Privacy Policy

Last updated: 20.10.2026

This policy explains what Kid Monitoring collects, why, how long we keep it, and what you can do about it. It covers the Kid Monitoring mobile app and the services behind it.

The data controller is MONAPP CALABS LIMITED, Anakreontos Street 24, Larnaca, Cyprus. You can reach us at helpdesk@kidmonitoring.com.

1. In short

Kid Monitoring exists so that a family can see where its members are and so that parents can manage a child's screen time. We collect what those two things require and nothing else.

We do not collect the device's text messages or emails, call logs, contacts, photos from your gallery, browsing history, or audio. The only messages we carry are the ones family members send each other in the app — check-ins, their answers, and a child's reason for asking for more time (section 2). We do not sell your data. We do not use it for advertising.

2. What we collect

Account information. Your email address and a password, which we store only in a protected form. Your name, and a profile photo if you choose to add one; each member of the family group can have a photo of their own. The family group's two invite codes — the family's, and one that adds only a child's device — and when each was made.

Device registration. For each phone in your family group: a display name, whether it is registered as an adult's or a child's, the device manufacturer and model, the Android version, the version of the app it runs, when it joined the family group, a random identifier we generate for the device, and a notification token provided by Google so that we can send alerts to it.

Location. The device's latitude, longitude and accuracy, with the time the position was taken. This is collected in the background, including when the app is not open, because a family locator that only worked while the app was on screen would not work at all. The app shows a permanent notification on any device while it is sharing location. Without Premium a device sends its position every 15 minutes — every minute for its first three days in a family group; with Premium, every minute, and at once when a parent asks for it. A device that has restarted keeps sending its position every few minutes before it is first unlocked.

Recent movement. A short trail of positions making up the last 24 hours of movement, so that a parent can see where a family member has been today.

Location history. On a child's device only, one position every 30 minutes, so that a parent can see where their child has been over the past weeks and not only today. A position is recorded whether or not the device has moved, and is stored on the device and uploaded when it next has a connection. A parent can switch this off, and can delete all of it, from their own device at any time; it cannot be switched off or deleted from the child's device. Switching it off also stops the notifications about that device going quiet (see "Notification history" below) keeping where it was.

Places, on a child's device only. A parent can mark places on a child's map — home, school, a grandparent's house — each as a name, a position and a size. We record when the child's device arrives at or leaves one of them, and the position that showed it — worked out on our server from the locations the device already reports — and notify the family's parents, who can see that position on a map. It is kept whether or not location history is switched on, because the arrival or departure itself already says where the child was. A parent can also set a time by which the child is expected at a place on chosen days; at that time we check the child's last reported position and tell the parents if the child is not there, or if their device cannot say where it is. Nothing about a place is sent to the child's device.

Speed alerts, on a child's device only. A parent can ask to be told when a child's device travels faster than a speed they choose. Where they have switched this on, the child's device compares the speed its GPS measures with that speed, on the device. Only when it has been faster for 30 seconds does it send that speed to us, with where and when it happened, and the family's parents are notified — at most once every two hours for each child. While the alerts are off, or the device is slower than the parent's speed, nothing about its speed is sent. The device cannot tell who is driving: a child on a bus, a train or in somebody else's car sets it off too, and the notification says only how fast the device was travelling.

Web addresses. On a child's device, and only where a parent has switched web filtering on, the app checks the address of each website the phone tries to open against the categories the parent chose, using lists built into the app. This check happens on the phone. The addresses are not uploaded, not stored and not visible to us or to the parent: we do not build, keep or show a list of the sites a child has visited. What reaches our server is only the parent's own settings — which categories they selected, whether safe search and YouTube Restricted Mode are on, and any sites they added to their allow or block list.

The filter works by intercepting the phone's address lookups using Android's VPN facility. There is no VPN server: nothing is routed to us or to any third party, and the phone's ordinary internet traffic does not pass through the app. Android shows a permanent VPN indicator on the device while it is active.

Parental attestation, for devices set up as a child's. Before a device can be set up as a child's, the adult doing so must confirm that they are the parent or legal guardian of the person who will use it, that the person is under 18, and that it is being set up with their knowledge. The same confirmation is asked for, on the adult's own device, when they make an existing adult member's device a child's. We record the name the adult types and the date they confirmed it, against that device. This is how we evidence that a responsible adult intended the monitoring. With it we record the child's age, in whole years, as that adult gives it — a number from 1 to 17, on the day of the confirmation. We keep it with that record as part of the evidence that the device is a minor's, and so that we know which children are under 13, whose parents the law gives particular rights (section 5). We do not ask for the child's date of birth, we do not check the age against anything, and we do not use it for advertising or to build a profile of the child. The name and the age are visible only to the adults on your own account and are deleted when the device is removed; the age is also removed if the device is later made an adult's.

Device status. Battery level and whether the device is charging, whether Airplane mode, silent mode or battery saver is on, whether the screen is on, whether it is connected to Wi-Fi, and the name of the app currently in the foreground — and, while it shares its location, whether it is still, walking or travelling in a vehicle, which the device works out from its own positions (we keep only the current state, replaced each time the device reports). This is shown to the family so that, for example, a phone that has stopped reporting can be explained, and when a child's device is running low on battery the family's parents are notified. We also record the device's time zone, as its offset from UTC. That is not shown to anyone: it is how a time a parent sets, such as "at school by 8:30", comes to mean that time where the child is.

Connection, location and clock settings, on a child's device only. Whether Airplane mode is on, whether Wi-Fi is switched on, whether the device can reach the internet, whether the system location switch is on, and whether the device sets its date, time and time zone automatically — and, while web filtering or an internet pause is on, whether Private DNS is set to a provider's name, which takes the device's lookups past the filter (we record only that it is, not which provider) — and whether the device has a second profile or user, such as Samsung's Secure Folder, Xiaomi's Second space or a work profile, inside which the app cannot work (we record only that there is one, never what is in it). We record when one of these changes and notify the family's parents, so that a device which has stopped appearing on the map can be told apart from an app that has stopped working — and, for the clock, because screen time follows the device's own date, which can be moved by hand when it isn't set automatically. We also keep the time a child's device last contacted us; when four hours pass without it, not counting the night, the family's parents are told that nothing has been heard from the device, and told again when it is back.

Permissions and uninstall protection. Whether the Android permissions the app depends on are granted — location on every device, and on a child's device also whether that location is precise or only approximate, usage access, web filtering and display over other apps — and, on a child's device, whether uninstall protection is on. On a child's device we also check that the app can still do its job: whether it is exempt from battery optimisation, whether the device let it show its block screen, and whether its protection is running. We record when one of these is turned off or back on and notify the family's parents, because an app that has lost one can look as if it is working when it is not. Uninstall protection is Android's device admin feature, used only so that the app cannot be uninstalled without the family knowing; it gives us no access to anything on the device.

Wi-Fi network name. The name of the network a device is currently connected to, shown to the family alongside the rest of that device's status. We keep only the current one: it is replaced each time the device reports, and cleared when it leaves the network. We do not keep a history of the networks a device has joined, and the app cannot scan for or identify nearby networks it is not connected to. Android treats a network name as location information and only provides it while the device's location permission and location switch are both on; where it is not provided, nothing is recorded and nothing is shown.

Screen time, on devices registered as a child's only. Which apps are installed on the device, which category each falls into, and how many minutes each app was used on each day. This is what the screen time reports and limits are built from. It is collected only where the parent has granted the "Usage access" permission on that device. When a new app is installed on a child's device, the family's parents are told its name, and where a parent has chosen to block new apps it is blocked until they allow it. Every Monday the family's parents are also sent a summary of each child's week before — how long the device was used, how that compares with the week before, and which app was used most — worked out from these same records; nothing more is collected for it.

Settings you create. The limits, schedules, app rules and category rules a parent sets for a child's device; a change to today's limit; a lock or an internet pause, and when it ends; the places and the times a child is expected at them; the speed for speed alerts; the web filter's settings; and whether location history is kept.

Ringing a device. A parent can ring a child's device to find it. The device plays a sound for up to a minute and shows who rang it; we pass on only the request.

Changes in the family group. When a device joins the family group, is removed or deleted from it, signs in or out, or its member switches sharing their location or live location off or on, the family's adults are notified, and the notification is kept in their notification history like any other. When an adult makes a device an adult's or a child's, that device is told who did.

Chores and rewards, on a child's device only. The chores a parent sets for a child — a title the parent types, a kind (chores, homework, reading or other), how many minutes of screen time each one earns, and which days it can be done on or that it is to be done only once — and, for each, when the child last marked it done and whether a parent approved it or sent it back, with that parent's name. An approved chore's minutes are added to that day's screen-time limit. Each of these steps is also a notification to the person it concerns, kept in their notification history like any other.

Requests for more time, on a child's device only. When an app is blocked, a child can ask their parents to allow it for a while: which app, for how long (15 minutes, 30 minutes or an hour), and — only if the child chooses to write one — a short reason in their own words, such as "it's for homework". The request goes to the family's parents as a notification and is kept in their notification history like any other. The reason is the one piece of text in the app that a child writes to their parents; it is optional, limited to a single short line, and shown to nobody outside the family.

Emergency alerts. When someone raises an SOS we record who raised it, when, and where their device was at that moment — or, if it had not found its position yet, the first position it reports within the following half hour — so that it can be shown to the rest of the family. When a family member answers it — that they have seen it, or are on their way — or cancels it, we pass that on to the rest of the family, and it is kept in each device's notification history like the SOS itself.

Notification history. Each notification the app shows is also kept for the device it was sent to, so that one missed while the phone was put away can still be found: what kind of notification it was, who it was about and the name they had at the time, its details (such as a place's name and where the child's device was when it arrived there or left, a battery level, how fast a child's device was travelling and the speed the parent had chosen, a child's screen time for a week and the app they used most, or where someone was when they raised an SOS or a child checked in — added up to half an hour afterwards if their device had not found its position yet) and when it happened. When a parent answers a child's check-in — "Got it", "On my way" or "Call me", fixed phrases rather than a message they write — the answer is kept in the child's history and in the family's other adults', with which check-in it answered. A child's request for more time keeps the reason they gave, if they gave one, in each parent's history. On a child's device with location history switched on, a notification that the device is running low on battery, has been turned off, has lost its connection or its location, or is not at a place by a time a parent set also keeps where the device was last located at that moment, and a speed alert keeps where the device was travelling that fast; with location history switched off, they do not. A device's history can only be seen on that device, and can be deleted from it — one entry or all of them — at any time. Deleting removes that device's copy and nobody else's.

Technical records. Our servers record the IP address of requests for a short period in order to rate-limit sign-in and invite-code attempts, which protects accounts against guessing attacks. Like any web server, ours, and Cloudflare in front of it (section 4), also log each request as it arrives — the IP address it came from, when, and which part of the service it asked for. Server error logs may incidentally contain technical details of a failed request, including the identifier of the device that made it.

When you write to us. If you write to us — from Leave feedback in the app, or otherwise — we receive your email address and what you write. A message from Leave feedback also carries the star rating you chose, the device's manufacturer and model, its Android version and the app's version, which the app adds so that we can help; you can see and change them before you send it.

Password resets. When someone asks the app to reset the password for an email address, and an account uses that address, we email it a link to choose a new password; the app says the same whether or not an account uses it. We keep a record of each link — which account, when it was asked for, the language the app was in, when the link stops working and whether it was used — and the link itself only as a one-way hash, which cannot be turned back into a link that works. When the password has been changed, we email the account to say so. Requests are rate limited by IP address, like sign-ins (see "Technical records").

Purchases. Premium is a subscription bought through Google Play, which takes the payment: we never receive your card details, billing name or address. For each subscription we keep what Google Play gives us to check it and to know who has Premium — a purchase token, the order number, which subscription it is, whether it is active, in its free trial or will renew, when the period paid for ends — and which child's device it covers and which device bought it. We ask Google Play about it when it is bought and as it renews.

3. Why we collect it, and our legal basis

We process account information, location, movement, device status and settings in order to provide the service you asked for — this is processing necessary for the performance of our contract with you.

We process technical records, including IP addresses for rate limiting, on the basis of our legitimate interest in keeping accounts secure and the service available.

Where we rely on consent — for example the Android permissions that allow location and usage access to be collected at all — you can withdraw it at any time by revoking the permission in your device settings, or by turning off location sharing in the app. Withdrawing consent stops future collection; it does not make past collection unlawful.

We keep purchase records because accounting and tax law require it — a legal obligation — as well as to provide Premium.

A child's data is processed on the instructions of the parent or legal guardian who set up the child's device, and who confirmed on that device that they have the authority to do so (section 2, "Parental attestation").

We do not use your data for advertising or profiling, and we make no automated decisions about anyone that have legal or similarly significant effects. The rules the app applies to a child's device — limits, schedules, blocks, alerts — are the ones a parent set, applied as the parent set them.

4. Who we share it with

Your family's data is visible to the members of your family group, and to nobody else's. Within the family group, every member — children included — sees every member's position on the family map; the family's adults also see what the app reports about each child's device, its screen time, and the rest of section 2; a child sees, on their own device, the rules that apply to it (section 5).

Before someone joins. A person who enters a valid invite code is shown the names, photos and roles of the family group's members, so that they can see which family they are about to join. Share a code only with someone you mean to add; it stops working after 48 hours, and making a new one ends the old one.

We use a small number of service providers who process data on our behalf, under contract, and only on our instructions:

• DigitalOcean — hosts our servers and database in the United States.
• Cloudflare — every request between the app and our servers passes through Cloudflare's network, which protects the servers from attack and carries the encrypted connection. Cloudflare receives each device's IP address and, while it carries them, the requests themselves, under its data processing terms.
• Google (Firebase Cloud Messaging) — delivers push notifications to devices. Google receives a device token and the content of the notification, which may include a family member's name, for an emergency alert a location, for a speed alert how fast a child's device was travelling and where, and for the weekly screen-time summary how long a child's device was used and the name of the app used most.
• Google (Firebase Realtime Database and Firebase Authentication) — carries live location. While a parent has the map open, each child's device sends its current position there (latitude, longitude, accuracy and the time it was taken), under a random identifier rather than a name and with a number for its family group, so that only that family's adults can read it, and the parent's device reads it from there. Only the latest position is kept: each one replaces the last, and there is no history. It is deleted when the device is removed from the family or the account is deleted, and so is the sign-in record each device has there — the same random identifier and when it last signed in — within a few hours. Live location can be switched off on each device, under Settings.
• Google (Google Maps) — on a device set to Google's map, which is the default, the map is drawn by Google Maps, part of Google Play services. Google receives the device's IP address and the parts of the map being looked at, under the Google Privacy Policy; the family's positions are drawn on the map by the app, on the device.
• Google (Roads API) — so that a route follows the streets rather than drawing straight lines between positions, our server sends Google the positions of the route being drawn — coordinates only, with no name, identifier or time — and gets back the line along the roads. We keep the result for up to a day so that the same route is not sent twice. This happens only for a device that shows Google's map.
• The OpenStreetMap Foundation (tile.openstreetmap.org), or the provider named in the map's credit line — on a device set to OpenStreetMap, or without Google Play services, serves the map imagery. Your device requests map tiles directly from it when you view the map, which shows it the device's IP address and the parts of the map being looked at.
• Email — the password-reset emails (section 2) are sent by our own server. Like any email, they then pass through the recipient's own email provider.
• Google (Google Play) — sells and bills the Premium subscription, under Google's own terms. Google already has your payment details; we send it only the purchase token, to ask whether a subscription is valid, and to acknowledge it.

When you choose to pass a location on. Where the app shows a family member's position it offers to hand it to another app on your device: to Google Maps or another maps app when you tap Directions, or to a messaging app you pick when you tap Share. This happens only when you tap one of them, the location goes only where you send it, and from then on it is handled under that app's own terms. We do not send it anywhere ourselves.

When you look at a location. The screen that shows one position — a family member's, or where an alert happened — also shows the address there, on a device that draws Google's map. The address comes from the lookup built into the device — Google's, through Google Play services, under Google's own terms — which receives that position's coordinates from the device and sends the address back to it. It does not pass through us and we do not keep it. A device set to OpenStreetMap, or without Google Play services, does not look addresses up, and shows the coordinates alone.

When you search for an address. On the Places screen a parent can find a place by typing its address instead of tapping the map. The search uses the address lookup built into their device — on most Android devices Google's, through Google Play services, under Google's own terms. The text they type goes from their device to that lookup, and the result comes back to their device; it does not pass through us and we do not receive or keep it. Nothing about a place is stored until the parent saves it, and then only what section 2 describes.

We may disclose data if we are legally required to, or where it is necessary to protect someone's life or safety. We will not do so otherwise.

We do not sell personal data, and we do not share it with advertisers or data brokers.

5. Children

Kid Monitoring is used on devices belonging to children, and we take that seriously.

The account is created and controlled by a parent or legal guardian, who must be 18 or over. A child does not create an account: a parent adds the child's device to the family group using an invite code, and the setup is carried out on the child's own device.

About a child's device we collect the same categories described in section 2 — location, recent movement, location history, arrivals at and departures from any places a parent has set, how fast the device was travelling when a parent has switched speed alerts on and it went faster than the speed they chose, device status, the chores a parent has set and when the child marked them done, the requests the child sends for more time on an app (with a reason, if they choose to give one), and, where the parent has enabled it, which apps are used and for how long. We do not collect a child's email address, contacts, text messages, calls or browsing history. Where web filtering is switched on, the addresses it checks stay on the child's phone and are not collected either.

The app is never hidden on a child's device. It appears in the app list with its own icon, and Android shows a permanent notification whenever location is being shared — and, on a child's device whose location is not shared, a notification saying that its screen-time limits are on. A child can turn off location sharing themselves, and can sign out; when they do, the adults in the family are notified.

A child's device is never shown an offer to buy anything. The rules on it can be changed only from an adult's device; a child's device cannot make itself an adult's, and the invite code it shows can add only another child's device.

A child's name and photo, like every member's, are shown to a person who enters the family group's valid invite code before they join (section 4).

A child can also see every rule that applies to their device, on the device itself, under My day: what is stopping apps at the moment, how much screen time is left today, when downtime and school time start, which apps and websites have rules, and what they have asked their parents for today and the answers. To show that last part, the device keeps its own short record of what it sent — for a few days, and on the device only. It is not sent to us.

A parent or guardian may at any time see what is held about their child, correct it, or delete it — see section 7. If you believe we hold information about a child without the necessary parental consent, contact us at helpdesk@kidmonitoring.com and we will delete it.

Parents in the United States. Where a child under 13 uses a device in the United States, the Children's Online Privacy Protection Act (COPPA) gives their parent the say over what is collected from it. Nothing is collected from a device as a child's until an adult has confirmed that they are the parent or legal guardian of the person who will use it, and accepted its being set up as a child's — on the device itself when it joins the family group, or on their own device when they make an existing member's device a child's (section 2, "Parental attestation"). Sections 2, 4 and 6 are our notice to parents of what we collect from a child's device, how we use it, who receives it and how long we keep it. A parent can at any time see what is held about their child in the app; ask us for a copy of it, or for it to be deleted; and stop any further collection by removing the child's device from the family group, which also deletes what is held about it. To ask for any of these, or if you believe a child's device was set up without their parent's agreement, write to us at helpdesk@kidmonitoring.com. We ask a child for nothing more than the app needs in order to work, and nothing a child does in the app is made public.

6. How long we keep it

Recent movement is kept for 24 hours and then deleted automatically.

Location history (the half-hourly positions from a child's device) is kept for 30 days and then deleted automatically. A parent can delete it sooner, or stop it being collected at all, from their own device.

Arrivals and departures at places are kept for 30 days and then deleted automatically. The places themselves are kept until a parent deletes them.

Notification history is kept for 30 days and then deleted automatically, and can be deleted sooner from the device's own notifications screen.

Chores are kept until a parent deletes them, or the child's device is removed; a chore set to be done only once is deleted automatically two days after a parent approves it. Only the latest completion of each chore is kept with it; the record of earlier ones is the notification history, kept for 30 days.

Requests for more time, and the reasons given with them, are kept only in the parents' notification history, for 30 days.

Speed alerts — how fast a child's device was travelling, and where — are kept only in the parents' notification history, for 30 days. The speed a parent chose is kept with the rest of the settings.

Web addresses checked by the web filter are kept for no time at all. They are checked on the phone as the lookup happens and discarded; there is nothing to delete, and nothing to ask us for. The filter's settings are kept for as long as the account exists.

The current position of each device is kept until a newer position replaces it. The same is true of the copy used for live location (section 4), which is also deleted when the device is removed.

Screen time records — which apps were used on a child's device and for how long each day — are kept for 30 days and then deleted automatically.

Location history and screen time records are deleted after 30 days whether or not the device is still sending them — when a parent has switched location history off, for example, or the device has stopped reporting.

Device status changes — that a permission, a setting or the device itself was turned off or back on, and when — are kept for 30 days: in the notification history, and in a record we use so that the same change is not reported to the family twice.

Account information, device registrations and settings are kept for as long as the account exists. A device's registration — its name, role, photo and the rest — is deleted when the device is removed from the family group, along with every record about it except the notices in the family's notification histories that it joined, signed in or out, switched its location sharing off or on, or was removed: a name and what happened, with no location, kept so that a device does not simply vanish from the family without a word, and deleted with the rest of the history after 30 days. A device's notification token is taken off its record as soon as it signs out. Of the app version a device runs, only the current one is kept.

Profile photos are kept until they are replaced, or the member's device is removed, or the account is deleted.

Invite codes stop working 48 hours after they are made, and are replaced when a new one is made.

Password-reset links stop working one hour after they are sent, or as soon as one is used — using one ends all the others of the account — and the record of them is deleted a day after that.

Routes drawn along the streets (section 4, Roads API) are kept on our server for up to a day, so that the same route is not sent to Google twice; with them, for a day, the times at which each child's route was last sent, which is how we limit how often that happens.

A position still to be found for an SOS or a check-in is waited for for up to half an hour; the record that it is waited for — the device, the moment and how good the position was — goes when the wait ends.

Technical records used for rate limiting are kept for a short period, normally no more than a few days. Our web server's and Cloudflare's records of requests, and our server error logs, are kept for a month.

Messages you send us are kept for as long as we need them to answer you and for 4 years afterwards.

On the device itself, the app keeps what it needs in order to work — the family, the rules that apply, positions and reports waiting to be sent, and a record of the notifications it has shown — until they are sent, replaced or no longer needed, and removes all of it when the device signs out. Uninstalling the app removes it too. The app's data is not included in Android's backups or moved to a new phone.

Purchase records are kept while the subscription exists, and for 15 years after it ends. They are not deleted with the account: a subscription belongs to the Google account that bought it and goes on until it is cancelled in Google Play, and a family set up again with that Google account takes it up again. What is kept holds nothing that identifies you to anyone but Google.

When an account is deleted, all of the above is deleted with it, except purchase records. See section 7.

7. Your rights

You can, at any time:

• See what the app holds — locations, movement, location history and screen time are all visible in the app itself.
• Correct your name and photo, under Settings, My account.
• Stop location being collected, by turning off location sharing under Settings, My location, or by revoking the permission in Android; and stop live location, under Settings. A parent can switch off a child's location history, speed alerts and web filtering from their own device, and a permission revoked on a child's device stops what depends on it.
• Delete parts of it: a parent can delete a child's location history from the GPS history screen, places and chores from their screens, and every device can delete its own notification history, one entry or all of it. An adult can remove a member's device from the family group, which deletes what is held about it.
• Delete your account and all its data, under Settings, My account. You can also delete it without the app, at kidmonitoring.com/delete_account.php.

Deleting from an adult's device deletes the entire family group, including every member's data, and cannot be undone. Deleting from a child's device removes that device and its data. Deleting does not cancel a Premium subscription: cancel it in Google Play, under Payments and subscriptions.

Depending on where you live you may also have the right to obtain a copy of your data in a portable form, to object to or restrict certain processing, and to complain to your data protection authority. To exercise any of these, write to helpdesk@kidmonitoring.com. We will respond within one month.

8. Security

Data is transmitted between the app and our servers over an encrypted connection, through Cloudflare's network (section 4); the app refuses unencrypted connections. Passwords are stored in a protected form and never in plain text. Sign-in, invite-code and password-reset attempts are rate limited to protect against guessing, and an invite code stops working 48 hours after it is made. A link to reset a password works for one hour and once, is kept only as a one-way hash, and the new password chosen with it is held to the same rules as a new account's. A device is known to our servers by a random identifier, and to the other devices in its family by another identifier derived from it, never by the one it signs in with. A child's live location can be read only by the adults of the same family group, and written only by the child's own device. Access to our systems is restricted to the people who need it.

Profile photos are kept on our server at addresses that cannot be guessed, rather than behind a sign-in: anyone given a photo's address could open it.

On the device, the app's data is kept in the app's own private storage. So that a device that has restarted can go on reporting before it is first unlocked, the app also keeps the device's identifier, and whether it is a child's and shares its location, in storage that Android makes available before the screen lock is entered; it is encrypted by the device, but not by its screen lock.

The app's notifications are shown as Android shows any app's — on the lock screen too, unless the device is set otherwise — so a family member's name, a place or an alert can be read there by whoever holds the device.

No service can promise perfect security. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant authority as the law requires.

9. Where your data is held

Our servers are located in the United States, hosted by DigitalOcean, and our other service providers — Google and Cloudflare — process data there and in other countries. If you live in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred outside it. DigitalOcean, Google and Cloudflare are each certified under the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework, and their data processing terms also include the European Commission's Standard Contractual Clauses. This covers our servers and database, Firebase Cloud Messaging, the Firebase Realtime Database and Authentication, the Roads API and Cloudflare's network. You can ask us for a copy of the safeguards that apply by writing to helpdesk@kidmonitoring.com.

Our website. This policy also covers kidmonitoring.com. The website uses cookies. A session cookie (PHPSESSID) lets the site work as you move from page to page, and is deleted when you close your browser. When you first visit, the site asks whether you accept its cookies, and remembers your answer. We use Google Analytics to count visitors and see which pages are read; it sets cookies of its own (such as _ga) and receives your IP address, your browser and device type and the pages you visit, under the Google Privacy Policy. We do not use it for advertising. Cloudflare, which carries every request to the site (section 4), may also set a cookie of its own, such as __cf_bm, to tell people from automated traffic; it does not identify you. You can delete or block cookies in your browser at any time. The app itself uses no cookies and no analytics.

10. Changes to this policy

We may update this policy. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect, and we will update the date at the top.

11. Contact

MONAPP CALABS LIMITED
Anakreontos Street 24, Larnaca, Cyprus
helpdesk@kidmonitoring.com