Privacy policy

Data controller

David Bárta, a self-employed natural person, company ID (IČO) 06748333, Lopatecká 1194/36, Praha 140 00, Czech Republic. Contact: hey@jarvis.kids.

JARVIS has no Data Protection Officer, because the processing does not reach the scale for which Article 37 of the GDPR requires one.

What we process

• Adult account: e-mail, name, user name (optional), form of address, language, time zone, profile photo (optional). With Sign in with Apple also your Apple account identifier and, where you use it, the hidden Apple address.
• Sign-in and security: password hash, sign-in links, passkeys, sessions (IP address, browser and device type, last known country), a fingerprint of the browser and system to recognise a new device, for kids the PIN hash and sign-in attempts, the encrypted backup key to the family content. The operational records of sign-in and password recovery requests also hold an approximate location derived from the IP address (country and city only) and the website the request came from (without path or parameters).
• Family and kids: the family name, members with their role and access. For a kid: name, sign-in nickname (stored readable, because the kid signs in with it), year of birth, form of address (boy, girl or not stated), school year, an avatar picked from a preset list (we do not upload photos of kids), the app's look, reminders and days off with a reason (such as illness or a trip).
• Family content: tasks, chores, rewards, goals, coins and their history, approvals, notes, kids' proposals, the calendar, badges, days in a row and the family activity feed.
• Registration and consents: when you accepted which version of the terms and this notice, the legal guardian's statement, your analytics choice, your opt-out of product e-mails. If you fill in the short questionnaire at registration (what you want to use JARVIS for and how many kids you plan to add), your answers too.
• Interest in the Android test: the e-mail you enter in the Get JARVIS section on jarvis.kids, the page language, when we sent you the confirmation e-mail, when you confirmed the address, when we sent you the test invite or when you unsubscribed, and when and to which wording you gave consent. We process this also when you have no JARVIS account.
• Notifications: the push subscription address of your browser or phone, the device type and when the subscription was last used.
• Reminders to kids: a record of every reminder the server sent a kid (the afternoon and evening chore reminders, the streak reminder and the reminder a parent sends): when it went out, what triggered it, the phase (from how long the kid has not opened the app and how many reminders went unanswered), the kid's age band, the label of the text from our own set and whether it arrived, or why not (for example quiet hours). The record holds neither the notification text nor the kid's name. For a kid also the time they last opened the app (the app on screen, written at most once every 5 minutes). From both and from the kid's age we will set the tone and the frequency of reminders: a kid who has not opened the app for a few days gets more urgent reminders (kind up to 8, with gentle teasing from 9, cheekier from 13, but not at the kid's expense), and when there is still no response after a longer time, the reminders stop and at most one gentle reminder a week arrives. If a child does not respond to reminders for a long time, JARVIS sends one final reminder and after that at most one a week. To do this we store the time the final reminder was sent. We clear it as soon as the child opens the app again; if the child only completes something, it is cleared at the next reminder. Otherwise it is deleted together with the child's account.
• Support and feedback: what you write to us in the app or by e-mail, an attached file (such as a screenshot) and technical context (page address, browser, app version).
• Audit record: who performed an important action in the family and when (for example approved a task, removed a member or erased data), without kids' names.
• Technical data: server logs, error reports, performance measurements and aggregate usage counts (details in the Analytics and measurement part). For every account, a kid's included, the time the app was first and last used (written at most once every 5 minutes): from it the adults of the family see whether a kid has signed in to the app yet, penalties count for a kid only from their first use of the app, and the operator sees an overview of recently active accounts with e-mail and role in the admin tools.

Legal bases

• Contract (Article 6(1)(b) of the GDPR): the adult account, the family and the service as adults use it, including notifications and service e-mails. You enter the contract by accepting the terms at registration.
• Parent's consent for a kid under 15 (Article 6(1)(a) and Article 8 of the GDPR, Section 7 of Czech Act No. 110/2019 Coll.): the kid's data and their content in the family. You give this consent at registration as the legal guardian.
• The kid's own consent from 15 (Article 6(1)(a) of the GDPR): the kid confirms it themselves, see the Kids part.
• Legitimate interest (Article 6(1)(f) of the GDPR): security of accounts and of the service (sessions, new-device alerts, PIN attempts, the audit record, server logs), error reports, performance measurement, aggregate counts of sign-ins and registrations, operational events of the iPhone app, visit statistics of the public website, the operational overview of recently active accounts, answers to support messages and product e-mails. You can object to this processing.
• Legal obligation (Article 6(1)(c) of the GDPR): the record of consents, handling your GDPR requests and the register of security incidents.
• Separate consent (Article 6(1)(a) of the GDPR): the optional analytics “Help us improve” in the app, the traffic measurement of the jarvis.kids website through PostHog (for the latter also under Section 89(3) of Czech Act No. 127/2005 Coll., because it stores a cookie) and the list of people interested in the Android test: we send you the invite to the closed test on Google Play and news about the Android version. All of it is voluntary and off by default. Consent to the list applies only once you confirm the address with the link in the e-mail, and you withdraw consent with the Unsubscribe link in every such e-mail.

When you withdraw consent, it has no retroactive effect. Security records do not depend on consent and are deleted when their retention period ends (see Retention).

Kids

A kid's account is created by an adult who is the kid's legal guardian. A kid in JARVIS has no e-mail address and we never e-mail kids. For kids we have an explanation in their own words on the Privacy for kids page.

• Kids under 15: the legal guardian consents for the kid at registration.
• Kids aged 15 and over: from 1 January of the year in which a kid turns 15 by their year of birth, JARVIS shows the kid the “Tvoje data” (Your data) screen when they open the app and asks them to confirm it themselves (on the web and in the current version of the iPhone app). Until the kid confirms, the adults of the family see in the kid's settings that the confirmation is pending. A kid without a year of birth is not asked.
• Who sees a kid's data: the kid and the adults of the family, according to the access the family gave them. The operator does not read the encrypted family content in the admin tools (see Security).
• Downloading a kid's data: an adult with full access to the family can download the kid's data as a file in the family settings: profile, history of tasks, chores, rewards and coins, goals, badges, proposals, days off, calendar, activity feed, devices and sign-ins and the record of reminders, with names and notes decrypted.
• Removing a kid: a kid removed from the family no longer sees it, but their data stays for now and the removal can be undone. We e-mail the adults with full access the date on which we will erase the kid's data. No sooner than 30 days after that e-mail we erase the kid's account and data for good. This also applies to kids removed earlier.
• Erasing a kid's data: an adult with full access can erase a kid's data at once with “Smazat data dítěte” (Erase the kid's data). The erasure cannot be undone, and after it (also after the automatic erasure) the adults with full access receive a summary by e-mail.

What stays after a kid is erased: the record of leaving the family with its date but without the name; audit records without the kid's name for 24 months; copies in the database backups for at most 7 days; the family's tasks, rewards and goals with their names, and texts written by adults. What has already left JARVIS (e-mails, notifications on a phone) we cannot delete.

Analytics and measurement

We distinguish the optional analytics, which you decide about, the measurement a safe and reliable service needs, which always runs, and the visit statistics of the public website. We use no advertising tools, we do not follow you on other websites and we do not sell data.

• Optional analytics “Help us improve” (off by default): when you turn it on, we count which screens and features are used, for example how often the overview was opened or a task was sent as done. We store only daily totals per event name, platform and role, with no identifier of a person or a family and no time of day.
• Who decides: each adult decides for themselves with their own switch in Settings → Privacy. For the kids of a family, the adult who created the family (or the adult the family's administration later passed to) decides: kids' usage is counted only when that adult has it on. Only in families where that adult has it on do we also count the age groups of kids by year of birth, the kids' form of address (boy, girl) and the popularity of task and reward templates; the result is only counts across all such families together. This choice covers the optional analytics only, not what the next points describe.
• Turning it off: the switch applies at once. Daily totals already counted are not linked to any person or family, so they cannot be separated out; we keep them for 25 months.
• Always, whatever you choose (legitimate interest): daily totals of sign-ins per sign-in method and totals of registration steps (in the same form as above, without identity); error reports from the website, the server and the iPhone app through Sentry (without default personal data and without screen recording); performance measurement of the website through Vercel Speed Insights and of page load times, always with the address stripped of parameters and identifiers; the time the app was last used for every account (see What we process).
• The iPhone app and EAS Observe: the app always sends operational and performance events to EAS Observe (Expo, USA), for example a task done, a reward request, a goal claimed (with its amount in coins), the sign-in method, a registration step, a failed server call (only the shape of the address), load times and moves between screens without identifiers. They contain no names and nothing you write in the app. Expo adds device details and an install identifier.
• Visit statistics of the public website: on jarvis.kids we count page visits through Vercel Web Analytics without cookies, for every visitor, including those who decline the measurement in the cookie banner. The page address is sent without parameters, identifiers and invitation tokens. We keep no such statistics in the app on app.jarvis.kids or on the app's pages.
• Traffic measurement of the jarvis.kids website through PostHog (off by default): it runs only when you accept it in the cookie banner. The website then loads the PostHog tool and records the pages viewed, leaving a page, clicks, scrolling and, for the click map, the coordinates of clicks and of where the mouse pointer rests. For a click we send a description of the element on the page without its text and, for the buttons into the app and to the App Store, their label (for example hero-register). Page and link addresses are sent without parameters, identifiers and tokens, ad click identifiers are deleted and the source of the visit (the utm_ parameters) is kept. We send no name, no e-mail and nothing you type into a form, we record no screen and we do not link the visit to an account in the app. Your browser gets a random identifier (see Cookies and storage on your device) by which PostHog recognises a repeat visit. Every event carries the type of browser, system and device, the screen size, the browser language and time zone and the page you came from (without parameters). PostHog also sees the IP address and can derive an approximate location from it. PostHog processes the data on servers in the EU. PostHog never runs in the app on app.jarvis.kids or in the iPhone app.

You can object to processing based on legitimate interest by e-mail at hey@jarvis.kids.

Notifications and service e-mails

• Web push: the content of a notification is encrypted under the Web Push standard, so the browser's push service (Apple, Google, Mozilla) cannot read it.
• Push in the iPhone app: goes through Expo (USA) and the Apple Push Notification service, and the notification text is readable for them. From app version 1.9.0 (once it has been opened), the phone that receives the notification fills the kid's first name into the text: the server sends the text without the name, with the kid's internal identifier the phone uses to find the name. In older versions of the app the notification text can contain a kid's first name.
• Service e-mails: sign-in link, password recovery, e-mail change, alert about a sign-in from a new device (device and system type, approximate location from the IP address, country and city only, and the time; for a kid's sign-in the alert goes to the adults of the family), reminders to finish registration, notices about removing and erasing a kid, and changes of the terms or of this notice. They can contain a kid's first name. We send them through Resend and you cannot opt out of them, because they concern your account.

Product e-mails

Besides service e-mails we occasionally write to you about JARVIS itself: a new release of the app or a new feature. The frequency is low, on the order of a few messages a year.

• Legal basis: legitimate interest in telling our own users about our own similar service (Article 6(1)(f) of the GDPR together with Section 7(3) of Czech Act No. 480/2004 Coll.). Consent is not required for these messages precisely because every message carries a working way to stop them.
• How you opt out: the “unsubscribe” link in the footer of every such e-mail (it works without signing in), or in the app under Settings → Notifications → E-mail. We write the opt-out into the consent record, so it holds even after this notice changes again.
• What still reaches you after you opt out: service and security messages about your account and our agreement (sign-in link, alert about a sign-in from a new device, a change of the terms or of this notice, planned maintenance). The service cannot be run safely without them.
• Who never receives these: child accounts. Product and marketing messages are never sent to kids; a product e-mail always goes to an adult in the family.
• Sender: these e-mails go out through Resend, the same processor as our service messages. We never pass your address to an advertising network or a data broker.

Recipients and sub-processors

• Vercel (USA): runs the website and the server (compute in the Frankfurt region), file storage in Vercel Blob in Frankfurt (adult profile photos encrypted with the family key, feedback attachments unencrypted), visit statistics of jarvis.kids and website performance measurement. Static files (styles, fonts, icons) are delivered by Vercel's global network, also outside the EU.
• Neon (USA): the database in the Frankfurt region. It stores the encrypted family content only in encrypted form.
• Resend (USA): sending e-mail from the Ireland region through Amazon SES (AWS) in the same region.
• Sentry (USA): error reports from the website, the server and the iPhone app, and server logs, EU region (Germany).
• Expo (USA): delivering push notifications to iPhones, app updates (IP address, device, app version) and EAS Observe.
• Apple (USA): Sign in with Apple, push delivery (Apple Push Notification service) and the iCloud+ mailbox for hey@jarvis.kids.
• Google (USA): the operator's Gmail mailbox, which receives alerts about new feedback and replies in it (your name, e-mail and the text of the message, which can contain a kid's name), about a new access request (name, e-mail and message) and reports of failed nightly server jobs. For people interested in the Android test we enter the confirmed e-mail address by hand into the tester list of the closed test in Google Play Console; Google then manages the invite and access to the test under its own terms.
• Google Cloud KMS (Belgium region): only protects the families' encryption keys and processes no personal data.
• PostHog Inc. (USA): traffic measurement of the jarvis.kids website after your consent in the cookie banner, servers in the EU.

Transfers to the USA rely on the EU-US Data Privacy Framework where the company is certified, otherwise on the Standard Contractual Clauses in the data processing agreement. The data processing agreement is part of the providers' terms of service; with PostHog Inc. we signed it separately on 14 October 2026.

We pass no data to advertisers or data brokers and use no third-party advertising tools.

Retention

• Account, family and family content: until you delete the account, the kid or the family. A removed kid is erased no sooner than 30 days after the e-mail about the removal (see Kids).
• Unfinished registration: a registration that nobody finished or confirmed and nobody started to use is deleted automatically together with the family it created, roughly 3 to 14 days after registration. We send you a reminder by e-mail first.
• Sessions and sign-in links: a sign-in lasts 30 days and is extended while in use. Expired sessions and sign-in links are deleted in the next nightly cleanup.
• PIN sign-in attempts: 90 days.
• Codes for connecting a kid's device and family invitations: the record is deleted 30 days after it expires.
• Devices for new sign-in alerts: 12 months after the last sign-in from that browser and system.
• Feedback and access requests: 24 months after the last message (feedback) or after it was sent (access request).
• Interest in the Android test: an unconfirmed e-mail is deleted 30 days after the confirmation link expires (the link is valid for 7 days), an unsubscribed one 30 days after you unsubscribe. A confirmed e-mail is kept until you unsubscribe.
• Files: a profile photo is deleted at once when it is replaced or deleted, and together with the account or the family. A feedback attachment is deleted together with the conversation, that is 24 months after the last message; deleting the account does not delete it, and you can write to us to have it deleted sooner.
• Push subscriptions: revoked ones 30 days, never used ones 60 days.
• Record of reminders sent to a kid: 90 days. The time a kid last opened the app is overwritten at the next opening and is erased together with the kid.
• Audit record: 24 months. After an account is deleted, the record of the erasure stays as proof that we carried it out, and it holds only a fingerprint (hash) of your e-mail address, not the address itself: if you ask about the erasure, we find it by the address you send us. Other records lose the link to your account; we keep an e-mail address in them where it documents the action itself (for example an access request, or a sign-in link sent to a parent when a kid's device was connected).
• Record of consents: until the account is deleted.
• Daily usage totals: 25 months.
• Database backups: 7 days. A deletion in the live database does not reach the backups, but after a week the data is gone from them too.
• Traffic measurement of the jarvis.kids website: the website remembers your choice in the cookie banner for 12 months, then asks again. The PostHog cookie lasts 1 year from the last visit. Events at PostHog are kept per the settings of the service.
• Logs and third-party services: server logs at Vercel about 3 days; error reports in Sentry, events in EAS Observe and visit statistics per the settings of those services.

Cookies and storage on your device

We use no advertising cookies. We store only what the service needs or what you set yourself; the cookie for the traffic measurement of the jarvis.kids website only after your consent in the cookie banner:

• Sign-in: the cookie __Secure-better-auth.session_token (30 days), __Secure-better-auth.dont_remember for a sign-in without remembering, short-lived security cookies during Sign in with Apple, and jarvis-signed-in (30 days, deleted at sign-out). It holds no data about you and tells the jarvis.kids website to offer a button into the app instead of the sign-up.
• Your choices: parent_active_kid (which kid you picked in the overview, 365 days) and jarvis-locale (the language of the website and the app, 365 days). While you are signed out it keeps the language you pick. Once you are signed in, the app copies the language from your account settings into it, so the jarvis.kids website and the app at app.jarvis.kids use the same language.
• Browser storage: what you have already seen or dismissed, the consent in progress during Sign in with Apple, a kid being added (name and nickname, never the PIN, at most 30 minutes), the answers to the short registration questionnaire until they are saved to the account (at most 24 hours), a kid's device key and files for a fast start and offline mode without family content.
• Traffic measurement on jarvis.kids: we store your choice from the cookie banner in browser storage under the key jarvis-consent (12 months). When you accept the measurement, PostHog stores the cookie ph_<project key>_posthog (1 year from the last visit) and entries starting with ph_ or __ph in browser storage, with a random identifier of the browser and of the visit. This cookie belongs to the jarvis.kids website only, the app at app.jarvis.kids does not get it. When you decline the measurement, PostHog is not loaded and stores none of this (only your choice is kept); when you switch it off later, we delete the PostHog cookie and entries from the browser.
• iPhone app: sign-in data in the Keychain, a data cache for offline mode (at most 1 day, cleared at sign-out), data for the widget and the answers to the short registration questionnaire until they are saved to the account (at most 24 hours). Sentry and EAS Observe keep an install identifier on the phone.

Visit statistics through Vercel Web Analytics, performance measurement and error reporting on the website store nothing in the browser.

Security

Kids' real names, the names of tasks, chores, rewards and goals, notes, the calendar and other free text of the family are encrypted with a key of each family's own. That key is protected by a master key in Google Cloud KMS. The server decrypts the content only in memory, in two cases: when a member of the family works with it in the app (opens, saves, searches or downloads it), and when the server itself composes a notification, an e-mail or an activity feed entry for the family (for example a reminder with a kid's name, a days-in-a-row notice or the e-mail about a removed kid). The JARVIS admin tools never decrypt the encrypted content. This is not end-to-end encryption: the server is technically able to decrypt the content.

• Passwords and PINs: stored only as a hash; after several wrong attempts the PIN sign-in is locked for a while.
• Audit record: important actions (such as erasures) are written down before they run.
• Signed-in devices, showing the approximate country of a session: on the Security screen we show the account owner, and a parent for the sign-ins of their children, the approximate country (never the city, never the IP address) of every active session, so that unknown sign-ins can be spotted. The country is derived from the IP address and kept at its last known value: it is refreshed while the session stays active, so it changes once the device moves to another country. We keep no history. A session carries a single current value, which disappears together with the session. Legal basis: legitimate interest in protecting the account (Article 6(1)(f) of the GDPR).

If we detect a personal data breach that is likely to result in a risk to your rights, we notify the Czech Office for Personal Data Protection within 72 hours (Article 33 of the GDPR). If the risk is high, we also inform you without undue delay (Article 34 of the GDPR). We record every incident in an internal register, even when it is not notified.

Your rights

Under the GDPR you have the following rights. You can exercise them in the app (Settings → Privacy) or by e-mail at hey@jarvis.kids:

• Right of access and to data portability (Articles 15 and 20): “Download your data” in Settings → Privacy gives you a JSON file with your profile, family membership, sign-ins, devices and audit records. The encrypted family content is not in it yet; you can ask for it by e-mail. A kid's data is downloaded by an adult with full access (see Kids).
• Right to rectification (Article 16): edit your name, profile and the kids' details directly in the app.
• Right to erasure (Article 17): “Delete account” in Settings is immediate and irreversible. If you are the last adult in the family, you first delete the family (Settings → Family → Delete family), and with it the kids' data. The data of one kid is erased by an adult with full access (see Kids).
• Right to restriction of processing (Article 18): by e-mail.
• Right to object (Article 21): to processing based on legitimate interest by e-mail, to product e-mails through the link in each of them.
• Right to withdraw consent (Article 7(3)): you turn the analytics off with one switch in Settings → Privacy. You switch off the traffic measurement of the jarvis.kids website by clicking “Cookie settings” in the website footer and turning off the Traffic measurement switch, then clicking “Save choice”; events sent before that stay at PostHog for the retention period. To withdraw consent given for a kid, erase the kid's data or the family. A kid aged 15 or over can withdraw consent by asking a parent to erase their data, or by writing to us.

If you believe that we are breaching the GDPR, you can lodge a complaint with the Czech Office for Personal Data Protection or with another supervisory authority in the EU or EEA where you live, where you work or where you believe the breach happened (Article 77 of the GDPR).

Changes to this policy

When a change only adds or corrects information (such as a new processor or a corrected description), we raise the version at the top and show you a notice in the app with a link here. You do not need to confirm anything. When a change would need your new consent (a new purpose or wider processing than you agreed to), we ask you to confirm at your next sign-in. Typo and link fixes are not announced.

On 2026-10-23, without a new version, we added the list of people interested in the Android test on jarvis.kids: what we store, consent and how to withdraw consent, passing the address to Google Play Console and the retention (sections What we process, Legal bases, Recipients and sub-processors and Retention). It concerns only people who ask for the test; the app stays as it was.

In version 2026-10-17 compared with version 2026-10-16 we added the traffic measurement of the jarvis.kids website through PostHog, which runs only after your consent in the cookie banner, the new processor PostHog Inc., its cookie and retention, and how you withdraw consent (parts Legal bases, Analytics and measurement, Recipients and sub-processors, Retention, Cookies and storage on your device and Your rights). The app stays as it was.

In version 2026-10-16 compared with version 2026-10-09 we added the jarvis-signed-in cookie, which tells the jarvis.kids website to offer a button into the app after you sign in, and that after sign-in the app copies the language from your account settings into the jarvis-locale cookie (part Cookies and storage on your device).

In version 2026-10-09 compared with version 2026-10-08 we added that from app version 1.9.0 the phone fills the kid's first name into the push notification text and the server does not send it in the text (part Notifications and service e-mails).

In version 2026-10-08 compared with version 2026-10-07 we added that for a kid who does not respond for a long time we store the time of the final reminder and when we delete it (part What we process).

In version 2026-10-07 compared with version 2026-09-28 we added that for kids we record the time they last opened the app and a record of the reminders the server sent them (with the phase and the age band), without the notification text and without the name, that the tone and the frequency of reminders will follow it and the kid's age, kept for 90 days and included in the file with the kid's data (parts What we process, Kids and Retention).

What changed in version 2026-09-28 compared with version 2026-07-27:

• We rewrote the notice to be easier to read and to address you the same way throughout.
• The legal bases are split by purpose: contract for the account and the family, the parent's consent for the data of kids under 15, legitimate interest for security, error reports and measurement, legal obligation for the record of consents.
• New Kids part: a kid aged 15 or over confirms their data themselves, an adult with full access can download or erase a kid's data, and a removed kid is erased no sooner than after 30 days.
• Analytics: we store only daily totals, the adult who created the family decides for the kids, and we describe what runs whatever you choose (error reports, performance measurement, EAS Observe, totals of sign-ins and registrations). Visit statistics run only on the public website.
• We added the processors Sentry, Expo, Google Cloud KMS, Vercel Blob, Vercel Web Analytics, Speed Insights, Apple iCloud+ and Google (the operator's Gmail mailbox), and removed Google Firebase Cloud Messaging, which we do not use.
• Notifications: in the iPhone app the notification text goes through Expo and Apple and can contain a kid's first name.
• We added retention periods (sessions, sign-in links, PIN attempts, devices, feedback, files, daily totals) and the automatic deletion of unfinished registrations, and we describe the time the app was last used.
• New part on cookies and storage on your device.
• Security: a more precise description of the encryption (when the server decrypts the content), and the country of a sign-in is the last known one, not the one from the moment of sign-in.
• The record of an account erasure holds only a fingerprint of the e-mail address, not the address.
• Changes to this policy: we distinguish a change we only inform you about from a change that needs a new consent.