Privacy Policy

Who's responsible for your data

Our approach

• We collect the minimum data needed for the service to work.
• We never sell data, never show ads, and never profile children.
• Video and audio calls are transmitted in real time and are never recorded or stored by us.
• A child's name in nuschl is a name chosen by the parent, never required or verified as a legal name.
• The child never has their own account, email, or password. Every setting on the child's device is controlled by the parent.

If you've just signed up for updates

The waitlist form on our homepage collects only your email address and your opt-in preferences (product updates, testing interest). That's used solely to reach out about those things, on the basis of your consent (Art. 6(1)(a) GDPR), and kept until you ask us to remove it or the waitlist itself is retired.

Once you use the nuschl app

From the parent (Admin account holder)

• Email address and authentication credentials.
• Account settings and preferences, including an optional device-unlock PIN (stored as a one-way hash, never as plain digits).
• Consent records: which policy you accepted, which version, when, and the device used.

About the child

• A name or nickname chosen by the parent (a pseudonym by design).
• An optional avatar. If a photo is uploaded, it's converted into an illustrated sketch and the original photo is deleted immediately after conversion; we never keep both.
• Minimal call metadata (who was called, when, how long), kept for 30 days, used solely to power an optional automatic "cooldown" feature the parent can configure, never shown to anyone as a call history and never used for any other purpose.

From invited contacts (grandparents, family, friends linked to a child)

• Email address and authentication credentials.
• An optional display name and avatar, subject to the same sketch-and-delete rule above.
• Consent records.

Video messages

Short recorded video messages, if someone chooses to leave one instead of a live call. Deleted automatically after 30 days.

Technical data

• Push notification device tokens, to deliver incoming call alerts and message notifications.
• Rate-limiting records, to prevent abuse of avatar generation and video messaging.
• Crash reports (device model, OS version, and technical details of what went wrong), via Firebase Crashlytics. This is never linked to your call content or your child's data.

What we do not collect

No advertising identifiers. No behavioural tracking. No location data. No contact-list scraping. No third-party analytics SDKs anywhere in the child's own experience. Call content is never stored, and we never build a browsable call history for any account.

Why we process it

Before any child data is processed, the parent accepts this policy, our Terms of Service, and gives specific consent to processing the child's data, as part of account setup. Consent is recorded with its version. If we materially change this policy, we'll ask you to consent again before you can continue using the service.

Who we share it with

We use a small number of service providers who process data on our instructions:

• Google Firebase: our backend, database, authentication, file storage, and server-side logic. Our database is hosted in an EU multi-region specifically for GDPR data residency.
• Stream Video Cloud: routes call audio and video in real time between devices. Call content passes through their infrastructure in transit only; it's never stored or recorded, by them or by us.
• Google Gemini: converts an uploaded photo into an illustrated sketch. The photo is sent for this single purpose and is not retained by us afterwards.
• Apple (APNs/PushKit) and Google (FCM): deliver call alerts to your device.

We don't share data with anyone else, except where legally required. Some providers process data outside your country; where that happens, we rely on appropriate safeguards including Standard Contractual Clauses.

How long we keep it

Your rights

At any time, from Account Settings, you can:

• Download your data: a complete export of everything associated with your account.
• Delete a child's profile: permanently removes that child's profile, contacts, call metadata, video messages, and avatars.
• Delete your account: permanently removes everything, including stored files, with no recovery.

You also have the right to correct inaccurate data, object to processing, restrict processing, and complain to your local data protection authority. In Bavaria, that's the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), or the authority local to you.

For any of this, or a question we haven't covered, email info@nuschl.family.

Children

nuschl is designed for use by children, but children do not hold accounts, cannot sign up, cannot add contacts, and cannot change any settings. Everything is controlled by the parent. There is no open internet access on the child's device, no messaging with strangers, and no discovery of other users. A contact can only ever be linked to one specific child, by invitation from that child's parent, and the parent can remove that link at any time.

Security

Access to data is restricted so each account can only ever reach its own records, enforced by our database's own security rules and verified on every server-side operation. Privileged credentials exist only on our servers, never in the app itself. Diagnostic crash reports are kept separate from your account and call data.

Changes

We'll notify you of material changes and ask you to re-accept before you continue using nuschl.