Kidbaton Privacy Policy

Last updated: November 7, 2026 (policy version 1)

Kidbaton ("the app") helps parents and guardians manage their children's classes, activities, drop-offs and pick-ups. This policy explains what information the app handles, where it is kept and the choices you have. Kidbaton is operated by Jin Zhang ("we").

1. Who the app is for

Kidbaton is for parents and legal guardians. Children do not use the app; the information about children is entered by their parent or guardian. Each time you add a child, you confirm that you are the child's parent or legal guardian and agree to this policy, and the app keeps a record of that confirmation.

2. Without Family Cloud, your data stays on your phone

Children, classes, schools and studios, schedules, attendance, make-up balances, fees, attachments and settings are stored only on your device. No sign-up is needed and nothing is sent to our server. The free plan and Pro work completely offline.

The only other network request is a weekly check for public holiday data (a static file such as /holidays/v1/JP.json). It carries no user identifier.

3. What is sent when you use Family Cloud

Family Cloud is a paid, optional feature for sharing with family members. Only after you start Family Cloud or join a family is the following sent over an encrypted connection (TLS) to our server (Cloudflare) and shared with the family members you choose:

• Children: name (a nickname is fine), color, and date of birth if you entered one
• Family members: display names you enter (for example "Grandma"), roles, and which children each member can see
• Schools and studios: name, type, address, phone number, rules and fees you entered
• Classes, schedules, changes, cancellations, attendance and make-up balances
• Drop-off / pick-up tasks and who completed them, and when
• Fees and payment records (amounts and dates)
• Attachments you add (for example a photo of a timetable or an invoice)
• Records of guardian confirmations and of your consent to share with family
• Technical data: family ID, member ID, device ID, device type (iOS / Android), app version, and notification tokens (Firebase Cloud Messaging, Apple Live Activity tokens)
• A schedule summary for the next 180 days and the past 30 days (class times, task windows and default helpers, without children's names), used for evening reminders, Live Activities and calendar subscriptions
• If you link Sign in with Apple or Google: only an identifier from that provider, stored as a one-way hash. We do not receive or store your email address
• A recovery code, stored only as a one-way hash

This data is stored on the server in readable form (it is not end-to-end encrypted). This lets notifications, lock-screen Live Activities and calendar subscriptions show names. We protect it as follows: encrypted connections; encryption at rest by Cloudflare; strict separation between families, with membership and per-child permissions checked on every request; private storage for attachments; server logs that record only the route, status and timing (never names, notes or request contents); and encrypted daily backups.

4. Sharing within your family

People you invite see and edit information according to the role you give them. A "Helper" sees only the children you choose and never sees fees. Before you create an invite, the app asks for your consent to share the selected children's information, and you can withdraw it at any time in member settings.

5. Notifications and calendar subscriptions

• Notifications (for example "Grandma picked up Ken") are delivered through Firebase Cloud Messaging (Google) and Apple Push Notification service and contain the time, child's name, class name and helper's name. You can turn on "Hide children's names in notifications". Notifications never contain addresses.
• A calendar subscription link (webcal) can be read by anyone who has the link, including calendar services such as Google Calendar that fetch it. By default, event titles do not include children's names; you can choose to show them per link, and you can stop a link at any time.

6. Purchases

Purchases are handled by the Apple App Store or Google Play. To check what you have purchased, purchase records and an anonymous app user ID (with Family Cloud: your family ID) are sent to RevenueCat, Inc. We never receive your payment card details.

7. What we don't do

• No ads, no advertising identifiers (IDFA / Advertising ID), no tracking across apps or websites, no analytics or profiling.
• We do not sell personal information or share it for cross-context behavioral advertising.
• No access to your location, contacts, microphone or photos except a photo you choose to attach.

8. Service providers and where data is kept

• Cloudflare, Inc. (USA): hosts the Family Cloud server, database, attachments and backups in its data centers, which may be outside your country.
• RevenueCat, Inc. (USA): purchase status.
• Google LLC / Firebase (USA): notification delivery; Google Play purchases and sign-in on Android.
• Apple Inc.: App Store purchases, notifications and Live Activities, Sign in with Apple.

These providers process data on our behalf under their data processing terms. By starting Family Cloud you agree that the data in section 3 is stored and processed outside your country.

9. How long we keep data

• Deleting a child, class or record removes it on your devices; on the server it is erased within 30 days.
• Deleting your account: you leave the family immediately, and your account data is erased within 30 days.
• Dissolving a family (owner): all of the family's data on the server is erased after 30 days.
• If a Family Cloud subscription ends, sync stops after a 30-day grace period. The family's server data is kept for 180 days so you can resubscribe, and then deleted (we notify the owner in the app beforehand).
• Families with no sync for 24 months and no active subscription are notified and deleted 30 days later.
• A device that registers but never joins a family is removed after 30 days.
• Encrypted backups are kept for up to 90 days, so deleted data disappears from backups within 90 days.
• Data on your phone stays until you delete it or the app. The anonymous ID kept in the iOS Keychain / Android Block Store remains after reinstalling so you can find your family again.

10. Your choices and rights

• See, correct and export: all data is visible and editable in the app. More → Export & backup creates a backup file and CSV files at any time.
• Delete a child's data: on the child's page, "Delete all of this child's data" deletes it from your devices and the server, including attachments.
• Delete your account: More → Settings → Delete account & data, or on the web at https://kidbaton.mengduo.net/delete with your recovery code.
• Stop sharing: the owner or an admin can remove members or change what they can see; members can leave at any time.
• Requests: to request access to, correction or deletion of data held on our server, contact us below. We reply within 30 days, or sooner where the law requires.

Depending on where you live, you may have rights under Japan's Act on the Protection of Personal Information, Korea's Personal Information Protection Act, US state privacy laws (including the California Consumer Privacy Act), Canada's PIPEDA, the UK GDPR, the Australian and New Zealand Privacy Acts, Taiwan's Personal Data Protection Act, Hong Kong's Personal Data (Privacy) Ordinance and Singapore's PDPA. You may also complain to your local data protection authority.

For the UK: we process Family Cloud data to provide the service you asked for (contract), keep records of your consent to share with family (consent), and protect the service from abuse (legitimate interests).

11. Security incidents

If a security incident affects your information, we will notify you in the app and by notification, and notify the authorities as required by law.

12. Changes

When we change this policy, we update this page and the version number, and the app tells you the next time you open it.

13. Contact

Operator: Jin Zhang
Contact: zhangjin99@yahoo.com