MichalKids Privacy Policy

Last updated: March 27, 2026

1. Introduction

MichalKids ("Application", "we", "us") respects the privacy of its users and is committed to protecting personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Polish data protection legislation.

This Privacy Policy describes what data we collect, how we use it, and what rights users have in relation to the processing of their personal data.

2. Data Controller

The data controller is DevOps Jakub Pazdyga, registered address: ul. Powstancow Slaskich 57a, 44-361 Syrynia, Poland, Tax ID (NIP): 2220682818, REGON: 241415540.

For data protection inquiries, please contact us:

Email: noreply@michal.kids
Feedback form: michal.kids/#feedback

3. Data We Collect

3.1 Children's data (with parent/guardian consent)

GPS location — collected every 5 minutes or when the device moves by 50 meters, to ensure the child's safety
Screen state — whether the screen is on/off and whether the child is actively using the device
Battery level — so the parent can check the device's charge status
WiFi connection status — information about wireless network connectivity
Device information — phone model, operating system version
Child's first name — provided by the parent during device pairing
Age group — selected by the parent (4–7, 7–10, 10–14, 14–18 years)

3.2 Parent/guardian data

Email address — for account registration and communication
Full name — for identification within the family
Password — stored in encrypted (hashed) form
Location — optionally, for display on the family map

3.3 Background Location

The Application may access the child's device location even when the app is closed or the phone is locked. This feature is activated solely by the parent/guardian and is used to deliver real-time safety alerts:

Entering or leaving safety zones (geofences)
Automatic School Mode activation when the child enters the school zone
Deviation from an approved route
Rapid status check in SOS situations
Safety features operating even when the app is closed or the device is locked

Location data is visible only to family members within the app. The child can also see their own collected data in their app.

How to disable: Background location can be disabled at any time in the phone's settings (Settings → Apps → MichalKids → Permissions → Location → "Only while using the app" or "Deny"). Restricting this permission may cause some safety features to become unavailable (zone alerts, School Mode).

Retention: All location data is stored for a maximum of 7 days, and real-time location data for 15 minutes. The last known position is retained until the account is deleted.

3.4 App Usage Statistics (optional)

With the parent's informed consent, the Application may collect aggregated app usage statistics on the child's device. This feature is disabled by default and requires:

Deliberate activation by the parent in the app settings
Granting a system-level permission on the child's device

What we collect: Aggregated usage time per app, app categories (games, education, social media).

What we do NOT collect: Content displayed in apps, messages, conversations, or browsing history.

The child can see the same data in their app. The parent can disable this feature at any time in the app settings.

3.5 Payment Data

When purchasing a Premium subscription, the following data is transmitted to the payment processors (PayU S.A., Revolut):

Email address — for transaction identification
IP address — required by the payment processor
Transaction amount — the price of the selected subscription plan
Transaction identifier — internal order number

Data NOT transmitted by MichalKids: Credit/debit card numbers, CVV/CVC codes, or bank account details. This data is entered directly on the PayU website and never reaches MichalKids servers.

PayU S.A. is a certified payment processor holding a PCI DSS Level 1 certificate, the highest security standard in the payments industry.

PayU Privacy Policy: https://www.payu.pl/polityka-prywatnosci

3.6 School Mode and Bedtime Mode

A parent may configure device lock schedules for their child's device: School Mode (within the school geofence during lesson hours) and Bedtime Mode (at a set evening time).

Data collected: schedules (days of the week, start and end time), safety zone identifier (School Mode only), child identifier, known WiFi network names (technical data used for automatic school mode activation, optional)
Parent PIN: stored only as a cryptographic hash (never in plain text), allows manual device unlock
Auto-activation: the device locks automatically based on the schedule and/or entry into the geofence
During lock: the child has access only to the SOS function
Retention: schedules are stored until deleted by the parent

3.7 Cookies and Tracking Technologies

The michal.kids website uses the following analytics technologies:

Google Tag Manager (GTM-KWWQ26TP) — analytics script management
Google Analytics 4 (G-SD1V8RHV2R) — website traffic analytics (anonymous visit statistics, traffic sources, devices)
Google Ads (AW-18024408795) — advertising effectiveness measurement (conversion tracking)
Custom session tracker — anonymous session identifier (stored in browser sessionStorage, not cookies), navigation paths, time on page, scroll depth. Purpose: user experience analysis and application improvement.

The user may block cookies in browser settings. Disabling cookies may affect the functionality of some website features.

3.8 Push Notifications

The Application uses Firebase Cloud Messaging (FCM) to send push notifications to the parent's device.

Notification types: security alerts (SOS, zone exit), device pairing request, reminders
FCM token is stored on the server until logout or account deletion
The user may disable notifications in the phone's settings

3.9 Error Tracking

The Application uses Sentry (sentry.io) for automatic technical error reporting.

Data collected: error type, stack trace, device model, OS version, application version
We do NOT collect: user content, messages, or personal data in error reports
Purpose: fast detection and resolution of technical issues

3.10 App Distribution

The MichalKids application is available for download from the Google Play Store and directly from the michal.kids website.

When downloading directly from the website, the user must allow installation from unknown sources in the device settings
The APK file is digitally signed with the same key as the Google Play Store version
The Application automatically checks for available updates

4. Purpose of Data Processing

Data is processed exclusively for the following purposes:

Enabling parents to check the location and ensure the safety of their children
Displaying the child's device status (battery, activity, connectivity)
Notifying about the child entering/leaving safety zones (geofences)
Generating activity reports and statistics for parents
Ensuring application features work correctly (device pairing, communication)
Processing Premium subscription payments
Improving service quality and resolving technical issues
Locking the child's device during school hours and at night (School Mode, Bedtime Mode)
Analysing website traffic and improving user experience
Sending push notifications about security events
Detecting and resolving technical errors

5. Legal Basis for Processing

Art. 6(1)(a) GDPR — user consent (parent/guardian)
Art. 6(1)(b) GDPR — performance of a service contract (including payment processing)
Art. 8 GDPR — parent/guardian consent for processing a child's data

Data of children under 16 years of age is processed only with the explicit consent of a parent or legal guardian, in accordance with Art. 8 GDPR.

6. Data Retention Periods

Location data — retained for 7 days, then automatically deleted
Real-time location data — retained for 15 minutes
Last known position — retained until account deletion
Screen activity data — retained for 30 days
App usage statistics — retained for 30 days (if enabled)
Account data — retained until the user deletes their account
Payment transaction data — retained for 5 years (tax obligation)
System logs — retained for 14 days for diagnostic purposes
School Mode / Bedtime Mode schedules — retained until deleted by the parent
Website analytics data (page tracker) — retained for 90 days
FCM token — retained until logout
Sentry error reports — retained for 30 days

7. Data Sharing

Personal data is not sold or shared with third parties for marketing purposes.

Data may be shared only with:

Family members as part of the app's functionality (location on the family map)
Technical service providers (hosting, databases) under data processing agreements
PayU S.A. (ul. Grunwaldzka 186, 60-166 Poznan, Poland, Tax ID: 779-23-08-495) — payment processor under a data processing agreement. Data shared: email address, IP address, transaction amount
Google LLC (Google Analytics, Google Tag Manager, Firebase) — analytics and push notifications, under standard contractual clauses
Functional Software Inc. (Sentry) — technical error monitoring, under a data processing agreement
Law enforcement — only pursuant to a valid court order

8. Data Security

We implement appropriate technical and organizational measures to protect data:

Encryption of data in transit (TLS/HTTPS)
Encryption of data at rest (AES-256)
Two-factor authentication (optional)
Regular security audits
Access restricted to authorized personnel only

9. User Rights

Under the GDPR, users have the following rights:

Right of access — the right to obtain information about processed data
Right to rectification — the right to correct inaccurate data
Right to erasure — the right to request deletion of data ("right to be forgotten")
Right to restriction of processing — the right to limit how data is used
Right to data portability — the right to receive data in a structured format
Right to object — the right to object to data processing
Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out prior to the withdrawal

To exercise any of the above rights, please contact us at: noreply@michal.kids

10. Data Deletion (how to delete your data)

You may delete your account and all associated data at any time:

In the app: sign in to MichalKids → Settings → Privacy & Data → Delete account. Your account and the parent's and child's data are deleted.
By email: write to noreply@michal.kids with the subject "Data deletion", stating your account email address. We process the request without undue delay, at the latest within 30 days.
Via the form: michal.kids/#feedback — choose "Data deletion".

After account deletion we permanently erase the parent's and child's personal data (location data, account, schedules). Data we are legally required to keep (e.g. payment provider billing records) is retained only for the required period and then deleted.

Facebook Login (optional): if you choose to sign in or register with Facebook, we receive from Facebook only your email address, your name, and your Facebook account identifier (Facebook ID). We use these solely to create and sign you in to the parent account — we do not pull your friends list, posts, or any other Facebook data. You can remove the Facebook link at any time: send a data-deletion request via any of the methods above, or revoke the app's access in your Facebook settings. We also honor automated data-deletion requests initiated by Facebook (Data Deletion Callback).

11. Complaints

If you have concerns about the processing of your personal data, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO):

Urzad Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warsaw, Poland https://uodo.gov.pl

12. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy. Users will be notified of material changes via the Application or email.

13. Contact

If you have any questions regarding this Privacy Policy or the processing of personal data, please contact us:

DevOps Jakub Pazdyga Email: noreply@michal.kids Feedback form: michal.kids/#feedback Website: https://michal.kids