← Back to heifamily.com
Legal · Privacy Policy

Privacy Policy

Last updated: 4 November 2026 · Applies to the heifamily apps (Android and iOS), the web dashboard and heifamily.com

This Policy explains what personal data heifamily processes, why we process it, who we share it with, how long we keep it and what rights you have. We have written it to describe what the service actually does with your data, without implementation detail that is not needed to understand the processing.

1Who we are

heifamily is built and operated by Architech Dev Labs S.R.L., a company registered in Romania (trade registry no. J2015000417330, fiscal code CUI 34490136), with its registered office at Strada Würzburg no. 37, Gura Humorului, Suceava County, Romania. For the processing described in this Policy, Architech Dev Labs S.R.L. is the data controller within the meaning of the GDPR.

For privacy questions or requests: privacy@heifamily.com.

2How heifamily works

heifamily is a family-safety app. A parent creates the account, adds a child and pairs the child's Android phone. From then on the child's app reports to that family the information needed by the features that are on — such as location, screen time, device state, alerts and web filtering. The monitoring features are on from the moment the child is added, and a parent can switch each of them off; Message Guard is the exception and stays off until a parent turns it on. From the age at which the law of the child's country lets the child consent alone (in France, also before that age), the child can switch off any feature on their own phone, and Message Guard, if a parent turns it on from that age (in France, at any age), runs only if the child also allows it.

Monitoring begins only after the device is paired and the necessary permissions are granted on the child's phone.

Message Guard stays off until a parent turns it on, after reading what it does.

heifamily is not designed to run covertly: the child's app is visible and shows which protections are active. During setup the child's phone is also asked, visibly, to grant heifamily device-administrator rights, which prevent the app from being uninstalled until they are switched off in Android's settings; switching them off notifies the parent.

Wherever possible, processing happens on the device itself, and only the information a given feature needs reaches our servers.

heifamily is intended for parents, or others holding parental responsibility, using the service for their own minor children. Today the child app runs on Android; on iOS, heifamily is a parent app.

3Data we process about parents

  • Account data: your first name, email address, sign-in method, and the information needed to administer the account and to demonstrate your acceptance of the Terms and of this Policy. If you sign in with Apple and choose "Hide My Email", the address on your account is Apple's private relay address rather than your real one, and anything we send you there is forwarded by Apple.
  • Family and settings data: your children's profiles (such as first name, date of birth and the country they live in, which together set the age from which the child decides), the places you define, schedules, screen-time limits, language preferences and your family's other settings.
  • Device data: basic technical information about the phones you use heifamily on, the app version, the platform, and the tokens needed for push notifications.
  • Subscription and free trial: your plan, the store you pay through, the purchase identifiers and the state of your subscription. We do not receive your card details; payment is handled by Google Play or the App Store.
  • Preventing repeat free trials: we keep pseudonymous identifiers derived from limited account and device data, so that we can recognise a free trial that has already been used. They do not contain your email address or your device identifier in the clear, and they are kept for 24 months.
  • Product analytics in the parent app: only if you allow it, on the screen shown after you accept the Terms; nothing is sent unless you do. Firebase Analytics then collects how the app is used (the screens you open, steps such as adding a child or choosing a plan, subscription or payment problems), basic technical information about the phone and the app, and an identifier of the installation; Google also works out an approximate city from the connection. It never receives the locations the app tracks or your family's messages and names. Analytics does not run on the child's device, and you can change your answer at any time in Settings on the parent's device.
  • AI assistant in the parent app: if you use it, what you write or dictate in the current conversation, the assistant's replies in it and the app language are sent to Google Gemini on Vertex AI, within the European Union, so that it can answer your questions about heifamily, prepare a change you ask for that you could also make from the menu, or show you information about your children that the app reads on your phone and does not send to Google. Where the app recognises your children's first names, it replaces them with labels; nothing else about your children is sent, such as their schedules, location or messages. Google does not use this content to train AI models and does not cache it. If Google's automated safety checks flag a request, Google may keep it for up to 90 days in the EU, only to investigate abuse of its service, and authorised Google staff may review it. heifamily keeps nothing of the conversation: we only count requests, to apply a daily limit, and our logs do not contain what you wrote. The assistant can be wrong, and nothing in your settings changes until you tap Confirm. Avoid writing other personal details, such as addresses or other people's names, because they are sent as you write them.
  • Support and correspondence: the messages you send us, our replies, and limited technical context when you write to us from inside the app.
  • Diagnostics and crash reports: technical data used for debugging and app stability. Crash reports are sent to Firebase Crashlytics only from the parent's phone, and only if you allow it, on the same screen as product analytics.

4Data processed from the child's device

Nothing in this section is collected before the device is paired and the necessary permissions are granted. No crash reports are sent from the child's phone. A child's data is held under that family and is visible only to that family's authorised parents, apart from the technical providers described below and our support staff, who open a family's data only to provide support or fix a fault; each access through our support tools is logged (section 9).

4.1 Location and movement

We process the current position, its accuracy, the time, the type of movement, the speed where available, the battery level and a short street-level address. We also keep a history of routes, for the period given in section 9. This data is used for maps, route history, geofencing, named places, and arrival/departure and speed alerts. When location is switched off, pressing the panic button can still send the phone's current position once, with the alert.

4.2 Steps, screen time and apps

We may process the daily step count, the usage time of monitored apps, the list of installed apps and, for the current day, the stretches of time during which a monitored app was in use. While a parent is watching the child's status live, the app may temporarily report whether the screen is on and which monitored app is in the foreground; that status is overwritten and does not become permanent history.

4.3 Web filtering

While the content filter is active, heifamily filters DNS requests in order to apply the rules the parent has chosen. We keep no history of the sites visited and we do not inspect page content. When the filter blocks a site while the child is browsing, the phone sends us only the category of the block (for example gambling), so that we can alert the parent; the name of the site is not sent. Some technical or background blocks raise no alert. If a private DNS server set on the phone gets around the filter, the parent is alerted, and the phone sends us that server's name with the alert.

4.4 Calls

Call blocking works only on the child's phone: the phone compares the number of each incoming call with the numbers the parent has blocked and rejects the calls that match. So that calls from numbers saved in the phone's contacts are checked too, Android requires access to the contacts; heifamily does not read them and sends nothing from them. The number and time of a call are not sent to us or to the parents. The phone counts the calls blocked each day and sends only that number, a few times a day, so that the parent can see how many calls were blocked today. We do not record calls and we keep no log of calls or SMS messages.

4.5 Message Guard

If a parent turns on Message Guard, the child's phone has shown the child what it does (and the child has allowed it, where section 2 requires it) and notification access has been granted, the child's phone checks the messages it receives in supported messaging, email and social media apps, as they appear in notifications. It compares them with a list of words and phrases stored on the phone, in English and in the phone's language. We do not read what the child types, the conversation history inside apps, or messages the child sends.

The check happens only on the child's phone. No message, sender, word found, category or count is sent to heifamily, to the parents or to anyone else, and nothing about the messages is stored. If the list cannot be loaded, nothing is checked.

If a received message seems to contain something dangerous, the child sees a warning and can choose to send their parents the fixed request "I need to talk"; the message itself is not sent. The child can also send this request at any time from the app. Parents then receive only a notice that the child wants to talk to them. Message Guard does not block the child and takes no legal or similarly significant decisions.

4.6 Device state and family actions

We process information such as online/offline state, the app version, the state of the necessary permissions, the time zone and, for the ring feature, the ringer state. The child's device signs in anonymously — its account holds no email address, no name and no phone number — and we use a per-installation identifier, a server-generated device identifier and a push token so that alerts and commands can reach the phone; advertising identifiers are explicitly disabled. The device also records when the in-app disclosure screens were accepted and which version of that text was shown, so that we can demonstrate which disclosures were accepted and when.

The child can trigger a panic button, a request for extra time or the request "I need to talk", and the parent can request a location or presence update, change screen time, make the phone ring and send fixed check-in questions. heifamily provides no free-text messaging between parent and child on this path; we keep only the information needed for the feature used.

5What we deliberately do not collect

  • We do not read the child's keyboard and we do not read the conversation history inside messaging apps.
  • We keep no browsing history and we do not inspect the content of web pages.
  • We keep no log of calls or SMS messages and we do not record calls.
  • The child's app does not request camera or microphone access for the features described in this Policy.
  • We use no advertising SDKs, and we do not sell or rent personal data.
  • We do not run product analytics or crash reporting on the child's device.

6Providers and recipients

We use technical providers only for the functions the service needs. They process data only for the purposes described here and, where applicable, under data processing agreements.

  • Google Cloud / Firebase / Vertex AI — Role: database, authentication, cloud functions, web hosting, server logs, push, crash reporting, app integrity checks, product analytics (only if you allow it) and the AI assistant in the parent app · Data: what each function requires; the AI assistant runs in the EU and receives only what is described in section 3.
  • Google Workspace (Gmail) — Role: delivering the emails we send you (account, security, purchase and deletion notices) and our email correspondence with you · Data: your email address, your first name and the content of the email.
  • Google and Apple sign-in — Role: confirming your identity if you choose to sign in with Google or Sign in with Apple · Data: the account identifier, name and email address that provider shares with us; the provider learns that you signed in to heifamily.
  • Google Play and Apple App Store — Role: taking and administering subscriptions · Data: purchase and subscription-state data; we do not receive your card details.
  • Apple Push Notification service and App Attest — Role: delivering alerts to iPhones and confirming that requests come from the genuine iPhone app · Data: the iPhone's push token and the text of each alert or notice, which can include your child's first name, another parent's first name, a place name or address, a speed, the app concerned, the category of a blocked website or the start of a reply from our support.
  • RevenueCat — Role: verifying and synchronising the subscription · Data: purchase identifiers, a pseudonymous family identifier and basic technical data; it receives nothing about your child.
  • Cloudflare — Role: DNS resolution while the web filter is active · Data: the domain names looked up (sent encrypted) and the device's network IP, as any DNS service receives.
  • Mapbox / Google Maps / Apple Maps — Role: maps, place and address search, and drawing or snapping routes · Data: the coordinates and map requests the feature in use requires; to draw your child's routes along roads, Mapbox receives the positions of the journey with their times and accuracy. Mapbox's map software also reports each map load to Mapbox, with an identifier of the device or browser, and Mapbox uses these reports to bill us; we have switched off its optional usage telemetry, which you can turn back on from the map's information button in the app.
  • Android's geocoding service — Role: turning a position of the child's phone into the short street address shown to parents, on the child's phone itself · Data: the coordinates of that position; on most Android phones this service is provided by Google.
  • Google Maps on the web — Role: place search in the web dashboard · Data: your browser's IP address and standard request data, what you type and a point near one of your child's places. The Cookie Policy published on our website lists everything the website and the dashboard load from other companies.
  • Public list providers / GitHub — Role: downloading the lists used by local filtering · Data: standard download-request data, such as the network IP.

Within the family, authorised parents see the child's data. We may disclose data to authorities only where the law requires it. If the service or the company is transferred to another operator, data may be transferred with the service, in compliance with our legal obligations and with notice to users. We do not sell data and we do not use it for advertising.

7Where data is processed and international transfers

The family's product data is stored primarily in the European Union, and the AI assistant runs in the EU. Some platform services and providers are global or have infrastructure in the United States, including RevenueCat, Mapbox, certain Google and Apple services (among them sign-in and the delivery of our emails), Cloudflare and the public list providers. For transfers outside the European Economic Area we rely on the safeguards provided by the GDPR, including the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. You can request further information at privacy@heifamily.com.

8Data security

We apply technical and organisational measures to protect data against unauthorised access, loss or misuse. These include encryption in transit and at rest, access control, authentication, anti-abuse limits, separation of data between families, audit logs, and backups for recovery in the event of an incident.

If a personal data breach occurs, we handle it and notify the authority and the people affected where the GDPR requires us to do so.

9How long we keep data

We keep data only for as long as the purposes described require. Deletion is automated, per data type. The main periods are:

  • Location history and screen time — approximately 30–31 days.
  • The child's last known position (with its address, accuracy, battery level, step count and time) — replaced by each new position; if the phone stops reporting, the last one is kept until the child is removed or the account is deleted.
  • Places you name (their coordinates and address, and when your child was last there) — until the child is removed or the account is deleted; removing a place from your list takes away its name, radius and alerts but keeps that record.
  • Steps — daily counts are stored one record per calendar month and deleted 31 days after that month's last update, so up to about two months.
  • Alerts — approximately 30 days.
  • The number of calls blocked today — replaced each day by that day's number; if the phone stops reporting, the last one is kept until the child is removed or the account is deleted.
  • Live presence and current status — overwritten; not kept as history.
  • The installed-apps list and the records of an unpaired device — approximately 30 days after unpairing.
  • Routes matched to roads (the path of your child's journeys, drawn along roads) — 31 days from when the route is drawn on the map. A route your child travels again, such as home to school, is kept in a library shared by the children of the family for 120 days from the last time a journey along it was viewed, so a route repeated regularly is kept for as long as it keeps being repeated; removing any child deletes the whole library.
  • Support conversations — 180 days after they are resolved.
  • Support access log (which administrator looked up or changed which family's account, and when) — 24 months, also after the account is deleted.
  • Technical incident records (a family's identifier and our notes on a fault we are investigating) — 180 days after the incident is resolved, also after the account is deleted.
  • Technical diagnostics and server logs — 30 days; crash reports may be kept for up to 90 days.
  • Emails we send you — the copy in our sending queue is deleted after 30 days. Copies of the emails we send you and of our email correspondence with you are kept in our Google Workspace mailbox for at most 24 months after the last message.
  • Product analytics — up to 14 months in Firebase Analytics.
  • Subscription and billing records — your plan, the store, the purchase identifiers and the state of the subscription, while the account exists; the technical log of individual billing events, 180 days, also after the account is deleted.
  • Withdrawals from a subscription (the name and email address you give us, the subscription and the order, when you sent the withdrawal and what we refunded) — 3 years, also after the account is deleted, as proof of what you asked and what we did.
  • Pseudonymous identifiers preventing repeat free trials — 24 months.
  • Account and family setup — until deletion; families without paid access are deleted 3 months after that access ends, if it is not renewed.
  • Backups — deleted data ages out of backups within at most 98 days.

If you delete your account while you have a subscription, we may keep the data strictly needed to stop or follow its billing, to show that you asked us to stop it and to prevent the same purchase from being claimed again, as a rule for up to 24 months. On Google Play, the purchase identifier may be kept for longer only if the billing continues. On the App Store, your email address may be kept temporarily only so that we can warn you about continued billing, and it is erased when the subscription ends or, at the latest, within 90 days of the end of the paid period.

11Data about people who contact your child

By the nature of the service, we may process limited data about people outside the family — for example the number of someone who calls the child, which the child's phone compares with the parent's list of blocked numbers without sending it to us or to the parents. The numbers a parent blocks, with any label the parent adds, are kept until the parent removes them or the child is removed. Message Guard checks the messages such people send to the child only on the child's phone, and sends nothing about them to us or to the parents. We use this data only for the child's safety and keep it for the periods above. We do not use it for commercial profiling or advertising.

Informing each such person individually is impossible or would involve disproportionate effort (art. 14(5)(b) GDPR); this Policy serves as the public notice of that processing.

If you are such a person, you can request information, you can object to the processing where the law allows, and you can request erasure of the data concerning you at privacy@heifamily.com.

12Your rights and your child's

Under the GDPR, you and your child have, as applicable, the right of access, rectification, erasure, restriction, objection, withdrawal of consent and data portability, as well as the right to lodge a complaint with a supervisory authority.

In Romania the competent authority is ANSPDCP (www.dataprotection.ro). You can also contact the supervisory authority of your own EU/EEA country. To exercise your rights: privacy@heifamily.com. We reply within the period set by the GDPR, as a rule within one month at most.

Depending on their age and maturity, a child may also exercise their rights directly. We encourage parents to be open with their children about using heifamily.

13Deleting your account

You can request deletion of your account in the app. There is a 24-hour grace period during which you can cancel the request. If you have a paid period running, you can choose to keep the account until the access you have already paid for ends, and to have it deleted then.

After deletion we remove profiles, children, monitoring data, devices, alerts and family links, apart from the limited data that we must, or are justified to, keep temporarily — such as the pseudonymous identifiers preventing repeat free trials and the data strictly needed to close a subscription that is still being billed. These exceptions and their periods are described in section 9.

You can also delete more narrowly at any time. Removing a child erases that child's profile, monitoring data and alerts right away, and that child's device records about 30 days later.

Deleted data may remain for a limited time in backups kept for disaster recovery, but it is not used in the ordinary course and ages out of backups within the period given in section 9.

14The website and browser storage

The public heifamily.com website uses no behavioural advertising and runs no product analytics. The servers that deliver the site receive, as any web service does, the IP address and standard technical data needed to serve the page. What the website, its sign-in pages and the web dashboard keep in your browser, such as the language you choose, and what they load from other companies is described in the Cookie Policy published on the site.

15Changes to this Policy

If we change this Policy in a material way, we will tell you in the app or by email before the change takes effect. If the change materially affects the data collected about a child or the purpose of the processing, we will ask for fresh acceptance where the law requires it. Previous versions are available on request at privacy@heifamily.com.

16Contact

Architech Dev Labs S.R.L. · Strada Würzburg no. 37, Gura Humorului, Suceava County, Romania · Trade registry J2015000417330 · CUI 34490136 · privacy@heifamily.com