Privacy

In short: the family's content is encrypted end to end and our server cannot read it. The server knows who is in the family, which devices are connected and when things happened, because without that it cannot connect the tablet to the phones or send a notification. No ads, no analytics, no selling of data.

This policy covers the Grandsapp app on the tablet, the Grandsapp for the family app (in the browser at app.mygrands.app) and this website. Last changed: 18 October 2026.

1. Who processes the data

The controller is Aning Film d.o.o., Opatovina 25, Zagreb (52144444572). For every question about data, write to support@mygrands.app.

2. The family's content: encrypted end to end

The server receives and keeps the following only encrypted, and only the family's phones and tablets hold the key to open it:

• photos and their captions, voice and video messages, voice notes from the tablet;
• reminder texts and times, the list's buttons and items, the board's layout and the place for the weather;
• the name of the person the tablet is for, how the tablet addresses them, and the tablet's language;
• the setting up of video calls. The call itself, picture and sound, travels encrypted directly between the phone and the tablet or through a relay server (section 6).

The family's key is made on the first phone and travels to the family's other devices locked with their keys. The server never has it, so it cannot read any of the above, not even a reminder about health or medicines. It sees only that an encrypted packet arrived, how large it is, what kind it is and when. If a family loses all its devices, the content cannot be recovered.

Every family made in the app is encrypted from its first moment, before it sends anything.

3. What the server can read

To connect the devices and send notifications, the server keeps and reads this:

• The family and its members: the family's name, each member's name and who manages the family.
• Devices: random device identifiers, their public keys and when they were last connected. Access tokens and invite links are kept only as a hash, with the link's role, creator and expiry.
• What happened when: the identifiers and times of what was sent, which reminder was confirmed, the time it was due, when and how, which message was played, the state of the list's items and who is bringing them. Never the content itself.
• Files: the size, type and hash of each encrypted file.
• The tablet's state: the battery's level, condition and temperature, charging, the app's version and what it supports, whether it has a voice for reading aloud, a microphone and a camera, whether it is locked to the board, whether it is set up as a dedicated tablet, whether it is exempt from battery optimisation, whether Do Not Disturb is on, and how far an update has got.
• A board the tablet refused: why: which tiles and what sizes, and the size of its screen. Never what the tiles say.
• Calls: who calls whom, when, how long the call lasts and why it ended.
• Notifications: the phone's notification subscription (the push service's address and the keys for encrypting) and which kinds of notifications the phone wants.

Notifications carry nothing of the family's content: they only say that something happened, for example that a reminder was not confirmed. They are encrypted for each phone separately, so the push service cannot read them.

4. Weather and place search

The place for the Outside tile is kept encrypted, inside the board. For the forecast, the tablet and the app ask our server for the weather at coordinates rounded to about one kilometre, and the server asks the Norwegian Meteorological Institute (MET Norway). When you look a place up by name in the app, the server passes the words you type to OpenStreetMap Nominatim; it remembers the answers for seven days by query, not by device. Both services get only coordinates or words, never your IP address or anything about the family.

If you tap "Use my location" in the app, the phone (with your permission) finds where it is, rounds that to about one kilometre and keeps it in the board, encrypted. The phone's exact position is never sent anywhere and never logged. The rounded position goes to our server at once as a forecast request, as any place on the board does, so it stays in the server logs until they expire (section 5).

5. Other data we process

Creating a family. The New family screen loads Cloudflare Turnstile, a check that the family is not being created by a script. Turnstile sees the phone's IP address and browser while it checks, and our server hands Cloudflare the check's token and the IP address for confirmation; we keep neither. We remember the answer to the request for ten minutes, so that a second tap does not make a second family, and the number of families made that day for two days, with no names or addresses.

IP addresses. We use a device's IP address only to limit the number of attempts to pair, join and create a family, with Cloudflare's one-minute counters. We do not store it with the family.

Server logs. Cloudflare records technical logs of requests for us: the time, the method and the address of each request (which holds the family's and the device's identifiers, and for a forecast or a place search the rounded coordinates or the words typed), its outcome and Cloudflare's request details, which may include the IP address and an approximate location. They serve troubleshooting and are kept for a few days, at most seven. They hold no family content.

6. Who helps us

• Cloudflare, Inc., our processor: the server, the database, file storage, logs, the Turnstile check, forwarding the support email and this website.
• Aning Film d.o.o.: the mailbox that receives email sent to support@mygrands.app.
• Cloudflare Realtime (TURN): when the phone and the tablet cannot talk directly, it relays the call's encrypted traffic. It sees both sides' IP addresses, when the call ran and how much data it carried, and a label for the family, never the picture or the sound. In every call the phone and the tablet learn each other's IP address.
• Push services of browsers and phones: Google (Android and Chrome), Apple (iPhone and Safari), Mozilla (Firefox) and Microsoft (Edge on Windows). They receive only encrypted notifications for the address the phone got from them.
• MET Norway (forecast) and OpenStreetMap Nominatim (place search), as section 4 says.

We do not sell data or give it to anyone for advertising.

7. Where the data is processed

Cloudflare processes data in its network of data centres around the world. The family's data is stored in Cloudflare's data centres, usually near where the family first connected, and may be outside the European Union. For transfers outside the European Economic Area, Cloudflare applies the European Commission's standard contractual clauses and is certified under the EU–U.S. Data Privacy Framework. The push services and the other providers named process data in their own countries, under their own rules.

8. How long

• The family's data: while the family exists, within these limits. Photos until the family removes them (at most 300; beyond that the oldest unmarked one goes). Voice and video messages and voice notes from the tablet: at most 30 days. Reminders until the family removes them, and of their confirmations the last 50 per reminder. Finished list items: 7 days. What waits for a device that is offline: 7 days. Marks of removed photos and reminders: 30 days. Invite links: 30 days after they were used or expired.
• Pairing: a pairing code until it expires. A new-tablet (QR) code is valid for 24 hours and kept ten more minutes after use, or seven days after it expires.
• An encrypted file that never reached the family, an interrupted upload for example: at most two days.
• The tablet's state: only each tablet's latest report.
• A device that leaves the family or is removed loses access at once, and its notification subscriptions are deleted. Its name, role and public key stay in the family's records while the family exists, because they stand next to what it sent.
• Server logs: a few days, at most seven.
• A deleted family: everything is deleted from our storage, usually within a minute. Server logs keep the family's identifier until they expire.
• A family that never got going, with no tablet ever paired and a single member, deletes itself 30 days after it was made if nobody opened it in those 30 days. If someone did, it is looked at again 30 days later.

9. Deleting

A family can delete everything itself, in the family app: Delete the family deletes the whole family, Leave the family takes your phone out of it, and Remove the tablet and Remove from the family remove a tablet or another phone. You can also ask for deletion by email. All the steps, and what is deleted, are on the Deleting your data page.

10. On the tablet and the phone

The tablet and the phone keep the family's content and keys on the device itself; the tablet also protects the keys with Android's keystore where the device has one. A removed tablet deletes everything it had of the family, and a phone that leaves the family deletes its keys and stored content. The tablet reads reminders aloud only with a voice that works on the tablet itself, without the internet, so the text does not leave the tablet; without such a voice a reminder only chimes.

11. What we do not collect

We ask for no email address and no phone number, read no contacts, track no precise location, and use no advertising identifiers, analytics or tracking cookies.

12. This website

The site has no tracking cookies, analytics or forms and runs no scripts. Cloudflare serves it.

13. Purposes and legal bases

• Providing the service the family asked for (connecting devices, relaying and keeping content, notifications, calls): performance of a contract, Article 6(1)(b) of the General Data Protection Regulation.
• Security and protection against abuse (limits on attempts, Turnstile, server logs): legitimate interest, Article 6(1)(f).

14. The limits of the protection

Encryption protects the content, but not everything. Honestly, this stays open:

• The data in section 3 is not hidden: the server sees who is in the family, who talks to whom and when, and how large files are.
• A dishonest server cannot read or forge content, but it can hold back, delay or repeat what was sent, change the marks it keeps itself (whether a reminder was confirmed, whether a message was played, who is bringing an item), show one of the family's photos under another's caption, or leave a device on the old key after someone leaves.
• A new family member receives the keys, so a dishonest server could add a member, but everyone would see them in the Family members list. The device code at pairing confirms that the key went to the right tablet.
• There is no recovery: a family that loses all its devices loses its content.
• Deleting a family takes only the phone of the one person who manages it and the family's name typed, so keep that phone locked.

15. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection. The family does most of it in the app: it changes names, removes devices, deletes the family. We cannot read the family's content, so we cannot hand it out either; it is available in the app. For anything else write to support@mygrands.app; we answer within one month. You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) or with the supervisory authority of the country you live in.

16. Children

Families are created and managed by adults; the family app is not meant for children. Anyone may use the tablet. About the person with the tablet the server knows only what section 3 says about the tablet and about what happened when.

17. Changes

We publish changes to this policy on this page, with the date of the last change at the top.