TheyOkay Privacy Policy
In short. We do not sell data, show ads, or share data for advertising. Voice messages, stickers, phone information and location are encrypted on family members' phones — the server only sees ciphertext. Audio, stickers and location stay on the server only until delivery and for no longer than 48 hours. There is no continuous location tracking. The microphone and location are never turned on secretly.
1. Who is responsible for your data
Data controller: [full name or company name, country, address, registration number]. For any questions about your data: simpltools.apps@gmail.com.
EU representative (Art. 27 GDPR): [name and address of the representative — required if the controller is outside the EU].
2. What data we process, why, and on what basis
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: internal Google sign-in identifier. You enter the name your family sees yourself. | Sign-in, restoring your family when you change phones | Performance of a contract (Art. 6(1)(b)) |
| Family: names, relationships, labels ("Mom"), roles, the older person's phone model, settings (volume, quiet hours, when to worry) | Running the service | Performance of a contract |
| Voice messages and stickers (encrypted) | Family communication | Performance of a contract |
| Older person's phone information: battery, whether it is charging, when the phone was picked up (screen, unlock, motion sensor), when it was last online. GPS is not used for this. | Hints to the family that the phone is fine | Consent of the older person (Art. 6(1)(a)), given on their phone |
| "Listen in": an audio recording of up to 30 seconds | At a family member's request, after an audible and spoken warning on the older person's phone | Consent of the older person — each time or in advance |
| Location (only within "Listen in"): coordinates and accuracy | Showing the requester where the phone is at that moment | Consent of the older person and the Android location permission |
| Acceptance of the Terms: date and version | Recording that you agreed | Legitimate interest (Art. 6(1)(f)) |
| Technical data: push-notification address, public encryption keys, server error logs | Delivering messages, security, fixing faults | Performance of a contract; legitimate interest |
Analytics (Firebase Analytics, Google). To find faults and the places where people get stuck during setup, we collect de-identified technical events: which setup steps were completed, whether permissions were granted, whether a voice message arrived and how long it took, whether it played, whether the service is running on the phone; plus the phone model, Android version, language and the phone's role. Analytics contains no names, texts, audio, location or message content. We do not collect the advertising ID and do not use data for advertising. Legal basis: legitimate interest (Art. 6(1)(f)); you can object by writing to us. Kept for [2] months. The app has no ads.
No law requires you to provide this data. The service cannot work without account and family data; phone information, "Listen in" and location are optional, and everything else works without them.
3. Location
- The app does not track location continuously and does not keep a location history.
- Location is determined once: only when a family member taps "Listen in", only with the older person's consent, and with a note on their screen saying "… can see where you are".
- Location is encrypted for the requester and deleted from the server as soon as they receive it, and in any case within 48 hours.
- The address is looked up from the coordinates on the requester's phone using Android.
4. How long we keep data
| What | Where and how long |
|---|---|
| Audio of voice messages and "Listen in", sticker images, location | On the server until delivered to the recipient's phone, no longer than 48 hours. If not delivered within 48 hours, it is deleted undelivered. |
| Record of a voice message without audio (who, to whom, when, length, listened to or not) | On the server for 30 days — for the feed and "listened" notices. |
| List of voice messages | Only on your phone, for 30 days. Lost if you change or reset your phone; you can save what you need to Downloads. |
| Older person's phone information | Only the latest state, no history. |
| Family and account data | While you use the service; after you delete your account or leave the family, we delete it within [30] days. |
| Server error logs | [30] days. |
5. Encryption and security
Each phone has its own key pair; the private key is kept in Android's secure storage and never leaves the phone. Content is encrypted on the sender's phone so that only the recipient and the sender can read it. Access to a family's data on the server is limited to its members.
6. Who processes data on our behalf
- Google Cloud / Firebase (Google Ireland Ltd. and affiliates) — storage, server functions, push notifications, sign-in. Data is stored in Frankfurt, Germany (europe-west3).
- Google Play — subscription payments. We do not receive payment details.
- Google Analytics for Firebase — de-identified technical analytics (see section 2).
Transfers outside the EU/EEA (for example, to the US for Google services) rely on the EU-US Data Privacy Framework adequacy decision and the European Commission's Standard Contractual Clauses. We do not share data with third parties for their own purposes, except where required by law.
7. Your rights
European Union, EEA, United Kingdom (GDPR)
Access to your data and a copy of it; rectification; erasure; restriction of processing; objection to processing based on legitimate interest; portability; withdrawal of consent at any time without affecting earlier processing (on the older person's phone — by uninstalling the app or answering "Not now" to a request). You can lodge a complaint with the data protection authority in your country.
Israel (Privacy Protection Law 5741-1981, as amended by Amendment 13)
The right to review information about yourself and to request that it be corrected or deleted. You can lodge a complaint with the Privacy Protection Authority.
United States (state privacy laws, including the CCPA/CPRA in California)
- Categories of data: identifiers, account data, audio recordings, precise location (on request), device information — for the purposes described in section 2.
- We do not sell personal information and do not share it for cross-context behavioural advertising. We use precise location only to provide the service that was requested and do not infer characteristics about anyone from it.
- You can ask what data we hold about you, get a copy, correct it and delete it, and appoint an authorised agent. We will not treat you differently for using these rights.
How to use your rights: email simpltools.apps@gmail.com. We reply within 30 days (45 days in the US) and may ask you to confirm the request comes from you.
8. Children
The service is not intended for children under 16, and we do not knowingly collect their data. If you learn that a child has given us data, write to us and we will delete it.
9. Where the service is available
The subscription is purchased and paid for through Google Play wherever Google Play accepts payments. Your loved one uses the app free of charge as part of the family — including in countries where Google Play payments are unavailable. You are responsible for using the service in line with the law of the country you are in.
10. Changes
We will give advance notice of significant changes to this policy in the app.