Privacy Policy

1. Who is responsible

We are responsible for the PaceFox processing described here. YouTube, Netflix and the App Store also process information for their own purposes, as explained below.

2. Parents and children

PaceFox is designed for a parent or legal guardian to manage a family’s viewing routine. Children use profiles connected by that adult; they do not register a separate email-and-password account. A device identifier linked to a child profile is still personal data, even if no real name is used.

A nickname and an icon selected from the app are enough for a profile. This icon (also called an avatar) is a supplied illustration, not a photograph of your child. The current profile form does not ask for a child’s date of birth, age group, school, address, photograph, weight or medical history. Please avoid putting those details in nicknames, device names or support messages.

The connected parent can see the profiles, settings, assigned devices and activity summaries available for their family. Child devices receive the profiles and settings assigned to them. Profiles are not public, searchable by other families or displayed on a leaderboard.

Parents set up and manage PaceFox for their children. Before child setup, the parent acknowledges the child-data notice and explicitly confirms by email that they are an adult parent or guardian. This records the authenticated account holder’s confirmation; it does not independently verify age or parental authority. This acknowledgement is not independent verification of parental consent where such verification is legally required. A parent account does not remove the privacy rights of the child using it. Contact us if you have questions about authorization or want us to stop processing a child’s information.

Parents can request access to, correction or deletion of their child’s information and object to further processing by contacting us. We will verify the requester’s authority in a proportionate way. Where processing necessary for a feature must stop, that feature may no longer be available. If you believe a child has used the service without the required authorization, contact us so we can restrict access and investigate.

For children: your parent chooses your routine and can see the activity summary for your profile. If your parent turns on video history, they can also see the videos reported by PaceFox. Camera images used for movement stay on your device. PaceFox does not show your profile to other families. You can stop a break or stop watching at any time. Ask your parent if you want to change or remove your information.

3. Parent accounts and family profiles

Firebase Authentication handles the parent’s email address, account identifier, password authentication, email verification, sign-in sessions and password resets. Passwords are handled by the authentication service; they are not stored in our family-profile database. You can sign in with email and password, Apple or Google. For social sign-in, Firebase receives the provider identifier, authentication credentials and any name, email address or profile information supplied by that provider. Apple may supply a private-relay email address. PaceFox does not receive your Apple or Google password. Signing in to PaceFox does not sign you in to YouTube or Netflix.

Your child’s PaceFox profile is not public and is managed within your family through your parent account. Our family database stores the parent-to-family relationship, membership and account status, family time zone, setup timestamps, the selected child nicknames and avatars, routine settings and allowed watching windows, child-device assignments and the family’s Free or Plus access. Where recorded, notice and authorization evidence includes its version, scope, method and time.

Account access requires an internet connection. Authentication sessions and limited app state may persist on the device so you do not have to sign in after every restart. Removing an app is not a request to delete the associated cloud account; device keychain or operating-system backups can also preserve some local credentials.

4. Connected devices, PINs and security

To connect a child device, we process an installation identifier, pairing invitation and approval status, device name, family and profile assignments, session credentials and connection/settings timestamps. QR invitations contain a secret used to authorize the connection. Manual codes require confirmation on the parent’s device. Treat both as private.

An optional four-digit child PIN helps keep siblings in their own profiles. We store a salted verifier in a restricted server area and use attempt limits; parents can reset a PIN instead of retrieving it. A child PIN is not a parent password or a guarantee that another person cannot use an unlocked device.

A mandatory six-digit family parent PIN protects parent controls on a shared device and signing out of connected child devices. For server-managed Plus access, its salted verifier and family-wide attempt counter stay in a restricted server area. Authorized Free setup also stores a protected PIN verifier on the selected shared device so that parent controls can be checked locally; this verifier is not a readable copy of the PIN. An authenticated parent can reset it after confirming their identity using the account’s supported sign-in method. Recovery on a child-only device does not retain the parent’s sign-in session there.

Our infrastructure also processes technical request information, such as IP addresses, timestamps, app/device information, authentication and app-integrity signals, and errors. Restricted counters and session records help prevent repeated code guesses, unauthorized access, duplicate requests and reuse of viewing credit. We use this information to operate and protect the service, not for advertising.

We use encrypted connections, access controls and server-side authorization checks. Family data in our cloud database (Google’s Firebase Cloud Firestore) is encrypted during transfer and at rest. No system is completely secure. Revoke a lost device from the parent area and contact us if you suspect unauthorized access.

5. Viewing time and activity

PaceFox counts foreground time in its viewing area, including browsing and ads, toward the viewing allowance. This is not the same as the exact playback time of a particular video. We process the selected profile, routine, viewing credit, session/device identifiers, granted time windows, daily-limit state, Timeout and Exception settings, the parent who changed them, start and end times, request identifiers and acknowledgements needed to enforce the routine across devices.

Free supports one child on a shared parent-and-child device. Its routine, selected YouTube mode and approval list, remaining viewing allowance and today’s watching and completed-break totals are stored in protected local app storage. Ordinary Free watching and break completion do not upload activity or create per-video history. We keep a settings backup and installation ownership record on our server. Changed settings can be backed up when connected; the app occasionally checks ownership and plan status, including at app startup, during periodic checks and when opening parent controls. Free needs an online ownership check at least every seven days. Moving Free to another device requires the parent’s account: settings can be restored, but local activity and remaining time are not restored from that backup. An offline old device can remain authorized until its check expires.

On an upgrade to Plus, the device transfers its current settings, remaining earned allowance and current-day totals once so that they can be managed across devices. It does not backfill per-video history. Plus retains server-coordinated viewing allowances and daily summaries. Exception watching is included in today’s watching total and does not count as a completed break. Summaries are approximate, including conservative accounting after a crash or interruption.

With Plus, you can optionally enable detailed video history separately for each child. It is off by default. When enabled, the managed browser reports observed video playback to your family’s private history: the selected child profile, content provider and video identifier, available title, YouTube channel metadata or Netflix artwork URL, start and observation times, estimated playback seconds and a report identifier used to avoid duplicate records. This activity reporting does not send search queries, login forms, passwords or website cookies to our family database. Reports are delayed and approximate; pauses, interruptions, advertisements or website changes can leave gaps or incomplete metadata. They describe activity observed in PaceFox, not a complete YouTube or Netflix account history. The providers themselves receive browsing information as described in section 7.

With Plus, authorized parents can view reported videos, daily session totals and completed-break counts for the current and previous family calendar month. The device batches video reports, allowing two updates close together and replenishing one upload allowance every three minutes. Rapid video changes are combined into a batch; unchanged playback does not generate repeating uploads. Turning recording off stops new video reports when connected devices receive the setting, clears their unsent observations, and prevents the server from accepting new reports. Disconnected devices apply the change when they reconnect. Re-enabling starts a new recording period without backfilling old observations. Previously saved history remains available until its normal expiry; child or family deletion removes it through the deletion process. Watching-time totals and break controls continue independently. Pending observations are stored in protected app storage, excluded from device backups, and may be sent on a later app visit. Clearly labelled example reports use sample activity, not hidden Free history. Free parents can approve up to five YouTube videos and one channel on their shared device, freely replacing selections. Plus supports more YouTube approvals, playlists and Netflix approvals. We store selected content references, available titles and related metadata, inclusion or exclusion choices, and update/version information so the selected Free device or connected Plus devices can apply those choices. Approval lists describe the parent’s selections; they are not an independent assessment of content suitability.

6. Camera and movement breaks

The current build can use the camera to scan a pairing QR code. Images are processed on the device to read the code; PaceFox does not upload or retain those camera images. The code needed to pair the device is sent to our server.

Movement breaks use the camera and on-device pose estimation to recognize participation in guided movements. Camera images and the body points used for movement tracking (pose landmarks) are processed live on the device. PaceFox does not save photos or videos of your child, upload camera images or pose landmarks, recognize identity, or create a biometric identity profile. Tracking is approximate and can miss or incorrectly recognize movement.

Parents can choose a movement break or a quiet break, with either Free or Plus. Quiet breaks use a timer shown as progress, a fox animation and optional bundled calming audio; they do not use the camera or assess movement. No disability, illness or reason for this choice is requested or stored. Free keeps the timer locally; Plus stores the break type, start/end times and profile/device reference needed to validate completion. Completed quiet breaks count toward the same break totals and are labelled separately in Plus history. Break totals and completion entries continue when detailed video history is off.

Completing a movement or quiet break adds watching credit and a completed-break count. Free keeps this activity in protected local app storage. With Plus, the app sends the completion request, profile/session identifiers and the current round to our server; the server records the completed break for credit, daily summaries and family history. It does not receive the camera images or pose landmarks. Prerecorded guidance voices and mascot animations are app resources. Playing them does not send your child’s voice, images or activity to a speech-generation service.

PaceFox does not request microphone access or integrate with Apple Health, Health Connect, Strava or a calendar.

7. YouTube, Netflix and website storage

Opening YouTube or Netflix loads that provider’s website in PaceFox’s embedded browser. The provider and services used to deliver its website can receive the device’s IP address, browser information, visited pages, video requests, cookies and other identifiers. Provider accounts, recommendations, advertising and playback are governed by that provider’s own terms and privacy notice. Restricting navigation inside PaceFox does not stop a loaded page from contacting domains used for media, advertising or supporting resources.

Website storage is persistent and separated by PaceFox family, child profile and paired installation. Cookies can survive an app restart and keep a provider login signed in, subject to the provider’s expiry and security checks. These cookies are not uploaded to the PaceFox family database or shared with sibling profiles. Provider sign-out and privacy controls remain relevant; deleting a PaceFox account does not erase data already held independently by YouTube or Netflix.

Before a child first uses each provider on a device, the parent unlocks setup with the parent PIN, reviews the provider notice, configures the provider account or profile as needed, and confirms that setup is complete. PaceFox keeps a separate local setup-confirmation record for each provider, family and child on that installation. This record is not a copy of provider credentials and does not independently verify age, supervision or whether the provider login is still valid. Resetting provider setup clears its local confirmation and website storage; a later expired login may require the parent again.

PaceFox does not add advertising SDKs, sell family data or use child profiles for advertising. YouTube or Netflix can nevertheless display advertising or process data under their own policies. Plus and approved-content mode do not make those services ad-free or disable their tracking. A PaceFox profile is not a provider account and does not override a provider’s age, supervision, household or subscription requirements.

See the Google Privacy Policy, YouTube Terms of Service, Netflix Privacy Statement and Netflix Terms of Use. A parent must consider the provider’s age and supervision requirements before enabling it. Accepting PaceFox’s terms does not replace permissions or consent required for the provider’s own processing.

8. Purchases and paid access

Apple handles payment for iOS purchases. RevenueCat helps us retrieve products, validate transactions and restore access. It processes the parent’s PaceFox account identifier, purchased product, transaction and original-transaction identifiers, purchase and renewal dates, expiration, refund and entitlement status, store/environment information, and technical information such as SDK/app version and IP address. We do not receive complete payment-card or bank-account details.

Our server stores a limited purchase verification result and the family’s resulting access. Purchases are attached to the parent’s account so they can work on that family’s connected devices. We do not deliberately send child nicknames, PINs, camera data or viewing activity to RevenueCat. We do not send child data for advertising attribution. Optional web setup measurement is described below.

The production service supports Apple purchases; TestFlight and other store testing can use sandbox transactions. Android purchases and web subscription checkout are not currently offered. Lifetime access codes are validated on our server; we store a hashed code identifier and a redemption record associated with the family, never payment details. Redeeming an access code does not start a subscription. See RevenueCat’s privacy information and Apple’s privacy information.

9. Website, account emails and support

When you choose a website language, we remember that preference in your browser until you change it or clear your browser storage. The preference is not sent to our family database.

Web registration at /register and account management at /account use the same parent account as the app. After parental consent, incomplete setup settings are saved to the family so you can resume. Authentication uses browser session storage. Parent PINs are sent securely for server-side verification storage, never saved in browser storage. Firebase App Check and Google reCAPTCHA protect account operations against abuse; these security services process connection and browser information. They are separate from optional measurement. See Google’s privacy information.

Where optional setup measurement is enabled, you may allow or decline it independently of parental consent. Only after allowing it do we store a random journey identifier, an allowlisted campaign/source, setup step, event name and timestamp. We do not include account identifiers, email addresses, child names, viewing history, PINs, payment details, advertising click identifiers or full URLs in those events. We do not load advertising pixels. Counts represent consenting browser journeys and are not linked across devices. The measurement choice and journey are stored in your browser for up to 30 days; server measurements expire after 30 days through scheduled cleanup. Use “Measurement preferences” to withdraw and delete the current browser journey’s measurements. Declining does not affect family setup or paid access.

During parent setup, PaceFox asks for an explicit acknowledgement of the child-data notice and sends a consent email. The parent confirms on our hosted page; simply opening the email or link does not give consent. For email registration, this confirmation also verifies the email address. The pending consent step follows the parent account across devices and blocks further setup until confirmation. An informational follow-up is scheduled for 24 hours later and requires no second confirmation. Consent can be withdrawn in the parent account settings or using the follow-up link. Withdrawal blocks further online authorization; it does not automatically delete existing records or immediately erase data on offline devices.

Firebase Hosting delivers our account and legal pages. Hosting and related infrastructure process request information needed to serve and secure them. The legal pages use locally hosted fonts and images, with no analytics scripts, embedded videos or marketing cookies.

Account action links contain a temporary code and action information needed to verify an email address or reset a password. Firebase processes these when you use the link. Do not forward such links. Our account pages use a no-referrer policy and avoid recording action URLs in application logs; hosting, browser and email systems can still process URLs as part of delivering the service.

We use Firebase’s authentication email service for account messages and IONOS for the pacefox.app domain, our support mailbox and parental-consent emails. For consent delivery, IONOS processes the parent’s recipient address, our sender address, the notice and confirmation or withdrawal link, and technical delivery information. If you contact us, we process your email address, message and the information needed to respond. Please do not send passwords, child camera recordings or unnecessary sensitive details.

The current app has no Firebase Analytics or Crashlytics integration, no marketing newsletter and no child social features. Infrastructure logs and information you choose to send for troubleshooting are separate from an analytics or crash-reporting SDK. Push notifications are not currently enabled; a future notification feature will explain device-token handling and ask for system permission.

10. Purposes and legal bases

For the adult account holder, account operation, providing the agreed service, purchase verification and requested support normally rely on performance of the contract or steps you request before it (GDPR Article 6(1)(b)). Required legal and accounting records rely on applicable legal obligations (Article 6(1)(c)).

Necessary service security, fraud prevention and limited technical troubleshooting may rely on our legitimate interests (Article 6(1)(f)), after considering the impact on the people concerned, particularly children. These interests do not authorize unrelated tracking or collection merely because it could be useful.

Where processing relies on consent (Article 6(1)(a)), it must be specific, informed and freely given, and can be withdrawn. A parent’s contract is not automatically a legal basis for all processing about a child. Children’s routine and activity information is used for the parent-selected controls and private family reporting described in this notice. Those purposes require an applicable lawful basis and any legally required parental authorization; an adult account acknowledgement or camera permission does not by itself establish either. We do not treat acceptance of our terms as consent to unrelated or optional processing.

If you withhold information necessary to authenticate an account, connect a device or check purchased access, we cannot provide that particular function. You can browse these legal pages without creating an account. We do not use the data for decisions producing legal or similarly significant effects; automated timers apply the routine selected by the parent.

11. Service providers and international processing

• Google/Firebase: Google sign-in, authentication, family database, functions, hosting, integrity checks and supporting operational infrastructure.
• RevenueCat: subscription and purchase validation and entitlement management.
• Apple: Sign in with Apple, App Store transactions, operating-system services and app/device integrity services.
• IONOS: domain, support-email and parental-consent email delivery services.
• Google/YouTube: the embedded video website, acting separately for its own service purposes. Actual and example history reports also request small public video thumbnails from YouTube’s image service. Those requests disclose the requested video identifier and connection information such as the device’s IP address to Google. PaceFox does not attach account credentials or YouTube browser cookies to these thumbnail requests; the app caches these images locally to avoid repeated downloads. Earlier app builds also used a bounded disk cache. Updated builds use temporary memory caching and remove the earlier disk cache when the artwork cache is initialized; local deletion cleanup also removes it. An inactive device cannot run this cleanup until the app runs again.
• Netflix: the embedded streaming website and public artwork requests, under Netflix’s own privacy arrangements. Fetching artwork discloses connection information such as the device’s IP address to the image host.

Firebase and RevenueCat publish data-processing terms for their services, linked below. Providers acting on our behalf process information under the applicable service and processing terms. Apple, Google/YouTube and other providers can also have independent legal duties and purposes. We may disclose limited information where legally required or necessary to establish or defend legal claims. We do not sell or rent family data or share it for third-party marketing.

Our production Firestore database and application functions use Google’s Frankfurt region (europe-west3). Other processing and support can occur outside Germany or the European Economic Area. Selecting a European database or function location does not place every authentication, purchase, log or support service in Europe. Where GDPR requires transfer safeguards, the relevant arrangement must use an applicable adequacy decision or Standard Contractual Clauses with any necessary supplementary measures. We can provide information about the safeguards applicable to your data on request.

See Firebase privacy and security, RevenueCat’s data processing terms and IONOS’s privacy information. Contact us for details about the providers and arrangements relevant to your information.

12. Retention and deletion

Accounts, profiles and settings

Kept while needed for the active account and its selected features. Removing a child starts deletion of their profile, settings and associated history. Deleting the family account revokes server access and queues removal of family records and the parent authentication account. It is not an instantaneous erasure of every copy.

Parental consent and delivery records

We store the parent account identifier, notice version and scope, acknowledgement/confirmation timestamps, language, an email-address hash and delivery/withdrawal status. Consent evidence remains with the parent account until account deletion, subject to applicable retention obligations. Confirmation links expire within 48 hours and withdrawal links within one year; expired link records are removed by bounded cleanup jobs. Queued email links are removed after sending, cancellation or exhausted retries. Mail providers and the recipient’s mailbox can retain their own copies under their respective retention arrangements.

Daily summaries

Ordinary local Free activity stays on the device. Where server-side operational daily records exist outside Plus reporting, they are marked for deletion 48 hours after the relevant family calendar day ends. With Plus calendar reporting enabled, daily summaries recorded during Plus are retained for the current and previous family calendar month, then marked for deletion at the start of the following month. A retained Plus day keeps that expiry after a downgrade; new Free days are not archived. If Plus starts during a day, that day's aggregate can include the operational totals already recorded earlier that day. This does not create a record of individual videos. History access requires active Plus and ends at the retention boundary even if database cleanup is delayed. Database expiry cleanup is asynchronous, so expiry is not a guaranteed physical removal deadline.

Plus video history and pending reports

Reported videos and completed-break events use the same current-and-previous-calendar-month expiry as Plus daily summaries. Access requires a current authorized parent and active Plus. Removing a child or family revokes access and schedules bounded deletion of its history. A local pending queue contains at most 2,000 observations; observations older than 48 hours are discarded on the next recording/upload opportunity. Signing out clears that queue. An inactive device may retain an unsent queue until the app next runs or its data is erased. Free playback is not recorded for later upload.

Pairing, sessions and operational records

Pairing invitations are valid for five minutes; session and viewing permissions have their own short validity periods. Expiry prevents further use but does not necessarily delete the record. Expired pairing-code lookups and request-rate-limit records are eligible for automatic database expiry cleanup (codes after their five-minute validity, request-rate records ten minutes after their last request). An hourly job removes eligible unsuccessful pairing invitations starting 24 hours after invitation expiry, with bounded batches and checks that protect connected devices. Database expiry and scheduled cleanup are asynchronous; these are eligibility times, not guaranteed physical deletion deadlines. Connected-device and recovery records follow separate rules. Minimal installation release records and the corresponding anonymous recovery identity may remain after family deletion so an offline device can confirm that it has been disconnected when it reconnects. Release records use installation or connection identifiers (including secret-derived hashes for local Free recovery) and a release time, without child names, PINs or viewing history. After a family is fully deleted, an hourly job retires eligible records and the matching anonymous recovery identity when the device has acknowledged that it has an on-device recovery fallback. Checks protect active families and replacement connections. Revoked connections in still-existing families and legacy connections without this acknowledgement have no fixed automatic deletion deadline: their recovery proof remains needed by offline devices. You can contact us to request a review or deletion of records associated with a disconnected device.

Purchase records

We retain verification state while needed to provide or restore paid access and resolve purchase issues. Apple and RevenueCat hold separate transaction records. Family-account deletion removes our family billing state and, after the family records and parent authentication account have been deleted, automatically queues erasure of the associated RevenueCat customer. The cleanup verifies that the provider record is absent before closing the task and retries temporary failures. If the provider identity is shared with another identified account, or erasure cannot be confirmed, the task is retained for review so another family’s records are not blindly deleted. A minimal customer identifier, task status and reason remain until the follow-up is resolved. This is asynchronous, not immediate erasure of every provider-held copy. Any records required for a specific legal or financial obligation remain subject to the applicable retention obligation. Account deletion and RevenueCat cleanup do not cancel an Apple subscription or guarantee a refund. Contact us for help with an unresolved deletion request.

Support, logs and backups

Our production project’s standard Cloud Logging bucket retains logs for 30 days; its required administrative audit bucket retains records for 400 days. These are separate from provider-operated logs: Firebase describes Authentication IP logs as retained for a few weeks and Hosting IP data for a few months. Deleted Firebase Authentication information can remain in live or backup systems for up to 180 days under Google’s published policy. Firestore scheduled backups and point-in-time recovery are not enabled in this project; that does not mean providers maintain no service-level copies. Support messages are kept to handle the request and related follow-up; the mailbox does not currently have an automatic deletion deadline. You can request deletion by contacting us. Provider-held copies are governed by the applicable provider’s retention arrangements. Records needed for a specific legal obligation or dispute may be retained only for that purpose and the relevant period.

Use the child’s settings to remove a profile or the parent’s account settings to delete the family. You can also email us for access or deletion, including if you cannot sign in. Deleting an account does not cancel an Apple subscription, erase YouTube or Netflix account history, or remove independently held store records. Manage subscriptions separately in your Apple account. On disconnected devices, an already-issued viewing allowance can remain usable until its short expiry; reconnection rechecks access.

13. Your rights and choices

Subject to the applicable conditions, you and your child have rights to access, correction, deletion, restriction, data portability and objection. You can withdraw consent without affecting processing that was lawful before withdrawal. You can object to processing based on legitimate interests for reasons relating to your situation.

Contact mail@pacefox.app. We may need reasonable evidence of your identity or parental authority. We normally respond to GDPR requests within one month; if a permitted extension is necessary, we will explain it within that period. No public profile or purchase is required to ask a privacy question.

You may complain to a data-protection authority, including in the country where you live or work. For our establishment in Bavaria, the relevant authority for private businesses is the Bavarian State Office for Data Protection Supervision (BayLDA).

14. Changes to this notice

We will update this notice before materially changing how we process personal data, provide appropriate notice and request consent where required. Features not currently offered, such as Android support, direct web billing or push notifications, are not authorized merely because they appear on a roadmap.