Privacy policy

2forkids helps separated parents organise their children’s lives between two homes. To do so, the app processes personal information about you, your children and your family members. This policy explains which information, why, who it is shared with and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR).

In short: no advertising, no data sale. The most sensitive content (messages, documents, photos, the children’s health sheet…) is end-to-end encrypted on your devices with a key that belongs to your family: we cannot read it. Data is hosted in the European Union.

1. Data controller

The data controller is HOME SPLIT HOME LLC, a Limited Liability Company with registered office at 1013 Centre Road, Ste 403S, Wilmington, DE 19805, New Castle County, USA, publisher of the 2forkids app (Android and iOS apps, web app and the 2forkids.com website).

For any question about your personal data, including to reach the person in charge of data protection: contact@2forkids.com.

2. The data we process

2.1 Your account

• Required: e-mail address, name (display name, first name, last name), password (kept only as a hash by our authentication provider, never in clear text), technical account identifiers.
• Optional: phone number, date of birth, gender, profile photo.
• If you choose to sign in with Google or Apple, we receive your e-mail address, name and an account identifier from that service.
• The version of the terms of use you accepted and when, your language and your preferences (notifications, theme, app options).

2.2 Your family and your children

• Family members: name, role (parent, child, relative…), access profile, e-mail address of invited people.
• Children: name and year of birth.
• Optionally, a child health sheet (blood group, allergies, illnesses, chronic problems, height, weight, hair and eye colour) and child identity numbers. The health sheet is end-to-end encrypted with the family key.

2.3 The content you share

Custody schedule and day swaps, events, messages, expenses and receipts, settlements between parents, documents, photos and albums, lists, comments and likes. What is end-to-end encrypted is detailed in section 3.

2.4 Location

The app only accesses your precise location in two cases, when you ask for it:

• when you check in at an event (optional feature): the coordinates are stored with the event and shared with the family members concerned (notification and e-mail);
• when you use your current position to fill in an address (handover place, event place).

There is no background location tracking.

2.5 Purchases

History of your token purchases (product, store, price, currency, transaction id) and movements of your token wallet (credits and debits). The payment itself is handled by Google Play, Apple (App Store) or, on the web, by RevenueCat and its payment provider Stripe: we never see your card details.

2.6 Technical, security and analytics data

• Devices: device identifier, model, operating system, notification token (Firebase Cloud Messaging).
• Sessions: IP address and the browser or app used (“user agent”), to secure your account (new-device detection, sign-in attempt limits).
• Security logs: security events associated with a hash of the IP address.
• Analytics: Firebase Analytics, with hashed user and family identifiers, to understand how features are used and improve them.
• Crash reports: Firebase Crashlytics (mobile apps), to fix errors.

On Android, the Firebase Analytics SDK declares the Google advertising ID permission. 2forkids does not use this identifier for advertising and shows no ads.

3. End-to-end encryption

Each family has an encryption key kept on its members’ devices. The content below is encrypted on your device (AES-256-GCM) before it is sent; our servers only store the encrypted version, which neither 2forkids nor its processors can read:

• message text and conversation titles;
• event titles, places and notes;
• custody schedule names and handover places;
• expense descriptions, notes and comments;
• vault documents and gallery photos (each file encrypted separately), with their titles and captions;
• list names and items;
• the children’s health sheet.

Not end-to-end encrypted (encrypted in transit and at rest by Google, but readable by our servers because the service needs them): names, e-mail addresses and profile fields, expense amounts and splits, dates, receipts attached to expenses, event attachments, profile and family photos, the location stored with a check-in.

If you lose access to all your devices without keeping your PIN or recovery document, encrypted content cannot be recovered, not even by us.

4. Why we use your data (purposes and legal bases)

We do not use your data for advertising, do not sell it and do not share it for advertising purposes. We send no marketing newsletter. The 2forkids team does not read your conversations: their content is end-to-end encrypted.

5. Artificial intelligence

AI features are optional. They rely on Google Gemini models (Vertex AI):

• Message courtesy analysis: only if you enable the paid AI analysis, the text of the message you are writing is sent to Google Gemini (European Union region) before it is sent, to suggest a rewording. Without this option, a local filter runs on your device.
• In-app assistant: when you use it, your request and the family context needed to answer it (members’ names and roles, pending invitations) are sent to Google Gemini.
• Custody schedule suggestion and information extraction: the text you type is sent to Google Gemini to suggest a schedule or pre-fill a form.

According to the Google Cloud terms that apply to these services, the data sent is not used by Google to train its models. AI answers are suggestions: check them before using them.

6. Who can access your data

6.1 Your family members

Information is shared within the family according to each member’s access profile (admin parent, household member, read-only relative…). Invitations are e-mailed to the addresses you enter. A shared export (for example a certified conversation export) is available through a link protected by an 8-digit PIN, to the people you send it to.

6.2 Our processors

We use the following providers, which process data on our behalf and on our instructions:

We may also disclose data when required by law (for example an order from a judicial authority), within the limits of what we can read: end-to-end encrypted content remains unreadable to us.

7. Hosting location and transfers outside the European Union

App data is hosted in the European Union (Google Cloud: Firestore eur3, Cloud Storage EU, Cloud Functions europe-west1). Some providers (Google, RevenueCat, Mailgun, Stripe, Apple) are based in the United States or may access data from there; HOME SPLIT HOME LLC itself is based in the United States. These transfers are covered by the safeguards provided by the GDPR (the “EU-US Data Privacy Framework” adequacy decision for certified companies, or the European Commission’s standard contractual clauses).

8. Retention periods

• Account and content: as long as your account is active. When the account is deleted, see section 9.
• Sessions and devices: as long as the session or device is active, and deleted with the account.
• Security logs (hashed IP address): 1 year.
• Purchase history: kept after the account is deleted, for the period required by accounting and tax obligations.
• One-time codes (sign-in, password reset): valid for 10 minutes, then deleted.
• Analytics and crash reports: according to the retention settings in Firebase.

9. Account deletion

You can delete your account at any time from the app (Profile → Delete my account, a recent sign-in is required) or by writing to us. Everything is explained on the Delete my account page. In short:

• Deleted: your sign-in account, your user record (replaced by a deletion marker), your sessions, devices and preferences, your profile photo; your member entries are anonymised (“Deleted user”, e-mail and photo removed) and your access is removed everywhere.
• Kept: the content you created inside the family (schedules, expenses, documents), attached to the anonymised member; the messages you sent (encrypted) with their integrity fingerprint, needed for the other parent’s records and exports; the purchase history; security logs (1 year).

10. Your rights

Under the conditions set by the GDPR, you have the following rights:

• access: get a copy of your data;
• rectification: most information can be changed directly in the app (profile, family);
• erasure: in particular by deleting your account (section 9), except for data we must or may legitimately keep;
• restriction and objection to processing based on our legitimate interest;
• portability of the data you provided;
• withdrawal of consent at any time (for example by deleting the health sheet or turning off AI analysis), without affecting past processing;
• set instructions about your data after your death (where local law provides for it).

To exercise these rights, write to contact@2forkids.com from your account’s e-mail address. We answer within one month, which may be extended by two months for complex requests. We may ask you to prove your identity.

If you believe your rights have not been respected, you can lodge a complaint with the supervisory authority of your country of residence, in France the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr). We encourage you to contact us first so we can find a solution.

11. Minors

The service is intended for adults (parents and relatives). A minor can only use it through an access created by their legal representative, who remains responsible for it. Information about children is entered by the parents, under their responsibility and in the children’s interest.

12. Security

Besides end-to-end encryption, we protect accounts with e-mail address verification, a code e-mailed when signing in from a new device (when enabled), sign-in attempt limits, app integrity checks (App Check) and strict data access rules: each record can only be read by authorised members. No measure is infallible: keep your password secret and let us know about any suspicious use of your account.

13. This website

The 2forkids.com website sets no cookie, uses no analytics tool and loads no third-party resource. Our host (Google Firebase Hosting) keeps technical logs (including the IP address) to run the service and keep it secure.

14. Changes

We may update this policy to reflect changes in the app or in the law. The date of the last update is shown at the top of the page; for significant changes, we will let you know in the app or by e-mail.

15. Contact

HOME SPLIT HOME LLC, 1013 Centre Road, Ste 403S, Wilmington, DE 19805, New Castle County, USA.
E-mail: contact@2forkids.com