Privacy policy

1. Controller

[BITTE PRÜFEN: Whether a data protection officer must be appointed (Art. 37 GDPR, § 38 BDSG).]

2. What this is about

Jalkab helps parents plan playful daily tasks for their children, which the child ticks off on an Apple Watch. It consists of the iPhone app for parents, the Apple Watch app for children and the web panel at app.jalkab.com. Only parents or legal guardians create an account; children have no account of their own.

3. What data we process

• Parent account: e-mail address (sign-in with a one-time code or Sign in with Apple), display name, time and version of your consent, family membership, your iPhone’s push token.
• Child profile (created by you): name (visible only within your family), an automatically generated nickname, avatar, birth year, school grade, watch colour theme, interests, need tags from a fixed list, time zone, region as region and district names (no coordinates), participation in the leaderboard and in anonymous comparisons.
• Use within the family: daily plans and tasks, completions, approvals with praise and bonus points, points, streaks, badges, rewards and redemptions, family and personal goals, the child’s wishes, the weekly schedule (type, subject, weekdays, time and duration of courses, private lessons and sports), parents’ family notes.
• The child’s Apple Watch: an anonymous device session without e-mail or name, the time of pairing and of the last activity.
• Security: IP address on pairing and invitation attempts, to limit failed attempts. These entries are deleted after two days.
• Location: with your permission, the iPhone turns an approximate location into region and district names on the device; only these names are sent. On the web you choose the region yourself.

4. Purposes and legal bases

• Providing the account, family, plans, points and syncing between iPhone, watch and web: Art. 6(1)(b) GDPR.
• Your child’s data, AI suggestions and anonymous comparisons: your consent as parent or legal guardian, Art. 6(1)(a) together with Art. 8 GDPR. You can withdraw it at any time with effect for the future by deleting the child profile or your account; you can switch off the anonymous comparison in your child’s settings.
• Sign-in e-mails and push notifications to parents: Art. 6(1)(b) GDPR. Push notifications can be turned off in the iOS settings.
• Protection against abuse (limiting pairing and invitation attempts): legitimate interest, Art. 6(1)(f) GDPR.

5. AI suggestions and moderation

When you ask for suggestions, age, school grade, interests, the chosen need tags, the type, subject and time of the weekly schedule entries, the categories of the last seven days and your note for the request are sent to OpenAI. Names, nicknames, region, family notes and account data are never sent. Wishes your child sends from the watch are checked for inappropriate content by OpenAI’s moderation service before they reach you. Suggestions only appear on the watch after you approve them.

[BITTE PRÜFEN: Contracting party, data processing agreement and retention period at OpenAI.]

6. Recipients and processors

• Supabase (database, sign-in, server functions); hosted in Frankfurt am Main (AWS eu-central-1). [BITTE PRÜFEN: Data processing agreement with Supabase, seat of the contracting party.]
• Cloudflare, Inc., USA (delivery of the web panel, DNS).
• OpenAI, USA (AI suggestions, moderation of wishes), see section 5.
• Apple (Sign in with Apple, Apple Push Notification service, iCloud Mail servers sending the sign-in e-mails from hello@jalkab.com, App Store and TestFlight).

For transfers to the USA we rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and on standard contractual clauses (Art. 46 GDPR) otherwise. [BITTE PRÜFEN: Certification or clauses per recipient.]

7. No ads, no tracking

Jalkab contains no advertising and no third-party analytics or tracking tools. We only receive crash reports through Apple, if you allowed sharing in the iOS settings.

8. Cookies and local storage on the web

The web panel only sets strictly necessary cookies (§ 25(2) no. 2 TDDDG): the sign-in session, the chosen language (one year) and, if you open an invitation link, the invitation code (seven days). In the browser’s local storage we remember whether you hid the getting-started guide.

9. Retention and deletion

We keep the data for as long as your account exists. You can delete your account at any time in Settings: this deletes all of your family’s data, including the child profiles and the watch pairings. If there is a second parent, only your account is deleted and the family data stays with them. You can delete single children, tasks, notes and rewards at any time. Pairing codes are valid for ten minutes. [BITTE PRÜFEN: Retention in the hosting provider’s backups.]

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), and you can withdraw a consent at any time (Art. 7(3)). Write to us at hello@jalkab.com.

You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

11. Changes

If this policy changes, we update the date above and tell you about material changes in the app.