This page is a translation provided for convenience. The French version is the legal reference and prevails in case of difference.
Privacy policy
Last updated: October 3, 2026
Joya Home is meant for families, and therefore for children. This page states exactly what the Joya Home (for parents) and Joya Home Kids (for children) applications collect, why, for how long, and who can see it. If any sentence seems unclear, write to us: [email protected].
In short
- No advertising, no reselling, and no advertising tracking or analytics tool from any other company in the applications.
- Your child sees in their application what you can see about them.
- Location is off by default; visiting friends are never monitored.
- Trips, SOS alerts, website history, alert sentences, time per app, calls and voice messages, sweet notes, mission photos and the family feed are deleted automatically after 30 days.
- You can delete your account at any time, directly in the application.
1. Who is responsible
The data controller is Benjamin Taieb, sole proprietor (entrepreneur individuel), 11 Rue Jacques Duchesne, 75019 Paris, France (SIRET 528 074 370 00032), publisher of Joya Home. Contact: [email protected].
The parent who creates the “home” in Joya Home chooses the settings applied to their child's phone (location, website history, alerts…). We process data to make this service work, and for nothing else.
2. The parent's data
| Data | Why |
|---|---|
| First name, email address, password | To create your account and sign you in. The password is never stored in plain text: we only keep a hash (bcrypt) from which it cannot be recovered. |
| If you use “Sign in with Apple” or “with Google”: the identifier Apple or Google sends us, your email address if it is verified (with Apple, this may be a private relay address), your first name | To sign you in without a password. With Apple, we also keep a technical token used solely to revoke access at Apple when you delete your account. |
| Home name, time zone, language | To display the application in your language and apply schedules (“Bedtime” at 9:30 pm) at the right time. |
| For each connected phone (5 at most): the notification token, the type of phone (iPhone or Android), the language | To send you notifications. |
| What you create in the application: moments and schedules, calls (title, text, optional voice message of up to one minute), sweet notes, missions, challenges and forfeits, family places, hallway baskets, questions for “the home quiz” (question, four answers, the correct one, a theme), the reward for the champion of the week | To make these features work. |
| Subscription: the plan (monthly or yearly, number of children), start and end dates, renewal status, trial period, the store (App Store or Google Play), the transaction identifier or purchase token sent by Apple or Google, and, at Apple, an indication that the purchase was received through Family Sharing | To check with Apple or Google that the subscription is valid, and unlock the features for the whole home. We never receive your bank details. |
| A hash (SHA-256) of your email address and of your Apple or Google identifier | To grant the 7-day free trial only once per person. It is not the address itself: the address cannot be recovered from the hash. |
The email address is only used to sign you in and to send you the “forgotten password” code (see section 10). No newsletter, no advertising.
3. Other adults and visiting friends
- The other parent: the same data as you (first name, then email and password, or Apple, or Google). They have the same rights as you.
- The babysitter or grandparents (“sitter” role): only a first name. Their access ends automatically after the chosen duration (12 hours at most). They can call, unlock the screen, answer requests, read the family feed and receive a child's SOS alert (with their location at that moment); they see neither the map, nor trips, nor website history, nor time per app, nor alert sentences, and cannot change settings.
- Visiting friends: a first name, typed on their phone after scanning the home's QR code. Their access ends at midnight the same day. During the visit, their phone follows the home's breaks and the adult website filter, but nothing is monitored: no location, no website history, no content alerts, no time per app, no app approval. Please still let their parents know before offering them the QR code.
4. The child's data
The child has neither an email address nor a password: they join the home with a code (or a QR code) created by their parent.
| Data | Why |
|---|---|
| First name (entered by the parent), color, app style | To display the family in both applications. |
| Month and year of birth — optional | To set the level of the “weekly math test”. Never the day of birth. |
| Settings chosen by the parent (in each of their homes if they have two) | To apply the home's rules on their phone. |
| Protection status: on or off, iPhone or Android, application version, permissions granted, time of last contact | To warn the parent if protection is turned off. |
| Battery level and charging status (charging or not) — only the latest value is kept | To show it to the parent, and warn them once when it drops below 15%. |
| Screen time for the day (in minutes), earned time, penalties | To apply the daily limit if the parent has set one. |
| Time requests (optional text), missions and forfeits, and their photos (1 or 2, taken and sent by the child) | To let the parent answer and approve a mission. |
| Challenges: game, moves played, result, forfeit, rematch; weekly score and champions of past weeks | To run the games, the family score and the champion of the week. |
| Weekly test, practice and knowledge duel (math, dictation, vocabulary, general knowledge, logic): questions, answers, response times, score; and, for each answer, the type of question and whether it was correct (memory of weak spots and progress); their badges and weekly summaries | To give the score and the reward, show the details to the parent, bring back more often what was missed, show their progress curve and badges, and send the Sunday summary to the parents. |
| Times their phone was put in the hallway basket: which basket, time put down, end of the break, pick-up | To put the phone on break and show it to the parent. |
| Sweet notes received and their replies; the news in their bell | To display them and notify the parent who wrote. |
| The family feed: calls and replies (“Coming!”), arrivals at and departures from places, moves from one home to the other, protection turned off, alerts, challenges, missions, basket | The family log, visible to the adults of the home. |
| Their time piggy bank (minutes earned, expiry dates, minutes used) and their “5 more minutes?” requests (time, answer) | To save earned time for later, and let the parent answer. |
5. Location, the map and the SOS alert
- Location is off by default. The parent turns it on, in the child's profile, and can turn it off at any time; it is never turned on for visiting friends.
- It only works if the child's phone allows it: the application asks the iOS or Android question and explains why.
- We keep the last known location (latitude, longitude, accuracy, time), replaced with each update. The phone sends a new location when the child has moved about 150 meters.
- The trip history only keeps significant locations: a new point when the child has moved at least 100 meters; as long as they don't move, the same point is extended, which gives the stops (“at school from 8:05 am to 4:30 pm”). An inaccurate location (more than 100 meters) never goes into it. Each point is deleted automatically after 30 days.
- Family places (name, emoji, coordinates, radius) are used to notify the adults when the child arrives or leaves. These arrivals and departures are recorded in the family feed.
- The location, the map and trips are visible to parents only. When location is turned off, the server ignores the locations sent and records no trips.
- The base map: to draw the map, the parent application downloads map images from Apple (Maps) on iPhone, and from Google Maps or OpenStreetMap on Android. These services receive the area displayed and the IP address of the parent's phone — never the child's first name or their recorded trips.
- The SOS alert (“Alert my parents”): when the child keeps their finger pressed for 2 seconds, the alert goes to the parents and the sitter on duty, with the battery level and the location at that moment — even if location is turned off: it is the child who gives it, at that instant, with their phone's permission. There is no continuous tracking. The alert and its location are deleted automatically after 30 days.
6. Two homes (separated parents)
A child can belong to two homes, when each of their parents has their own. Both parents must agree: the parent of the first home creates a code, and the other parent types it into their own application.
- Each home keeps its own rules and only sees what happens in it. When the child is in the other home, it only receives their first name and “in their other home”: no location, no trips, no websites, no feed, no phone status.
- Their last location is deleted each time they move from one home to the other.
- The move is made manually by a parent, or automatically when the child arrives at the “this is our home” place of the other home — only if both homes have turned on location for them.
- What each home keeps about them (websites, trips, basket) stays in that home, and goes with it if the child leaves it.
7. Protection, apps and browsing
On iPhone
It is Apple's Screen Time that pauses applications, applies per-app limits, blocks the installation of new applications and in-app purchases if the parent requests it, and filters adult websites. Apple does not share with Joya Home the names of applications, the time spent in each one, the websites visited, or the content of messages: the selection of applications made in Apple's screen is recorded as opaque identifiers. On iPhone, there is therefore no website history, no time per app, and no content alert.
On Android
Joya Home Kids uses Android's accessibility service, which the child and their parent turn on during installation. It makes it possible:
- to know which application is open, in order to pause it at the right time, count screen time and the time spent in each application;
- to read the address bar of the main browsers (Chrome, Samsung Internet, Firefox, Edge, Opera, Brave…): we only keep the name of the website (“youtube.com”), never the full address, the search typed or the content of the page. This is also what relaunches a Google, Bing or DuckDuckGo search with the filter (“safe search”) and sends YouTube to YouTube Kids if the parent asked for it — without sending anything to the server;
- to spot worrying words in a few messaging apps (WhatsApp, Snapchat, Instagram, TikTok, Messenger, Telegram, Discord, Google and Samsung Messages). The comparison with word lists, in the application's 9 languages and slang included, is done on the phone; no conversation is sent for analysis.
| Feature (set by the parent) | What is sent to the server | Who sees it | How long |
|---|---|---|---|
| Adult website filter | If a website is blocked: a “Website blocked” line in the feed | The adults of the home | 30 days |
| Website history | The website name, the day, the first and last time of the visit, an approximate duration | Parents only | 30 days, then automatic deletion |
| “Risky website” alert (drugs, weapons, dating, chatting with strangers, gambling, self-harm…) | The website name and its category, at most once per website per day | The adults of the home (in the feed) | 30 days |
| Content alert in a messaging app | The category (danger to self, blackmail or extortion, sexuality or a stranger approaching, threat, weapons, harassment, hate, drugs, gambling), the application name and only the sentence containing the word in question, 200 characters at most. Never the rest of the conversation, never the sender's name. At most one alert per category and per application every 30 minutes. | The sentence: parents only. The alert line (category, application): the adults of the home | 30 days, then automatic deletion |
| Time per app | For each day and each application: its name and total minutes — never minute-by-minute detail | Parents only | 30 days, then automatic deletion |
| List of installed applications | The name and technical identifier of each application, so the parent can choose the one for a limit | Parents only | Replaced with each update; deleted when the child is removed from the home |
| Approval of new applications | The name of the newly installed application, then the parent's decision (allowed or refused) | Parents (the feed: the adults of the home) | As long as the home exists (so as not to ask again at each reinstallation) |
Help websites (helplines, suicide prevention, etc.) are not on the list of risky websites. The sentence that triggered an alert may have been written by someone other than your child; that is why it is shown only to parents and deleted after 30 days. These word lists are deliberately simple: they can be wrong both ways (false alert, worrying message not detected).
8. Camera, microphone, photos and NFC
- Camera: to scan the QR code of the home or the basket and, on the child's side, to photograph a completed mission.
- Photos: only those the child chooses to send for a mission. Joya Home has no access to any other photo.
- Microphone: only when an adult records a voice message for a call (“Dinner's ready!”), one minute at most.
- NFC: the parent application writes on the basket sticker a link containing a secret code; the child's application reads this link when they put their phone down. Nothing else is read.
9. Notifications
Notifications go through Apple's services (APNs) for iPhones and Google's (Firebase Cloud Messaging) for Android. To be useful, some of them contain a little text. Here they are:
| Notification | What it contains |
|---|---|
| Call (“Dinner's ready!”) | The call title, the first name of the calling adult, the countdown |
| Sweet note and reply | The author's first name and the text of the note |
| Time request, mission, forfeit | The first name, the number of minutes, the text of the request or mission |
| Arrival at or departure from a place, move from one home to the other | The child's first name and the name of the place or home |
| SOS alert | The child's first name and battery level — the location is shown in the application |
| Low battery | The child's first name and the battery level |
| New application installed (Android) | The child's first name and the application name |
| Risky website | The child's first name and the website name |
| Content alert | The child's first name only — never the sentence in question, which is read in the application |
| Protection turned off | The child's first name |
| Hallway basket | The child's first name and the time the break ends |
| Challenges, results, weekly test, Sunday summary, badges, champion of the week | First names, the game, the score, the forfeit or the reward, the summary of the week, the badge |
| Time piggy bank, “5 more minutes?” | First names and the number of minutes; for “5 more minutes?”, the name of the break and the answer |
The “silent” notifications that wake up the application only contain a technical type (for example “instruction”), with no personal data.
10. Email
The only email Joya Home sends is the 6-digit “forgotten password” code, at a parent's request. It is valid for 15 minutes, we only keep a hash of it, and it is deleted automatically about one hour after it expires. It is sent from our mailbox hosted by Gandi. We never write to a child.
11. Legal bases
- Performance of the contract (Article 6(1)(b) GDPR): your account, the features you use, the subscription and its verification with Apple or Google.
- For children's data, the service is used at the request and under the responsibility of the parent, who holds parental authority. The monitoring features — location and trips, website history, content alerts, time per app, app approval — are options the parent turns on or off at any time; for children under 15, the parent consents on their behalf (Article 8 GDPR, Article 45 of the French Data Protection Act). The SOS alert is triggered by the child themselves.
- Our legitimate interest (Article 6(1)(f) GDPR): the security of the service and the prevention of abuse (limits on attempts and sends, technical logs, free trial granted only once).
12. Where the data is, and our service providers
| Provider | Role | Location |
|---|---|---|
| Render Services, Inc. | Server hosting | Frankfurt (Germany) |
| MongoDB, Inc. (MongoDB Atlas) | Database, encrypted at rest | Frankfurt (Germany) |
| Apple Inc. | iPhone notifications (APNs), “Sign in with Apple”, Screen Time, App Store and subscription, base map (Maps) on iPhone | United States and worldwide |
| Google LLC (including Firebase) | Android notifications (Firebase Cloud Messaging), “Sign in with Google”, Google Play and subscription, Google Maps base map on Android | United States and worldwide |
| OpenStreetMap Foundation | Base map on Android when Google Maps is not used (map images only) | United Kingdom and Europe |
| Gandi SAS | Sending the “forgotten password” email, contact mailbox | France |
| Cloudflare, Inc. | Hosting of this website (no application data) | United States and worldwide |
Render, MongoDB, Apple, Google and Cloudflare are American companies. Any transfers outside the European Union are covered by the safeguards provided by the GDPR (the European Commission's standard contractual clauses, the EU–US Data Privacy Framework, or the adequacy decision for the United Kingdom). Subscription payment is handled by Apple or Google: we never receive your bank details.
13. How long
| Data | Duration |
|---|---|
| Trips (significant locations) | 30 days, automatic deletion |
| SOS alerts (with their location) | 30 days, automatic deletion |
| Website history (Android) | 30 days after the last visit, automatic deletion |
| Sentence that triggered an alert (Android) | 30 days, automatic deletion |
| Time per app (Android) | 30 days, automatic deletion |
| Calls and voice messages, sweet notes, family feed | 30 days, automatic deletion |
| Photos of requests and missions | Deleted 30 days after the request (once the request has been handled); the request itself remains in the home's history |
| Answers to the questions of the weekly test, practice and the knowledge duel (type of question, right or wrong, response time) | 400 days, automatic deletion (for the one-year progress curve) |
| Time piggy bank (deposits and history) and “5 more minutes?” requests | 30 days, automatic deletion (a piggy bank deposit is deleted 30 days after its expiry date) |
| “Forgotten password” code | Valid for 15 minutes, deleted automatically about one hour later |
| Child's current location | Only the latest is kept, replaced with each update, deleted at each move from one home to the other and when the child is removed from the home |
| Battery level | Only the latest value is kept |
| Child's account (first name, date of birth, settings, phone status, list of their applications), weekly test scores, memory of weak spots, progress, badges and weekly summaries | Until a parent removes them from the home, or until the home is deleted |
| Subscription data | As long as the home exists; deleted with it. Accounting obligations relate to the sales, which are kept by Apple and Google. |
| “Free trial already used” hash | Kept after the account is deleted, so that the trial is granted only once; it is only a hash, with no address or name |
| Everything else (moments, places, challenges and scores, champions, missions, home quiz, baskets and drop-offs, approved applications, daily screen time) | As long as the home exists: everything is deleted when the last parent deletes their account |
14. Who sees what in the family
| Who | What they see |
|---|---|
| Parents | Everything about their home: the feed, the map, the location and trips, the battery, SOS alerts, websites visited, time per app, new applications, alert sentences, mission photos, weekly math test scores |
| Babysitter, grandparents | The family feed, calls, requests and their photos, math test scores, SOS alerts — not the map, nor trips, nor website history, nor time per app, nor alert sentences, nor settings |
| The other home (separated parents) | Nothing of what happens in your home: only that the child is “in their other home” |
| The child | Their own calls, missions, challenges and scores, the first names of family members, the weekly score and champion, and the “Your parents can see” list |
| Visiting friends | The home's rules on their own phone, until midnight |
15. Transparency towards the child
Joya Home refuses hidden tracking. In Joya Home Kids, the “My home” section shows a “Your parents can see” list that follows the actual settings of their phone: their screen time, their phone's battery, “where you are, and your trips from the last 30 days” if location is on, and on Android “the websites you visit”, “alerts, with the sentence in question”, “the time spent in each app” and “the new apps you install”. It adds: “Never all your conversations, nor your photos.”
On Android, the screen asking for accessibility permission also tells the child. We encourage you to talk about it with your child when installing.
16. What we don't do
- No advertising, neither in the parents' application nor in the children's.
- No sale or rental of data, no advertising profiling.
- No analytics or tracking tool from any other company in the applications.
- No sending of entire conversations, full page addresses, or the content of pages visited.
- No continuous location tracking when location is turned off (only the SOS alert, triggered by the child, sends their location at that moment).
- No access to contacts, nor to photos other than those sent for a mission.
- No public profile, and no way for a stranger to contact a child in Joya Home.
17. Security
Exchanges with the server are encrypted (HTTPS). Passwords are only stored as a hash (bcrypt), and so are the “forgotten password” codes (HMAC hash). Apple and Google sign-ins are verified by their signature, and purchases with Apple or Google. Each home is isolated: no one can read another family's data, including between the two homes of the same child. Location, trips, website history, time per app and alert sentences can only be read by parents. In the event of a data breach, we will notify the CNIL within 72 hours and the families concerned when the law requires it.
18. Your rights
You may, for yourself and for your minor child: access your data and obtain a copy, have it corrected, have it erased, request the restriction of processing, object to it, request its portability, withdraw your consent at any time, and set instructions regarding what happens to it after your death.
- Delete your account: directly in the application, or by email (see Delete my account).
- Everything else: write to [email protected]. We reply within one month at most. We may ask you to prove that the account is yours.
- A child or teenager can also write to us themselves.
If our answer does not satisfy you, you may lodge a complaint with the CNIL (the French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr.
19. Changes
This policy may change along with the application. The date at the top of the page is authoritative. In the event of a significant change, we will inform you before it takes effect.