Privacy Policy
In short: DigiTogether is a parental-control and digital-wellbeing app. A parent installs it on their own phone and on their child's phone. We collect only what the app needs to keep the child safe and to show the parent their child's digital activity. We do not upload message text, we do not read SMS or call logs, we send no analytics from the child's phone, we do not show ads, and we never sell anyone's data. You can delete your account and all of your family's data from the app at any time.
1. Who we are
DigiTogether (the "App") is provided by Kundan Kumar, trading as DigiTogether, Bengaluru, Karnataka, India ("we", "us"). We decide how and why the personal data described below is processed.
Contact for privacy questions, requests and grievances: [email protected].
2. Who this policy is about
- Parents and guardians who create a DigiTogether account and manage their children's settings.
- Children whose phone is set up in child mode by their parent or guardian.
DigiTogether is designed to be set up and controlled by a parent or legal guardian. A child's phone can only be linked to a family by entering the child's PIN, which the parent sets. By linking a child's phone, the parent confirms that they are the child's parent or legal guardian and that they consent to the processing described in this policy for that child. DigiTogether must not be used to monitor adults, or anyone without the authority to do so.
3. What we collect
3.1 From the parent
| Data | Why |
|---|---|
| Name and email address; your Google account name and email if you sign in with Google; your password (handled by our authentication provider, which stores it in hashed form) | To create and secure your account |
| Children's names, optional avatar, the child PIN (stored only as a one-way bcrypt hash on our server), app rules, bedtime and study-mode schedules, safe zones, blocked websites and categories, rewards, challenges and praise you create | To apply the rules you choose on your child's phone |
| Your child's age band, interests, goals and country, if you choose them | To suggest quests that suit your child |
| Your replies to your child's quests and level-ups: a reaction, a note or a voice note | So your child sees and hears your answer |
| Approved contacts you enter (name, phone number, relationship) | To mark which contacts your child may reach |
| Push notification token for your phone | To send you alerts and requests from your child |
| Subscription status (if you subscribe) | To unlock paid features |
3.2 From the child's phone
The app shows a persistent notification while it is running, so it is always visible on the child's phone. Each item below is collected only after the related permission is granted on that phone. Before Android asks for Accessibility, the web filter (VPN), notification access or location all the time, the app shows a screen that says what is read and who sees it, with Agree or Not now; Not now keeps that feature off. Before your child's first quest photo, voice note or video, the app tells them who will see it.
| Data | How | Why |
|---|---|---|
| Which apps are used and for how long; the list of apps the child can open, and the phone's make and model | Usage access | Screen time, app limits, blocking |
| Precise location, including in the background, and battery level (sent with the location) | Location permission | Live map, location history, safe-zone arrival and departure alerts |
| Names of websites visited or blocked (domain names only, for example "example.com" — not the pages or their content) | An on-device web filter (Android VPN service) that checks website names. Allowed lookups are answered by Google Public DNS (8.8.8.8) | Safe browsing and the parent's web activity view |
| Titles and channels of YouTube videos watched, and YouTube search terms | Accessibility service, reading the YouTube app's screen only — no other app; and what YouTube is playing, through notification access | YouTube activity and content-safety alerts |
| Which app showed a notification, and when (for every app — not the notification's title or text) | Notification access | Notification counts per app |
| For chat apps (WhatsApp, WhatsApp Business, Instagram, Snapchat, Telegram, Messenger, TikTok, Discord, BeReal, Signal, Twitter / X and Pinterest): the sender's name, the group's name, whether it was a call, a missed call or a video call, the type of media (such as photo or voice), and the time — never the message text | Notification access | Who your child talks to; alerts about messages and calls from unknown contacts |
| Alerts generated on the phone, such as an unsafe word found in a message, a YouTube title or a search. Message text is checked on the phone; only the matched word and the sender's name are sent, never the message | On-device check | Safety alerts to the parent |
| Quest proof: photos, voice notes and videos (up to 15 seconds) your child chooses to take for a quest | Camera and microphone, only when your child taps to record | Uploaded to a private storage area so the family can see the quest; deleted as described in section 6 |
| Quests, XP, coins, streaks, virtual pet, reward requests, "waves" to approved contacts, requests for more time or to leave child mode | Use of the app | The game and reward features, and parent–child requests |
| Daily and weekly screen-time summaries | Generated from usage data | Reports for the parent |
| An anonymous account ID for the phone, a push notification token, and PIN-entry attempts | Automatically | Linking the phone to the family, sending settings changes, preventing PIN guessing |
3.3 Technical and usage data (parent and child phones)
- Crash reports from both phones (device model, OS version, app version, the crash details, the phone's account ID and whether it is a parent or child phone — never the child's name or ID) to fix problems.
- Product analytics, from the parent's phone only: which screens and features are used, and events such as sign-in. They are linked to your account by an account ID only — never your name or email address — and are sent without using your IP address for location. They never include app names, a contact's relationship, social app names or which child. No analytics are sent from the child's phone (Mixpanel and Firebase Analytics are off while the phone is in child mode).
3.4 What we do not collect
- The text of messages or notifications (it is checked on the phone only), SMS, or call logs.
- Your phone's contact list (only the approved contacts a parent types in).
- Photos taken with the in-app camera outside quest proof — they stay on the phone. (Quest proof is uploaded, see 3.2.)
- Your phone number.
- The device's advertising ID. DigiTogether shows no ads.
4. How we use data
- To provide the App's features to the parent and child, as described above.
- To send alerts, requests and settings changes between the parent's and the child's phones.
- To secure accounts, prevent abuse (for example PIN guessing) and fix errors.
- To understand which features parents use so we can improve the App.
- To manage subscriptions and to comply with the law.
We do not use children's data for advertising, and we do not sell or rent personal data to anyone.
5. Who we share data with
Within a family, the child's activity is visible to the parent account that set up the child. Outside the family, we share data only with service providers that process it for us:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and server functions — stores the account and family data | India (Mumbai) |
| Supabase Storage | Quest proof photos, voice notes and videos, and parents' voice notes, in a private storage area | India (Mumbai) |
| Google Firebase Cloud Messaging | Push notifications. A notification can contain alert text, such as a video title or a sender's name | May be outside India |
| Google Firebase Crashlytics | Crash reports (both phones) | May be outside India |
| Google Firebase Analytics | Usage analytics (parent's phone only) | May be outside India |
| Mixpanel | Product analytics (parent's phone only) | May be outside India |
| Google Public DNS | Answers the web filter's website lookups from the child's phone | May be outside India |
| Google Maps | Showing locations and safe zones on a map | May be outside India |
| Google Sign-In | Signing in with a Google account (optional) | May be outside India |
| RevenueCat and Google Play Billing | Subscriptions and purchases | May be outside India |
We may also disclose data if required by law, to protect a person's safety, or as part of a business transfer (in which case this policy continues to apply).
6. How long we keep data
- Location history, website activity, YouTube and chat activity, and alerts: 90 days. A server job deletes older records every night.
- Notification records (which app, and when) and app sessions (when each app was opened): 30 days.
- Quest proof (photos, voice notes, videos): deleted 30 days after you approve the quest, unless you choose to keep it. Kept proof, and your voice notes on level-ups, stay until you remove the child or delete the account.
- All other account and family data, including daily app-usage totals: while the account exists. To delete one child and all of their data without deleting your account, open that child's settings in the App and choose Remove; it takes effect right away.
- When you delete your account, your profile, your children's profiles and all of their data, and the children's phone accounts are deleted from our database immediately. Quest proof files and voice notes are deleted from storage shortly after (also when you remove a single child). Copies may remain in our hosting provider's encrypted backups for a short period until those backups expire.
- Crash and analytics data are kept by those providers according to their retention settings.
7. How we protect data
- All data is sent over encrypted connections (HTTPS); unencrypted connections are blocked by the app.
- App data is excluded from Android cloud backups.
- Quest proof and voice notes are kept in a private storage area that only the family's phones can open.
- Database access rules ensure a parent can see only their own children, and a child's phone only its own child.
- The child PIN is checked only on our server and stored only as a bcrypt hash; repeated wrong guesses are blocked.
- Sensitive actions (such as approving rewards or deleting an account) are checked on the server, not only in the app.
No system is perfectly secure, but we work to protect your data and will inform affected users and authorities of a personal-data breach as required by law.
8. Your rights and choices
Under India's Digital Personal Data Protection Act, 2023, and other applicable laws, you can:
- Access the data held about you and your children — most of it is visible in the App.
- Correct it — edit names and settings in the App, or contact us.
- Erase it — delete your whole account in the App (how to delete your account), or remove a single child and all of their data from that child's settings.
- Withdraw consent — remove permissions on the child's phone, leave child mode on it, or ask us to delete the child's data. Some features stop working without the related data.
- Nominate another person to exercise these rights in the event of death or incapacity.
- Raise a grievance with us at [email protected]. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
For requests by email, write from the email address on your account so we can verify you. We aim to respond within 30 days.
9. Children
DigiTogether processes children's data only on the instructions and with the consent of their parent or guardian, only to provide parental controls and digital-wellbeing features, and never for advertising. If you believe a child's phone was linked without a parent's or guardian's consent, contact us and we will delete that data.
10. Changes to this policy
We will update this page when our practices change and change the "Last updated" date above. If a change is significant, we will also tell you in the App before it takes effect.
11. Contact
Kundan Kumar, trading as DigiTogether
Bengaluru, Karnataka, India
Email: [email protected]