MichalKids Privacy Policy
Last updated: October 26, 2026
1. Introduction
MichalKids ("Application", "we", "us") processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Polish data protection legislation.
This Privacy Policy describes what data we collect, for what purpose and on what legal basis, how long we keep it, who we share it with, and what rights the data subjects – parents, guardians and children – have.
2. Data Controller
The data controller is DevOps Jakub Pazdyga, registered office: ul. Powstańców Śląskich 57a, 44-361 Syrynia, Poland, Tax ID (NIP): 2220682818, REGON: 241415540.
For matters relating to personal data protection, you can contact us:
- Email: support@michal.kids
- Feedback form in the parent dashboard (after signing in): michal.kids/app#feedback
The address noreply@michal.kids is used only for sending messages – please do not send requests to it.
3. What Data We Collect
3.1 Children's data (with parent/guardian consent)
- Location – GPS coordinates and their accuracy, collected periodically and when the position changes, to keep the child safe
- Child's name and age group – provided by the parent when adding the child
- Child's phone number (optional) – entered by the parent or another adult family member in the child's profile; used to show adult family members a "Call" button on the SOS alarm screen – the parent places the call from their own phone. We do not send text messages to this number, do not call it automatically and do not verify it. An adult family member can change or remove it at any time, and the child sees only their own number (not those of siblings); we delete it when the child is removed from the family or the account is deleted
- Device status – battery level and charging, screen state (on, unlocked), phone model, operating system and app version
- Foreground app – the name of the app the child is currently using and a list of recently launched apps (Android)
- Wi-Fi and mobile network – name and address of the Wi-Fi network the phone is connected to, names and addresses of nearby Wi-Fi networks (scanned roughly every 30 minutes on Android), mobile carrier and network type
- Nearby Bluetooth devices – address, name, manufacturer and signal strength of Bluetooth devices detected around the child's phone (Android). Used to recognise context, e.g. "at home" or "in the car". These may be devices belonging to third parties. To detect devices that often accompany the child, we store only a cryptographic hash of the address, without the device name
- Domain names (Windows computer) – the app for the child's Windows computer collects the domain names requested by browsers and apps (without IP addresses)
- Consents – the content of consents given by the parent to the processing of the child's data, the date, and the IP address and browser from which consent was given
- Games and Academy – we record when the child or parent opened a game or a lesson, on which device and what the score was (number of points), to check that the games and lessons are understandable and work. We do not record the child's answers. We delete the data about openings after 180 days. We keep Academy progress (completed lessons, scores, certificates) until the account is deleted, so that the child and the parent can see it.
- Today's task: we record which task from the games or the Academy we suggested to the child and whether it was done. We delete the data after 180 days.
3.2 Parent/guardian data
- Email address – for account registration and communication
- First and last name – for identification within the family
- Password – stored only as a cryptographic hash; we do not store the password in plain text
- Phone number (optional) – to verify the number, send SMS codes, and notify you of your child's SOS alarm by SMS and voice call. You can remove the number yourself in settings
- Sign in with Google (optional) – Google account identifier, email address, first and last name, and profile photo URL
- Sign in with Facebook (optional) – Facebook account identifier, email address, first and last name. We do not download your friends list, posts or any other Facebook data
- How you heard about us (optional) – one answer from a closed list, chosen on the screen after sign-up, and a note that the screen was shown or skipped. We use it only to assess which channels reach parents; we do not collect free-text answers.
- Parent location (optional) – for display on the family map and when you send your child the “All OK?” question: at the moment you send it, the app attaches your current position once – only if it already has your permission to access location (we do not ask for a new permission and do not track you in the background). We keep this position together with the question for 30 days. In Settings you have the option “Show my child where I'm asking from”. Unless you turn this option off, your child will see, with that question, the name of the family zone you are in (e.g. “Home”) or your approximate distance from them – never your exact address or coordinates.
- Technical data – IP address and browser information when you sign in and use the service
3.3 Background Location
The Application may use the child's device location even when the app is closed or the phone is locked. This feature is activated only by the parent/guardian and is used to deliver real-time safety alerts:
- Entering and leaving safe zones (geofence)
- Turning on School Mode when the child enters the school zone
- Deviation from a planned route
- Quick status in SOS situations
- Safety features working even when the app is closed or the device is locked
Family members can see locations in the Application. The child can also see the collected data in their own app.
Zone exit log (feature in preparation). When the system confirms that a child's phone has left a safe zone, we record the zone it left and the time. We then record the first confirmed entry of that phone into any zone within 3 hours (including a return to the zone it left). The log is meant to be used to calculate how long the child's journey between zones usually takes (e.g. from school to home), separately for weekdays and weekends, and then for the “didn't arrive on time” alarm when a child does not reach the destination in the usual time. Calculating these times and detecting delays are in preparation; nobody – neither the parent nor the child – receives any notifications based on the log. The log contains no coordinates: it contains device, family and zone identifiers, event times and technical information about the detection and the outcome of the journey. We keep the data for 180 days (section 6).
How to turn it off: Background location can be turned off at any time in the phone settings (Settings → Apps → MichalKids → Permissions → Location → "Allow only while using the app" or "Don't allow"). Restricting this permission may make some safety features unavailable (zone alerts, School Mode).
Retention: location points are kept in the app database for 30 days. Kept longer: the last copy of the location analytics archive (until 25.11.2026, without names or account identifiers), the timeline of visited places (90 days after the stay or journey ends), the child's journeys (until the device, child or account is deleted) and the child's trips with the travel journal (until the child or account is deleted). Section 6 gives the details.
3.4 App Usage Statistics
On a child's Android device, the Application may collect app usage statistics. This requires granting the system permission "Usage access" on the child's device.
What we collect: the app name and how long it was used in each hour, the app category (e.g. games, education, social media).
Apps at places on the map and timeline: next to visited places and route segments we show which app the child used in the foreground and for how long – only continuous use lasting at least 2 minutes. The Premium plan shows the app name; other plans show only its category (e.g. messaging, game, camera). On Android without the "Usage access" permission we show only the periods when the phone was unlocked, without the app name. On iPhone, Apple does not make the foreground app available, so we do not show it. Exception: on an iPhone with iOS 26.4 or later, signed in with an Apple Account from an EU country, a parent can agree on the child's phone (confirming with their own Apple ID) to share Screen Time data with us. The phone then periodically sends how many minutes each app took in each hour (app identifier and name, category assigned by Apple), and on the map and timeline we show hourly bands ("this hour mostly: …") – without the times individual apps were opened, without content and without visited websites. Apple allows this for only one app at a time, so after this consent the built-in Screen Time on that iPhone stops collecting new data. Sharing can be paused in the MichalKids app on the child's phone, and consent can be withdrawn in the Screen Time settings. Combining place, time and the kind of activity on the phone is profiling within the meaning of the GDPR: it serves only to inform the family and does not lead to automated decisions with legal effects. The overview is built from device events and we keep it as long as those events (section 6) – no content, only the app or category and the time.
What we do NOT collect: content displayed in apps, messages, calls, browsing history.
The child sees the same data in their app. The permission can be revoked at any time in the child's phone settings.
3.5 Screen Time Budgets (feature in preparation)
This section concerns a feature that is in preparation. We process the data described here only once the feature is switched on – we will let you know in the app.
The parent can set daily and weekly screen time limits for app categories. We store the limits, one-off extensions granted by the parent, and the history of limit notifications.
3.6 School Mode and Bedtime Mode
The parent can set schedules for School Mode (during lessons, in the school zone) and Bedtime Mode (at a set evening time). These modes limit distractions on the child's phone but do not fully lock the device:
- iPhone: if the parent has granted Screen Time permission, other apps and websites are covered by a system shield. MichalKids with the SOS button and the system Phone and Messages apps remain available. Without this permission, the mode does not restrict apps
- Android: the app shows a full-screen mode screen with an SOS button. This is not a system lock – the screen makes other apps harder to use but does not guarantee the child cannot open them
- SOS is always available during the mode
- Turning on: by schedule, when entering the school zone, or when connecting to a school Wi-Fi network specified by the parent
- Parent PIN: ends the mode early on the child's phone; stored only as a cryptographic hash
- Data collected: schedules (days of the week, times), school zone, school Wi-Fi network names (optional), child identifier
3.7 The Child's Conversation with the "Michal" Assistant (AI)
The child can talk in the app with the "Michal" assistant, which is based on an artificial intelligence model.
- Conversation content – the child's messages and the assistant's replies. Content is encrypted in the database (AES-256-GCM). To generate a reply, the content is sent to an AI model running in Microsoft Azure (Azure OpenAI) in the European Union (section 7)
- Voice – if the child speaks to the assistant, the recording is converted to text by Google Speech-to-Text in the EU (until 26 October 2026) or by Microsoft Azure in the EU. We do not store recordings
- Moderation – questions the assistant declined to answer are stored in an encrypted moderation log
- Crisis signal – if the conversation suggests that the child may be in danger, the parent receives a notification. The notification does not contain the conversation content. The content of messages flagged as a crisis may be read by an authorised MichalKids administrator to assess the child's safety
- Deleting the conversation – the "clear conversation" command deletes the messages immediately
Voice commands (a feature in preparation) given in the app are stored as text transcripts. We process this data only once the feature is switched on – we will let you know in the app.
3.8 Parent Assistant and AI Features
The parent can use a chat with the assistant ("Guardian Angel"), daily summaries and tips. To prepare a reply, the assistant uses family data (e.g. location, alerts, zones) and sends it to an AI model in Microsoft Azure (Azure OpenAI) in the EU (section 7). We keep the content of the parent's conversations with the assistant until the account is deleted.
3.9 Routes, Journeys and Travel Journal
- Planned routes – route points set by the parent and journey status
- Journeys – detected journeys of the child with stops
- Trips and travel journal – departure and return dates, destination town and its coordinates, visited places with addresses, stop and travel times, distance travelled, number of nights
3.10 Payments
When a paid plan is purchased, data is passed to the payment operator chosen by the user:
- PayU S.A. – email address, first and last name, phone number, IP address, amount and order number
- Revolut – amount, currency and order number; the user enters card details directly in the Revolut form
- Google Play and Apple App Store – the purchase takes place in the store; we receive a purchase confirmation (transaction and product identifier)
We keep the transaction history, subscription status and invoice details, if the user provides them.
We do not receive card numbers, CVV/CVC codes or bank account details – they are entered directly with the payment operator.
PayU privacy policy: https://www.payu.pl/polityka-prywatnosci
3.11 Cookies and Analytics Technologies
Consent banner. On the first visit to michal.kids we show a consent banner. Until you choose, only strictly necessary mechanisms run. Analytics and marketing tools start only after consent:
- After analytics consent: Google Tag Manager (GTM-KWWQ26TP), Google Analytics 4 (G-SD1V8RHV2R), Firebase Analytics (in the browser)
- After marketing consent: Google Ads (AW-18024408795), Meta Pixel, TikTok Pixel and storing ad click identifiers (gclid, fbclid, ttclid) for 90 days
Withdrawing consent: at any time via the "Privacy settings" link in the page footer or in the app under Settings, in the privacy section. After withdrawal, advertising identifiers are removed from the browser.
Runs without consent:
- Our own site measurement – a session identifier in the browser's sessionStorage (not cookies), page views, time on page, scroll depth, clicks, page errors and referral source; the server adds the IP address and browser and, after sign-in, the user identifier. Purpose: analysing and improving the service
- Installation and child's phone connection measurement – when you open an invitation link or launch the app for the first time, we record a random installation identifier, the source category (e.g. invitation link) and the phone connection stages (link opened, app launched, request sent, first location). Once the phone is connected, we link these stages to your family. Purpose: to find and fix the places where connecting the phone fails. We delete the data together with the account.
- Notifying Meta about opening the demo – when someone opens the demo version of the app, our server sends Meta the IP address, browser information and ad click identifiers
- Firebase Analytics in the Android app – collects app identifiers and usage events
- Google Fonts – when a page is displayed, the browser downloads fonts from Google servers, which receive the IP address
Registration and advertising. If the user has given marketing consent, at registration we send Meta and TikTok a hash (SHA-256) of the email address together with the ad click identifier, and Google Ads only the ad click identifier (gclid). Purpose: measuring advertising effectiveness.
3.12 Push Notifications
The Application sends notifications via Firebase Cloud Messaging (Android) and Apple Push Notification service (iPhone).
- Notification types: safety alerts (SOS – with the child's name and place, leaving a zone), crisis signal, device pairing request, reminders
- Notification token stored on the server until sign-out, device removal or account deletion
- Notifications can be turned off in the phone settings
3.13 Error Monitoring
The Application uses Sentry for automatic reporting of technical errors. Data is stored in the EU region (Germany).
- Data collected: error type, stack trace, page or screen address, device model, system and app version
- Limits: the server removes, among others, email addresses, phone numbers, the child's name, addresses, coordinates and tokens from reports. Reports from the browser and mobile app do not go through such filtering and may contain the address of the visited page
- Purpose: quickly detecting and fixing technical problems
3.14 Feedback and Diagnostics
- Feedback sent via the form – feedback content, email address, technical data
- Emails to our help addresses (support@, pomoc@, kontakt@, contact@michal.kids) – we save a copy of the message as a feedback ticket: subject, text without the quoted earlier correspondence, names and sizes of attachments (we do not store the attachments themselves). The sender's address is stored encrypted. An AI model running in the EU makes a first assessment of the text so that urgent matters, especially about a child's safety, are spotted sooner. A person replies. One exception: to a message that may concern a child in danger we may immediately send one automatic sentence with the emergency number 112 and the free child helpline 116 111
- App diagnostics – pseudonymous reports on the app's state on the device (without user content)
3.15 Measuring Messages to Parents
For every message we send to a parent (email, push notification, tip in the dashboard), we store its metadata: the channel, the message type (template), its goal – the step the message suggests (e.g. adding a child, pairing a phone, acknowledging an SOS alert) – the account and family identifier, the sending result and the time of sending, delivery, opening, clicks and any bounce.
- We do not store the message content or the email address
- Purpose: checking whether messages help parents take the step they need, and improving messages that are unclear
- Retention: 30 days from sending, then deleted automatically; earlier when the account or family is deleted
3.16 App Distribution
- Android – via Google Play
- iPhone – via the App Store
- Windows computer (child app) – installer downloaded from the parent panel; the app automatically checks for and downloads updates
3.17 Emails: what we send and how to opt out
- System messages – alerts and SOS alarms, warnings about your child's safety (e.g. that the child's phone has stopped sending its location or that an alarm will not get through), address confirmation, password reset, payments, changes to the Terms. They are part of the service (Art. 6(1)(b) and (c) GDPR), so they have no unsubscribe link. You can turn off email alerts in Settings → Notifications; deleting the account stops all system messages
- Account reminders – e.g. to add a child, pair a phone or finish setting up. We send them on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Each one has an "I don't want account reminders" link; you can also turn them off in Settings. Once turned off, we do not send them
- News and offers – sent only with your consent (Art. 398 of the Polish Electronic Communications Law, Art. 6(1)(a) GDPR), given at registration or in Settings. You can withdraw consent at any time via the link in every such email or in Settings. Withdrawal takes effect from that moment
- We record the version and wording of the consent, the date it was given and withdrawn, and the date reminders were turned off – to show what you agreed to and to respect your choice
3.18 How we learned about the installation (installation source)
When you install the app from Google Play, the store may tell the app which link or ad the installation came from (Google Play Install Referrer). Once after installation we record on your account: the name of the source, medium and campaign (utm parameters, e.g. "google / cpc / campaign name"), whether the link contained an ad click identifier (only "yes" or "no" – we do not store the identifier itself), the time of the click and of the start of the installation, and the result of the read. From the child's phone we send only the technical result of the read and whether the installation comes from a pairing link – without campaign names.
We use this solely to assess which channels reach parents, and we do not pass this data to advertising networks. You have the right to object to such processing (section 9).
4. Purposes of Processing
Data is processed for the following purposes:
- Enabling parents to check their children's location and look after their safety
- Displaying the status of the child's device (battery, activity, connection)
- Notifying about entering/leaving safe zones and about SOS alarms (push, SMS, voice call)
- Detecting that a child has not reached the destination in the usual time (“didn't arrive on time”, feature in preparation – currently without notifications)
- Limiting distractions in School and Bedtime Mode and handling screen time budgets (feature in preparation)
- The child's conversation with the "Michal" assistant and detecting crisis signals
- Parent assistant, summaries and tips
- History of routes, journeys and trips
- Ensuring the Application's features work (sign-in, device pairing, communication)
- Processing payments and issuing accounting documents
- Handling feedback and requests
- Service security, abuse prevention, detecting and fixing errors
- Analysing website traffic and improving the service
- Measuring advertising effectiveness (with consent)
- Assessing the effectiveness of the channels through which parents reach the app (installation source)
5. Legal Basis for Processing
- Art. 6(1)(a) GDPR – consent: the child's data (location, device data), analytics and marketing on the website (consent banner), ad effectiveness measurement at registration (marketing consent from the banner), news and offers by email (separate consent, section 3.17)
- Art. 6(1)(b) GDPR – performance of a contract: running the account, app features ordered by the parent, payments
- Art. 6(1)(c) GDPR – legal obligation: accounting and tax documents
- Art. 6(1)(f) GDPR – the controller's legitimate interest: service security and abuse prevention, error monitoring (Sentry), system logs and backups, our own site measurement, measuring the effectiveness of messages to parents, account reminders by email (section 3.17), keeping the service working during outages (backup infrastructure and backup map, section 7), establishing, exercising and defending legal claims. You have the right to object to processing on this basis (section 9)
- Art. 6(1)(f) GDPR – the controller's legitimate interest: measuring the effectiveness of user acquisition channels (installation source, section 3.18). You have the right to object (section 9).
- Art. 8 GDPR – parent/guardian consent to the processing of the child's data
Data of children under 16 years of age is processed only with the consent of a parent or legal guardian, in accordance with Art. 8 GDPR. The parent gives consent when adding the child.
6. Data Retention
| Data | Retention period |
|---|---|
| Location and events from family members' devices (the child's, and the parent's if they share their location) in the app database | 30 days, then automatically deleted |
| Raw GPS readings in the app database | depending on the plan: Free 3 days, Standard 14 days, Premium 30 days; then deleted automatically |
| Location analytics archive – we no longer send new data to it. Its last copy remains in Microsoft Azure (EU, Poland): children's and parents' devices, without names or account identifiers, with a pseudonymous device and family identifier and exact coordinates | we delete the whole copy by 25.11.2026 at the latest; before that, we delete data from it after account deletion |
| Real-time data | 15 minutes |
| Last known device position | until the device or account is deleted |
| Timeline of places – visited places with coordinates, times of stay, type of activity (e.g. walking, driving), driving segments with speed and the number of nearby devices, with daily summaries | 90 days after the stay, journey or session ends (for ongoing ones – after the last update), then automatically deleted – including data of a removed device; sooner on request (section 10) |
| Battery history | 7 days |
| Nearby Bluetooth devices (address hashes) | 30 days |
| Alerts (zones, SOS, battery) | 90 days |
| Zone exit log and the typical journey times between zones calculated from it (“didn't arrive on time” feature in preparation; no coordinates) | 180 days, then deleted automatically (typical journey times – 180 days from the last recalculation); earlier when the exit zone, device, child or account is deleted |
| Completed planned routes | 90 days (route templates – until deleted by the parent) |
| The child's journeys, trips and travel journal | no time limit – journeys until the device, child or account is deleted; trips and travel journal until the child or account is deleted |
| App usage statistics (app name, category and usage time per hour) | 30 days, then automatically deleted |
| Games and Academy – openings of games and lessons, device and score (number of points) | 180 days |
| Today's task – task from the games or the Academy suggested to the child and whether it was done | 180 days |
| Academy progress (completed lessons, scores, certificates) | until the account is deleted |
| Screen time statistics | until the device or account is deleted |
| Screen time budgets (feature in preparation) | until deleted by the parent, or the child or account is deleted |
| The child's conversation with the "Michal" assistant and moderation log | 90 days; earlier after "clear conversation" (moderation log – 90 days) |
| The parent's conversations with the assistant | until the account is deleted |
| AI model request log (quality control) | 30 days |
| Voice command transcripts (feature in preparation) | no fixed period (section 10) |
| School/Bedtime Mode schedules | until deleted by the parent |
| Parent consents | until the account is deleted |
| Consent to news and offers, turning off reminders (with history of changes) | until the account is deleted |
| Account data | until the account is deleted |
| Transaction history and invoice details in our database | until the account is deleted |
| Feedback sent via the form or by email | 365 days |
| App diagnostics | 30 days |
| Metadata of messages to parents (channel, template, goal, delivery, open and click times; no content or address) | 30 days from sending |
| Our own site measurement | 7 days in the app database, then deleted automatically; data sent earlier to the analytics archive (email address only as a hash) is kept in its last copy until 25.11.2026 |
| Installation source (Google Play Install Referrer data, section 3.18) | 13 months, then only aggregate data not linked to an account |
| System logs | 30 days |
| Database backups | the last 7 daily backups |
| Push notification tokens | until sign-out, device removal or account deletion |
| Sentry error reports | according to the Sentry service settings |
7. Recipients of Personal Data
Personal data is not sold.
Data is shared with:
- family members as part of the Application's features,
- public authorities – only where required by law,
- the entities listed below.
| Entity | Role | Purpose | Data | Place of processing |
|---|---|---|---|---|
| Google (Google Cloud: database copy until 25.10.2026) | processor | database backup copy | all service data | EU (Warsaw, europe-central2) |
| Microsoft (Azure OpenAI: GPT models running in Azure) | processor | conversation with the "Michal" assistant, parent assistant, summaries and tips, first assessment of a conversation for signs of danger, first assessment of feedback | conversation and feedback content, family data needed for a reply | EU (Sweden, processing only in the EU) |
| Google (Speech-to-Text) | processor | speech-to-text conversion | voice recording (not stored) | EU (until 26.10.2026) |
| Microsoft (Azure: hosting – servers and database, last copy of the analytics archive until 25.11.2026, Key Vault) | processor | hosting and data storage (the last copy of the analytics archive is deleted in full by 25.11.2026 at the latest) | all service data | EU (Poland, Poland Central region) |
| Google (Google Maps Platform: Maps, Geocoding, Places) | independent controller (does not act on our instructions; processes data under the Google Maps Platform terms, the Google Controller-Controller Data Protection Terms and its own privacy policy: policies.google.com/privacy) | addresses and place names, map | coordinates | possible transfer to the USA – based on the EU-U.S. Data Privacy Framework (Google certification) or standard contractual clauses |
| Hyperknot Software Kft. (OpenFreeMap, OpenStreetMap data) | independent controller | backup map when Google Maps does not load | IP address, area of the displayed map (tile coordinates) | Hungary (EU); the provider may use the Cloudflare network – possible transfer outside the EEA |
| Cloudflare (R2, cdn.michal.kids) | processor | storage of app files: backup copy refreshed hourly and delivery (profile photos, report attachments, app and blog files), serving files during outages; second backup map – MichalKids' own map tiles | profile photos, report attachments; when downloading files and the map – IP address, area of the displayed map (tile coordinates) | files stored in the EU; delivery via the Cloudflare network – possible transfer outside the EEA (USA) |
| Google (Firebase Cloud Messaging, Firebase Analytics, Google Analytics, Google Tag Manager, Google Ads, Google Fonts, Sign in with Google) | processor or independent controller – depending on the service | push notifications, analytics, ad measurement, sign-in | device token, notification content, analytics data, gclid, IP address, sign-in data | possible transfer outside the EEA (USA) |
| Google Play | independent controller | selling subscriptions in the store | purchase data | according to Google's policy |
| Apple (App Store, Apple Push Notification service) | independent controller (App Store) / processor (notifications) | selling subscriptions, notifications on iPhone | purchase data, device token, notification content | possible transfer outside the EEA (USA) |
| Twilio Inc. | processor | SMS (codes, SOS alarm), SOS voice calls | phone number, SMS and message content (child's name, place) | USA |
| Twilio SendGrid | processor | sending emails; receiving copies of messages sent to our help addresses | email address, message content | USA |
| Functional Software Inc. (Sentry) | processor | error monitoring | error reports | EU (Germany) |
| OpenAI | processor | automatic blog texts (no personal data); fallback model for analysing feedback when EU models are unavailable | feedback content | USA |
| Notion Labs Inc. | processor | handling feedback | feedback content, email address | USA |
| GitHub Inc. | processor | fixing errors reported by users | feedback content | USA |
| OpenStreetMap Foundation (Nominatim) and public OpenStreetMap servers (Overpass, OpenRouteService) | independent controller | place names, nearby points, route planning | coordinates | according to the provider's policy |
| ipapi.co | processor | determining the city from the IP address in statistics | IP address | according to the provider's policy |
| PayU S.A., ul. Grunwaldzka 186, 60-166 Poznań | independent controller | payments | email, first and last name, phone, IP, amount | Poland |
| Revolut | independent controller | payments | amount, currency, order number; card details entered with Revolut | according to Revolut's policy |
| Meta Platforms (Facebook) | independent controller | Sign in with Facebook, ad measurement (Meta Pixel, Conversions API) | sign-in data, page events, email hash, click identifiers, IP, browser | possible transfer outside the EEA (USA) |
| TikTok | independent controller | ad measurement (TikTok Pixel, Events API) | email hash, click identifier, page events | possible transfer outside the EEA |
Backup infrastructure. The service's primary infrastructure (application servers, the main database, keys in Azure Key Vault) runs in Microsoft Azure (Poland Central region, Poland, EU). In addition, we maintain in the EU: until 25 October 2026, a copy of the database in Google Cloud (Warsaw), refreshed every 6 hours (all account and family data), and – until 25.11.2026 – the last copy of the analytics archive in Microsoft Azure (Poland Central region), plus a copy of app files (including profile photos and report attachments) in Cloudflare R2 (files stored in the EU), refreshed hourly. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) – keeping a child safety service working. The database copy in Google Cloud is refreshed every 6 hours, so data deleted from the service disappears from it at the next refresh at the latest. The file copy is refreshed hourly, so data deleted from the service disappears from it within an hour. We no longer refresh the last copy of the analytics archive: we delete data of deleted accounts from it separately, and we delete the whole copy by 25.11.2026 at the latest. Microsoft may retain the content of requests for up to 30 days to detect abuse, within the EU data zone.
Backup map. Google is our primary map provider. When Google Maps does not load (e.g. during an outage), the parent panel in the browser and the Android app (in versions that have the backup map) show a backup map: first OpenFreeMap (OpenStreetMap data) and, if that is unavailable too, MichalKids' own map tiles from cdn.michal.kids (Cloudflare, files stored in the EU). The browser or phone then downloads map fragments (tiles) directly from these servers, which see the IP address and the area of the displayed map (tile coordinates). That area usually covers the surroundings of where the child is, but we do not send these providers names, account or device identifiers, or the child's position – the child's marker is drawn on the device. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) – keeping a child safety service working when the primary map fails. OpenFreeMap privacy policy: openfreemap.org/privacy.
Transfers outside the European Economic Area. Some of the recipients listed process data in the USA or other countries outside the EEA (column "Place of processing"). Information about the safeguards applied to a given transfer and how to obtain a copy of them is available by writing to support@michal.kids.
8. Data Security
We apply technical and organisational measures to protect data, including:
- Encryption of data in transit (TLS/HTTPS)
- Encryption of data at rest in Microsoft Azure
- Additional encryption of selected data in the database (including email address, phone number, the child's name, the content of the child's conversation with the assistant)
- Passwords stored only as cryptographic hashes
- Access to data limited to authorised persons
9. Rights of Data Subjects
Under the GDPR, parents, guardians and children have the following rights:
- Right of access – to obtain information about the data processed and a copy of it
- Right to rectification – to correct inaccurate data
- Right to erasure – to request deletion of data ("right to be forgotten")
- Right to restriction of processing
- Right to data portability – to receive data in a structured format
- Right to object – to object to processing based on legitimate interest (including the measurement of the installation source); just write to the address in section 13 and we will remove this link to your account
- Right to withdraw consent – at any time, without affecting the lawfulness of processing before withdrawal
To exercise these rights, please contact us at: support@michal.kids
10. Data Deletion (how to delete your data)
You have the right to request the deletion of your account and related data at any time. To do so:
- In the app: sign in to the MichalKids app → Settings → Privacy & data → Delete account. The button sends us a deletion request; we delete the account manually after verifying it.
- By email: write to support@michal.kids with the subject "Data deletion", stating the account email address.
- In the parent dashboard (after signing in): michal.kids/app#settings → "Delete account".
We handle the request without undue delay, no later than within 30 days.
After the account is deleted, we delete the parent's and child's account data, including location, devices, consents, schedules, transaction history and trips. Entries in the last copy of the analytics archive (Microsoft Azure, EU) are deleted after account deletion in a separate, later step; we delete the whole copy by 25.11.2026 at the latest. Database backups expire on their own (section 6).
Known limitation: at the time this Policy was updated, some derived data from the child's device – including the timeline of places, detected routines and activities, the history of screen time budget notifications and voice command transcripts (both features in preparation) – is not automatically deleted together with the account. If you want this data deleted, say so in your deletion request.
Store subscription: deleting the account does not cancel a subscription purchased in Google Play or the App Store. Cancel it in the store (Google Play → Payments & subscriptions → Subscriptions; iPhone → Settings → your name → Subscriptions).
Sign in with Facebook: you can remove the Facebook link by sending a data deletion request in one of the ways above or by removing the app's access in your Facebook settings. An automatic data deletion request submitted through Facebook (Data Deletion Callback) disconnects the Facebook account from the MichalKids account; it does not delete the MichalKids account – use the methods above for that.
11. Complaints
If you have doubts about the lawfulness of personal data processing, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence. The lead supervisory authority of the controller is the President of the Personal Data Protection Office (UODO) in Poland:
Urząd Ochrony Danych Osobowych ul. Stawki 2, 00-193 Warsaw, Poland https://uodo.gov.pl
12. Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy. Users will be notified of material changes via the Application or email.
13. Contact
If you have any questions regarding this Privacy Policy or the processing of personal data, please contact us:
DevOps Jakub Pazdyga Email: support@michal.kids Feedback form in the parent dashboard (after signing in): michal.kids/app#feedback Website: https://michal.kids