In short
Grandi asks for the bare minimum about your child: a first name, an age band, an avatar. No surname, no date of birth, no profile picture, no address. No ads, no trackers, no third-party analytics in the app. Your data lives in France, and you can export or delete everything from the app, without writing to us.
What Grandi knows about you
This part is for you, the child. You can read it with a grown-up.
- Your first name, the one your parents typed in.
- Roughly how old you are: 4-6, 7-9 or 10-12.
- The animal you picked for your profile.
- Your tasks, your wins and your rewards, to show you how far you have come.
And that's all. Grandi doesn't know where you live, doesn't know your surname, and never shows your things to strangers. If you want it all gone, ask your parents: they can erase everything.
1Who processes your data
The Grandi app (com.everoncraft.grandi) is published by
EveronCraft, the data controller under the GDPR. Full details of the publisher
are in the legal notice. Any question
about your data: contact@everoncraft.com.
Grandi is a family service: neither a banking service nor a medical one. Nothing entered in the app has clinical or financial value.
2The parent account
Grandi has only one kind of account: an adult's. It is created with an email address and a password.
- The password is never stored: the server only keeps a cryptographic hash of it (bcrypt).
- Once signed in, your device holds session tokens — an access token valid for one hour, a refresh token valid for 60 days — kept in the system's secure store (Android Keystore).
- You may add a display name and a language. These are the only optional fields on the account.
- No social sign-in, no phone number, no postal address.
The parental lock stays with you. The four-digit code that protects the Parent Space — like fingerprint or face recognition, if you enable it — is checked on the device. The code is salted and hashed (SHA-256) inside the system's secure store: it is never sent to our servers, and we cannot recover it.
3Your child's profile
This is the heart of our commitment: a child has no account, no digital identity and no existence outside your household. You create the profile, and you alone control it.
What we record
- Their first name (or a nickname, your call)
- Their age band: 4-6, 7-9 or 10-12
- The avatar picked from a list
- The display mode (puzzle or progress)
- An optional child code, stored hashed
Five fields, all chosen by you.
What we never ask for
- Surname
- Exact date of birth
- The child's email or phone number
- Profile picture, school, address
- Location, advertising ID, contacts
Those fields don't exist in the app.
An age band rather than a date of birth is not a detail: it is enough to adapt the wording and the suggested tasks, and it cannot identify a child. It is the least precise piece of data that still makes the service work.
Your call. Nothing requires you to enter your child's real first name — a nickname works just as well. We also encourage you not to put sensitive information into task or reward titles: those fields are free text, and therefore your responsibility.
4Household life
To show a child's progress, the app records what the family creates in it:
- routines and tasks (title, icon, category, suggested age band);
- completions: which task, by which child, at what time, approved by which adult, and the points awarded;
- rewards and their redemptions, missions, weekly goals;
- puzzles and unlocked achievements;
- the household itself: its name, time zone and country.
This data is used solely to run the app for your family. Every request to the server is scoped to one household: an account can only reach its own data.
5Proof photos
Some tasks can ask for a proof photo — the school bag tidied, the table set. It is an option: it only exists if you turn it on for a task.
- Access to the camera or the gallery is requested only at that moment, and only for that photo.
- The photo is stored on our servers, outside any public directory. It can only be viewed through a signed link valid for 60 seconds, issued to members of the household.
- It is deleted automatically 72 hours after upload. A purge job runs every hour: the file leaves the disk, and the completion loses sight of it.
- You can delete every photo in the household at once, from the Parent Space.
No face recognition, no image analysis, nothing sent to a third party: a proof photo is seen only by the adults of the household, and not for long.
6Inviting the other parent
A household can hold two adults. To invite the second one, you enter their email address: it is stored with the invitation, until they join the household from their own account.
- You never share your password: the co-parent signs in with their own.
- Both adults see the same data and have the same approval powers.
- A pending invitation can be cancelled; the address is erased with it.
- A co-parent can leave the household: their membership is removed, and the household's data stays with the account holder.
Someone else's address. By inviting someone, you entrust us with their email address. Only invite people who expect it, and who hold parental responsibility for the children in the household.
7Notifications
Grandi sends two kinds of notifications, and they don't work the same way.
- Routine reminders (morning, evening) are scheduled locally by the app on your phone. Nothing goes through our servers, no identifier is created.
- Activity notifications — “Léa marked ‘Tidy my school bag’” — are sent by our server when a child reports a task. They are delivered by Expo's notification service, which then hands them to Google. For this, the app registers a device token (a technical notification identifier), and the message contains the child's first name and the task title.
You can turn notifications off in the app or in your phone settings. The device token is deleted along with the account, and its legal basis is your consent, which you may withdraw at any time.
8Grandi Premium
Grandi is free for up to two children and one parent. The Grandi Premium subscription goes through Google Play Billing: Google handles the payment, and we never see your payment method.
- We receive a customer identifier and the state of the subscription (active, trial, cancelled, refunded), tracked for us by RevenueCat, so your access stays up to date.
- You manage and cancel the subscription from Google Play.
- No purchase is possible on the child's side: every payment screen sits behind the parental lock. A child never sees a price, and is never nudged to spend.
How these providers handle data: policies.google.com/privacy and revenuecat.com/privacy.
9What we don't do
- No advertising, no ad network, no advertising identifier.
- No third-party tracking or analytics SDK: no Firebase Analytics, no social network, no attribution tool. The app only calls our own infrastructure.
- No selling, renting or trading of personal data — and certainly not a child's.
- No advertising profiling, no automated decision with legal effects.
- No geolocation: the app never asks for your position.
- No face recognition, no biometric data sent to us (fingerprint or face unlock is checked by the phone, not by us).
- No access to contacts or the microphone.
10Logs and access record
- Household record: sensitive actions (viewing a photo, exporting, deleting) are recorded with their author, target and timestamp. This record exists for you — knowing who did what in your household — and to keep the record of processing required by Article 30 of the GDPR. It is deleted with the household.
- Server logs: every request leaves a technical line (method, path, status code, duration, IP address), needed for security and diagnostics. Request content is never logged — no password, no child's first name. Retention: 30 days maximum.
Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR). We run no analytics inside the app.
11Hosting and transfers
- OVH — France (European Union): hosting of the API, the database and the proof photos. This is where the whole household lives.
- Expo (notification delivery, United States): receives the device token and the notification text, including the child's first name (see § 7).
- Google (Play distribution and billing, United States / Ireland): subscription processing.
- RevenueCat (subscription state tracking, United States).
These three transfers outside the European Union are covered by the European Commission's standard contractual clauses. Apart from them, no data leaves the European Union.
Switching off the only transfer that touches the child. Your child's first name leaves the European Union only in the text of activity notifications. Turning those notifications off removes that transfer entirely.
12Retention periods
| Data | Retention |
|---|---|
| Parent account | As long as the account exists |
| Household, child profiles, routines, progress | Until deleted in the app |
| Proof photos | 72 hours, then automatic deletion |
| Session tokens | 1 hour (access) and 60 days (refresh), revoked on sign-out |
| Notification token | While notifications are on; erased with the account |
| Pending invitation | Until accepted or cancelled |
| Household record | Deleted with the household |
| Server logs | 30 days maximum |
13Export or delete everything
Everything happens inside the app, without writing to us and without delay, under Parent Space → Settings:
- Export: a readable archive holding the entire household — members, children, tasks, completions, rewards, goals, achievements, invitations, photos. Your right to portability, in one gesture.
- Delete the photos of the household, immediately.
- Delete a child: their profile and everything attached to it — tasks, completions, goals, achievements — disappear in cascade.
- Delete the account: if you are the household owner, the whole household is erased; if you are a co-parent, you leave the household and your account is closed.
Deletion is final: the data cannot be recovered afterwards. You may also write to contact@everoncraft.com — we handle the request within 30 days, usually within 72 hours.
14Your rights, and your child's
The GDPR gives you the right to access, rectify, erase, restrict, object and port your data, as well as to withdraw your consent at any time. The tools in § 13 cover these in self-service; for anything else, one address: contact@everoncraft.com. We reply within one month.
A child's rights are exercised through you. By creating a profile, you declare that you hold parental responsibility for that child. It is on that basis that you view, correct, export or delete their data — the child has neither an account nor an identifier.
Legal bases: the account, the household and the progress rest on performance of the service you request (Art. 6(1)(b)); activity notifications on your consent (Art. 6(1)(a)); security and logs on our legitimate interest (Art. 6(1)(f)).
If our answer doesn't satisfy you, you may lodge a complaint with the French supervisory authority, the CNIL: cnil.fr, or with the authority of your country of residence.
15Security
- All exchanges with our servers use HTTPS (TLS).
- Passwords are hashed (bcrypt), never stored in clear text.
- Session tokens are signed, short-lived, and kept in your phone's secure store.
- Every request is scoped: the server checks that the account really belongs to the household being addressed before answering.
- Photos are never served from a guessable address: a signed link, valid for one minute, is required.
- The database is not exposed to the internet: it can only be reached by the API, on the server's internal network.
No system is infallible — which is why we collect the bare minimum, and why photos, the only genuinely sensitive data, live for just 72 hours.
16Changes
This policy may change; the effective date at the top of the page changes with it. Significant changes will be flagged in the app or on the Google Play listing.