Privacy Policy — Chat for Kids

Last updated: 2026-10-27 · Effective date: 2026-07-26

Chat for Kids ("the app", "we", "us") is a child-safe messaging app built for families. This policy explains what data we collect, how we use it, and the choices you have. It is written to comply with GDPR, GDPR-K, and COPPA requirements for services directed at children.

1. Who is the data controller?

Stelios Vouzonikos, operating as NXT, is the data controller for Chat for Kids. Contact: [email protected].

2. Who can use the app?

Parents must be at least 18 years old to create an account. Children use the app only under a parent-linked profile set up by that parent. The parent consents to the processing described below on the child's behalf, as required by GDPR-K (EU 16+ / country-specific) and COPPA (US under 13). When a parent creates a child profile, every feature that lets the child exchange messages, calls, photos or voice with other people starts switched off, and the parent chooses which ones to enable; each can be changed later in Family Safety.

3. What we collect

3.1 Account data

• Parent: email address, display name, avatar (an emoji, or a small picture you draw yourself in the app, up to about 40 KB, stored as the avatar), date of birth (used once to verify 18+, not retained as the raw date; only the "verified 18+" fact is retained), hashed PIN, FCM push notification token, X25519 identity public key, app language and time zone (so notifications arrive in your language). If you buy the ad-free upgrade: the Google Play purchase token, product id and Google's verification receipt, kept for refunds and support.
• Child: first name, avatar (an emoji, or a small picture the child draws in the app, up to about 40 KB, stored as the avatar — never a photo), age, hashed PIN, FCM token, X25519 identity public key, link to their parent account, app language and time zone (chat hours follow the child's clock). Children do not provide an email address.

3.2 Message data

• Text and voice messages sent within the app. These are end-to-end encrypted on the sender's device and decrypted only on the recipient's device — we cannot read them, and neither can anyone with access to our servers.
• Message metadata: sender ID, receiver ID, chat ID, timestamp, message type (text / photo / video / GIF / sticker / voice / keepsake / missed call), reactions, the ephemeral public key used for forward secrecy. When a child edits a message, the previous wording is kept (encrypted, like the message) so the parent's monitor can show it; when a message is deleted, a note that it was deleted — never its content — appears in the parent's activity log. A child can also "tell" a parent about a message or a call with one tap, or hold a "help" button during a call: the reason the child picked, who it was with and when go to the parent's activity log and, as a notification naming the child and the kind of report, to each parent's phone — never the message or the call itself, and nobody is blocked by it. When a child is put into a group chat (by anyone), the parent's activity log records the group's name, who created it, how many members it has and their first names (up to ten), and again when a group reaches ten members. In the chat monitor, the child's guardians see who is in a group now and, for each member, the first name of the parent who approved that friendship and the date. Anyone can also open a “My devices” chat whose only member is themself, to pass text, photos, videos or voice from one of their own devices to another; it is encrypted, stored and kept exactly like any other chat, and a child's My devices chat appears in the guardians' chat monitor like every other chat. A small speaker button can read a friend's name aloud using the phone's own text-to-speech engine; only voices installed on the phone that work without a network connection are used, so the name is not sent anywhere. A parent can also write their child a letter for a later day: it is encrypted on the parent's phone like any message, waits on the server as ciphertext until the chosen time (the parent can cancel it until then), and is then delivered as an ordinary message. A family can also build a storybook together: a drawing (and its voice line) that a child or parent adds as a page of a story is visible to everyone in that family — both parents and the children — not only to the child and their parents as other memories are. Pages are kept like memories and go with the account. Metadata is not encrypted because the server needs it to route and deliver messages.
• Photos shared in chat. Like text and voice messages, these are encrypted on the device before they are uploaded — we cannot open them.
• Videos shared in chat, and photos and drawings saved to Memories (a drawing may carry a short voice line the child recorded, and a child may keep a short voice-only retelling of a story page or a video there — “Tell it back”). These are not end-to-end encrypted. They travel over an encrypted connection and are kept in a private area that only the people they were shared with can open, but our server does hold the file itself. For chat videos this is deliberate: the server re-encodes every video to strip out the location data and other hidden camera information the original file carries, and it can only do that if it can read the file. If you would prefer nothing to leave the device readable, send a photo rather than a video. If a parent turns on “Our photos in Pairs”, the Pairs game on that child's phone deals cards from the child's own Memories photos: they are shown from where they are already kept, nothing is copied or sent anywhere new, and they never appear in a game played with a friend.

3.2.1 Content filtering

• Text messages are checked against a word filter on the child's device before they are sent. Strong words, personal details, links and requests for gift cards, codes or money are blocked outright, and blocked attempts are recorded in the parent's activity log. When personal details are blocked, the child sees a short card asking them to check with a grown-up first; nothing extra is recorded. A milder word match pauses the message and asks the child to reconsider; if the child sends it anyway, the message is still delivered, and a note (not the word itself) is added to the parent's activity log.
• Photos are screened on the device itself before they are sent and before they are shown. No image leaves the device for that check.
• Voice messages are not filtered automatically. No transcription happens on the device or on our servers. Parents can listen to every voice clip in the chat monitor.

3.3 Technical data

• App version, device type, OS version, IP address of the request (retained in our server logs for fraud prevention, rotated out automatically within 30 days).
• WebRTC signalling data for voice/video calls (session descriptors, ICE candidates) — encrypted in transit, erased the moment the call ends. The call record itself (who called whom, when, how long, answered or missed) is kept.
• Call audio and video: 1-on-1 calls run directly between the two phones, or through our relay server when the networks require it; either way the media is encrypted between the phones and the relay cannot read it. Group calls pass through our own media server, which has to decode each participant's stream to forward it to the others, so group-call audio and video are not end-to-end encrypted. Nothing is recorded. The app asks for Bluetooth permission only so a call can play through a headset or car kit. It reads a connected headset's name only to show it in the call's audio-output picker, and never stores or sends it anywhere. Calls are registered with the phone's own call system (Android Telecom) so that headset and car buttons can answer or end them and two calls never overlap; nothing about them is stored or sent anywhere by that registration. Incoming and active calls also appear as system call notifications, which may show on a connected Android Auto display or Wear OS watch.
• Draw Together (since v2.122): during a 1-on-1 video call the two children can draw on a shared canvas. The strokes travel over the same direct, encrypted connection as the call itself, never through our servers, and are not stored by anyone; they disappear when the call ends. Closing the canvas on one phone leaves the picture with the other child until then. A drawing is kept only if a child chooses “Keep in Memories”, which saves it as a Memories photo of that child (section 3.2).
• A device-readiness snapshot from the child's phone (whether notifications, camera, microphone and location permissions are granted, and whether battery optimisation or autostart could stop calls from ringing), shown to the parent so they can fix a phone that would otherwise miss calls.
• Error reports from the app (app version, platform, the error text and a code location; never message content or contacts), kept for 30 days so we can fix what breaks. After a call the app also sends call-quality figures (buffer sizes, packet loss, whether the call went through our relay, Wi-Fi or mobile data, and whether a headset was used — never its name), so we can improve call quality.
• On-device message translation (optional, off by default): a parent can switch on "Translate messages" for a child. The app then uses Google's ML Kit translation on the phone itself — the child's phone, and the parent's own phone for that child's replies — so the text of a message never leaves the device to be translated. Since v2.111 the same switch also covers the title of a calendar task written in another language, translated the same way on the phone. What does reach Google is a one-time download of a language pack (about 30 MB per language, over Wi-Fi) and ML Kit's own technical identifiers (an installation id and a configuration check) that Google uses to serve that download; we receive nothing. Android phones only.
• Approximate location if — and only if — the parent has explicitly enabled "Share location with parent" for the child. See §7.

3.4 Advertising

Non-personalised ads are served by Google AdMob inside the app. We do not collect any advertising identifier (IDFA / GAID) from children. Every ad request is marked for AdMob's child age treatment (the setting that replaced the earlier child-directed and under-age-of-consent flags, covering COPPA and GDPR-K) and limited to general-audience content. A GDPR consent dialog is shown to EU users before any ad loads.

3.5 Family calendar

A parent or co-parent can put chores, homework, bedtime, reminders and events on a child's Today screen. For each task we store the title the parent typed (up to 80 characters), its kind, date, optional time, repeat rule, the dates the child ticked it done, and who created it. A task may also be a Game night: then we also store which of the app's two-player games it is and who your child will play it with (you, or one of your child's existing chat friends). A homework task may also carry a short spelling list the parent typed (up to 15 words), used only to build the child's practice puzzles on the phone; it is stored like the title. Since v2.113 a parent may also attach one short voice note of their own voice to a task (a word or phrase, up to 15 seconds); it is stored like a Memories voice line — in your child's Memories folder on our server, not end-to-end encrypted, never transcribed — playable by the child and the child's guardians only, and deleted with the task or the note. Task titles, spelling lists and day labels are written by a parent and, since v2.128, are end-to-end encrypted on that phone under a key that only the child and the child's guardians hold — our server stores them as ciphertext it cannot read (a task written before v2.128 is sealed the next time a guardian opens the calendar). The child and the child's guardians can read them, nobody else. The parent may also choose which country's public holidays the child's calendar shows; otherwise the phone's region setting is used on the device and never sent to us. A guardian may also put a short label on a day ("With Dad", up to 24 characters) that the child sees on Today; it is informational only — no custody or legal schedule is recorded. When one guardian adds, changes or removes a task or a day label, the child's other guardians get a plain notification saying so (who and the date; the title itself is only readable inside the app). A chore may be marked as earning a star: the stars are counted from the ticks already stored, and a child may set a purely virtual goal (a number of stars and one of four free rewards in the app) — no money, no purchases. Tasks, labels and goals are deleted with the child's account.

3.6 Family daily challenge

The games hub offers one puzzle a day that is the same for everyone in the family. When a family member finishes it, we store the date, which puzzle it was and how many seconds it took. Parents, co-parents and the children of the same parent can see each other's results; nobody outside the family can, and there is no ranking across families. Results are deleted after 90 days (see section 9).

3.7 Two-player board games

When two friends (or a parent and child) play one of the board games over a chat — chess, checkers, Four in a Row, Memory Duel, Hangman, Dots & Boxes or Tavli — we store the current position of that game (the board, whose turn it is, and who made the last move) so either player can carry on later from another device. Only the two players, and their guardians through the monitor, can read it. If one player moves while the other is away, the other is sent a "Your move!" notification that names the game and the friend; it is never sent across a block, and at most once every two minutes. A saved position is deleted 30 days after the last move, and with the account (see section 9).

3.8 Game rooms

A child can open a "room" for one of the games friends play together (two players, or up to four in Puddle Rally) so that friends can see who is playing what and join. We store the game, the child who opened the room, the child's first name as the app shows it, who joined, and the room's state. A room is visible only to the child's approved friends, their siblings, the child's parents and the parents of any child who has joined it — never to anyone else. Joining is checked on the server against the circle of the child who opened the room. Rooms are a moment, not a record: one that nobody joins is deleted after 30 minutes, a finished one as soon as the game ends, and all of them with the account (see section 9).

3.9 Quiet right now

A child can tell the app they have to be quiet for a while — at the cinema, at school, at the library, at church, at the doctor, at a restaurant, sleeping, or just quiet — and until when (at most 12 hours). We store that place word and the end time, nothing else: the child picks from a list, there is no free text. While it lasts, the app's own sounds on the child's phone stay quiet (a friend's call does not ring; a parent's still does, vibrate-only) — it never changes the phone's own settings. The place and end time are shown to the child's parents only, who also receive one notification when it starts; friends see nothing. A parent or co-parent can also end the quiet spell early from their own app — the child's phone simply returns to normal; nobody else is told. The entry is deleted a day after it ends, and with the account (see section 9).

3.10 Asking for a bit more time

When a child's daily time limit runs out, they can ask for 10 more minutes and pick a reason from a short list (to finish a level, talking to a friend, homework or a chore, or just a little more) — there is no free text. We store the reason word, the day, and the answer. The ask is shown to the child's parents only, who each get one notification and can say yes or not now; the child sees the answer. An ask never adds time by itself — only a parent's yes does, for that day only, and the parent's time limit setting is not changed. A child can ask at most three times a day. The entries are deleted two days later, and with the account (see section 9).

3.11 Asking a parent to unlock a feature

When a feature is switched off for a child (for example video calls or the camera), the child can ask their parent to turn it on and may add a short reason in their own words (up to 500 characters). We store which feature, when it was sent and the parent's answer; the reason is end-to-end encrypted on the child's phone (since v2.128) under the family key, so we hold it only as ciphertext. The request — reason included — is shown only to the child and the child's parents (a co-parent included); the parent the child belongs to also gets one notification about it. It is deleted 30 days after the parent answers, or 30 days after it was sent if nobody answers, and with the account (see section 9).

3.12 Who changed a setting

When a parent or co-parent changes one of a child's settings in Family Safety, we record which settings changed (the old and the new value), which parent changed them and when. The record is written by our server, not by the app, and is shown only to that child's parents (a co-parent included) — not to the child. It is deleted after 90 days, and with the child's account (see section 9); if a parent's account is deleted, their name is removed from it.

3.13 “Noticed this week”

The Family Safety screen may show one sentence comparing this week's activity counts with last week's — for example more late-evening app opens, or more messages stopped by the filter. It is worked out on the parent's phone from the activity entries the app already keeps; nothing new is collected or stored, and no message content is read.

4. What we do with it

• Authenticate users.
• Deliver messages, calls and notifications.
• Enforce parental controls (time limits, feature toggles, chat monitoring).
• Prevent abuse (rate limiting, PIN brute-force protection, basic moderation of flagged content).
• Serve non-personalised ads as described above.

We do not: sell data, run behavioural ad profiling, share contacts, or use data for marketing outside the app.

5. Legal basis (GDPR)

• Parent consent for processing their child's data, obtained at sign-up (Art. 6(1)(a) + Art. 8 GDPR).
• Contract with the parent for providing the service (Art. 6(1)(b) GDPR).
• Legitimate interest in security, abuse prevention and service reliability (Art. 6(1)(f) GDPR).

6. Sharing with third parties

Processors we use:

• Our own servers in the European Union — accounts, encrypted messages and encrypted media are stored on infrastructure we operate ourselves (a self-hosted open-source Supabase stack); no third-party cloud database holds your data.
• Google Firebase Cloud Messaging — push notification delivery only.
• Google AdMob for non-personalised ads (parent dashboard only).
• Google ML Kit — on-device translation language packs, downloaded only when a parent has switched "Translate messages" on; message text is not sent to Google.
• Self-hosted LiveKit and TURN relay for voice and video calls — also operated by us, no third party. Google Play (via Google's servers) verifies ad-free upgrade purchases.

We do not share data with advertisers, analytics providers outside Google, social networks, or data brokers.

7. Location sharing

Location is opt-in and controlled by the parent, not the child. When enabled, the child's device sends an approximate location every few minutes to the parent's account. The parent can disable it at any time and past coordinates are deleted within 30 days. Precise GPS is requested only at the moment the parent turns the feature on.

Turning coordinates into a street name. When a parent views their child's location, our server — not the child's phone — asks the OpenStreetMap Nominatim service what address is at those coordinates. Two things limit what that reveals: the coordinates are rounded to roughly 110 metres before they are sent, and only the rounded pair is shared, never your child's exact position, name, account or any identifier. Results are cached so the same neighbourhood is not looked up repeatedly. OpenStreetMap is a non-profit mapping project; see their privacy policy. If you would rather share nothing at all, leave location sharing switched off — no lookup happens.

8. Security

• End-to-end encryption for 1-on-1 messages (per-message ephemeral X25519 keys for forward secrecy).
• End-to-end encryption for group chats (per-member sealed chat key, rotated when someone leaves).
• PINs are hashed with PBKDF2-SHA256 at 600,000 iterations with a per-user random salt.
• Rate limiting and lockout on repeated bad PINs.
• Database row-level security enforces per-user access; the server cannot decrypt message text, voice clips or chat photos. Chat videos and Memories photos are the exception — see section 3.2.
• A web-application firewall and strict transport security guard the server edge.

9. Retention

• Account data is kept while the account is active.
• Messages remain until the sender deletes them or the chat is deleted. Walkie-talkie voice clips delete themselves 24 hours after they are sent. There are two exceptions: a voice line a child chose to keep in Memories — with a drawing, or on its own as a retelling of a story page or a video (“Tell it back”) — stays until the child or a parent deletes that memory, or the account is deleted; and a keepsake — a voice note a parent leaves for their own child in their 1:1 chat, for the child to play whenever they want — does not expire and is kept like any other message.
• Call signalling data (session descriptors, network candidates) is erased at the end of the call; the call record is kept with the account.
• Error reports are deleted after 30 days.
• Location coordinates are deleted after 30 days.
• Flagged content (reported for moderation) is retained for up to 12 months for safety review.
• Family-calendar tasks are kept until a parent deletes them and are deleted with the child's account (see section 3.5); a parent's voice note on a task goes with the task or the note, whichever is removed first.
• Daily-challenge results (date, puzzle, seconds) are deleted after 90 days, and with the account (see section 3.6).
• Saved two-player board-game positions are deleted 30 days after the last move, and with the account (see section 3.7).
• Game rooms (the game a child opened and who joined it — shown only to the child's approved friends, siblings and parents, and to the parents of any child who joined) are deleted 30 minutes after nobody joins, as soon as the game ends, and with the account.
• Quiet right now (the place word and end time a child chose — shown only to the child's parents): deleted a day after it ends.
• Asks for more time (a reason word, the day and the parent's answer): deleted two days later.
• Unlock requests (the feature, the child's reason and the parent's answer, and the parent's notification about it): deleted 30 days after the answer, or 30 days after sending if nobody answers.
• Settings changes (which of a child's settings a parent changed, from what to what, and when — shown only to the child's parents): deleted after 90 days.
• Reading days (one date per day a child, or a parent for them, marked "I read a bit" — no titles or minutes) are deleted after 13 months, and with the account.

10. Your rights

Under GDPR, parents (acting on behalf of their child) can:

• Access the data we hold about them or their child.
• Correct inaccurate data.
• Delete the account and all associated data ("right to be forgotten").
• Export a copy of the data.
• Object to or restrict processing.
• Lodge a complaint with their national data-protection authority (for Cyprus: Office of the Commissioner for Personal Data Protection, www.dataprotection.gov.cy).

Account deletion is available directly in the app: sign in as the parent, open the Dashboard tab and tap Delete my account. It permanently removes the parent account, every child profile, and all associated data. See Delete Your Account for details.

To exercise any of these rights, email [email protected] from the email address on the account. We respond within 30 days.

11. Children's data (COPPA)

Children do not provide contact information directly. The parent creates the child's account and consents to processing. Children cannot share their real-world identifying information publicly — there are no public profiles and the app has no open search.

Parents can review, delete or modify their child's data at any time from the Family Safety screen inside the app, or by emailing [email protected].

12. International transfers

Account data, messages and media are stored on our own servers in the European Union. Push notification delivery (Firebase Cloud Messaging) and ad serving (AdMob) may route through Google's global infrastructure, which transfers data under the EU-U.S. Data Privacy Framework and Google's Standard Contractual Clauses.

13. Changes to this policy

Material changes are announced in the app at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent change.

14. Contact

Data-protection questions, rights requests, security reports:
[email protected]