What we collect, why we keep it, and how long it stays

Who we are

The service described here is operated by GuestSpy, which is the data controller for the website at guestspy.com, for the parent panel, and for the data the child app sends to our servers. Questions about anything on this page go to [email protected]. If you would rather talk to support first, [email protected] reaches the same small team.

GuestSpy is parental monitoring for Android that stays visible on the child's phone and is run from a website. It is built for a parent or guardian supervising their own child, with the child's knowledge. That purpose shapes every decision below: we collect what a parent has switched on, we keep it for a short, fixed period, and we never use it for anything other than showing it back to the parent who asked for it.

Three sources of data, kept apart

It helps to be clear about which data comes from where, because the rules differ.

Data from this website

When you read a page here, our web server records the usual request details: your IP address, the page requested, the time, the browser and operating system string, and the referring page if your browser sends one. These server logs exist to keep the site running and to spot abuse, and they are rotated after 30 days. If you use the contact form we receive your name, email address, the topic you chose and your message, and we hold that correspondence for as long as it takes to answer you and for 12 months afterwards in case you write back. The site also sets a small number of cookies and uses browser storage for your advertising-consent choice; the cookie policy lists every one of them.

Data from the parent panel

When a parent creates an account we hold the account data described further down: an email address, a password hash, the names you give your children, and the devices you pair. Everything a parent does in the panel that changes a rule or triggers a remote action is written to an activity log with the name of the parent who did it, so that two parents sharing one account can see who set what.

Data from the child app

The child app sends to our servers only the categories that a parent has switched on in the panel, and for the sensitive categories only after the person holding the phone has accepted a consent step on that phone. A freshly paired phone sends nothing beyond a heartbeat that says it is online, its battery level and the app version. The full list of categories, and the retention period for each, is in the table that follows.

Every category the child app can collect

This table is the heart of the policy. Nothing appears in the panel that is not on this list, and every row is off until a parent turns it on. Rows marked as needing consent require the direct-download build and a consent step accepted on the child's phone. The panel can send the request; only the phone can accept it.

Three retention periods cover the whole table. Location history is kept for 30 days because a parent asking "where was she last Tuesday" rarely needs to look further back than that. Logs of all kinds, which means usage, headers, filter events, Wi-Fi and email headers, are kept for 90 days so that a weekly report can be compared with the previous two months. Media, which means recordings, flagged photos, camera photos and audio clips, is kept for 14 days and then deleted from our storage. These periods are fixed in the system; a parent cannot extend them, and neither can we on request.

Unpairing a device stops collection at once. The phone deletes its local queue and the server stops accepting data from that device identifier. What was already uploaded ages out on the schedule above unless the parent deletes it sooner, which they can do from the Devices page.

The parent's account data

To run a panel account we hold the parent's email address, a salted hash of the password (never the password itself), the display name of each parent on the account, the names and birth years given for each child, the devices paired to each child, and the rules set for each device. If two-factor authentication is on, we hold the shared key used to generate codes and a set of one-time recovery codes. The sessions list shows each browser signed in, with an approximate location derived from the IP address and the time of last activity; that list is there so a parent can sign out a browser they no longer recognise.

Because the service runs on access days earned through small tasks rather than payment, we never hold card numbers or billing addresses. We do record which parent tasks have been completed, such as a feedback survey or a bug report, along with whatever you typed into them. A bug report with a screenshot is kept until the bug is fixed and for six months afterwards; a survey answer is kept in aggregate form indefinitely and in identifiable form for 12 months.

The weekly email report contains a summary of the child's week. It is sent to the email addresses on the account and we keep a copy under Reports in the panel for 12 months. If you would rather not receive the email, the Reports page has a switch; the panel copy is still generated.

What the child can see and do

The child app opens to a Transparency screen that lists every category above and shows whether it is currently on. The child can open it at any time; no PIN or parent sign-in is needed to view it. When a parent asks for a photo, requests an audio clip, locks the phone, rings it or changes a rule, the phone shows a notice naming the parent who did it. Nothing happens on the phone that the person holding it cannot see.

A child can withdraw consent for any of the consent-based categories from the same screen. Doing so stops that category immediately and the panel shows the parent that consent was withdrawn, with the time. We think this matters: supervision that cannot be questioned is not supervision, it is surveillance, and we do not build for that.

A child who wants to know what has been collected about them, or wants it deleted, can ask us directly at [email protected]. We will need to confirm which device they are talking about, which we can usually do through the pairing code history, and we will tell the parent on the account that the request was made. Where local law gives a child the right to have their data deleted regardless of the parent's wishes, we follow the law.

Cookies, advertising and the consent banner

The guide pages on this site may carry adverts served by Google AdSense. Where ads are on, Google and its partners may set cookies and read device identifiers to decide which advert to show and to count whether it was seen. In regions where consent is required before personalised advertising, you will see a consent banner the first time you visit; choosing "non-personalised" or declining means any adverts shown are selected by page content alone, not by anything known about you. Your choice is stored in your browser under the key guestspy_consent and is not sent to us.

You can change your choice at any time from the link in the footer. You can also opt out of personalised advertising across Google's services at https://www.google.com/settings/ads, and from many other advertising networks at https://www.aboutads.info/choices/. The cookie policy explains each cookie by name.

Two things are worth saying plainly. First, no advertising runs inside the parent panel or the child app; it is confined to the public guide pages. Second, nothing collected by the app, from location to message headers, is ever used to target advertising to anyone. The ad network sees a visitor reading a guide about bedtime routines; it never sees a child's data.

Analytics

We measure which guide pages are read and for how long using page-level counts derived from our own server logs. We do not run a third-party analytics script on this site at the time of writing. If that changes, this page and the cookie policy will be updated before the script goes live, and the script will be covered by the same consent banner as advertising. Inside the panel we record which features are used so that we can decide what to build next; those counts are tied to the account, not shared outside, and deleted with the account.

Who we share data with

Your data is never sold, rented or swapped. It is never given to advertisers, data brokers or "partners" in exchange for anything. The only parties who process it on our behalf are the suppliers we need to run the service:

• Hosting and storage providers, who run the servers and the storage buckets that hold uploaded media. They act under a written contract that limits them to storing and serving the data for us.
• Email delivery providers, who send sign-in codes, alerts, weekly reports and replies from support. They see the recipient address and the content of the email.
• Google, in respect of advertising on the public guide pages only, as described above, and in respect of the Google Play listing for the Play build.

We will disclose data to a court, regulator or law-enforcement body where we are legally required to do so, and we will tell the account holder unless the law forbids it. If the service were ever transferred to another organisation, the data would go with it under the same policy, and you would be told before the transfer took effect.

International transfers

Our servers may be located in a country other than the one you live in. Where data moves from a country with a data-protection regime that restricts transfers, such as the United Kingdom or the European Economic Area, we rely on the standard contractual clauses approved for that purpose, or on an adequacy decision where one exists. A copy of the clauses we use is available on request from the privacy address.

Security

Data travels between the phone, the panel and our servers over TLS. Media files are stored encrypted at rest and are served through short-lived signed links, so a URL copied out of the panel stops working within minutes. Passwords are hashed with a slow, salted algorithm. Access to production systems by our own staff is limited to the people who operate them, is logged, and requires hardware keys.

Two features in the panel are there for your side of the arrangement. Two-factor authentication adds a code from an authenticator app at sign-in, and we recommend every parent turns it on under Security. The sessions list shows every browser currently signed in and lets you sign any of them out; if you see a session you do not recognise, sign it out, change your password and write to us. We will tell you without undue delay if we discover a breach affecting your data, and we will tell the relevant regulator where the law requires it.

Your rights

Depending on where you live you may have a legal right to some or all of the following. We offer them to every account holder regardless of location, because they are the right way to treat people.

• Access: ask what data we hold about you or your child, and receive a copy.
• Export: download the data on your account in a machine-readable form. The Account page in the panel has an Export button that produces a ZIP file within a few hours.
• Correction: fix anything that is wrong, such as a misspelt name or an incorrect birth year.
• Deletion: delete a single device's data, a child, or the whole account. Deleting the account removes every record within 30 days, apart from a minimal log of the deletion itself and anything we must keep by law.
• Withdraw consent: switch off any category at any time from the panel, or, for the child, from the Transparency screen on the phone.
• Object or restrict: ask us to stop processing data in a particular way while a disagreement is resolved.
• Complain: raise the matter with your national data-protection authority if you think we have handled it badly.

To exercise any of these, write to [email protected] from the email address on the account, or from another address with enough detail for us to confirm who you are. We answer within one month, and sooner for anything straightforward.

Children

The parent, not the child, operates the service. Panel accounts are opened by adults, and we do not knowingly create an account for anyone under 18. The child app does not ask the child for a name, an email address or any account; it is paired to the parent's account with a six-digit code, and the only identity it carries is the device identifier and the name the parent chose. A child under 13 never has an account of their own with us, and we do not collect information from children for our own purposes. Everything the app collects is collected on behalf of the parent, shown to the parent, and deleted on the parent's schedule or on the timers above, whichever comes first.

If you believe a child's data has reached us without a parent or guardian behind it, for example because the app was installed on a phone that is not a minor's, write to the privacy address and we will investigate and delete it.

Changes to this policy

We will change this page when the service changes. Small changes, such as a new email provider, will be noted at the top with a new date. Material changes, such as a new category of data or a longer retention period, will be announced in the panel and by email to every account at least 14 days before they take effect, so that a parent who disagrees can export and delete before the change applies. Earlier versions are available on request.

Contact

Privacy questions, rights requests and complaints: [email protected]. Everything else: [email protected], or the contact page. Letters can be sent to GuestSpy.