Draft dated 28 October 2026. Not for publication until the marked fields and release checks are complete. Effective date: [date].
This Policy covers the parent and child GPS Tracker & Locator apps and associated service. Reading it does not replace separate informed consent or operating-system permissions.
Operator: Individual entrepreneur Anna Harashchenko (FOP Harashchenko Anna Anatoliivna), Ukraine.
Correspondence address: [postal address]. Support, privacy and deletion contact: [working email address].
Deletion request without installing the app: [public URL].
Registration details: [FOP registration details]. Countries served: [country list].
The service is for parents and legal guardians caring for their own minor children. Monitoring adults, including a partner or spouse even with their consent, or other people's children is prohibited.
Parents must explain what is transmitted, to whom and how to stop it in language the child understands, considering age, maturity and privacy. Parental consent does not automatically authorise processing other people's conversations.
The scope depends on enabled features and permissions.
| Data | Purpose |
|---|---|
| Adult email, phone number, name, role, city, login and family-access data | Account, authentication, contacting you about the account and subscription, device linking. The phone number is mandatory at registration |
| Client record: email, phone number, identifiers of the adult's and child's phones (Android ID), registration, last-activity and deletion dates, subscription status and payment history | Abuse prevention: obtaining the free period again with another email on the same device, circumventing restrictions; customer records and support |
| Child name or nickname, profile details, pairing codes, Lumi tasks and points | Profile and family features |
| Precise location, time, accuracy, routes, geofences and SOS | Maps, history and alerts, including in the background |
| Battery, connectivity, permission and protection status | Device status and change notifications |
| Microphone audio during a live session | Live transmission through the server to the parent's phone |
| Chat text, voice messages, selected or created photos and videos | Delivery and playback, separately from live audio |
| App names, identifiers, icons, usage duration and limits | Screen-time reports and parental restrictions |
| DNS domains, time and blocking outcome | Local VPN filtering and parental reports, not page content or a complete browser history |
| Numbers and times of rejected unknown calls | Parental alerts; contacts are checked locally to recognise known callers |
| Access and push tokens, Android ID, network and diagnostic data | Delivery, security, device recognition and trial-period enforcement |
The service does not read conversations inside other apps or record telephone calls. This does not exclude materials voluntarily sent in the family chat. The contact list is not uploaded by this feature, but local contact access is used.
After a separate initial explanation, consent and permissions on the child's phone, an authorised adult can start a session remotely without the child confirming every session. Transmission can work in the background and with the screen locked while the operating system allows the service to run.
While ready, the notification says “Radio available to parents”; the microphone does not capture audio between sessions. During transmission it says “Radio: parents can hear audio” (displayed in Ukrainian in the current app). Notifications are initially silent and vibration-free. Android controls its system microphone indicator.
Audio passes through the Operator's server and short RAM buffers on the server and phones. The live-radio feature does not create an audio file, transcript or archive, offer session downloads or use sessions to train AI. No file does not mean no personal-data processing. This is not end-to-end encryption: the server technically processes audio.
There is no fixed five-minute limit. A session ends when the parent stops it, leaves the listening screen, the child disables microphone access, or connectivity/the service ends. Detecting network loss takes some time. Buffers are released when the session is removed and are not intended for later playback.
On the child's phone: Settings → What parents can do → Technical transmission settings → Allow microphone for Radio (Ukrainian labels in the app). Switching this off stops transmission and prevents new sessions until re-enabled. Android permissions can also be revoked. Location and microphone have separate controls.
The Terms prohibit external recording, copying, publishing or sharing of live audio. The app cannot guarantee prevention of recording by external means. Chat voice messages, photos and videos are stored separately; the no-recording statement applies only to live Radio.
Account data is needed to perform the agreement. Sensitive features require appropriate legal grounds, a separate explanation and permissions. Parental authority and, where required, the child's own consent are determined by applicable law. Consent may be withdrawn without affecting the lawfulness of earlier processing. Security-related legitimate interests require assessment of the child's rights. Country-specific legal grounds: [confirm].
Refusing microphone access should disable Radio, not features that do not need it. System permission does not replace informed consent. Data is not intended for sale, advertising or marketing profiling. Automatic alerts and restrictions implement settings chosen by parents.
Connected authorised adults receive data within their family access. Parents must check invitations and protect their accounts. Hosting: [provider legal name and server country — confirm].
Google Firebase Cloud Messaging processes tokens, service data and notification content sent through push. The Android app uses Google Maps; other available maps may use OpenFreeMap/OpenStreetMap. Map providers receive network requests and the viewed map area. Allowed DNS requests go to the configured resolver; the current implementation uses Google Public DNS. Email provider: [confirm after setup]. Payment services: [confirm before paid launch].
Processing countries, provider agreements and international-transfer safeguards: [verify]. We do not claim that all data stays only in Ukraine.
The test server is available over HTTPS. Transport encryption, authentication, access control and incident response are the Operator's responsibilities; release verification is not yet complete. Public-authority requests are handled within applicable law. Breaches are notified as and when required by law.
| Data | Current implementation / clarification |
|---|---|
| Live audio | Short RAM buffer; no file archive |
| Account, profile, places and settings | Until account deletion |
| Client record (email, phone number, device identifiers, dates, subscription status) | Retained after account deletion to prevent fraud and abuse (the Operator's legitimate interest); not used for advertising or mailings |
| Chat and media files | Three-day server buffer; cleanup approximately hourly. The full history lives on the parent's and child's phones for a period the user chooses in chat settings |
| Support conversations | 90 days on the server; on the phone for a period the user chooses |
| Routes and domains | Three-day server buffer; complete cleanup needs verification |
| Detailed usage statistics | Seven daily sets; current app inventory remains in the profile |
| Parent's local archive | Choice of 3, 14, 30, 90 or 360 days, initially 30; the server cannot delete exported files |
| Logs, backups, push tokens, codes and device identifiers | [approve retention periods and verify cleanup] |
Delete an account in the parent app through Menu → My account → Delete account; an individual device can be deleted in its settings. Unpairing is not account deletion. After account deletion, child profiles, places, routes, events, chats and media are erased and child phones are unlinked. Only a minimal client record is kept (email, phone number, identifiers of the adult's and child's devices, registration and deletion dates, subscription status) so that the same device or person cannot obtain the free period again and so that abuse can be recognised. This data is not used for advertising. In the test version, deleting account records does not yet guarantee immediate removal of all media and local copies. This defect must be addressed before release; we do not promise verified erasure of every copy.
Under applicable law, you may request access, copies, correction, erasure, restriction or portability, withdraw consent or object. Contact: [working email]; outside the app: [deletion URL]. We may request proportionate identity verification and respond within statutory deadlines. You may complain to a competent data-protection authority; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights.
Material changes are disclosed in the app before taking effect. Continued use alone is not consent to a new sensitive-data purpose: new consent is requested separately when required. Both language versions must describe the same processing.