CheckMyKid Privacy Policy

Last updated: 7 November 2026

CheckMyKid is a family-safety and parental-control app. Parents see their children's location, receive alerts (SOS, arrivals and departures from saved places, low battery, phone offline) and can set rules for time spent on the phone. The app is transparent to the child: a notification is always shown on the child's phone that CheckMyKid is active, and the child can see at any time what data is sent to the parents and what rules apply.

This policy explains what data we process, why, who we share it with, and your rights.

1. Who is responsible for the data (controller)

The data controller is CORTEXDIGITAL S.R.L., Tax ID (CUI) 49462266, Trade Register no. J2024000239130, registered office at Str. Constantin Brâncuși nr. 62, bl. 12, sc. C, et. 2, ap. 25, Constanța, Romania.

For any question or request about your data: [email protected].

2. What data we process and why

### Parent account

  • email address and password (the password is stored encrypted, through our authentication provider), or your Google account if you choose Google sign-in;
  • the display name shown in the family.

Purpose: creating the account, authentication and running the family. Legal basis: performance of the contract (providing the service) — Art. 6(1)(b) GDPR.

### The child's phone

This data is processed only after the child connects the phone with a code received from the parent and grants the permissions, one by one, in the app. Each permission is preceded by an explanation before it is requested.

  • Precise location (GPS), including when the app is closed or not in use: for the parents' map, route history, arrival/departure alerts at saved places, parent-requested live tracking and the SOS-with-location feature.
  • Battery level and phone status (connected or not, which permissions are on or off, whether the phone is on a call): so parents know the app is working and receive low-battery and phone-offline alerts.
  • Time spent in each app and the list of installed apps (only if the "App time" permission is on): for usage statistics and for the rules set by the parents (app pause, daily limits, school mode, bedtime). We do not read what the child does in the apps, what they type, or their content.
  • Call state — only whether the phone is "on a call" or not (if the "Call state" permission is on). We do not learn who the child talks to, what number is called, and we do not record or listen to calls.
  • Phone numbers for the call filter (only if the parent turns the call filter on): the parent can set a list of allowed numbers, which is stored on our server so the child's phone lets them through; when the filter rejects a call, the rejected number is reported to the parent and stored in the blocked-calls log. The child's contact list is read only on the phone, to let calls from saved people through, and is never sent to our servers or to third parties.

### Family communication

  • chat messages, quick replies and voice messages sent between family members. Voice messages are recorded only while the user holds the microphone button and are sent only within that family.

### Parent location (optional)

Only if the parent themselves turns on "Show the family my location", and only while the app is open on the parent's phone.

### Technical data

  • an identifier for delivering notifications (Firebase Cloud Messaging token), the phone model and the app version.

Legal basis for the child's phone data and family communication: the consent of the parent setting up the service — Art. 6(1)(a) GDPR — and, for children under 16, consent given by the holder of parental responsibility — Art. 8 GDPR (see section 8).

We do not collect: screen content, messages or conversations from other apps, browsing history, photos, ambient audio. We do not show ads and we do not sell data.

3. Who has access to the data

  • Family members: parents see the data of the children in their family; the child sees what data is sent to the parents and what rules apply.
  • Providers that process data on our behalf (processors), under contract and data-processing terms:
  • Supabase — database, authentication and voice-message storage; the servers we use are in the European Union.
  • Google Firebase Cloud Messaging — delivering notifications to phones.
  • Google Sign-In — only if you choose to sign in with a Google account.
  • MapTiler — displaying the map and searching addresses. It receives only the displayed map area or the searched address, not your identity.
  • Resend — sending system emails (confirmation, password reset); it receives only the recipient's email address.
  • We do not transmit data to other third parties, except where required by law.

4. Transfers outside the EU/EEA

Data is stored on servers in the European Union. Some providers are companies outside the EU or may process data outside the European Economic Area, with the safeguards required by GDPR:

  • Supabase (a US company; the servers we use are in the EU – Paris) — under the EU‑US Data Privacy Framework and/or standard contractual clauses.
  • Google — Firebase Cloud Messaging and Google Sign-In (USA) — under the EU‑US Data Privacy Framework and/or standard contractual clauses.
  • Resend (USA) — under standard contractual clauses.
  • MapTiler (Switzerland) — under the European Commission's adequacy decision for Switzerland.

5. How long we keep the data

  • location history: 30 days, then deleted automatically;
  • notifications and alerts: 30 days;
  • chat messages and voice messages: 12 months, then deleted automatically from the server;
  • the blocked-calls log: 90 days, then deleted automatically from the server;
  • app-time statistics and call-filter numbers: for as long as the family exists, or until you delete them by deleting the account;
  • account data: until the account is deleted.

Automatic deletion is performed by a scheduled job running on the server.

6. Security

Communication between the app and the server is encrypted (HTTPS). Each family sees only its own data, through server-side access rules. The child's phone uses its own key, which can be revoked by the parent at any time.

7. Transparency to the child and uninstalling

The app is intended for parents but is designed to be transparent to the child. A visible notification is permanently shown on the child's phone that CheckMyKid is active, and the child can see at any time, in the "What parents see" screen, what data is sent and what rules apply, as well as the granted permissions.

Uninstall protection is optional and is turned on by the parent:

  • Disconnecting or uninstalling from the app (on the child's phone) requires a code from the parent or the parent's PIN; when the code is used, the parent receives a confirmation.
  • The protection (device administrator) can also be turned off at any time from the phone's Settings, without a code; in that case the parent receives an immediate alert. Through the device administrator feature, the app does not lock the phone, does not delete data and does not prevent uninstalling through Settings. The rules set by the parent (app pause, limits, call filter) are visible to the child in the «Rules» screen.

8. Children and parental consent

CheckMyKid is installed on a child's phone only by a parent or the holder of parental responsibility, who gives consent during setup. In Romania, for children under 16, data processing is based on the parent's consent (Art. 8 GDPR, national threshold of 16). When creating the family, the parent confirms that they are the child's parent or legal guardian and that they agree to this policy and the terms of use; this confirmation is stored, with the date and the version of the documents.

The parent can withdraw consent at any time: by turning off a permission on the child's phone, removing the child from the family, or deleting the account.

The child's rights (access, rectification, erasure, etc.) are generally exercised through the parent or guardian. From the age of 16, the child may also exercise these rights directly, by writing to [email protected].

9. Your rights (GDPR)

You have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw consent. For any request, write to [email protected]. You also have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP, www.dataprotection.ro).

We do not carry out automated decision-making and we do not profile based on your data or your child's data.

10. Deleting your account and data

  • In the app: Settings → Account → "Delete account". If you are the only parent, the family, connected children, locations, messages (including voice), rules and statistics are deleted.
  • Without the app: send an email to [email protected] from the account address, with the subject "Delete account". We delete the data within 30 days at most.
  • A parent can remove a child from the family at any time; that child's data is deleted.

Details: https://checkmykid.com/en/delete-account.html

11. Changes

If we change this policy, we announce it in the app. The current version is always available in the app (Settings → Privacy) and at https://checkmykid.com/en/privacy.html