Privacy Policy
1. General provisions
This privacy policy applies to the Strong Kids mobile app (Android and iOS) and its administration platform (hereinafter — “the Service”). The Service is intended for school-age children (6 to 18 years old) and their parents. By using the Service, you agree to this policy.
2. Data we collect
2.1 Parent / guardian data
- Email address (for registration)
- Password (stored encrypted, bcrypt hash)
- Selected language
- Parent zone PIN code (stored encrypted, bcrypt hash)
- Device notification token (Android; created on login so notifications can be delivered)
2.2 Child data
- Child's name (entered by the parent)
- Class group (grades 1–4, 5–8, 9–12)
- Avatar (selected from pre-prepared options)
- School and class assignment (if the school participates in the project)
2.3 Exercise data
- Exercise results (points, repetitions, duration)
- Motion analysis data (anonymous error codes, e.g. “heel rising”) — NOT body contours or extreme points
- Session history (date, time, results)
- Automatic diagnosis results (if generated from exercise errors)
2.4 Camera data — IMPORTANT
- The camera is used ONLY to recognize body posture in real time during exercises
- Video recordings are NEVER stored and NEVER transmitted to any server
- Motion recognition happens only on the phone (on-device):
- iOS: Apple Vision framework
- Android: Google ML Kit Pose Detection
- Only anonymized results (numbers, error codes) are sent to the server — not images
- A child's video, biometric and motion data are not used to train, improve or test artificial intelligence models, and are not transferred to third parties
3. How we use data
- To display exercise results (charts, tables)
- To generate diagnostic recommendations
- To create school reports (project participants only)
- To automatically assign corrective exercise blocks
- To deliver and improve the Service
- To detect and fix errors (via Sentry)
4. Data storage
- Data is stored on the Supabase platform, on servers within the European Union (EU region); stored data is encrypted with AES-256 level encryption
- Google (Firebase Cloud Messaging) and Sentry may process technical data outside the European Economic Area — such transfers are made under the European Commission’s Standard Contractual Clauses (SCC)
- We use Row Level Security (RLS) — each user sees only their own data
- App-side data is stored in encrypted internal phone storage
- Data is retained while the user has an active account; after account deletion or at the end of the service term, personal data is destroyed or irreversibly anonymized within 30 days
5. Data transfer to third parties
Strong Kids does not sell and does not share your personal data with third parties, except in the following cases:
| Service | Purpose | Data |
|---|---|---|
| Supabase | DB and authentication | Email, encrypted password, child data |
| Sentry (Android) | Error and crash monitoring | Technical error records: user identifier (UUID), role, child profile identifier and age group, device model and manufacturer, OS version, language, network type, app version, device build fingerprint and other automatically collected technical context (NO name, email or image data) |
| Firebase Cloud Messaging (Google) | Delivering notifications to the device | Device notification token, notification text (NO child data) |
| Apple App Store / Google Play | App distribution | According to Apple / Google privacy policies |
We do not use advertising networks, marketing analytics or profiling. From the Firebase suite we use ONLY Cloud Messaging (for notifications) — Firebase Analytics is not enabled. Sentry collects only technical error and performance data: error reports are always sent, while performance measurements are sampled from approximately 20% of sessions. This data is used solely to fix defects.
6. Children's privacy (COPPA / GDPR-K)
- The Service is intended for children, so we comply with COPPA (US) and GDPR Kids (EU) requirements
- A child's account is created only by a parent/guardian through their own account
- A child's direct identifiers (name) are visible only to parents and to school administrators/teachers if participating in the project
- In class and school leaderboards, child data is shown anonymously or aggregated
- We do not use children's data for advertising
- We do not collect children's direct contact details (email, phone)
7. Your rights (GDPR)
You have the right to:
- Obtain a copy of your data
- Correct incorrect data
- Delete your account and all data
- Restrict data processing
- Transfer data to another service provider
To exercise these rights, contact: info@strongkids.lt
8. Account deletion
You can request deletion of your account and associated data at any time.
In the app (fastest): Parent zone → Settings → “Delete account”. The account is deactivated immediately (login is blocked and notifications stop), and all data is permanently deleted within 30 days.
Or by email:
- Send an email to info@strongkids.lt
- Subject: “Account deletion”
- Include the email address used to register the account
What will be deleted:
- Parent account data (email, password, language preference, PIN)
- Children’s profiles (name, class group, avatar)
- All exercise session results (points, reps, error codes)
- School assignments and class participation records
- Device notification tokens (deleted immediately)
What is retained:
- Aggregated, anonymized usage data (no personal identifiers)
- Crash reports (Sentry) — pseudonymized (no name or email), retained for no longer than 90 days under Sentry’s retention policy, then automatically removed
Time to fulfill:
Requests are completed within 30 calendar days of receipt. Complex cases (GDPR Art. 12(3)) — up to 90 days with prior notice.
9. Security
- All data transmissions are carried out only over a secure TLS protocol (HTTPS)
- Data stored on the server is encrypted with AES-256 level encryption
- Passwords and PIN codes are stored as bcrypt hashes (never plaintext)
- Different user access levels are managed by role (RBAC) together with Row Level Security — every request is checked server-side
- Regular security audits
10. Cookies
The mobile app does not use cookies. The administration platform uses only essential cookies for authentication.
11. Changes to this privacy policy
We will notify you of changes through the app or by email. Continued use of the Service after changes constitutes acceptance of the new policy.
12. Contacts
Questions or complaints regarding privacy:
- Email: info@strongkids.lt
- Address: Chemijos g. 27C-62, LT-51331 Kaunas, Lithuania
- Website: https://strongkids.lt/
Supervisory authority in Lithuania: State Data Protection Inspectorate (VDAI), https://vdai.lrv.lt/