Privacy Policy

1. Who we are

The service described in this policy, the child app, the parent app and the parent panel at mobiletracking.app/my/, is operated by MobileTracking, which is the data controller for everything described below. Questions about this policy, and any request under it, go to [email protected]. We answer from that address ourselves rather than through a third-party ticketing service.

2. The short version

The app on your child's phone collects the shape of what they do, never the contents. That means names, times, durations, counts and categories: where the phone is, which apps were open and for how long, which websites' titles were visited and which were blocked, who was called or texted and when. It does not mean the words in any message, any photo, anything typed, or anything the camera or microphone could pick up. Your child can see the full list of what is shared on their own phone, and can see that you opened the panel today.

On the parent side we hold an email address, a password hash, your children's first names and dates of birth, and your settings. This public website shows advertising; the advertising is separate from the app and never receives anything about your family. We do not sell data, we do not put advertising code in the app, and when you delete a child or close your account, the records go with it.

3. What the child app collects, item by item

Each item below is tied to one feature and one Android permission. If the permission is not granted, that item is simply not collected, and the panel's health line says so. Everything in this list appears on the child's "What's shared" screen as soon as it is switched on.

• Location and accuracy. The phone's position, the time of the reading and the accuracy radius Android reports with it. Readings are taken when the phone settles somewhere, using Android's low-power location services, not by polling every few seconds.
• Place crossings. When the phone enters or leaves a circle a parent has drawn around a named place, such as Oakridge School, with the time. The circle is evaluated on the phone.
• Screen time and app usage. The names of apps used and the duration of each session, totalled per day, and the time any limit was reached or more time was requested.
• Installed apps. The list of installed app names, with the date an app appeared or was removed, so a new install can be flagged on the day.
• Web activity. The titles of visited web pages, the category the filter assigned to each, and any attempt to open a page in a blocked category. Not the page contents, and nothing inside a logged-in account.
• Call and SMS metadata (APK build only). Phone numbers, the saved contact name if there is one, the direction, the time, and for calls the duration. The Google Play build does not collect this at all.
• Notification counts and keyword matches. How many notifications each app showed and when. If a parent has set a keyword list, matching happens on the phone against notification previews, and only the matched word, the app name and the time leave the phone.
• Battery and permission state. Battery level, whether battery optimisation is on, which of the app's permissions are granted, and the time of the last check-in, so the health line can tell you why a phone has gone quiet.

4. What it never collects

This list is as important as the one above, and it does not change by plan or by price. The child app does not read the contents of any message, on SMS or in any app including WhatsApp, Instagram, Snapchat, Messenger and Viber. It does not access photos or the gallery. It does not use the camera. It does not use the microphone and does not record calls. It does not log keystrokes, read passwords or capture anything typed into a form. It does not take screenshots or record the screen. It does not read posts, direct messages or follower lists on any social platform.

Where a feature could only work by crossing one of those lines, we do not build the feature. Keyword alerts are the closest the app comes: a match is made on the phone, and the message that triggered it is discarded there, unread by us and unseen by the parent.

5. The parent account

To create an account we ask for an email address and a password. We store the password as a salted hash and cannot read it back; if you forget it, we send a reset link to the email address rather than a copy. For each child you add we hold a first name and a date of birth. The date of birth sets age-appropriate starting values and the first name labels their card; we do not ask for a surname, a school name or a photograph. We also hold your settings: limits, schedules, saved places with their coordinates and radius, keyword lists, alert rules, and which co-parents you have invited. If you contact support, we keep the message and our reply.

6. This website, cookies and advertising

The pages you are reading now, as opposed to the panel you sign into, are a public website that shows display advertising. The advertising pays for the writing and testing on these pages. It is separate from the app and from the parent panel, and the advertising systems never receive family data: nothing about your children, their phones, their locations or your account is available to them.

We use Google AdSense to serve those advertisements. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or to other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet. You may opt out of personalised advertising by visiting Google's Ads Settings at www.google.com/settings/ads, and you can opt out of some other third-party vendors' use of cookies for personalised advertising at www.aboutads.info.

The cookie notice shown on your first visit records your choice. Choosing not to accept advertising cookies means ads may still appear, but they will not be based on your browsing. The website itself sets a small number of cookies needed to remember that choice and to keep a contact form submission from being sent twice. We do not run behavioural analytics on this website that could follow you to other sites.

7. How long we keep things

Location readings and the history built from them are kept for a rolling window of recent weeks and then deleted automatically; a parent can delete any day sooner from the history screen. App usage, web activity, call and SMS metadata, notification counts and keyword matches are kept for the life of the child profile, so that weekly comparisons keep working, and are deleted when the child is deleted. Account details and settings are kept until you close the account. Device health readings are overwritten by the next check-in and are not kept as a series. Support messages are kept for as long as is needed to answer them and then for a reasonable period in case you write back. Website cookies last for the period stated in the cookie notice.

8. Who can see it

You, as the parent who created the account, can see everything collected for your children. Any co-parent you invite from the Family access page can see the same, and the panel's command log records who changed a rule or looked at a location, by name. Our support staff can look at a limited set of screens, only while helping with a problem you have raised, and every such access is logged; they cannot read anything the app does not collect, because it is not stored anywhere.

Our hosting provider stores the data on our behalf and our email provider sends alerts and password resets. Both act as processors under contract and do not use the data for their own purposes. We will disclose data to a court, police force or regulator when the law requires us to, after checking that the request is valid, and we will tell you unless we are legally prevented from doing so.

9. What we never do

We do not sell personal data, and we do not share it with data brokers, marketing lists or "partners" of any kind. The child app contains no advertising SDK and never will. It contains no third-party analytics on location data: no library inside the app reports where a child is to anyone but your account. We do not use the data to build profiles of children for any purpose beyond showing it to their parent. We are paid by parents, so there is no ad-funded version of the app and no business reason for any of the above to change.

10. Children

The child app is installed by a parent or legal guardian on a phone used by their child, and the child is told. The consent screen shown before pairing completes lists what will be shared and what never will, and the "What's shared" screen keeps that list current for as long as the app is installed. We process a child's data on the instruction of the parent, as part of that arrangement, and the child can see what is collected at any time on their own phone.

We do not knowingly collect personal data from children outside that arrangement: a child cannot create a parent account, and the website is not aimed at them. If you believe a child's data has reached us some other way, write to [email protected] and we will delete it.

11. Your rights

You can see almost everything we hold about your family by signing in to the panel, and you can change the account details and every setting there. For anything else, you can ask us to give you access to your data, to export it in a readable format, to correct it, or to delete it, and we will confirm you are the account owner before we act. Most deletion is in your own hands: deleting a child from the Children page removes their history; closing the account from Account settings removes everything; uninstalling the child app stops collection immediately, whether or not the account still exists.

If you are in the United Kingdom or the European Economic Area, these rights come from the UK GDPR and the GDPR, which also give you the right to object to processing, to restrict it, and to complain to your supervisory authority, which in the UK is the Information Commissioner's Office. Similar laws in other places, including several US states, give similar rights, and we apply the same process whichever applies to you. Our lawful basis for the service is the contract with you, and for the child's data it is the parent's instruction within that contract; for the website's advertising cookies it is your consent, which you can withdraw through the cookie notice at any time. Requests go to [email protected]; we reply within a month and tell you if a request will take longer.

12. Changes and contact

When this policy changes, we update the date at the top and, for any change that affects what is collected or who can see it, we email the account address and show a notice in the panel before the change takes effect. Small clarifications of wording do not get an email. Older versions are available on request. The policy is written to be checked against the product: if a feature page or the FAQ describes something this policy does not cover, tell us through the contact page and we will correct one or the other.

Privacy requests: [email protected]. Everything else: [email protected]. Controller: MobileTracking.