion & Fitness permission.
- Photos and paste: the system picker or an explicit paste supplies only your selected avatar image; full-library or automatic clipboard access is not required.
- Notifications and background refresh: system settings control notification display and background scheduling; in-app alert preferences do not replace system permission. In Notifications settings, you can choose status alerts and manage emergency alerts, which start enabled. Turning off emergency alerts requires confirmation and does not prevent viewing alerts in the app or sending your own request. Refusal does not grant another permission.
Reading these documents requires no account or sensor permission. Joining a family or restoring a purchase does not grant location, motion or photo access.
Location sharing only when you request help
In versions that support ongoing location updates, the app attempts to keep updating a precise or approximate location only during a new help request that you start, enable the location option for and explicitly confirm. It shares the latest location, accuracy and capture time with currently authorized family members. You may still send a request without granting location access or with the location option off; an unavailable location is not replaced with a guessed location. Existing requests, older single-location requests and previously granted location permission do not automatically become ongoing location sharing after an update, or merely because you open the app or restore purchases.
The family service stores and authorizes access to only the latest help location. A newer fix replaces the previous one, without creating a location trail. For a new request with ongoing location sharing, the latest fix is not automatically cleared after one hour without an update while the request remains active; a new fix replaces it. Older single-location requests retain their original limited expiry and are not given broader consent by an app update. Location availability does not end the help event.
A help event remains active until its initiating member ends it. Acknowledgment by others, ordinary status expiry and pausing daily sharing cannot end it. Ending it on your device immediately stops that device’s help-location updates and clears its local help-location information, while withdrawing the service location over the network. If offline or the network fails, withdrawal is retried after connectivity returns; until the service receives it, currently authorized family members may still see the last location. Older single-location requests retain their original limited expiry. Leaving a family removes visibility within that family and does not claim that the initiating member resolved the request. Infrastructure backups and already displayed or offline copies may not disappear immediately.
Ongoing updates depend on location permission, the Precise Location setting, background scheduling, connectivity and whether the app has been force-quit. Revoking permission, network loss or force-quitting may interrupt updates. The app does not promise a fixed update interval, immediate delivery or reliable emergency assistance, does not contact emergency responders and is not an emergency-dispatch service. In an emergency, contact the appropriate local emergency service directly.
Purchases, devices and service operation
Apple handles payment. The service receives signed transaction information and checks the product, purchaser association, subscription status and expiry to decide whether a family can receive daily updates. It does not receive your payment-card details. One purchase account has one family slot for up to six account members; restoring a purchase recovers that account and its original family, while an expired subscription does not resume paid updates. This is not an Apple Family Sharing entitlement.
The service also uses an installation identifier and, when supported and registered, an Apple push token to identify the publishing device, request background refreshes and deliver alerts when you allow them. Authentication, rate-limit, request-deduplication and operational records help protect the service. Cloud and network providers may process connection and request metadata as part of operating their infrastructure.
Device verification uses Apple App Attest, device public keys, one-time challenges and revocable sessions. The service stores the verification and security records needed to protect account access. It does not receive your Apple password. Only your chosen device publishes daily status; recovering an account does not automatically grant location access or switch that publishing device.
Alongside background refresh hints, Apple Push Notification service (APNs) can deliver generic status-change or help alerts. Push payloads include event, family and recipient-account identifiers needed to open the relevant content, but no member names, specific statuses, coordinates, Wi-Fi identifiers or avatars. Opening an alert still requires verification of the current account and family-access rights. Delivery and widget refresh depend on the network, Focus and system scheduling; they do not prove that a family member has received or read a request. The app includes no advertising or third-party analytics SDK and does not use an advertising identifier for tracking.
When notification features are available, the family service stores your rules for entering or leaving a status, together with your emergency-alert preference. These account preferences do not select individual members and can be configured before joining a family; alerts apply only to other members of the family you can currently access. Device registration also stores notification permission and alert language. To match these rules, the service separately processes only the status category, confirmation time and expiry, using current family permissions to create short-lived alert tasks. Coordinates, Wi-Fi names and identifiers, avatars and raw sensor readings do not enter notification matching or delivery.
Storage and service providers
Apple provides StoreKit payment, transaction information, device attestation and related platform services. Supabase provides managed authentication, database and server functions. The configured family database is hosted in the United States (US West); information sent to this service is therefore processed outside mainland China when you use it there.
Connections use transport encryption, and protected family payloads are encrypted at rest. This is not end-to-end encryption: the family service can process data to provide authorized sharing and subscription verification. We do not sell personal information or use it for advertising.
When CloudKit daily-content mode is not enabled, the family service stores the latest state and its optional activity city, multiple-resident-city indicator, last device-activity time and last observation time within the encrypted state content. When that mode is enabled, the same fields accompany the state in device-encrypted CloudKit content. Neither mode shares raw gyroscope or acceleration readings, daily coordinates or Wi-Fi identifiers as state content.
When CloudKit daily-content mode is enabled, your daily status and avatar are encrypted on your device before being stored in Apple CloudKit’s public database for authorized family sharing. Each update uses a new random record identifier and a separate encryption key. Public records do not contain readable status text, avatar images, names or family identifiers, but technical information such as record size, timestamps, creator identifiers and service environment may remain visible. The public database does not restrict access to the ciphertext itself by family membership; the ciphertext alone cannot reveal its contents without the corresponding decryption key.
The same mode also stores your own latest daily-status and avatar archives in the CloudKit private database of your current iCloud account, using encrypted fields. These private archives are separate from the shared ciphertext and optional private-rule sync, and do not use Apple Family Sharing to manage membership. Your App Store purchase account and iCloud account may differ; changing iCloud accounts does not change your membership or subscription rights in the family service.
The Supabase family service continues to store subscriptions, membership, permissions, devices and the necessary sharing index, and stores each content update’s decryption key in encrypted form. The minimal notification-matching data described above is still submitted separately to the family service; this does not change how CloudKit daily content and private archives are stored. After checking the current session and family-access rights, the service provides the corresponding record identifier and key to authorized devices. This arrangement is therefore not end-to-end encryption that prevents the service from decrypting the content. The shared Home setting, help events and the latest help location you deliberately enable continue to be stored, authorized and cleared through the family service as described in this policy; they are not part of CloudKit daily-content mode. Existing daily status and avatars may migrate gradually after that member’s new content is successfully saved.
Your device retains settings, protected credentials and cached family data. Widgets read a limited local App Group snapshot. Personal settings sync according to your choices through Apple CloudKit’s private database, with their contents stored in encrypted fields. This sync is separate from the shared Home configuration and daily status sharing in the family service.
Provider information: Apple Privacy Policy and Supabase Privacy Policy. These external pages open only when you choose their links.
Supabase, Inc. processes hosted family-service data on our behalf. Its privacy contact is privacy@supabase.com. Please direct FamilyClock data requests to contact@etron.net.cn; we will coordinate with the provider where necessary. Its linked policy explains the provider’s role and contact channels and does not replace this policy.
The information sent to the overseas family service includes account and device-verification records, selected profiles, membership, purchase-verification records, current semantic status, the shared Home setting and any help location you choose to provide. Apple processes system-service data, private iCloud data and the CloudKit daily content described above under its own service arrangements. The US West database location stated above refers to the Supabase family service and does not mean that CloudKit data is stored in the same region. Provider privacy policies identify their contacts and rights channels; you may also contact us for assistance with requests concerning these providers.
Widgets receive only a reduced local snapshot, such as names, thumbnail avatars, status and update time. They do not receive precise help locations, Wi-Fi identifiers or location history. Existing legacy CloudKit family shares have separate access and deletion controls.
How information is retained
- Alert rules and the emergency-alert preference remain as account settings until you change them or the related records are deleted. Leaving or being removed does not clear these preferences, but pending events associated with the former family relationship become ineligible and are cleaned up. Recent status is used for notification comparison only during its limited validity and is cleaned up after expiry. Delivery tasks support short-term retries and are removed after delivery completes, expiry or loss of access; they do not create a daily status history for notifications. Revoking access cannot recall a generic alert already accepted by APNs or displayed on a device; access to its content still requires current authorization.
- Current daily status is replaced by a newer accepted status; pausing updates does not erase the last shared status or change its original timestamp.
- Join requests expire with their invitations. Membership-change notices are visible only to their recipient; unacknowledged notices remain available, while acknowledged notices are scheduled for removal after 30 days.
- Expired authentication and request records are removed by service maintenance. Only the latest help location is kept during ongoing sharing, and newer fixes replace older ones. The last fix is not automatically cleared after one hour without an update while the request remains active. Older single-location requests retain their original limited expiry. When the initiating member ends the request, local help-location updates stop and local location information is cleared immediately; the service location is withdrawn when connectivity allows. Events and end markers without location remain to represent the request and prevent delayed offline requests from reactivating it; they are removed with the associated family or account records.
- Account deletion clears your family-service profile and sharing records and revokes access. Minimal purchase-account ownership and revocation records remain to enforce the single-family allowance and prevent reactivation of a deleted service identity; retention is limited to what is necessary for those purposes and applicable legal obligations; restoring a purchase does not restore deleted private content. Authentication deletion is retried if its provider is temporarily unavailable. Existing device caches and infrastructure backups may require additional time to disappear; we do not promise immediate physical erasure of every copy.
Daily status offline thresholds are at most two hours: 30 minutes, 60 minutes or two hours depending on the state. These thresholds do not promise physical database erasure within that period. At the applicable threshold, the last confirmed state and its original update time remain visible and are marked offline; without a reliable record, the app waits for a state. A continuously observed period of device inactivity reaching the same threshold can also mark the state offline even when location updates continue. The service may retain the latest record until replacement or cleanup with the related data; retention does not extend access rights. Family profiles and settings are kept while needed for that family service.
In CloudKit daily-content mode, older public ciphertext enters cleanup after replacement or deletion of the associated sharing record. Network outages, offline devices, iCloud account changes and service retries may delay cleanup. For ciphertext uploaded without completing registration with the family service, server cleanup, when enabled, checks that it is no longer in use after a protection period of at least 24 hours before arranging removal. This is not a guarantee of deletion within 24 hours. Status freshness, revocation of access and physical deletion of ciphertext are separate matters.
Leaving or being removed from a family does not delete your own status and avatar archives in private iCloud. When you delete your family-service account, the app revokes family-service access and then attempts to clean up the corresponding personal archives and known public records in the current iCloud account. Copies in other iCloud accounts, offline copies and backups may require additional handling and time. You may use Apple’s available iCloud storage controls or contact the address in this policy for assistance. We do not promise immediate physical deletion of every copy.
Turning off private-rule sync stops syncing those rules; it does not erase copies already saved in private iCloud. Deleting a family-service account does not itself delete private iCloud settings. Manage the app’s iCloud storage through Apple’s available controls or contact us for assistance. Cloud-provider backup retention follows the provider’s configured lifecycle, so we do not promise immediate deletion of all backups.
Your choices and requests
Settings lets you change your profile, choose automatic sources, stop updates from this device, manage membership and request account deletion. Stopping daily updates is separate from ending a help event that you already started. You may cancel a pending join request or leave as an ordinary member without paying. A family manager with other members must first resolve the family through the available remove-member or dissolve-family controls before deleting the account.
After you leave or are removed, the service blocks further access to new shared content from that family. When CloudKit daily-content mode is enabled, it also stops providing the corresponding decryption keys to members who no longer have access. Revocation cannot recall plaintext, keys, screenshots or other copies already downloaded, or a response authorized before revocation that is still in transit. Deleting an account or leaving a family does not cancel an Apple subscription; manage it separately in Apple subscription settings. Contact contact@etron.net.cn for questions about access, correction or deletion of your information. Do not send passwords or payment details by email.
You may request access to or a copy of your personal information, correction, deletion, restriction of or objection to processing, a transfer where applicable, or an explanation of this policy. You can withdraw optional permissions through the app or system settings. Withdrawal affects future processing and may make the related feature unavailable; it does not undo processing lawfully completed before withdrawal. We verify only the information reasonably needed to protect your account when handling a request, respond within the period required by applicable law and explain any inability to fulfill it. You may raise a complaint with the competent authority.
Sensitive information and children
Precise location and a saved home address can reveal where you or your family live or are currently located. They are used only for the place configuration or confirmed help-sharing purposes described above. Even a simple status and its time can reveal aspects of your routine to family members. Share them only with family members you trust. Family members may save or forward information they have seen; revoking access cannot recall such copies.
Children should use the service with an informed parent or guardian. Personal information of a child under 14 receives special protection under Chinese law; a parent or guardian must give the legally required consent before that information is provided or shared. If the required guardian consent has not been obtained, do not provide the child’s information. A guardian can contact us to access, correct or delete it. If we learn that it was handled without the required consent, we will take steps to stop the relevant processing and remove it as required by law.
Where separate consent or another statutory procedure is required for sensitive information or overseas provision, this policy and system permission prompts do not substitute for that procedure. Reading this page is not consent to sharing or overseas processing.
When you visit these web pages
The public legal pages at etron.net.cn/familyclock/ can be read without signing in. The pages contain no scripts, advertising, analytics tags or forms and do not set application cookies. The website’s server and Cloudflare delivery and security services may process your IP address, requested URL, access time, browser information and technical error records to deliver pages and protect the site. This is separate from the app’s family records. See the Cloudflare Privacy Policy for its processing and contact channels. The bundled offline copy does not contact the website just because you read it.
Document updates
This copy is included with the app and can be read offline. Its date identifies the version you are reading. We will publish the updated date and policy when data processing changes, and provide the notice and consent process required by applicable law for material changes. Viewing this page does not grant a new permission or start data sharing.