Security and privacy at ParentLoop

Last updated: 2 November 2026

ParentLoop was created to store some of the most sensitive data a family can entrust to someone: the custody schedule, a child's health, documents, money. This page describes specifically what we do with it — without generalities like "bank-grade security". The app is preparing for a public launch and is not yet available in the stores.

Documents: end-to-end encryption

Court orders, test results, letters from school — the file and its title reach ParentLoop encrypted before they leave the phone. What sits on the server is a string of bytes we cannot read, and that is a matter of mathematics rather than of our internal policy. We do, however, see technical metadata of the entry: document type (e.g. passport or disability certificate), file type and size, who added it and when, and the expiry date if you provide one — on its basis the server sends a reminder.

Specifically, we use:

The private key never reaches our servers. It lives in the phone's secure storage (Keychain on iOS, Keystore on Android). Only its public half is published, so that the other parent can encrypt a file in a way that lets you open it.

Randomness comes from the operating system rather than the library's own default: in React Native that default can quietly fail, and the consequence of weak randomness is not an error but a guessable key that nobody ever notices.

Health data: end-to-end encryption

Allergies, medicines, chronic conditions, blood type, notes, medical entries (visits, vaccinations, diagnoses, test results, hospital stays) and height and weight measurements are encrypted automatically, separately for each child. The key is created automatically on the phone of a parent who has access to health data, has consented to its processing and has a document key on their phone (encryption can also be switched on manually in Settings); passing the key to the other parent or a caregiver requires confirming the key fingerprint. The app does not create the document key by itself: you create it once, in Settings or on the Documents screen (on phones that support passkeys, the app also offers it at the end of setup). Until you have one, the child's health data is not end-to-end encrypted. Encryption takes effect once everyone with access to that child's health data — the parents, and a caregiver if granted that permission — has the key. Until everyone authorised has the key, the data is stored as before (protected, but not end-to-end), and the app shows who it is waiting for. Once encryption is active, the data is encrypted on the phone with the same algorithms as documents; on the server we can see only that an entry exists, its date and who added it.

Two things we state plainly. The server still sees that an entry exists, its date and who added it — only the content is unreadable. And encryption starts only once every parent with access to the child's data has received the key. Until then the data is stored as before — protected, but not end-to-end — and the app shows who it is waiting for. Once encryption starts operating, the phone of the parent holding the key also rewrites previous entries into encrypted form; their plaintext version may remain in database backups for up to 7 days.

If you use ParentLoop alone, encryption starts as soon as you create your document key, without waiting for anyone. A parent who joins later gets the key only once you confirm their fingerprint on your phone. Why there is a period without encryption at all: when a family already has two people with access to health data and one of them has no key yet, we do not encrypt for the other one regardless. The person without a key would then stop seeing the child's allergies and medicines until someone confirmed their key — and that confirmation cannot be automated, because then the server could slip in a key of its own. Above the "Save" button of every health form, the app says whether what you are saving will be encrypted.

The child's PESEL number, if you enter it, is always end-to-end encrypted: without a document key, the app will not save it.

Sharing the key with someone new always needs confirming on a phone that already holds it — with that person's name and key fingerprint on screen.

Your recovery code

Because we do not hold your key, we cannot restore it when you change phones. So a recovery code is created together with your key — the key is derived from it. You can see it at any time in the key settings. Keep it somewhere other than the phone. Without it (or the passkey copy described below), documents and health data encrypted with the old key stay unreadable to you as well. That is the price of us not having access, and we would rather state it plainly than keep a back door "just in case".

A copy of your key in a passkey (optional)

Instead of retyping the code on a new phone, you can save a copy of your key as a passkey in Apple Passwords or Google Password Manager. On a new phone, one tap then unlocks your documents and health data.

How it works: the server holds an encrypted copy of your recovery code. The key to it is derived by your passkey (the WebAuthn PRF extension) and never reaches us — without the passkey, that copy is a string of bytes we cannot read either. The passkey is tied to a separate domain, klucz.parentloop.pl, which serves nothing but two configuration files, so no script on parentloop.pl can ask for it.

The honest trade-off: this is convenience in exchange for one assumption. Anyone who knows your Apple or Google account password and the passcode of one of your devices can use this passkey. That is why the copy is optional. You can delete it at any time in the key settings, and it also disappears when you change your key or delete your account.

Trusting the other parent's key

End-to-end encryption is only worth as much as your certainty about who you are encrypting to. The app remembers the other parent's key the first time it sees it. If that key later changes, the upload does not quietly proceed — it stops and asks a human.

You can also compare the key's fingerprint and confirm it to each other. A confirmation belongs to one pair of people and one specific key: rotate the key and it lapses, and has to be done again. Otherwise it would be a stamp that outlives the thing it was stamping.

When we design the encryption, we assume our own server may lie — because if anyone ever takes it over, that is exactly what they will try. So the other parent's key fingerprint is worked out by your phone, not by the server, and your phone compares your own key with the one it holds every time it reads it. A phone that has once seen a child's health data encrypted will not write it in plain text again, even if the server says encryption is off. Showing the recovery code and replacing the key need Face ID, Touch ID or the device passcode. Decrypted copies of files (documents, the data export, scans) are removed from the phone's storage every time the app starts and when you sign out.

Biometric lock

Opening a document requires Face ID, Touch ID or a passcode — every time, not once per session. A document cannot be opened without a device screen lock set up. An unlocked phone left on a table is not the same as consent to read a court order. The same applies to data export: the ZIP file contains documents already decrypted, so the app asks for Face ID, Touch ID or the passcode before every download.

Screenshots

Screens showing the key and recovery code, documents, and child app pairing block screenshots and screen recording. On Android, screenshots and recordings come out black, and the preview in recent apps is blank; on iPhone, screenshots and recordings also come out black, and the preview in the app switcher is blurred. Screenshots work normally everywhere else in the app. This is a deterrent, not a guarantee: taking a photo of the screen with another phone is unblocked by anything.

Sign-ins and signed-in devices

When someone signs in to your parent account (after the first 24 hours from account creation), you get a notification in the app and — if you have allowed notifications — on your phone, with the kind of device (iPhone or iPad, Android phone or tablet, web browser, or other device). You can't switch this notification off in the app's notification settings (during quiet hours it arrives when they end). In Settings → Privacy & data → Signed-in devices you see every device with an active session on your account, and you can sign any of them out with one tap. A signed-out device loses access within an hour at most.

Why it matters: you sign in to ParentLoop with a link sent by email or with a password. If someone learns your password or gets into your email inbox, you will know about the new sign-in at once. Sign that device out, then change your email password and your ParentLoop password.

Who can see what

Among users, only parents and guardians linked to a child have access to that child's data. The database itself enforces this — access rules operate at the level of each row, so it cannot be bypassed by sending a "cleverer" query bypassing the app. However, this is not end-to-end encryption of the entire database: data that is not encrypted on the phone (e.g. calendar, expenses, messages) is technically accessible to our server functions which send notifications and clean up data, and to team members with access to the database panel. We do not review them routinely. We read messages only when someone reports them, and other data only for a report or a bug fix. The panel we work in day to day shows aggregate figures only and requires a second sign-in factor.

Notifications

A notification shows on the lock screen and passes through the servers of Expo, Apple and Google, so it carries only what it must. It contains no message text, no health entries and no addresses: a reminder says what and when, and where is in the app. The same goes for a changed handover place: the notification says the place has changed, and the new one is in the calendar.

What is not end-to-end encrypted

Messages between parents. This is a deliberate decision rather than unfinished work. A conversation in ParentLoop is a shared record of what was agreed about the child: a sent message cannot be edited or deleted. When someone reports abuse, we have to be able to check what was actually written — with end-to-end encryption, a report would be a screenshot, which is easy to fake. For the same reason the profanity filter runs on the server: offensive words are masked before the message is saved, so they never reach the disk. Messages are encrypted in transit and at rest, and we read them only after a report. We would rather write that down than use the word "encrypted" in a way that sounds stronger than it is.

Where the data lives

The database and files are in the European Union (Frankfurt). Data needed for push notifications and app updates (Expo, Apple, Google) and for operating this website within the global Cloudflare network may go outside the EEA — on the basis of standard contractual clauses. Address autocomplete suggestions are fetched by the phone directly from Google Maps Platform, which acts as a separate controller under its own terms. The full list of providers is in the privacy policy.

On Android, text from a photo of a receipt or a timetable is read on the phone by Google's ML Kit library — only once you agree to it. Neither the photo nor the text goes to Google; the library sends only diagnostic data. You can withdraw consent in Settings → Consents.

This website

No cookies, no analytics, no tracking scripts, and no requests to third-party servers at all — including fonts, which are deliberately not loaded from Google. That is why there is no cookie banner: there is nothing to consent to. The only thing the website stores in the browser is the selected terms language (localStorage), to open it in the same language on the next visit.

The child has no account with an email address or password

In ParentLoop, a child does not create an account with a login and does not provide an email address. The ParentLoop kids app connects to the family via a one-time QR code — no email, no password, no chat, and no way to send messages to anyone. The child can check off chores and add their own events to the calendar (without links or phone numbers); parents see them if the child turns on "Show my parents".

When one parent pairs a child's device, the other parent is notified. A paired device can be unpaired at any time in the parent's app — from that moment the child's phone no longer fetches data from the server.

Who can join the family

Only someone invited by a parent who is already in the family can join a child's profile, and an invitation is valid for 7 days. Outside account setup, the invitation code and the code for pairing a child's phone appear only after Face ID, Touch ID or the phone's passcode (if the phone has a screen lock). When someone new gets access to a child's data, the other parent is notified.

No parent can take the other's access away alone or delete the child's profile without their consent. That is deliberate: parental authority is for a court to decide, not an app. We do not check parents' documents, because that would mean collecting court rulings and identity documents. If someone is processing your child's data without the right to, or against a court order, write to us: we confirm the report straight away, tell you within 7 days how we will handle it, and where an official document makes a threat to the child's or a parent's safety plausible, we may suspend that person's access while we look into it (terms, § 6(7)).

Everyone deletes only their own entries. A document can be deleted only by the parent who added it (or by the other parent once the first one loses access to the child's data). A calendar event is deleted by whoever added it, and a task by its author or the person the author handed it to. Next to an entry you cannot delete, the app shows who added it. This, too, is enforced by the database, not just the app.

If you are in danger

ParentLoop is no substitute for help, but a few things can make the situation easier:

If you are in immediate danger, call 112. In Poland, the "Niebieska Linia" helpline for victims of domestic violence: 800 120 002 (free of charge).

Your data, your call

Exporting everything and deleting your account are both buttons inside the app. You do not have to email us, wait, or explain why.

When a child turns 18

When a child turns 18, we delete their health data — health information, medical entries and medical documents — and their PESEL number. Height and weight measurements stay. About 30 days before, everyone who can see this data gets a notification that leads to the data export, so they can download it in time.

How we check

We review the security of the app and the database before every store release and after major changes. We have a data protection impact assessment (DPIA) that describes the risks to parents and children, including families in conflict, and a procedure for handling a data breach. An automated test on every database change checks that deleting an account deletes all of its data, and a daily check makes sure files are deleted too.

The app and the database are also read by outside security reviewers who assume that the server or another user is working against you; what they find is fixed before the next release. With every database change, an automated check makes sure the access rules have none of the known kinds of mistakes.

Found a problem?

Write to kontakt@parentloop.pl. We treat security reports as a priority, and we do not hold them against the person reporting.