Privacy

Controller

The controller within the meaning of the GDPR is ANTICIPATER GmbH, Alter Schlachthof 39, 76131 Karlsruhe, represented by Thorsten Reiser. Contact: hallo@anticipater.com · +49 (0) 721 619 025 28.

The app

On the devices the app stores: the names you give yourself and your child, your schedules, app groups, approval requests and decisions from the last 30 days, and the cryptographic keys of the pairing. Which apps are blocked in a group is known only to the kid’s iPhone itself — Apple does not pass this selection on to other devices or to us.

Between the devices this data is transmitted end-to-end encrypted: directly when nearby (local network/Bluetooth), otherwise via the iCloud of the Apple Accounts involved. Apple only stores encrypted messages that it cannot read, and delivers notifications via the Apple Push service. So that a notification arrives visibly, the sending iPhone also places an empty “wake-up call” in the app’s public iCloud database: only a random identifier of the recipient derived from the pairing, without any content; each new wake-up call replaces the previous one. Apple is responsible for iCloud; Apple’s privacy policy applies.

Screen Time: the app uses Apple’s Screen Time interface (Family Controls). The report under “Usage & Movement” (screen time, unlocks, most-used apps) is generated by a sandboxed Apple extension directly on the iPhone; this data does not leave the device and cannot be read by the rest of the app or by us.

Movement: if you allow it in the iPhone settings (Motion & Fitness), the app reads the current day’s steps, distance and active minutes (walking, running, cycling, car) from the motion sensors. On the kid’s iPhone, daily summaries — numbers only, no locations — are sent end-to-end encrypted to the paired parents’ iPhones, which keep them for 30 days. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the iPhone settings.

Places: parents can create places such as “Home” or “School” on their iPhone — via an address search (Apple Maps) or their own location — with a radius. If you allow “Always” location access on the kid’s iPhone, iOS monitors these areas on the device and the app only reports arriving and leaving (place, time) end-to-end encrypted to the paired parents’ iPhones; no position is transmitted. If-then rules can react to this. The legal basis is the consent of the parents with parental responsibility (Art. 6(1)(a) GDPR); deleting a place in the app or revoking location access in the iPhone settings ends the processing.

Movement profile (optional, off by default): if parents switch it on for a child, the kid’s iPhone records significant location changes and visits (Apple Location Services, not minute by minute), keeps them for 30 days and sends them end-to-end encrypted to the paired parents’ iPhones, which show the day’s route on a map. The child sees in their app that the movement profile is switched on. Switching it off deletes the history on both iPhones. The legal basis is the consent of the parents with parental responsibility (Art. 6(1)(a) GDPR), which can be withdrawn in the app at any time. We receive none of this.

Network: if network metering is switched on (on kids’ iPhones automatically with the Screen Time authorisation), a content filter directly on the iPhone counts which domains and apps use how many connections and how much data. The contents of connections are not read or stored. The filter also records when the kid’s iPhone was unlocked and locked again (times only, 30 days on the device) and sends today’s and yesterday’s times end-to-end encrypted to the paired parents’ iPhones; the child sees this under “What your parents see”. The count is kept only on the device; kids’ iPhones send a daily summary (total volume, most-used domains and apps) end-to-end encrypted to the paired parents’ iPhones. We receive none of this.

Protection list and ad blocker: the iPhone compares requested domains with included lists and blocks matches — on kids’ iPhones in the network filter. The protection list against malware, phishing and scam domains (HaGeZi Threat Intelligence Feeds) is switched on until the parents switch it off; the ad and tracker blocker (Steven Black Hosts) is optional. The comparison takes place exclusively on the device; the lists come with every app version and, from iOS 26, are additionally updated via Apple’s App Store (Apple-hosted additional app data, the same for all users, without any information about you or your child). When there is a match, the iPhone shows a notification with the blocked domain and Safari shows a block page; its link “Why blocked?” opens familydevice.com/blockiert without any information about the domain or about you — only if you tap it. Only how often and which domain was blocked is counted; kids’ iPhones send this count with the daily summary end-to-end encrypted to the parents’ iPhones, so that parents can see when an app or website connects to malware domains.

Updates are distributed by Apple via TestFlight or the App Store. The paired iPhones learn from each other over the encrypted connection which version is running on the others — the app does not ask any server for this.

Purchase and subscription are handled by Apple. From Apple we only receive anonymised sales reports, no payment data and no names.

Crash reports: if you have allowed sharing analytics data with app developers in the iPhone settings, Apple provides us with anonymous crash reports. You can switch this off there at any time.

The website familydevice.com

When you visit the website, our hosting provider Vercel Inc. processes technically necessary server logs (IP address, time, page requested, browser) to deliver and secure the site. The legal basis is Art. 6(1)(f) GDPR; the transfer to the USA is based on the EU-US Data Privacy Framework or standard contractual clauses. The website sets no cookies, has no sign-in and includes no analytics tools. A data processing agreement (Art. 28 GDPR) is in place with Vercel.

The website suggests a different language version to you if your browser prefers one of our languages. For this, the page reads your browser’s language setting, which it shares with every website anyway, only in your browser; nothing is stored or transmitted to us.

If you write to us by email — for example for beta access — we process your message and email address to reply (Art. 6(1)(b) or (f) GDPR) and delete them when they are no longer needed.

Children and young people

familydevice is made for families in which parents guide their children’s iPhone use. The features that share something about the child — places, movement profile, movement, network — are either off by default or need permission in the child’s iPhone settings. None of it is secret: under “What your parents see”, the app on the kid’s iPhone shows what is currently going to the parents, for as long as it is switched on.

The parents’ consent does not replace the conversation with the child. The older the child, the more their own opinion counts; from the age of 16, they should themselves support features such as places or the movement profile. We have carried out a data protection impact assessment (Art. 35 GDPR) for these features.

Recipients at a glance

APPLE

iCloud (encrypted messages between your iPhones), push service, Apple Maps (address search for places), TestFlight/App Store (updates, current protection lists, purchase, subscription, voluntary crash reports)

VERCEL

Only the website familydevice.com: technically necessary server logs

WE

Only emails you write to us — we receive nothing from the app

What we deliberately don’t do

• No Google Analytics, no Plausible, no Matomo, no Facebook pixel — neither in the app nor on the website.
• No ad tracking, no third-party cookies, no advertising SDKs.
• No profiles of your children’s usage, browsing or movement behaviour on our side — everything stays within your family.
• No selling or sharing of data.

Deletion

The app’s data is stored on your devices and in your iCloud. “Unpair” in the app deletes keys, rules and history on the device and the associated iCloud areas; deleting the app removes the rest from the device.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Write to us at hallo@anticipater.com — we will reply within 30 days. You can also lodge a complaint with the supervisory authority responsible for us: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg.