ParentLoop Privacy Policy

Last updated: 2 November 2026 · version 4.23

1. Who is responsible for your data

The controller of personal data processed in the ParentLoop and ParentLoop kids apps and on parentloop.pl is ParentLoop sp. z o.o. (a Polish limited liability company), registered office at ul. Grójecka 210, 02-390 Warszawa, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the Sąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy Krajowego Rejestru Sądowego (District Court for the Capital City of Warsaw, 12th Commercial Division of the National Court Register), KRS number 0001272931, NIP (tax ID) 7011335937, REGON 545952514, share capital PLN 5,000.00.

Data protection contact: kontakt@parentloop.pl. We have not appointed a data protection officer — at our current scale of processing one is not required; we will revisit this as that scale grows.

2. In short

This summary does not replace the text below — the full policy is what binds.

3. What we process, why, and on what legal basis

We do not collect device location, we do not profile users, we make no automated decisions producing legal effects, and we use no advertising SDKs or cross-app tracking analytics. We do not send your data or your children's data to external artificial intelligence services (such as chatbots or cloud-based AI models), and we do not use it to train AI; text from photos and pasted addresses are read on your phone (§7).

Pre-launch testing. If you test the app before launch, we also process: the email address of your Google or Apple account on the tester list in Google Play or TestFlight, the correspondence with your invitation and your confirmation that you accept the Terms, feedback you send through Google Play, TestFlight or email (from TestFlight also attached screenshots, crash reports, phone model and system version) and your answers to the post-test survey. We do this to give you the test version (GDPR Art. 6(1)(b)) and to improve the app based on your feedback (our legitimate interest, Art. 6(1)(f); you can object, §11). Taking part in testing, feedback and the survey are voluntary. Do not send screenshots showing health data or a PESEL number with your feedback. What you enter in the app stays in your account after launch, as for every user.

Reading the app's version from your phone does not require your consent, because it is strictly necessary to provide the service you use (Art. 399 of the Polish Electronic Communications Law): without it we cannot tell whether a bug fix has reached you. We do not record a device identifier, your IP address or which features of the app you use, and we keep no history — each time the app opens, it overwrites the previous record.

Which data is required. To create an account we need your first name and email address (and a password, unless you sign in with a link sent by email), and to add a child — their first name. When adding a child, you also represent that you hold parental authority or custody over them, or help care for them at a parent's invitation; without this statement you cannot add the child. Providing data is voluntary and no law requires it, but without the data listed above we cannot enter into the agreement and you cannot create an account. Everything else (for example date of birth, photo, PESEL number, health data, documents, entries, feedback) is up to you; if you leave something out, only the feature that needs it stops working — for example, without a date of birth the app will not suggest age-appropriate chores.

4. Data you did not give us yourself

ParentLoop works by design so that one parent enters data about the child, and sometimes about the other parent (for example the days the child spends with them, handovers and expenses that concern them). This means we may process data about a person who did not provide it to us themselves.

• Source: the other parent or guardian using ParentLoop.
• Scope: the categories listed in §3.
• Birthday guests: if a parent enters the first names of guests invited to the child's birthday, we store the first name only — no surname or contact details. Only that child's parents can see them, and they are deleted with the birthday plan or with the account. We do not know these children or their parents, and finding out who they are would mean collecting more data, so we do not inform them directly (GDPR Art. 14(5)(b)).
• Teachers: if a parent types in a lesson plan or reads one from a photo, we store the teacher next to the lesson as it was given — no contact details. That child's parents and the child in ParentLoop kids can see it, and it is deleted with the lesson plan or with the account. We have no contact details for teachers, and looking them up would mean collecting more data, so we do not inform them directly (GDPR Art. 14(5)(b)).
• Other people a parent enters: the child's doctor (in the health data) or a person named in an event, such as a coach. We store only what the parent provides. The basis is our legitimate interest in letting parents organise care and have this information to hand in an emergency (GDPR Art. 6(1)(f)). We do not inform these people directly (GDPR Art. 14(5)(b)): we have no contact details for them and no relationship with them, and finding a contact or writing to a doctor or coach would mean collecting more data and would tell them that the family uses the app and how it cares for the child. Only the child's parents see them, and calendar entries also the child in ParentLoop kids; we delete them together with the entry or the account.
• Once an invited parent joins, they see the same child data and may correct it, add to it, and exercise every right described in §11.
• How the other parent finds out: you send the invitation yourself — from your own email or messaging app; we never receive the other parent's email address or phone number. When the other parent joins, they see this policy while creating their account. Until they join we have no way to contact them, so we do not inform them directly (GDPR Art. 14(5)(b)); this policy is publicly available, and the invitation text the app prepares for you to send includes a link to it.
• How we protect these people's rights: instead of informing them directly, we publish this policy at parentloop.pl/privacy; the data entered is visible only to the child's family; we send these people nothing, do not profile them and do not use their data for marketing; and we delete it together with the entry or the account. Any of these people can object or ask for their data to be erased by writing to the address in §17.
• The parent entering a child's data confirms they are entitled to do so, normally through parental authority. ParentLoop does not verify or adjudicate disputes about parental authority or the scope of custody.

5. Documents and health data — end-to-end encryption

A child's documents (court rulings, settlements, parenting plans) are encrypted on the parent's device before they leave the phone. Both the file content and its title are encrypted. Private keys never leave the parents' devices. The document's type (for example a passport) and its expiry date are not encrypted — that is how the app reminds you that a document is about to expire and compares the date with the dates of a trip.

We encrypt the child's health data the same way, separately for each child. The health-data key is created automatically on the phone of a parent who has access to that data, has consented to health data and has a document key on their phone (encryption can also be switched on manually in Settings); passing the key to the other parent or a caregiver requires one confirmation (comparing the key fingerprint). The app does not create the document key by itself: a parent creates it once, in Settings or on the Documents screen (on phones that support passkeys, the app also offers it at the end of setup); until they have one, the child's health data is not end-to-end encrypted. Encryption takes effect once everyone with access to that child's health data — the parents, and a caregiver if granted that permission — has the key. Allergies, medication, chronic conditions, blood type, notes, records (visits, vaccinations, diagnoses, test results, hospital stays) and height and weight measurements are then encrypted on the phone before they reach our server; on the server we can still see that a record exists, its date and who added it. Until everyone with access to that child's health data has the key, the data is stored as before — protected, but not end-to-end — and the app shows who it is waiting for. Once encryption takes effect, the phone of the parent holding the key also rewrites previous entries into encrypted form; their plaintext version may remain in database backups for up to 7 days (§9).

The child's PESEL number, if you enter it, is always encrypted on the phone — separately for each parent, with that parent's document key — before it reaches our server. We cannot read it. On the server we can only see that a number has been saved and for which parents. Saving the number requires a document key.

In practice this means neither we nor our hosting provider can read this data — not even if we wanted to, and not even if someone gained access to the database. The trade-off: if you lose access to all of your devices without backing up your key, we cannot recover those documents or the encrypted health data, height and weight measurements, or PESEL number.

Key backup in a passkey. You can back up your key by saving a passkey in Apple Passwords or Google Password Manager. We then store an encrypted copy of your key that only that passkey can open — we cannot. You can delete the backup in the document key settings; it also disappears when you change your key, and together with your account. Anyone who knows the password to your Apple or Google account and the passcode of one of your devices can use that passkey.

Where to enter health information. End-to-end encryption and the health-data consent cover the health section and health documents. In expenses, messages and the calendar, write only what is needed to organise things (for example “doctor's appointment”, “pharmacy”), and keep the details of the child's health in the health section.

6. Messages between parents

We want to be straightforward here: messages are not end-to-end encrypted. They are stored on our server in readable form. This follows from two features we judged more important to families' safety than full encryption:

• Profanity filter — message text is checked automatically before it is saved, and detected profanity is masked. This is automated text processing with no human involvement.
• Abuse reporting and pausing a conversation — a parent can report a message. A reported message may be read by a designated member of the ParentLoop team in order to handle the report. Outside that case, nobody on the team reads parents' correspondence. Either side of a conversation can also pause it: until the person who paused it resumes it, nobody in that conversation can send a new message. We record who paused and resumed the conversation and when; both sides see this in the conversation and in its export, and the other side is notified. After a report we may also hide an unlawful message for both sides (the conversation shows that ParentLoop hid it, and we keep its text as evidence for an appeal or for law enforcement) or pause the conversation; only we can resume a conversation paused this way.

If we restrict your account after a report, we will give you the reasons for the decision and you can appeal it — the Terms of Service describe how.

If you need to pass the other parent something you would rather not entrust to a server, use encrypted documents (§5).

7. Text recognition from photos: receipts and the lesson plan

Reading amounts and dates from receipts happens locally on your device. Neither the receipt photo nor the text read from it is sent to any third-party text recognition service. Only the photo saved against the expense, and the extracted values if you confirm them, reach our server. On Android phones we use the Google ML Kit library to read text on the device, which sends Google diagnostic data about the device and the recognition run (without the photo or the recognized text — §8).

You can read a lesson plan from a photo as well. The text is read on your phone, and the app's copy of the photo is deleted as soon as it has been read — neither the photo nor the text read from it ever reaches our server or any third-party service (on Android, the Google ML Kit library sends Google diagnostic data only — §8). We store only the lessons you confirm.

Pasting an address from a message or note into an event reads the address on your phone and sends it nowhere. On an iPhone the phone's system does this. On Android we use the Google ML Kit library for it, but only if you agreed to ML Kit when reading a receipt or lesson plan (you can withdraw this in Settings → Consents); on first use it downloads a language model from Google and sends Google diagnostic data only, never the pasted text (§8). Without that consent we paste the address exactly as you copied it.

8. Who we entrust data to

Data in the app is visible only to the parents and guardians linked to that child's profile. We use providers who process data solely on our instructions, under data processing agreements:

The database and files are stored in the European Union. Transfers outside the EEA (push delivery and app updates) rely on the European Commission's adequacy decision (the EU–US Data Privacy Framework, for certified entities) and the European Commission's Standard Contractual Clauses.

Address suggestions come from Google Maps Platform (Places API). When you type an event's address, the phone sends the typed text directly to Google LLC (USA), which also sees the phone's IP address. Google processes this as a separate controller, under its own terms (the Google Maps controller data protection terms and Google's privacy policy), not on our instructions — which is why it is not in the table above. Only what you type into the address field reaches Google, without your account data or your child's name. Reading text from photos on Android: when reading text from a receipt or lesson plan photo (§7), the Google ML Kit library stores its own installation identifier on the phone and reads and sends to Google LLC (USA) diagnostic data about the device and the recognition run: device manufacturer, model and OS version, available hardware accelerators, app name and version, the library's installation identifier, execution times, image format and resolution, input and output size, feature version, event type and error codes (on connection Google also sees the phone's IP address) — never the photo itself or the text read from it. Google processes these data as a separate controller for diagnostics and usage analytics of the ML Kit library, under the Google APIs / ML Kit terms of service and Google's privacy policy. The transfer of data to the USA relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework (provided Google LLC holds active certification under it) or on Standard Contractual Clauses.

Phone calendar. If you turn on the calendar subscription in Settings, we create a private link that you add to a calendar of your choice (e.g. Apple Calendar and iCloud, Google Calendar, Outlook). That service fetches the data described in §3 from our server every few hours and keeps it under its own terms — as a separate controller that you choose, not on our instructions — which is why it is not in the table above. Some of these services process data outside the EEA, e.g. in the USA. The link works like a password: anyone who has it sees the same data, so do not share it. You can turn it off or create a new one at any time — the old one stops working at once. The calendar also includes custody days and events added by the other parent that you see in the app; the other parent sees in the app that your subscription is on.

The same applies on Android when you paste an address into an event (§7), if you have agreed to ML Kit: the pasted text never leaves the phone.

Once payments are switched on, subscriptions will be handled only by Apple (App Store) or Google (Google Play), acting as separate controllers of payment data under their own terms. We never see your card number; we only learn that a subscription is active, and its identifier. The subscription status will be checked for us by RevenueCat (RevenueCat, Inc., USA) as a processor, under the European Commission's adequacy decision for the EU–US Data Privacy Framework (provided it holds active certification under it) or the Standard Contractual Clauses: it will receive a random family identifier — no names or email addresses — the purchase data passed on by the store, and basic technical data about the phone (system, app version, store country). We will tell you about this by email before payments start (§16).

Testing in Google Play and TestFlight. The test version of the app, its updates, and feedback and crash reports sent through Google Play or the TestFlight app are handled by Google (Google Ireland Limited and Google LLC, USA) or Apple (Apple Distribution International Ltd. and Apple Inc., USA) as separate controllers, under the rules of the Google Play and TestFlight testing programmes. They make the course of testing and the feedback you send available to us in their consoles (§3). Data is transferred to the USA on the basis of the European Commission’s decision on the EU–US Data Privacy Framework or standard contractual clauses.

A day’s plan you send yourself. When your children live in one home, you can send the day’s plan from Home to someone without an account, such as a grandparent or a sitter: the date, the children’s first names, the day’s events with time and place, when school or preschool ends, and the first name of the person picking the child up. You send it yourself, with the app you choose, to the person you choose. ParentLoop sends nothing and keeps no record of who you sent it to. Once sent, that copy is outside ParentLoop: we cannot correct or delete it.

9. How long we keep data

• Account and child data — for as long as you use the app. We delete it when you delete your account (§11).
• Calendar link (§8) — works until you turn it off or create a new one, and expires when your account is deleted. We keep no separate copy of the calendar — the data is put together on each request. Events your calendar has already fetched may stay there until you remove the subscription from your calendar.
• Individual entries (an expense, event, document, measurement) — until the parent deletes them in the app.
• Health records (visits, vaccinations, diagnoses, test results, hospitalisations) are append-only: a correction creates a new entry, and a single entry cannot be erased from within the app. We delete them together with your account, or on request by email. When you withdraw consent to health data, we immediately delete all the child's health data, including health documents, unless the other parent with access to the child's health data has given their own consent — in which case they remain for them, and you stop seeing them (the consent of a caregiver who is not the child's parent does not keep them). Before withdrawing consent, you can download a copy of your data (§11). On the child's 18th birthday we delete the health data (§10).
• Consent history — retained after consent is withdrawn and after account deletion, to the minimum extent needed to show consent was given (the date and the document version; GDPR Art. 7(1)) — for 3 years from the end of the year in which consent was withdrawn or the account was deleted.
• Correspondence about your GDPR rights (your request, for example to provide or erase data, and our reply) — for 3 years from the end of the year in which we closed the matter, as proof that we dealt with it. Copies of identity documents and court orders sent to verify a request are deleted immediately after we check them (only a note confirming the verification remains in the correspondence kept for 3 years). Account deletion requests made on the website have their own, shorter period (below).
• Reports of messages and the decisions on them — for 3 years from the end of the year in which we closed the case, also if you delete your account in the meantime (then no longer linked to it), as evidence that we handled the report as the Digital Services Act (DSA) requires and in case of claims (GDPR Art. 6(1)(c) and (f)). We delete the text of a message hidden after a report together with the case, or earlier together with the message.
• App version — one record per phone system, overwritten each time the app opens. We delete it together with your account.
• Free access granted to an email address — if no account with that address exists yet, the invitation waits for at most 90 days, then we delete the address. Once the account is created, only the link to the account remains; we keep the information about the access, the tester flag and the team’s note until the account is deleted.
• Feedback and survey answers — for as long as your account exists; we delete them together with your account and they are part of your data export. Only the ParentLoop team reads them; the other parent does not see them. Feedback is also emailed to the team's mailbox — we will delete that copy at your request.
• Pre-launch testing data — we remove your address from the tester list in Google Play and TestFlight when your part in testing ends, at the latest 30 days after launch in that store. We keep feedback and crash reports from Google Play and TestFlight and your post-test survey answers for up to 12 months after testing ends. We keep the email in which you accept the Terms in the same way as the consent history.
• A child's ParentLoop kids access — until a parent revokes it, the child's profile is deleted, or the account is deleted.
• Birthday plans (guests, presents, reservations) — until a parent deletes the plan, or together with the account.
• Key backup in a passkey — until you delete it in settings, change your key, or delete your account.
• Messages between parents — a sent message cannot be edited or deleted in the app, because the conversation is a shared record of what was agreed about the child; after a report the team can only hide an unlawful message (§6). We keep messages for as long as someone in the family has an account, and delete them when the last person in the family deletes their account. When one parent deletes their account, their messages stay in the other parent's conversation, labelled “Deleted user” instead of their name and no longer linked to an account, until the other parent deletes their own account or we uphold an objection (§11). We keep the record of pauses and resumes in the same way as the messages.
• In-app notifications — 180 days from when they were sent, then deleted automatically. When someone deletes their account, their name is removed from other people's notifications; when a child's data is deleted, the child's name is removed from them.
• Account deletion requests from the website — the email address until the account is deleted or the request is cancelled (an unconfirmed request: 30 days). After that, only a hash of the address and the dates are kept for 90 days, as proof that we carried out the request; then they are deleted too.
• Child data after the child turns 18 — health data and the PESEL number are deleted on the eighteenth birthday, the rest of the data three months later (§10).
• Database backups — made daily and kept for 7 days. Deleted data is gone from them after that time at the latest; we only reach for a backup to restore the database after a failure.

10. When a child turns 18

The legal basis for processing a child's data is the performance of parental authority or custody by the parents (GDPR Art. 6(1)(f)), and for health data and the PESEL number — parental consent. On their eighteenth birthday parental authority ends — from then on the adult decides about their own data. So the app stops accepting new data about that person.

We delete health data and the PESEL number on the eighteenth birthday (if the parents did not get the notice about 30 days before the birthday, we delete them 4 weeks after the notice). We processed them on the basis of a parent's consent given on the child's behalf, and that basis ends together with parental authority. About 30 days before, parents with access to this data get a notification so that they can download a copy in time (Settings → Download my data). Height and weight measurements stay with the rest of the data.

Other data already stored stays visible, exportable and deletable for three months (our legitimate interest: parents can calmly download the shared record, and the adult can object to this — Art. 6(1)(f) GDPR) — locking someone out of their own data would be the opposite of what the GDPR is for. After three months we delete it; the app shows the parents the exact date. An adult whose data is held in ParentLoop may, during that time, ask us to provide or erase it. Such a person has no account in the app, so we confirm their identity with them directly: we ask for a few details from their former profile (for example their name, date of birth and which parent it was linked to) and reply to the email address they wrote from. We ask for an identity document only if we have reasonable doubts (Art. 12(6) GDPR), and we involve a parent linked to their former profile only with their consent. If we ask for a document, please cover the photo, PESEL number, and the document series and number (first name, surname, date of birth and expiry date are enough), and we delete the copy immediately after verification. We cannot decrypt or provide a copy of documents or end-to-end encrypted health data, height and weight measurements, and PESEL number (§5), but we can delete them together with the entire profile. A parent who downloads the export can pass a copy of the encrypted data on to the adult.

If a parent did not give the child's date of birth, the app does not know when the child turns 18, so the record does not close on its own: the data stays until a parent deletes it. Once the child is an adult, the parent should delete the child's profile themselves (Settings → the child's profile).

11. Your rights and how to use them

You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, to object to processing and to withdraw consent at any time — without affecting the lawfulness of processing carried out before withdrawal.

Directly in the app, without contacting us:

• Download all your data (Art. 15 and 20 GDPR) — Settings → Download my data. You get a ZIP file; the child's documents in it are decrypted on your phone, which is why the app asks for Face ID, Touch ID or your passcode before downloading. A phone without a passcode set cannot download the export — in that case we will send a copy of your data at your request, but without the documents and any health data, height and weight measurements, and PESEL number that are end-to-end encrypted, because we cannot decrypt them.
• Delete your account and data (Art. 17) — Settings → Delete data & account. Deletion happens immediately.
• Withdrawal of consent to health data and marketing consents — Settings → Consents. Withdrawing health data consent immediately deletes the child's health data, unless the other parent with access to the child's health data has their own consent (§9); you can download a copy of your data before withdrawing. You can remove the child's PESEL number in the child's settings.
• Correct your data (Art. 16) — directly in the child profile and account. Either parent corrects the child's name and date of birth on their own; the other parent gets an in-app notification with the old and the new value (the push notification to the phone does not include the date of birth).

Deleting your account and data without the app

You can also delete your account at parentloop.pl/delete-account: enter your account's email address and confirm with the link in the message we send. Your account and data are deleted 7 days after you confirm, to the same extent as when you delete them in the app. During that week you can cancel with the link in a second message, and the phones signed in to the account get a notification — this protects you from someone who got into your mailbox deleting your account. If there is no account at the address you enter, we send nothing, and the page responds the same way — the form does not reveal who has an account.

No longer have access to your account's email address? If your phone is still signed in, delete the account in the app (Settings → Delete data & account) — no email is needed. Otherwise, first try to recover access to your mailbox with your email provider. If that fails, write to kontakt@parentloop.pl from an address you can access. Because the other parent usually knows the details in your profile too, before we delete the account we will confirm that it is yours (GDPR Art. 12(6)): we will ask for information related to the account, and in exceptional cases (where your profile includes your first and last name) we may ask for a copy of an identity document with the photo, national ID number (PESEL), date of birth and document number covered. We use the copy only for this check and delete it as soon as it is done, keeping only a note in the correspondence that your identity was confirmed. We then delete the account the same way as with the form — after 7 days; we send a notice with a way to cancel to the account's existing email address and to signed-in phones (this protects the account if someone else wrote to us), and during that time you can also cancel by replying to our email.

Account deletion and the other parent

A child's profile is shared. If you delete your account while the other parent still uses ParentLoop, the child's data remains available to them — they are a separate user with their own basis for processing. What gets deleted is your account data and any data for which you are the only linked parent. Before deleting, the app shows you exactly what will disappear and what will remain.

The other parent is notified that the account was deleted — without your name. Messages you sent stay in their conversation, labelled “Deleted user” instead of your name and no longer linked to your account: they are also the other parent's correspondence about the child, and deleting them would take away their ability to show what was agreed (GDPR Art. 6(1)(f) and Art. 17(3)(e)). You can object to keeping all or selected messages (GDPR Art. 21(1)) by writing to kontakt@parentloop.pl (if your account has already been deleted, please give the child's first name and the approximate date and content of the messages so that we can locate them). We will consider your objection without undue delay and within one month at the latest, weighing your particular situation, the other parent's interest and the child's best interests:

• We uphold the objection and delete the message (or the relevant part of it) for the other parent too if keeping it puts your safety at risk (for example, it reveals your new address or workplace and you point to violence, harassment or a restraining order), if it concerns only you or third parties rather than matters concerning the child, if it was sent by mistake and nothing was agreed on the basis of it, or if the other parent agrees to its deletion.
• We reject the objection if the message documents arrangements concerning the child (care, handovers, trips, medical treatment, school, expenses), is evidence in ongoing or announced proceedings, relates to a reported breach of the Terms of Service (for example, threats), or if deleting it would change the meaning of the other parent's replies.

Requests from courts, authorities and the other parent

• We disclose data to courts, prosecutors, the police and other authorities only where the law requires it — after checking the basis of the request, and only to the extent it covers.
• We do not give one parent the other parent's data beyond what they can already see in the app. If you need material for court proceedings, use the data export (Settings → Download my data).
• Exports and records from the app are not official documents. We do not guarantee that a court or authority will accept them as proof of particular content or of a date.

Contact and complaints

For any of the above you may also write to kontakt@parentloop.pl — we respond without undue delay and within one month at the latest. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

12. Security

• Access to each child's data is enforced at the database level, not only in the app — a parent without permission for a given child cannot read that child's data even by bypassing the app.
• Connections from the app are encrypted (TLS), and data in the database and file storage is encrypted at rest.
• A child's documents, and health data once everyone with access to the child's health data has the key, are additionally end-to-end encrypted (§5).
• When you create an account or change your password, we reject passwords that have leaked in known breaches. Our server runs the check: it sends the Have I Been Pwned service only a short fragment of the password's hash, never the password itself or your phone's IP address.
• When someone signs in to your parent account (after the first 24 hours from account creation), you get a notification in the app and — if you have notifications enabled — on your phone, with the approximate kind of device (iPhone or iPad, Android phone or tablet, web browser, or other device). In Settings → Privacy & data → Signed-in devices you see active sessions (since when the account has been signed in and when each device was last active) and can sign any device out; its access expires within an hour at most. For the duration of the session, the sign-in service records the IP address and technical information sent by the app or browser (User-Agent), from which we read only the kind of device; we never display the IP address or include it in data exports. Legal basis: performance of a contract (Art. 6(1)(b) GDPR — session management) and our and your legitimate interest (Art. 6(1)(f) GDPR — account security and protection against unauthorised access; recipients for hosting and notifications — §8). A session leaves the list when signed out, when it expires automatically due to inactivity, or when the account is deleted, while the in-app notification itself is kept for 180 days (§9).
• Health records (visits, vaccinations, diagnoses, test results, hospitalisations) are append-only — a correction creates a new entry rather than overwriting the previous one.

13. ParentLoop team access

Access to production data is limited to a small, named group within the ParentLoop team, solely for technical operations, user support and handling abuse reports — never for marketing. Encrypted documents, the PESEL number and encrypted health data (§5) cannot be read by the team under any circumstances.

14. Children and ParentLoop kids

The ParentLoop app is for adults only — parents and guardians. For children aged 7 to 16 there is a separate app, ParentLoop kids:

• A parent sets up the child's access: the parent's app shows a one-time QR code, valid for 10 minutes, which the child scans in ParentLoop kids. The child gives no email address, phone number or password. The contract is with the parent, not the child.
• The child can see: which parent they are with on a given day, calendar events with their packing lists, their lesson plan with the room and the teacher, their after-school activities, their chores, and their own pocket money for the last 8 weeks (amounts only) — a parent can hide the amounts from the child. The app does not compare the child with their siblings.
• The child cannot see messages between parents, documents, health data, or expenses and settlements.
• From the child's phone we store only what is needed for it to work: the link between the device and the child's profile, the chores the child ticks off, the events the child adds to their calendar, a push notification token, and the phone's language (so we can send notifications in the right language). The child can put a PIN on their profile; it stays on the device only and never reaches our server.
• We match the look of ParentLoop kids to the child's age: a child under 16 gets the new look with a wallpaper, and an older child, or one whose date of birth we do not know, gets the previous look. The age is worked out on the child's phone from the date of birth a parent entered in the child's profile and is never stored. The child can change the look in Profile; that choice stays on the device only.
• The child can add their own event to their calendar (for example a test, a training session or a surprise for a parent) and decide with the “Show my parents” switch whether the parents will see it. We store the event on our server. If the child does not share it, the parents do not see it in their app or in their data export. We delete it when the child deletes it, or together with the child's profile or the account.
• Any parent with rights to the child's data can revoke the child's access at any time, with immediate effect. When one parent sets up the child's access, the other parent is notified.

15. This website: cookies and the waitlist

This website uses no marketing or analytics cookies. The mobile app contains no third-party tracking or advertising tools.

While the app is not yet in the stores, the website offers a waitlist. That is a different purpose from using the app, so it is described separately here:

• What we collect: your email address, the language of the page, which form the signup came from, the signup date, the confirmation date, and the version of the form wording you agreed to. Nothing else — we do not ask for your name or for any information about a child.
• Why: to send you one email on the day the app launches. We do not run a newsletter and we do not pass your address to anyone.
• Legal basis: your consent (Art. 6(1)(a) GDPR). After you submit the form you get one email with a link; you give consent by pressing "Confirm" on the page it opens. The link works for 7 days. Without confirmation we send you nothing beyond that link — so nobody can sign up someone else's address.
• How long: an unconfirmed signup is deleted after 30 days. A confirmed one is kept until the launch notification has been sent, and if launch is delayed, no longer than 24 months from signup.
• Withdrawing consent: at any time, with one email to the address in section 17. We then remove you from the list and send nothing further.
• Where the data goes: the form is handled by Cloudflare (which hosts this site), the address is stored in Supabase in the European Union — the same place as app data — and the email with the link is sent by Brevo (section 8).

Joining the waitlist does not create an account, and it is not linked in any way to an account you may create later.

16. Changes to this policy

We update this policy when what we do with data changes. We will email you at the address on your account at least 14 days before the change takes effect when we start using data we already hold for a new purpose or in a new way, when we add a new provider, or when the controller changes. A new, optional feature — one you do not have to use and that does not change what happens to data already stored — is described in this policy on the day it becomes available, and we tell you about it in the app; the date and version number are at the top of this page. Where a change requires fresh consent, we will ask for it separately — continued use of the app is not a substitute for consent. We record which version of this policy you accepted.

17. Contact

For questions about this policy: kontakt@parentloop.pl. Postal address: ParentLoop sp. z o.o., ul. Grójecka 210, 02-390 Warszawa, Poland.