Privacy policy

1. Controller and contact

Eugen Giminger, a sole trader operating under the business name Giminger Consulting, Komödienstr. 44, 50667 Köln, Germany, is responsible for the Kydly service.

Contact for privacy enquiries: info@giminger.com. No data protection officer has been appointed. Family content is processed on your devices and in your Apple iCloud/CloudKit areas; the provider does not operate a separate family-data server.

The controller and privacy contact are identified above. Family content is not stored in a database operated by the provider.

2. Scope

This information covers the Kydly iOS app, its family features and widgets, the local App Clip demo and the product pages under /kydly. Apple services and external websites you choose to open also have their own privacy information.

The App Clip demo processes fictional sample data locally. It does not connect a real family, synchronize family content with iCloud, or start real location tracking or purchases. Apple links you deliberately open and any operating-system map services are separate from this local demo processing. The website and the family features of the app are separate services. The website does not read your family iCloud, child profiles, location histories or Screen Time reports. The website is publicly accessible. Kydly is available on the App Store. This information describes data processing by the available app and App Clip. Optional location and child information require the applicable legal bases, understandable information and consent. Apple permission dialogs alone do not replace these requirements.

3. Categories of personal data

Depending on the features you use, the app processes family and profile information, roles, display names, optional profile pictures, family and child identifiers, device identifiers, device status including battery level, and associations with Apple/CloudKit participants.

Other categories include location samples with coordinates and timestamps, geographical zones, location events, visits, daily routes and optional place pictures. The app also processes rules and supported app selections, requests, decisions, control commands, family events and help messages.

The app processes purchase entitlements and access status, including an active free week under Apple’s introductory offer. Depending on use, this also includes timetables, task evidence, photos, learning progress and local settings. Website visits and support emails are separate activities.

4. Purposes and legal bases

The purposes are family association, rule management, location overviews, handling requests, family communication, learning content and checking access entitlements. Technical data supports secure operation and troubleshooting.

Our legitimate interests for the website are its secure technical delivery and handling general enquiries. Optional audience measurement starts only with your consent. An iOS permission alone does not establish data-protection consent for app features.

Contract-related processing, particularly entitlement checks and support, is based on Article 6(1)(b) GDPR. Optional website audience measurement is based on consent under point (a); secure website delivery and general communication serve legitimate interests under point (f); legal obligations are based on point (c). Actual consent and the role of those with parental responsibility are relevant to processing optional location and child information. An iOS permission does not replace these requirements.

5. Children and family accounts

Kydly is set up by authorized parents or legal guardians. Profiles belong to the connected family. Technical invitations and Apple authorization do not replace checking parental responsibility or authority to act on someone’s behalf.

Information for children: Your family can see certain rules, requests and location information that is shared with them. Talk together about which data is shared. Ask an adult you trust if you do not understand something.

Where a feature offered directly to children relies on consent under Article 6(1)(a) GDPR, Article 8 GDPR applies. In Germany, consent or authorization by a person with parental responsibility is required for this purpose for children under 16. Data sharing must also be discussed understandably in other circumstances. A technical role does not establish parental responsibility.

6. Location data and geofencing

The ongoing location service is activated on the child’s iPhone, not on the parent’s iPhone. When permission is granted, Apple location services process available coordinates and timestamps, arrival at and departure from saved places, and an available location with an SOS message. Background features need the corresponding iOS permission. The app enables the visible iOS background-location indicator; iOS controls how it is displayed.

Location samples, geofences and location events are CloudKit records. They are not kept solely on the child’s device: they synchronize with connected family devices. Daily routes are derived from existing samples and events.

You can manage permissions in iOS. Withdrawing permission may limit location tracking and notifications. Accuracy and freshness depend on iOS, power status, connectivity and permissions.

7. Screen Time and app management

Kydly uses FamilyControls, DeviceActivity and ManagedSettings with extensions. Apple authorization enables management of supported app access. Rules and app selections may synchronize within the family.

Actual usage times and DeviceActivity analyses remain in the protected report on the respective device. The report does not export these raw data to the provider or CloudKit. Rules, selection tokens, requests and decisions are separate data that synchronize within the family. Widgets currently receive no real Screen Time values from these reports; displayed time values come from the demo.

App selection and management use Apple’s protected interfaces. They do not read messages, browser content or complete device contents through general device access. Synchronized management data must be distinguished from local usage-time reports.

8. Apple services

The app uses services including iCloud/CloudKit, Apple family authorization, location services, MapKit, WidgetKit, notifications and StoreKit. Maps, place resolution, map imagery and Look Around may send requests to Apple.

Photos you voluntarily add to child profiles, places and reward evidence synchronize within the connected family through iCloud and are cached locally. Camera and photo access require iOS permission. Timetable recognition uses Apple’s Vision technology. If you open external navigation, destination coordinates may be passed to the map provider you choose.

Apple processes data under the terms of its respective services. Apple’s own privacy information explains recipients, processing and rights. Using Apple interfaces does not mean that all app data are processed solely locally or that every Apple service is automatically acting as our processor.

9. Cloud storage and synchronization

Family content is stored on your devices and through Apple iCloud/CloudKit in private areas and areas shared with the Kydly family. The provider does not operate its own server for these data. Families, members, devices, rules, zones, locations, location events, requests, commands, activities, visits and place media synchronize. Some images use CKAsset storage. Sharing concerns invited Kydly participants and is separate from Apple purchase sharing.

There are also local caches, UserDefaults, Keychain entries and App Group data for extensions and widgets. Local and cloud copies are separate storage locations. Synchronization requires a usable Apple Account and connectivity.

Invited and authorized Kydly participants can access shared family content. Sharing permissions are managed through Apple. We do not promise a particular form of end-to-end encryption for all CloudKit content.

10. Notifications

Kydly requests iOS notification permission and creates local notifications for requests and location events. CloudKit subscriptions for data changes also use Apple’s push infrastructure.

You can configure notifications in iOS. Lock-screen content may be visible to others. Settings, system status and connectivity can delay or prevent notifications.

Notifications are generated locally; CloudKit data changes may be signalled through Apple’s push infrastructure. The provider has no separate push server. Your iOS notification settings determine, among other things, which content appears on the lock screen.

11. Payments through Apple

Purchases take place only inside the app through Apple In-App Purchase. StoreKit checks signed transactions, product identifiers, entitlements, expiry and revocation. Apple processes payment information and billing; the website has no payment form.

The app has no separate card or bank-details entry. Apple processes purchases under its applicable terms. A family access snapshot in CloudKit, containing the organizer’s membership type and validity, enables access for the second parent and children even when Apple purchase sharing is turned off.

The provider does not receive full card or bank details through the app. Purchase entitlements and their status are evaluated to unlock access. Apple’s own retention and billing obligations remain separate from deleting a family.

12. Free introductory period

Eligible Apple Accounts receive seven free days as an introductory offer with the monthly subscription. Apple determines eligibility for the subscription group. Apple handles the purchase, payment method, automatic renewal and cancellation. Kydly evaluates signed StoreKit status, such as an active introductory period, expiry and renewal status. Lifetime has no trial period. Apple’s purchase dialog and the products and terms shown there are binding.

The active access logic determines trial status from StoreKit and does not start its own seven-day timer. Data models still contain older trial fields; existing local or cloud data may retain them. Family access status and validity are synchronized through CloudKit. Resetting the app does not create new eligibility for Apple’s introductory offer.

Apple purchase status remains authoritative. Changing devices, resetting local data or deleting a family does not reset Apple’s eligibility for a free introductory period. The monthly subscription and Lifetime are configured in App Store Connect, with Apple Family Sharing enabled for both products.

13. Website hosting through Vercel

The Kydly website at giminger.com is hosted through Vercel. Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, provides the website and technical infrastructure. The existing production service also uses infrastructure in the United States. App family data are not stored through Vercel. Hosting serves secure, reliable website delivery under Article 6(1)(f) GDPR.

Where Vercel processes personal data on our behalf, the data-processing terms agreed for the account actually used apply. Vercel’s own privacy information applies to certain processing for its own purposes, such as its account and operational data. Its subprocessors and transfer safeguards are described in the linked Vercel contractual information.

14. Necessary server and access data

When you visit the website, the hosting infrastructure processes, in particular, the IP address needed for delivery, time of access, requested address, response status and technical browser/device information. This supports delivery, security and troubleshooting under Article 6(1)(f) GDPR, independently of consent to optional audience measurement.

The website does not process family accounts or read app cloud data. The local development server may log access and compilation diagnostics.

Technical logs are retained only as long as required for delivery, troubleshooting and security; provider retention periods vary with the log type and service plan. No single deletion period is promised for every Vercel system log. Access to logs is restricted to authorized people.

15. Cookies and similar technologies

Optional Vercel Web Analytics loads only after you actively consent. It measures website visits using the page address, referrer and technical information such as browser, operating system, device category and broad region. It does not analyze Kydly family, location or Screen Time data. URL query parameters and fragments are removed; no custom analytics events are used on Kydly pages. Information is processed for aggregated audience measurement, not advertising.

The legal basis for voluntary measurement is Article 6(1)(a) GDPR and, where access to a device requires consent, section 25(1) TDDDG. Your choice is stored in the browser under gc-analytics-consent so that Kydly and the consulting website can share the same decision. This necessary storage is based on section 25(2)(2) TDDDG. You can change your choice and withdraw consent for future measurement using “Datenschutzeinstellungen” (Privacy settings) in the footer. Vercel’s documentation says Web Analytics does not use analytics cookies; technical identifiers and server processing are nevertheless covered by the consent.

Rejecting analytics leaves the website and its app information fully usable. Necessary storage of your choice is separate from optional analytics. Withdrawing consent reloads the website to remove the script already loaded; until then, the consent check prevents further events.

16. Third parties and recipients

Recipients are authorized Kydly family members, Apple for its services, Vercel for website hosting and, with consent, Web Analytics, and STRATO for email communication. The provider does not receive family content through its own family server. Content you voluntarily send by email becomes part of your support enquiry.

The Kydly app does not call third-party photo services. Place pictures come from the app itself, photos added by the family, or Apple maps. Location data are not sent to image services.

17. Transfers outside the EU

The website is delivered through a US hosting provider; Apple services may also involve processing outside the European Economic Area. Exclusively European storage is not promised. The applicable safeguards and contractual information of the services are also relevant.

Transfers to third countries must satisfy the applicable requirements of Articles 44 onwards GDPR. Vercel’s applicable data-processing terms include EU Standard Contractual Clauses; Apple’s information explains its transfer safeguards. Copies of or information about appropriate safeguards can be requested from the privacy contact.

18. Retention and deletion

The app provides for runtime-dependent cleanup of location samples after seven days. Location events, visits, requests and activities are cleaned up after 30 days. Expired commands are removed with an additional one-day margin. The organizer initiates cloud deletions; a deletion outbox allows retries.

Cleanup takes place while the app is running and cloud synchronization is available; this does not guarantee deletion at an exact instant. Profiles, rules, photos, local caches and any remaining older membership fields stay until the relevant family content is changed or deleted. Apple manages purchase records separately.

As organizer, you can use “Familie löschen & Kydly zurücksetzen” (Delete family and reset Kydly) in Settings. The app initiates deletion of family cloud data and resets local data. Participants can use “Familie verlassen & zurücksetzen” (Leave family and reset). A local reset or uninstall does not delete family iCloud data or cancel an Apple subscription. If cloud errors occur, repeat deletion or check its status; separate copies on offline devices and backups cannot be removed immediately.

When handling deletion requests, we take required legal records into account. Use the app features described to manage family content; Apple purchase history and provider backups have separate procedures. When requesting help, do not send complete child or location datasets unless needed to handle the request.

19. Your data protection rights

Subject to the GDPR, you have rights including access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests under the statutory conditions. You may withdraw consent with effect for the future.

Send enquiries to info@giminger.com. We have no separate administrative access to your private family iCloud and therefore cannot directly read or delete arbitrary family content. We help you use the available app features and handle requests about website and support data we process. Any identity verification is limited to necessary information; we generally respond within one month under Article 12 GDPR, subject to the extensions allowed there.

Children and people with parental responsibility may both contact us about privacy. If fulfilling a request concerns family iCloud data, we explain the available local and Apple management tools without claiming administrative access to your family.

20. Right to complain

You may complain to a data protection supervisory authority, particularly where you live or work or where a suspected infringement took place. For the provider’s location in Cologne, the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia is one competent contact: www.ldi.nrw.de.

Contact and complaint information for that authority are available at https://www.ldi.nrw.de/. Your right to contact another competent supervisory authority remains unaffected.

21. Data security

The examined Kydly codebase contains no separate analytics, advertising or crash SDKs. Its privacy manifest declares no tracking. Apple system diagnostics under your Apple settings and separately consent-based website audience measurement are distinct from this.

The app uses Apple authorization, CloudKit access structures, Keychain and signed StoreKit transactions. It checks family association and unconfirmed synchronization. This is not a guarantee of complete security.

Protect Apple credentials and devices and share invitations only with intended members. Role permissions, revocation, offline use and device changes require practical verification.

Safeguards include role-based Apple/CloudKit sharing, local key management and verification of signed purchase transactions. Public website access is encrypted through HTTPS. No technical measure guarantees complete security.

22. Changes to this privacy policy

Changes to features, recipients and data flows may require updates. Material changes must be communicated appropriately; this does not replace any required consent.

Last updated: 15 October 2026. This policy covers the released Kydly app, the App Clip demo and the Kydly website.

23. Support and privacy enquiries

Support and privacy contact: info@giminger.com. Emails are processed through STRATO. We process the sender address, message and information you voluntarily provide to handle your enquiry. The legal basis is Article 6(1)(b) GDPR for contract-related requests, otherwise point (f) for general enquiries and, where applicable, point (c) for legal duties. A mailto link only opens your email application and does not send anything automatically. There is no form, chat or ticket system.

Support emails are deleted once the enquiry is fully resolved, unless required evidence or legal retention duties apply. In that case, only the necessary content is retained for as long as needed. Immediate deletion from the mail provider’s backups is not promised.

Do not send passwords, unnecessary child photos, precise location histories or complete invitation links.

Support is provided only through info@giminger.com. Processing by STRATO is also governed by the agreed email and privacy terms. Use the same contact for privacy enquiries.