Privacy policy

1. Who we are

Kidoo (the website at kidoo.mt and the Kidoo apps for iPhone and Android) helps parents find places, activities and events for children in Malta and Gozo. It is run by [Company name], registered in Malta under number [Company registration number], with its registered address at [Registered address], Malta (“we”, “us”).

We are the controller of your personal data under the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act (Cap. 586). Contact us about privacy at privacy@kidoo.mt.

Kidoo is meant for parents, guardians and other adults planning activities for children. You must be 18 or over to create an account.

2. What we collect and why

Browsing without an account

You don't need to tell us who you are to use Kidoo. When you personalise the app, your answers are saved only on your device (in the app's storage, or your browser's local storage):

• your children's birth year, and optionally birth month and a nickname;
• your home area (a town or village, not an address) and the interests you pick;
• places and events you save;
• your privacy choices and whether you've finished the welcome steps.

We can't see this information. It is used on your device to suggest ideas that suit your family, and some of it (for example children's ages or interests) is sent with a request so that results can be filtered, without being linked to you or stored.

If you create an account

• Sign-in details. Your email address, or the details Apple or Google share when you choose “Sign in with Apple” or “Sign in with Google” (usually your name, email address — which Apple may replace with a private relay address — and an account identifier). We never receive your Apple or Google password.
• Family details and saves listed above, copied to your account so they stay in step across your devices.
• Technical records of sign-ins (such as time, IP address and device type), kept by our authentication provider for security.

We use this to provide your account and keep it secure. Legal basis: performing our agreement with you (GDPR Art. 6(1)(b)) and our legitimate interest in preventing abuse (Art. 6(1)(f)).

Location

If you tap “Near me”, we ask for your device's location (on iPhone and Android the system will ask for your permission first). It is used for that search only, to sort results by distance, and is never stored or put in web addresses. If you say no, we use your home area instead, if you've set one. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw in your device settings.

Reports and suggestions

When you report outdated information or suggest a place or event, we receive what you type and, if you give them, your name, organisation and email address. We use them to review and improve listings and to reply to you. These messages are seen only by the Kidoo team and are never published as written.

To stop spam, the form uses Cloudflare Turnstile (which checks that a person is sending it) and we keep a scrambled, one-way code (a salted hash) of your connection's IP address for 7 days to limit how many messages can be sent. Legal basis: our legitimate interests in keeping listings accurate and the service free of abuse (Art. 6(1)(f)).

Usage analytics and error reports (only with your permission)

If you allow it, we collect anonymous usage events (for example which screens are used, searches that found nothing, or which buttons are tapped) through PostHog, and technical error reports through Sentry, so we can see what is useful and fix problems. We don't use advertising identifiers and don't track you across other apps or websites. Nothing is sent until you say yes, and you can change your mind at any time in Me → Privacy choices. Legal basis: consent (Art. 6(1)(a)).

When you visit the website

Our hosting provider processes technical information needed to deliver pages securely, such as your IP address, browser type and the page requested. We don't use advertising cookies. Legal basis: legitimate interests (Art. 6(1)(f)).

Emails

We send emails only when you ask for them — for example a sign-in code, or a reply to a suggestion. We don't send marketing emails unless you separately agree to receive them.

3. Information about children

Kidoo is used by adults, not children. We deliberately collect as little as possible about the children in your family: a birth year so we can suggest age-appropriate ideas, and an optional birth month and nickname to tell children apart. Please don't enter a child's full name. We never ask for photos, exact dates of birth, schools or health information.

You can edit or remove children at any time in Me → My family. If you believe a child has created an account, contact us and we will delete it.

4. Who we share data with

We don't sell or rent personal data. We use the service providers below, who process data on our behalf under data processing agreements and only as we instruct.

Weather forecasts come from MET Norway and maps are served by Kidoo itself; neither receives personal data about you. Venue websites and booking pages you open from Kidoo are run by others and have their own privacy policies.

We may also disclose data if required by law, to protect people's safety, or as part of a sale or reorganisation of our business (in which case this policy would continue to apply).

5. International transfers

We keep data in the European Union where we can. Where a provider processes data outside the European Economic Area, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's standard contractual clauses, with extra safeguards where needed.

6. How long we keep data

• Data on your device stays until you remove it, sign out (which clears personal data from the device) or uninstall the app.
• Account data is kept while you have an account. When you delete your account, your profile, family details and saves are deleted straight away; copies in encrypted backups are overwritten within [7 days — confirm backup retention].
• Reports and suggestions are kept for up to [24 months] so we can follow up and keep listings accurate. The scrambled IP code is deleted after 7 days.
• Analytics and error reports are kept for up to [12 months].

7. Your rights and choices

Under data protection law you can ask us to:

• give you a copy of your personal data, including in a portable format;
• correct data that is wrong, or delete it;
• restrict or object to how we use it (including anything based on legitimate interests);
• withdraw consent at any time, without affecting what happened before.

Many of these are built in: edit your family in Me → My family, change analytics and error reports in Me → Privacy choices, and delete your account in Me → Account → Delete account. For anything else, email privacy@kidoo.mt. We reply within one month.

You also have the right to complain to Malta's supervisory authority, the Information and Data Protection Commissioner (idpc.org.mt), or the authority where you live.

8. Security

Data is encrypted in transit and at rest. Access to personal data is limited to people who need it, database rules ensure each account can only reach its own data, and sign-in uses one-time codes or Apple/Google rather than passwords. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the law requires.

9. Changes and contact

We'll update this policy when the app or the law changes, and change the date at the top. If a change is significant, we'll tell you in the app before it takes effect.

Questions? Email privacy@kidoo.mt or write to [Company name], [Registered address], Malta. See also our terms of use.