Draft — not yet reviewed by a lawyer. It describes how the service works today, but may still change.
Privacy policy
Last change: 11 November 2026
In short
- Parents use TimeProtect to set screen time limits on their children's devices. The account is created and run by a parent, not by the child.
- We collect only what the limits need to work: the parent's account, children's names as entered by the parent, the family's devices, limit settings and time counters.
- No ads, no analytics, we do not sell data and we do not build profiles.
- The family vault is stored only encrypted on the device. We do not know the password it is encrypted with.
- Deleting the account removes the data right away. Backups may keep it for at most 70 days, and when a backup is restored we delete it again.
- Servers are in the European Union (OVH, France).
1. Who is responsible for the data
The controller of personal data in the TimeProtect service (TimeProtect app, parent panel at
app.timeprotect.eu, website timeprotect.eu) is
[TO BE COMPLETED: name of the controller, address].
Contact for data protection matters: [TO BE COMPLETED: e-mail address for data matters]. We have not appointed a data protection officer [TO BE COMPLETED: confirm it is not required].
TimeProtect is free software. Whoever runs their own TimeProtect server is the controller of the data on that server, and this policy does not apply to it.
2. Whose data we process
- Parents with an account in a family (in the TimeProtect app or the parent panel).
- Children whose devices a parent has put under limits. A child does not create an account and does not give us any data directly.
- Supporters who make a voluntary payment through Ko-fi.
- Visitors of
timeprotect.euandapp.timeprotect.eu.
3. What data, why and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Parent account: e-mail address, name in the family, parent password (only as a bcrypt hash), time zone, notification e-mail settings | running the account, sign-in (sign-in code sent by e-mail), notifications (e.g. a request for more time, a device out of contact) | Art. 6(1)(b) – contract (providing the service under the terms) |
| Child: name or nickname entered by the parent, time zone, categories, limits, allowed hours, modes, blocks, “No limits until…”, daily time counters per category, requests for more time | counting and enforcing the limits set by the parent, showing the child their counters (counter link) | Art. 6(1)(b) (contract with the parent) and Art. 6(1)(f) – the parent's legitimate interest in caring for the child [TO BE COMPLETED: lawyer's assessment] |
| Family devices: name and model, app version, state of permissions and protection, time of the last connection, status report (the category counting time right now and the name of the current app, e.g. “YouTube”; sync state, sleep; only the latest state, each report overwrites the previous one), apps and websites assigned to categories (package and domain names), for limits that depend on Wi-Fi: hashes of network identifiers | limits across all of the child's devices, “now: …” in the panel, warning about two devices counting at once, commands from the panel (e.g. “Block now”) | Art. 6(1)(b) and (f) (as above) |
| List of apps installed on Android, needed by the parent to assign apps to categories | choosing apps in category settings | Art. 6(1)(b) [TO BE COMPLETED: confirm in what form the list reaches the server — the TimeLimit mechanism encrypts it with the family devices' keys] |
| Family vault: KeePass (KDBX) files encrypted on the device with a master password the server does not know, up to 10 previous versions of each file, app passwords (only as a SHA-256 hash), their labels and dates of use | storing and syncing the vault between family devices (WebDAV) | Art. 6(1)(b) |
| Ko-fi payments: amount, currency, date, type, support tier and the name the supporter gave on Ko-fi. No e-mail address, message or postal address. | accounting for payments (monthly summary for bookkeeping) | Art. 6(1)(c) – accounting and tax obligations [TO BE COMPLETED: whether the supporter's name is needed] |
| Technical data: IP address (in server memory for the sign-in attempt limit; not stored in the database), server logs (IP address, time, page address), panel session cookie, register of deletions (random identifiers of deleted families, persons and devices with a date, no personal data) | security, protection against abuse, keeping deletions in effect after a backup is restored | Art. 6(1)(f) – security of the service; register of deletions: Art. 6(1)(c) with Art. 17 |
Giving the data is voluntary, but without the parent's e-mail address and device data the service cannot work.
Cookies and browser storage. The parent panel uses one session cookie (valid 30 days), without
which you cannot stay signed in. timeprotect.eu sets no cookies; it only remembers the chosen language
in browser storage. We use no analytics or advertising tools.
4. Children's data
- The service is ordered and set up by a parent (legal guardian). We do not rely on the child's consent, so Art. 8 GDPR (a child's consent to information society services) is not the legal basis here. The child's rights are exercised by the parent as legal representative; a child may also write to us directly.
- We collect about a child only what the limits need: a name or nickname (the parent may enter anything), times in categories and the state of devices. We do not store what the child watches, messages, photos, location or browsing history.
- TimeProtect works openly: the child sees on the device that limits apply, how much time is left, and can ask for more. We encourage you to talk about the rules with your child before turning them on.
- A block after a limit runs out follows rules set by the parent. We make no decisions based solely on automated processing within the meaning of Art. 22 GDPR and do no profiling.
5. Who processes data for us
- OVH SAS (France) – the servers running TimeProtect and its database, and a second server with an encrypted backup copy. Data does not leave the European Union [TO BE COMPLETED: data processing agreement with OVH, data centre locations].
- E-mail: messages (sign-in codes, notifications, account deletion confirmation) are sent by our own mail server on an OVH server. From there a message goes to the recipient's mailbox provider.
- Ko-fi (Ko-fi Labs Limited) and the payment providers it uses (e.g. PayPal, Stripe) are separate controllers of the data of people who pay. Their own privacy policies apply.
- The domain uses Cloudflare DNS only to resolve names – traffic to the servers does not go through Cloudflare.
We do not transfer data to countries outside the European Economic Area and do not share it with anyone for marketing. We disclose data to public authorities only where the law requires it.
6. How long we keep data
| Data | Period |
|---|---|
| Family account (parents, children, devices, settings, vault) | until the account is deleted, or until a person or device is removed from the family. A family in which no device has connected to the server for 90 days is deleted by the server automatically. |
| Daily time counters | about 10 days (the server deletes older days); session times: 3 days |
| Requests for more time and closed alarms | 30 days |
| Previous versions of vault files | the last 10 versions of each file |
| Sign-in code from e-mail | 3 hours |
| Parent panel session | 30 days or until signing out (“Sign out everywhere”) |
| Ko-fi payments | 5 years (accounting obligations) [TO BE COMPLETED: counted from the end of the financial year?] |
| Server logs | [TO BE COMPLETED: retention of container logs] |
| Database backups | one copy every night; on the main server 14 daily and 8 weekly copies (about 2 months), an encrypted copy on a second server for 70 days |
| Register of deletions (identifiers and dates) | 120 days – longer than the oldest backup |
Account deletion and backups. Deleting an account, a person or a device removes the data from the database right away. Backups may keep it for at most 70 days; after that the copies are overwritten. Nobody uses them day to day. If we ever had to restore the database from a backup, right after the restore we delete again everything in the register of deletions, before the server starts serving again.
7. Your rights
You have the right to:
- access your data and get a copy (Art. 15),
- rectification (Art. 16) – you can change most data yourself in the app or panel,
- erasure (Art. 17) – in the TimeProtect app: delete the account (every parent with an e-mail address confirms with a code from e-mail); remove a person or device from the family in the app or panel; or write to us,
- restriction of processing (Art. 18),
- data portability (Art. 20) – on request by e-mail we send the data as JSON [TO BE COMPLETED: no export in the panel yet],
- object to processing based on legitimate interest (Art. 21).
A child's rights are exercised by the parent. We answer without undue delay, at the latest within one month. Send your request to the address in section 1.
If you believe we process data unlawfully, you can lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl), or with the authority of the country where you live.
8. How we protect data
- Connections only over HTTPS. Passwords are kept only as hashes.
- The family vault is encrypted on the device; the server stores only the encrypted file.
- Backups outside the main server are encrypted, and the second server fetches them itself (the main server cannot delete them).
- Administrative access is possible only on the server itself. The source code is public, so anyone can check what it does.
9. Changes to this policy
We announce important changes in advance in the parent panel or by e-mail. The date of the last change is at the top of the page. Earlier versions are in the history of the website's source repository.
The Polish version is the binding one; this English text is a translation.