Where's The Kid — Privacy Policy

Effective date: 21 October 2026 Version: 1.1 Applies to: the Where's The Kid Android app (in Hebrew: איפה הילד) and our website at https://wheresthekid.app.

TL;DR

• Where's The Kid helps parents confirm that their child reached daycare, and escalates alerts when no one confirms. To do that, our servers need to know who to alert, when and how.
• We store only what the alerts need: parent names and emails, optional phone numbers, the child's first name (no photo, no date of birth), the daycare name, the weekly schedule, and the contacts you choose to add.
• The app is free and shows ads. Ads are served by Google AdMob on some quiet screens, never on alert or confirmation screens. AdMob uses your device's advertising ID and related device data. Where the law requires it (for example in the EEA and the UK) we ask for your consent before personalised ads, through Google's consent form; otherwise you see non-personalised ads. You can reset or delete your advertising ID in Android settings at any time.
• Location is optional. If you turn on location reminders, geofencing runs on your phone; the phone's coordinates are never sent to us, your home place never leaves the phone, and we only receive events such as "arrived at daycare at 08:12". There is no continuous tracking.
• No address-book access, no data sale. The app does not read your contacts. We do not sell your personal data.
• Alerts go out by push notification, WhatsApp and email through Google Firebase, Twilio (WhatsApp), Twilio SendGrid and Amazon SES. SMS and voice calls are not available for now, so we do not process SMS or call data.
• Emergency contacts and the daycare are added by you. You must have their consent before adding them, because they may receive messages about your child.
• Data is hosted on Amazon Web Services in Frankfurt (EU). Some providers process data in the United States under Standard Contractual Clauses.
• Check logs are kept for up to 12 months; account data until you delete your account. Delete it any time in the app (Settings → Delete account) or at https://wheresthekid.app/en/delete-account/.
• The service is for parents aged 18 and over. It is not directed at children.

1. Who we are

The data controller is EZ Dev, an independent developer brand based in Israel (https://zedeasydev.com), which operates Where's The Kid (the "Service").

• Privacy contact: contact@zedeasydev.com

We answer privacy requests by email.

2. What data we process, and why

2.1 Account and sign-in

You sign in with your Google account only. The app sends a Google ID token to our backend, which verifies it with Google. We receive and store your Google account identifier, your name and your email address. We never create or store a password.

2.2 Parent profile

For each parent in a family we store: name, email address (taken from the Google account, and editable), an optional mobile phone number (in international E.164 format), whether you opted in to WhatsApp alerts, and your language (locale), which decides the language of your alerts. We also store your family membership: which family you belong to and the invite code used to join it. We store your device's push notification token (Firebase Cloud Messaging) so that alerts reach your phone.

A phone number is not required. If you add one and WhatsApp is available, it may be verified with a code sent over WhatsApp, and it is used for WhatsApp alerts and for the "Call partner" button, which opens your phone's dialer on your device. We do not send SMS or make calls to it.

2.3 Child and schedule

For each child, a parent enters: the child's first name, the daycare name, and a weekly schedule: for each weekday, whether a check is on, the drop-off deadline, and which parent is responsible, together with the time zone. We do not collect photos, date of birth, home address or any other information about the child.

2.4 Emergency contacts and daycare contact

You can add emergency contacts and a daycare contact (name, email address and/or WhatsApp number). These people do not use the app. They receive a WhatsApp message or an email from the Service only if an alert reaches the step of the escalation ladder that you configured for them. The message identifies the Service and includes your child's first name and the deadline.

You must have each person's consent to give us their details and for them to be contacted this way. If a contact asks you to stop, remove them in the app. A contact can also write to us, and we will remove their details.

2.5 Checks, alerts and confirmations

For each scheduled check or trip, we keep a check log: when the check was due, which reminders and alerts were sent (channel, recipient, time and delivery status), who confirmed or acknowledged it and when, and the escalation settings in force.

When you confirm, we receive your tap in the app or on a notification, your WhatsApp reply, or the opening of a signed confirmation link in a WhatsApp message or email. We use these only to confirm the check and record the confirmation. We do not use the content of your replies for any other purpose.

The check log is visible to the parents in the family, in the app.

2.6 Optional location reminders

Location is off by default and the Service works fully without it. If you turn on location reminders, the app asks for location permission (including background location) only after an in-app explanation, and:

• Geofencing runs on your phone. Android's Geofencing API evaluates the places you set. There is no continuous tracking: the app does not record your route, and your phone's coordinates are never sent to us.
• Your home place never leaves your phone. It is stored only on that device.
• A daycare place (its map position, radius, label and address) that you enter for a child is stored on our server as content you provide, so that every phone in your family can run the same arrival reminder.
• When a geofence fires, the app sends us an event such as "arrived at daycare at 08:12" or "left home at 07:50" (no coordinates). We add it to that day's check log and use it to notify your family and remind you to confirm.

You can turn location reminders off, or remove location permission in Android settings, at any time. Events already recorded stay in the check log for its retention period (section 5).

2.7 Advertising

The app is free and is funded by ads. Ads are served by Google AdMob in a small banner on some quiet screens (such as Settings, the alert history, Children and Family). We never show ads on alert or confirmation screens, during onboarding, or while a check is escalating.

When an ad is shown, the Google Mobile Ads SDK collects and processes, under Google's control: your device's advertising ID (Android Advertising ID), IP address, device and app information (such as model, operating system, language and app version), and ad interactions (which ads were shown and whether you tapped them). Google uses this to deliver and measure ads, limit how often you see the same ad, and prevent fraud, and, if you consent where consent is required, to show personalised ads.

Consent. In the EEA, the UK and Switzerland (and wherever else the law requires it), the app shows Google's User Messaging Platform (UMP) consent form before personalised ads. If you do not consent, you see non-personalised ads, which still use limited data for delivery, frequency capping, measurement and fraud prevention. You can change your choice at any time from the ad privacy options in the app's Settings.

Opting out. On Android you can reset or delete your advertising ID (Settings → Privacy → Ads, or Settings → Google → Ads, depending on your device), or opt out of ad personalisation. After deletion, apps and Google can no longer use the advertising ID for ads.

We do not pass your name, email, phone number, your child's details, your schedule, your check logs or your location events to AdMob or to advertisers. Google's own use of ad data is described at https://policies.google.com/technologies/ads and https://policies.google.com/privacy.

2.8 SMS and voice calls

SMS text messages and voice calls are not available in the free version for now. We do not send SMS or calls, and we do not process inbound SMS, call audio or keypresses. If they return as an optional paid feature, we will update this Policy first.

2.9 Email correspondence

If you email us, we use your message and email address only to reply.

2.10 What we do not collect

• No location tracking. No continuous or background tracking of your movements; the phone's coordinates are never sent to us (see section 2.6 for the optional reminders).
• No access to your contacts book. Emergency and daycare contacts are typed in by you.
• No photos, audio recordings, files or messages stored on your device.
• No payment data. There are no purchases in the app for now.
• We do not sell your personal data or share it with data brokers.

2.11 Website

Our website provides information about the Service and hosts the account-deletion page. It does not run third-party advertising or tracking SDKs, and it does not use cookies beyond those strictly necessary for it to work. Our hosting provider may keep standard technical server logs (such as IP address and time of request) for security and operations.

3. Legal bases

Where the GDPR or a similar law applies, we rely on:

• Performance of a contract (GDPR Art. 6(1)(b)): your account, parent profile, child schedule, checks, alerts, confirmations, push token and, if you turn them on, location reminder events and daycare places, which are needed to provide the Service you asked for.
• Consent (Art. 6(1)(a)): personalised ads where consent is required (through the UMP consent form), and the location permission on your device. You can withdraw consent at any time without affecting earlier processing.
• Legitimate interests (Art. 6(1)(f)): showing non-personalised ads to keep the Service free; processing the names, emails and WhatsApp numbers of emergency and daycare contacts so that the alerts you configured can reach them, which serves the interest of a child's safety; keeping check logs for a limited period so parents can review what happened and so we can investigate delivery problems; securing the Service; answering your emails.
• Legal obligations (Art. 6(1)(c)): keeping records where the law requires it.

The child's first name and schedule are provided by the parent, who acts as the child's legal guardian.

4. Who receives your data

We use service providers that process data on our behalf and under our instructions (processors):

Google AdMob. Ads are served by Google, which processes the advertising data described in section 2.7. For personalised ads, Google acts as an independent controller under its own terms and privacy policy.

WhatsApp. If you opt in to WhatsApp alerts, the messages are delivered through WhatsApp, which is operated by WhatsApp LLC / Meta Platforms. WhatsApp processes the messages it carries under its own terms and privacy policy.

Recipients you choose. Alerts and location reminder events are shared with the other parent in your family, and alerts reach emergency contacts and the daycare contact when the escalation ladder you configured reaches them. This is part of the Service you asked for.

Google also processes your Google account under its own privacy policy. We may disclose data if required by law or a valid legal order, or to protect someone's life or safety.

5. Retention

Our messaging providers (Twilio, SendGrid, Amazon SES, Firebase) keep their own delivery logs for limited periods under their own retention terms. Google keeps advertising data under its own retention policy.

6. Deleting your account

You can delete your account at any time:

• in the app: Settings → Delete account;
• on the web: https://wheresthekid.app/en/delete-account/;
• by email to contact@zedeasydev.com.

Deletion removes your profile and your phone-number routing records. When the last parent leaves a family, the family, its children, schedules, daycare places, contacts and check logs are deleted too. To reset the advertising ID that ads used, see section 2.7.

7. International transfers

We store data in the European Union (Frankfurt). Our operator is in Israel, which the European Commission recognises as providing an adequate level of protection. Twilio and Twilio SendGrid process message data in the United States, and WhatsApp and Google (including AdMob and Firebase) may also process data outside the EU. Where data leaves the EU or Israel, the transfer relies on recognised safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

8. Security

Data is encrypted in transit (HTTPS/TLS) and at rest. Access to our systems is restricted. Webhooks from our providers are verified by signature, and confirmation links are signed. No system is perfectly secure. If you believe your account has been misused, contact us immediately.

9. Your rights

Depending on where you live, including under the GDPR and the Israeli Protection of Privacy Law, you may have the right to:

• access the personal data we hold about you;
• rectify inaccurate data (you can edit most of it directly in the app);
• erase your data (see section 6);
• data portability: receive your data in a structured, machine-readable format;
• object to processing based on legitimate interests, or ask us to restrict it;
• withdraw consent to personalised ads (ad privacy options in the app's Settings) or to location (Android settings) at any time;
• lodge a complaint with a supervisory authority, for example your local EU data protection authority or the Israeli Privacy Protection Authority.

To make a request, email contact@zedeasydev.com. We may ask you to confirm that you control the account. We respond within the time limits set by applicable law. Emergency and daycare contacts may exercise these rights too.

We do not carry out automated decision-making that produces legal or similarly significant effects on you.

10. Children

The Service is for parents and guardians aged 18 and over. The app is not directed at children, and children do not use it. Ads are configured for an adult audience. The Service stores a child's first name and daycare schedule only because a parent provides them in order to protect the child, and never shares them with advertisers. We do not knowingly collect personal data directly from children. If you believe a child has given us personal data, email contact@zedeasydev.com and we will delete it.

11. Changes to this Policy

We may update this Policy. We will change the effective date and version above and, for material changes, notify you in the app or by email.

12. Language

This Policy is published in English and Hebrew. The English version is the governing text; if the versions differ, the English version prevails.

v1.1 (21 October 2026): the app is free and shows ads (Google AdMob, advertising ID, UMP consent, how to opt out); optional on-device location reminders; phone number optional; SMS and voice calls not available for now; removed the subscription section. v1.0 (20 October 2026): initial publication.