Privacy policy

Version 2026-09-11

Who we are

FamilyKite ("the app") is a parental control and activity time app. The app’s developer is the data controller for the personal data described here. The developer’s contact details are shown on the app’s Google Play store page, and requests under this policy can be sent there.

Who the app is for

A parent creates the account, creates child profiles, and decides whether a child’s Android phone is connected. Children use only the child screens a parent set up for them.

The app is designed only for parents to supervise their own children. It must not be used to monitor another adult.

What we collect

• Parent account: name, email address, and a password handled by our authentication provider.

• Child profile: display name and username created by the parent.

• Activity time photos: only a photo a parent chooses to show on an activity time.

• Avatar photos: only a photo a parent chooses from their own library as their avatar or a child's, on iPhone. Cropped to a small square on the phone and visible only to the family.

• From a connected child Android phone: the list of apps that can be opened from the home screen (name and package name), how long each app was used that day, the phone’s name and time zone, a random installation code, a security key that proves requests come from that phone, and which protection settings are on or off.

• Extra-time requests a child sends and the short note they add, and the parent’s answer.

• A notification token so the app can deliver notifications.

• On iPhone, from a parent’s own use of the app: which screens are opened and which features are used (for example that an activity time was started, never its title), and technical crash reports. They are tied to a random app-installation identifier and the parent account’s ID. Nothing is recorded while a child is signed in, and a parent can turn this off under Account → Privacy and data.

What we never collect

We never read or collect messages, typed text, screen content, photos or files other than the activity time or avatar photo a parent picks, contacts, location, browsing history, or audio. The app contains no advertising, uses no advertising identifiers, and never sells data or shares it for advertising. Usage statistics never contain names, app lists, activity time titles, messages, or anything a child does.

Phone permissions and how they are asked

Before each permission the app explains why it is needed, what it uses, and how, and the person can choose “Not now”. Declining turns off only the feature that needs it.

• Usage access: measures how long each app is used so the parent’s daily limits work.

• App blocking (Android accessibility): notices which app has just opened so the break screen can appear over a paused app. It sees only the app’s name at that moment — never what is on the screen or what is typed.

• Notifications and background running: keep a permanent notification visible while protection is on, and keep the parent’s rules working while the phone sleeps.

While a phone is connected, a notification on it always says that protection is on, and the child can see the parent’s rules in the app.

How we use it and on what basis

We use the data only to run the service: applying the parent’s rules, showing app time to the parent and the child, delivering notifications, keeping the connection between the phones secure, and managing accounts.

Data about a child is processed on the explicit consent the parent gives in the app, as the person with parental responsibility, before a phone is connected (KVKK Article 5(1); GDPR Articles 6(1)(a) and 8). The parent’s own account data is processed to provide the service they signed up for (KVKK Article 5(2)(c); GDPR Article 6(1)(b)).

Usage statistics and crash reports from a parent’s use of the iPhone app are processed to keep the app working and to improve it (KVKK Article 5(2)(f); GDPR Article 6(1)(f)). A parent can turn them off at any time.

The app records who agreed, to what, when, and under which version of this policy, so that consent can be shown later.

Who processes data for us

Supabase stores the data and handles sign-in. Expo’s notification service and Google Firebase Cloud Messaging deliver notifications. Google Firebase (Analytics and Crashlytics) receives the usage statistics and crash reports from the iPhone app. Google Play distributes the app. They process data only to provide these services. Where a provider processes data outside Türkiye, the transfer relies on the safeguards required by KVKK Article 9 and GDPR Chapter V.

How long we keep it

• Installed-app list and daily app time from a paired device: deleted 35 days after the device last reported it.

• Protection status reports (for example, a permission being turned off): 90 days.

• Notification delivery records: 30 days.

• One-time device security checks: 1 day.

• Extra-time requests, their notes and answers: 90 days.

• Daily time-sharing records: 90 days.

• Activity time history (when an activity time was added, started and ran out, with its title and length): 90 days.

• A device's remaining settings after it is unpaired: 30 days. Its app list and app time are deleted at the moment it is unpaired.

• Account, child profiles, rules, activity time and avatar photos, and consent records: until the account is closed, plus 30 days so it can be reopened on request; then deleted.

• Usage statistics from the iPhone app: up to 14 months at Google Firebase. Crash reports: 90 days.

Your choices and rights

• Turn off any phone permission in Android settings at any time; the parent is told that protection is incomplete.

• Turn off usage statistics and crash reports on an iPhone from Account → Privacy and data.

• Disconnect a child’s phone from the parent’s device card: its app list and app time are deleted at once.

• Delete a child account from Account → Children.

• Close the whole family’s account from Account → Close my account: sign-in stops at once, the data is kept for 30 days so the account can be reopened on request, then it is deleted.

You can also ask to access, correct, or delete your data, or object to its processing, under KVKK Article 11 and the GDPR. You can complain to the Personal Data Protection Authority (KVKK) or your local data protection authority.

Security

All traffic is encrypted in transit. Each family can reach only its own data. Rule changes sent to a child’s phone are signed, and the phone rejects any change it cannot verify.

Changes to this policy

When this policy changes in a way that affects what is collected, the version above changes and the app asks for agreement again before continuing.