Privacy policy

Last updated: 26 October 2026

1. Who we are

ZapaKID is a product of Zapacit S.R.L., Str. Zambilei nr. 76, Ghimbav 507075, Brașov County, Romania, J2020002568087, VAT RO43395664 (“we”), the controller of the personal data described here under Regulation (EU) 2016/679 (GDPR). Privacy contact: privacy@zapakid.ro.

2. The zapakid.ro website

This site is a presentation page only. It has no accounts, forms, cookies or analytics and loads nothing from other sites. Cloudflare, which hosts the site, briefly logs the IP address, date and page requested, for security.

3. Accounts: parents only, Apple or Google only

A parent account is created only with Sign in with Apple or Sign in with Google. We have no passwords. Apple/Google give us a unique account identifier and your email address.

Age check: the app asks the phone (Apple Declared Age Range, Google Play Age Signals) only to confirm the parent is at least 18; we never receive a date of birth. If the phone reports a minor, no account is created.

Kids don't create their own accounts: a child's phone only works after a parent scans the QR code, accepts the Parental Agreement and sets up the child's profile (nickname, age range, avatar).

If you lose access, you recover your account with Apple/Google, an email code or an SMS code (sent through Twilio).

4. Your family's chats

Messages, photos and voice messages are end-to-end encrypted on the phone. The keys stay on your family's phones and in the phone's encrypted keychain (iCloud Keychain, Android). Our servers store only encrypted data and cannot read, listen to or recover it, even if an authority asks.

For notifications we use Apple (APNs) and Google (FCM). Notifications only say who wrote, never what.

5. Where data is stored and who receives it

All data is stored in the EU only. Processors, each under a data processing agreement: Cloudflare (hosting and storage), Google (sign-in, Android notifications, encrypted backups, status page), Apple (sign-in, age check, iOS notifications), Twilio (SMS and email codes). When Apple, Google or Twilio process data outside the EU for sign-in or notifications, the transfer relies on the EU–US Data Privacy Framework or standard contractual clauses.

We don't sell data, show ads or build profiles.

6. How long we keep data

Encrypted messages: as long as the chat exists on at least one phone. Chat metadata (who, when, size): until both sides delete the chat. Security logs: 90 days.

Deleting an account or a child happens immediately, in the app. A child can't delete their own account; a parent does. When the last parent deletes their account, every child in the family is deleted too. Encrypted backups rotate after 30 days. The record of parental consent is kept for the life of the account plus 5 years.

7. Legal basis and children

We process data to provide the service (contract, Art. 6(1)(b) GDPR), for security (legitimate interest, Art. 6(1)(f)) and to prove parental consent (legal obligation, Art. 6(1)(c) and Art. 7). Children's data is processed on the basis of their parent's or legal guardian's consent (Art. 8 GDPR).

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, for yourself and your children. Write to privacy@zapakid.ro; we reply within one month. You can complain to Romania's data protection authority, ANSPDCP (dataprotection.ro), or to the authority in your EU country.

9. Changes

When we change this policy we update the date above; important changes are also announced in the app.