Kid Duty
Privacy Policy
Effective from: 28 September 2026
In short
- Kid Duty holds children's after-school schedule and keeps both parents in sync on it.
- We use only what you enter, and only to make the app work. No ads, no behavioural analytics, no tracking, no photos.
- Data is hosted in the European Union (Frankfurt, Germany).
- Event history is deleted automatically after 12 months.
- You can delete your account and data at any time, in the app: Settings → Delete my account and data.
1. Who is responsible for your data
Kid Duty is operated by Marius Bădău, an individual, who is the data controller for the data described here. Contact: privacy@kidduty.app.
Kid Duty is currently in an invitation-only test.
2. What data we use
| Category | What exactly |
|---|---|
| Your account | Your email address (to sign in). There are no passwords: you sign in with a code sent by email. |
| The family | Family name, time zone, each parent's display name, chosen colour and language, family settings. |
| Children | The first name (or nickname) the parent enters, and a colour. No photos, no date of birth, nothing else. |
| The schedule | Activities (name, place, days and times, travel time), events (date, time, place, notes), who does drop-off and pickup, the “dropped off” / “picked up” confirmations and their time, the “bring” list. |
| Change history | Who changed what and when, so both parents see the same story. |
| The phone | A push-notification token, an identifier the app generates, the operating system and the clock format (12/24h). A copy of the week's schedule is kept on the phone so the app works offline; it is removed when you sign out. |
| Invitations | Invitation codes and whether they were used. |
| Security | To stop abuse (such as mass email sending) we keep cryptographic fingerprints (hashes) of the email address and IP address, not the addresses themselves, for 24 hours. |
We do not collect: location (GPS), contacts, photos or advertising identifiers. The app contains no ads and no analytics or tracking tools.
3. Why, and on what legal basis
- To make the app work (the schedule, notifications, syncing between parents): performing the service you asked for — Art. 6(1)(b) GDPR.
- Security and abuse prevention: our legitimate interest in keeping the service safe — Art. 6(1)(f).
- Messages you send us (a problem or a suggestion, from the app): they leave from your own mail app to our address (hosted by Zoho, in the EU) and are used only to reply and to improve the app.
Children's data is entered by a parent to organise the family's schedule. Children do not use the app.
4. Who else sees the data
The other parent in your family sees the whole family schedule — that is what the app is for.
We use a few providers, strictly to run the service:
| Provider | For what | Where |
|---|---|---|
| Supabase | Database, sign-in and server | EU (Frankfurt) |
| Brevo | Sending the sign-in code email (your email address and the code) | EU |
| Expo | Relaying notifications and delivering app updates | USA |
| Apple, Google | Delivering notifications to the phone | USA |
| Zoho | The support mailbox: messages you send us and our replies | EU |
| Cloudflare | The kidduty.app domain and hosting these pages (technically, the visitor's IP address when a page is loaded) | Global network (US company) |
A notification sent over the internet (e.g. “Ana moved Swimming”) contains the name of the parent who made the change, the activity, the time, the place and only the child's initial, never the full name. Reminders (“time to leave”) are created on your own phone and never travel over the internet.
We do not sell data and do not use it for advertising.
5. Transfers outside the EU
Expo, Apple and Google may process notification data in the USA, and Cloudflare may process technical access data for these pages outside the EU. These transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Past events, with their lists, confirmations and change history: deleted automatically 12 months after the event date.
- The family, parents, children, activities and settings: for as long as the family account exists.
- Unused families: if no parent uses the app for 12 months, you receive a warning email; if nobody opens it within the following 30 days, the family and the parents' accounts are permanently deleted. Simply opening the app cancels the warning.
- Accounts created and never used (never signed in, no family): deleted after 30 days.
- Security fingerprints (email, IP): 24 hours.
- When something is deleted we keep a deletion record (an internal identifier and the number of records removed), with no names or content, so we can show the deletion happened.
- The hosting provider's backups are kept for a limited period and then overwritten.
7. How to delete your data
In the app: Settings → Delete my account and data.
- If you are the only parent in the family, the family, its children, activities, history and your account are permanently deleted.
- If another parent remains, your account and membership are deleted; the family schedule stays with the other parent, because it is theirs too. Your display name stays in the change history entries you made (e.g. “Ana moved Swimming”), so the family's record stays accurate, until those entries are deleted with their events, within 12 months.
If you can no longer use the app, write to privacy@kidduty.app from your account's address; we reply within 30 days. Uninstalling the app does not delete your data.
8. Your rights
You have the right to access your data, and to ask for it to be corrected, deleted, restricted or given to you in a portable form, and to object to its processing. Write to the address above. You also have the right to complain to your data protection authority — in Romania, the ANSPDCP (www.dataprotection.ro).
9. Security
Data is encrypted in transit. Each family sees only its own data, enforced by rules in the database itself. Sign-in uses a one-time code, with no passwords.
10. Age
Kid Duty is intended for parents (18+). It is not intended for use by children.
11. Changes
If we change this policy we update the date above; significant changes are announced in the app.
This policy exists in Romanian and English with the same content. If they ever differ, the Romanian version prevails.