Heshiz FamilyPrivacy policy
Heshiz Family stores what a family types into it and nothing else. No analytics, no advertising, no tracking, no selling of data.
Who is responsible
IntroInnovation Oy, Finland, is the data controller. Questions and requests go to privacy@heshiz.com.
What we store
| Data | Why |
|---|---|
| Parent email address | Signing in. There is no password; a six-digit code is emailed each time. |
| Device name (optional) and a sign-in token per device | Keeping a phone signed in and letting a parent see and remove signed-in phones. |
| Family name, parent display names, language | Shown in the app. |
| Child first name (or nickname) and birth year | Telling children apart in the app. No surname, no date of birth, no photo. |
| Agreements, consequences, changes and their reasons, stars, rewards | This is what the app is for. |
| Push notification token | Reminding a child's phone of an active consequence, if notifications are turned on. |
| Server logs (IP address, time, request) | Keeping the service running and stopping abuse. Kept 30 days. |
The camera is used only to scan a pairing code shown on a parent's phone. The image is read on the device and never stored or sent anywhere.
We do not collect location, contacts, messages, screen time, other apps, advertising identifiers or any data from the child's phone beyond the pairing itself.
Children
Heshiz Family is for families with children aged 7 and older. A child never creates an account and never enters personal data. A parent adds a child to the family, chooses what name to show, and pairs the child's phone. Everything about a child is entered by the parent, is visible to the parent, and is deleted by the parent.
The child's phone is read-only: it shows what is active for that child and when it ends. A child cannot change anything, cannot contact anyone through the app, and does not see other children's details beyond their names.
We do not knowingly collect personal data from a child without a parent's involvement. If you believe that has happened, write to privacy@heshiz.com and we will delete it.
Legal basis
Under the GDPR we process this data to provide the service you asked for (contract, Article 6(1)(b)) and, for server logs, to keep it secure (legitimate interest, Article 6(1)(f)). Data about a child is entered under the parent's authority as the holder of parental responsibility.
Who else sees it
Only the service providers that run the app, each bound by a data processing agreement, and only for the purpose named:
| Provider | Purpose |
|---|---|
| Neon | Database hosting. |
| Resend | Sending the sign-in code email. |
| Expo (Expo Application Services) | Delivering push notifications through Apple and Google. |
We never sell data and never share it for advertising. We disclose data to authorities only when the law requires it.
How long we keep it
As long as the family exists. Sign-in codes expire after 10 minutes. A signed-in phone that is not used for 180 days is signed out. Server logs are kept 30 days.
Deleting your data
In the app, a parent who owns the family can open Settings and tap Delete the family. That removes the family, every child, every agreement and consequence, and signs out every phone. It cannot be undone.
To delete your own parent account and email address, or if you are not the family owner, email privacy@heshiz.com from the address you sign in with. We delete it within 30 days and confirm by email.
Removing a child from the family (Family tab, the child, Remove) stops them appearing in the app; their history stays with the family until the family is deleted.
Your rights
You can ask to see, correct, export or delete the data we hold about you or your child, and you can object to processing. Write to privacy@heshiz.com. If you are not satisfied with our answer, you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the authority in your own country.
Security
All traffic is encrypted in transit. Sign-in codes and device tokens are stored only as keyed hashes. Sign-in is rate-limited per address and per network.
Changes
If this policy changes in a way that matters, we say so in the app and update the date at the top of this page.