Privacy policy
Egendi helps families plan a child's day. To do that we process data about parents and children, including some health data, so we want to explain clearly what we collect, why, and what rights you have.
1. Who processes your data
Data controller: MB Elibera, company code 304262864, registered office V. Nagevičiaus g. 3, LT-08237 Vilnius, Lithuania.
For privacy questions, email info@egendi.com.
2. What this policy covers
This policy covers the egendi.com website, the parent account dashboard and the Egendi mobile app (together, “Egendi”).
3. What data we collect
Parent account
- name, email address, password (stored only in encrypted form), language;
- family account members;
- your chosen plan and subscription status.
Child profile and schedule
- first name or nickname, year of birth;
- schedule activities, reminders, activity start and finish times;
- the child's choices in the app (for example, smartwatch settings).
Health and activity data (only if you turn it on)
With your permission, Egendi reads sleep, activity and heart rate data from the health platform on your child's phone (Apple Health or Google Health Connect), where a smartwatch or fitness band records it. This is special category (health) data. We use it only to show schedule insights and never for advertising.
Payments
Subscriptions are handled by RevenueCat, Apple App Store, Google Play and Stripe. We see your subscription status and payment history, but not your card details.
Website visits
- pages visited, clicks, time spent on parts of a page, scroll depth;
- device, browser and approximate location (country or city based on IP address);
- which ad or website you came from (UTM tags, ad click IDs such as gclid or fbclid);
- session recordings, only if you accept analytics cookies. Text you type into fields is hidden in them.
Technical data
Server logs, error reports and security events needed to keep Egendi running reliably.
4. Why we process data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating your account and providing the service | parent account, child profile, schedule | performance of a contract (Art. 6(1)(b)) |
| Sleep and activity insights | health and activity data | explicit consent of the parent (Art. 9(2)(a)), which can be withdrawn at any time |
| Subscriptions and accounting | plan and payment data | contract and legal obligation (Art. 6(1)(b) and (c)) |
| Website analytics, ad performance, session recordings | visit data, cookies | consent (Art. 6(1)(a)) |
| Security, fixing errors, improving the service with aggregated data | technical data | legitimate interest (Art. 6(1)(f)) |
| Service messages (for example, a plan change) | performance of a contract | |
| Newsletters | consent, which you can withdraw in every email |
Insights in the app are generated automatically and are wellbeing-level suggestions, not medical conclusions. They have no legal or similarly significant effects on you.
5. Children's data
- Egendi is designed for children aged 7–15, but the account is created and managed by parents or guardians. A child joins the family account by invitation from a parent.
- In Lithuania, a child under 14 cannot give consent to information society services on their own, so a parent gives consent on their behalf. Consent for health data is always given by a parent.
- We do not sell children's data, use it for advertising or build advertising profiles. There are no ads in the child's app.
- A child's data is visible only to members of the family account, according to the permissions set by the parents.
6. Who receives data
We do not sell data. It may be processed only by service providers acting on our instructions under data processing agreements:
- hosting and database: Google Firebase / Google Cloud (EU region) and Supabase;
- analytics: Google Analytics 4 (Google Ireland Ltd.) and PostHog (EU data centre);
- subscriptions and payments: RevenueCat, Apple, Google, Stripe;
- email: Brevo.
We share data with public authorities only when required by law.
7. Transfers outside the EU
Some service providers (for example, Google or RevenueCat) may process data in the United States. In those cases we rely on the EU–US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
8. How long we keep data
| Data | Retention period |
|---|---|
| Parent account, child profile, schedule | while the account is active; deleted within 30 days after the account is deleted |
| Health and activity data | 30 days; deleted when consent is withdrawn |
| Payment and accounting records | 10 years, as required by accounting law |
| Google Analytics 4 data | 14 months |
| PostHog data and session recordings | 12 months |
| Server logs | 90 days |
9. Cookies and analytics
Necessary cookies are always on. Analytics cookies are set only after you click “Accept”. Until then, Google Analytics runs without cookies and PostHog collects only anonymous page events without cookies. You can change your choice at any time with “Cookie settings” at the bottom of the page.
| Name | Purpose | Type | Expires |
|---|---|---|---|
| eg_consent | remembers your cookie choice | necessary | until you clear it |
| eg_lang | remembers your chosen language | necessary | 12 months |
| eg_attr | remembers which ad or website you came from until you sign up | analytics | 90 days |
| _ga, _ga_* | Google Analytics visitor measurement | analytics | up to 2 years |
| ph_*_posthog | PostHog analytics, heatmaps and session recordings | analytics | up to 1 year |
10. Your rights
You have the right to:
- access your and your child's data and get a copy;
- ask us to correct inaccurate data;
- ask us to delete data (“right to be forgotten”);
- ask us to restrict processing, or object to processing based on legitimate interest;
- receive your data in a machine-readable format and move it to another provider;
- withdraw consent at any time (for example, for health data or cookies). This does not affect processing before the withdrawal.
Send requests to info@egendi.com. We will reply within 30 days. You can also delete your account and all its data in your account settings.
If you believe your rights have been infringed, you can lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt) or with the data protection authority in your country of residence.
11. Security
Data is transferred only over encrypted connections (HTTPS). Access to data is limited to people who need it for their work.
12. Changes and contact
We may update this policy. We will tell you about significant changes by email or in the app before they take effect. The current version is always published on this page.
Questions: info@egendi.com · MB Elibera