Pasitos is a family-safety app operated by Airstream SRL, Republic of Moldova (“we”, “us”). It has two parts: Pasitos for parents (the Android app and the web dashboard at my.pasitos.me) and Pasitos Kids, installed on the child’s Android phone. Together they let a family see where the child is, how their day went and when they need help. This policy explains what we collect, why, how long we keep it, who helps us run the service, and the rights you have.
1. What we collect
| Category | What it includes |
|---|---|
| Parent account | Your email address (or phone number), display name, language, the family role you choose (for example mom, grandpa or nanny, with an optional short label), and a record that you accepted the Terms and this policy. Passwords are handled by Google Firebase Authentication: we never see or store them. If you sign in with Google, we receive your verified email address and name. |
| Parent’s phone | The push token used to deliver notifications, the version of the Pasitos app and when it last started. We use them to deliver alerts and to know which phones need an update. |
| Child profile | A display name, an avatar (a photo, an emoji or initials), a colour, an optional birth year and a daily step goal. The previous name and avatar are kept so a parent can undo a change the child made. A profile photo is stored in private storage on our servers and is shown only to the family’s parents and the child’s phone. We do not need the child’s real or full name. |
| Location | The precise location of the child’s phone, also while the app is in the background: coordinates, accuracy, speed, altitude, direction, time and the kind of movement (on foot, by bike, in a vehicle, still). From it we build stops, trips, the day’s route and arrivals at and departures from the places the family has set up. |
| Phone status | Battery level and charging, network type and Wi-Fi network name, internet connection, location on or off, power saving, ringer mode, the state of the app’s permissions, the phone model, Android version and app version, and the ambient sound level as a single number (the microphone is read for a moment, and no audio is kept or sent). |
| Activity | Step counts and whether the child is walking or riding. |
| Screen time and apps | The list of apps installed on the child’s phone (names and icons), how long each app was used per day, and events of the limits a parent sets (a limit reached, a blocked app opened, quiet time started). To apply these limits, Pasitos Kids uses an Android accessibility service that sees only which app is in front. It never reads text, screen content or typing. |
| Achievements and rewards | The child’s points (XP), level, streaks, badges and quests, counted on the child’s phone; badges for places visited; and the rewards a parent sets (a title, a prize and the progress towards it). |
| Waves | A wave, heart or hug sent between the child and a parent: who sent it and when. Waves carry no text. |
| Safety events and notifications | SOS signals with the child’s location, the parents’ answers, and the family’s notification feed. |
| Live sessions | A record that a parent started listening or looking through the camera: who, for which child and when. No sound or image is kept (see section 2). |
| Subscription | For the family owner’s Google Play subscription: its plan, state, number of places, renewal and expiry dates, the Google Play order number and purchase token, the amount and currency, and whether a payment was refunded. Card and bank details are handled by Google and never reach us. |
| Crash reports | If an app crashes: the phone model, Android and app version and the technical trace of the error (Firebase Crashlytics). They contain no location. |
| Security records | Records of important account actions, such as sign-in, pairing a phone and deleting an account. Your IP address is used only for a few minutes to limit abuse and is not stored with your account; our web servers keep no access logs. |
2. Live sound and camera: never recorded
A parent can listen to the sound around the child’s phone or look through its camera, for example when the child is not answering. This happens only when a parent starts it, lasts at most 10 minutes, and the child sees a notice on the screen for as long as it lasts.
Nothing is recorded or stored. The sound and picture are streamed live, encrypted, directly between the two phones (WebRTC). When a direct connection is not possible, our relay server (turn.pasitos.me) forwards the encrypted stream without being able to decode it. No audio or video is saved on our servers, on the child’s phone or on the parent’s phone, and Pasitos offers no way to record it.
We keep only the record that a session took place (see section 1).
3. How we use the data
- Show the child’s current location, the day’s route and past days to the family’s parents.
- Notice arrivals at and departures from the family’s places and send notifications.
- Deliver SOS alerts and let parents answer them.
- Show whether the child’s phone is online, charged and reporting.
- Show screen time and apply the app limits and quiet hours a parent sets.
- Run live sound and camera sessions that a parent starts.
- Count steps, achievements and rewards, and pass waves between the child and parents.
- Turn coordinates into addresses and routes on our own servers.
- Sell and manage the subscription.
- Send occasional service news about Pasitos, such as a new version. You can turn these off in the app’s notification settings (“Pasitos news”); alerts about your child are not affected.
- Keep the service working and secure, fix errors and prevent abuse.
We process this data to provide the service the account holder asked for (contract) and, where the law requires it, on the basis of the parent’s or guardian’s consent given for the child. Service news and crash reports rely on our legitimate interest in keeping the service working and informing you about it.
4. Children and parental consent
Pasitos is made for families. A child does not create an account: a parent or legal guardian pairs the child’s phone with the family. The person who pairs it confirms that they are the child’s parent or legal guardian (or are otherwise allowed to do so) and gives consent for the child where the law requires it. They should explain to the child, in a way suitable for their age, what the family can see.
Pasitos Kids shows the child what it shares before it starts and keeps a notice on the screen while it runs; a separate notice appears during live sound or camera sessions. Pasitos is not meant for adults. Using it to follow another adult without their knowledge is not allowed.
A parent can see, correct and delete the child’s data at any time (sections 7 and 8).
5. Service providers
We share data only with providers that help us run Pasitos, and only what each of them needs:
- Hosting: the database, the application and the profile photos run on servers operated by Airstream SRL in the Republic of Moldova. We are moving them to servers rented from Hetzner Online GmbH in Germany (Falkenstein), with encrypted backups in Finland (Helsinki).
- Cloudflare: carries the traffic between the apps, the websites and our servers and protects them from attacks. It sees IP addresses and encrypted traffic; it does not keep the content. The relay for live sessions does not go through Cloudflare.
- Google Firebase: Authentication (sign-in, passwords, Google sign-in), Cloud Messaging (delivering notifications to both apps) and Crashlytics (crash reports).
- Google Play: Google Play Billing sells and bills the subscription as the payment processor and tells us its state; Google Play also delivers app updates. On the child’s phone, the location is worked out by Google Play services on the phone itself.
- Airstream account service (account.pasitos.me, operated by Airstream SRL): shows the family owner the subscription. It receives the owner’s email address, name and language and the subscription’s plan, state, dates, number of places and receipts, and nothing about the children.
- Email: sign-in codes and password-reset emails are sent through our own mail server (mail.airstream.md, operated by Airstream SRL).
- MET Norway (the Norwegian Meteorological Institute): the weather. Our server asks MET Norway for the weather of an area rounded to about 10 km where a child is, to show it in the parent app and to award weather badges; the parent app asks only our server. MET Norway receives only that rounded area, never a precise location, a name or an account.
- OpenFreeMap: the map images, made from OpenStreetMap data. The parent app and the web dashboard load the part of the map you are looking at; OpenFreeMap sees that area and your IP address, not whose location is on it.
- Addresses and routes are worked out on our own servers from OpenStreetMap data (Nominatim and OSRM), so no third party receives the coordinates for that.
Other parents see a child’s data only when the family owner invites them into the family. We may disclose information if the law requires it or to protect someone’s safety. We do not sell personal data or share it for advertising.
6. How long we keep data
| Data | Kept for |
|---|---|
| Location points (each position the child’s phone sends) | 90 days |
| Stops, trips, day routes and the day’s timeline built from them | As long as the child’s profile exists, so the family can look back at past days; erased when the child or the account is deleted |
| Step counts | 60 days |
| Waves | 30 days |
| Links a parent shares to a child’s location | 30 days after they expire or are revoked |
| Technical diagnostics from the child’s phone | 14 days |
| Notification feed, SOS history, screen time and apps, achievements and rewards, records of live sessions | Until the child or the account is deleted |
| Live sound and camera | Never stored |
| Positions waiting to be sent on the child’s phone | At most 7 days on the phone |
| Push tokens and app versions | Until you sign out on that phone, the token stops working, or the account is deleted |
| Database backups | 14 days, then overwritten |
| Subscription and payment records | After the account is deleted, kept without the link to the family, as accounting and tax law requires |
| Security records | Kept after the account is deleted, for security and legal purposes |
7. Deleting your data
You can delete your account at any time in the parent app (Account → Delete account), in the web dashboard at my.pasitos.me, or by writing to us. Deletion happens at once; there is no waiting period.
Deleting the account erases your account and the families you own, with every child’s profile and photo, location history, stops, trips and routes, screen-time data, achievements, rewards, waves, notifications and SOS history. The paired children’s phones are told to stop and clear what they have not yet sent, your sign-in account at Google Firebase is deleted, and the Airstream account service is told the subscription has ended. If you are a member of a family that someone else owns, you leave it and that family’s data stays with its owner.
What remains: the security record that the account was deleted, and subscription and payment records without the link to your family (section 6). Deleted data disappears from backups within 14 days. Deleting the account does not cancel a Google Play subscription: cancel it in Google Play.
You can also delete a single child, which erases that child’s data in the same way, or unlink a child’s phone, which stops it sending anything while keeping the history until you delete it.
8. Your rights
- Access and correction: see and edit the family’s and the child’s details in the app, or ask us for a copy of your data.
- Deletion: as described in section 7.
- Restriction and objection: ask us to limit how we use your data, or object to a use based on our legitimate interest.
- Portability: ask for your data in a machine-readable format.
- Consent: withdraw consent at any time by unlinking the child’s phone or deleting the child or the account; this does not affect what happened before.
- Choices in the app: switch notification groups off, including “Pasitos news”; revoke permissions in the phone’s settings (some features then stop working).
We answer requests within 30 days. You may also complain to a data protection authority: in Moldova, the National Center for Personal Data Protection (datepersonale.md); in the EU, the authority of your country.
9. Security
All traffic is encrypted (HTTPS/TLS), and live sessions are encrypted end to end between the two phones. Sign-in tokens are kept in the phone’s secure storage. Only the family’s parents and the child’s own phone can reach a child’s data, and the server checks this on every request; profile photos are never public. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
10. International transfers and changes
Our servers are in the Republic of Moldova (and, after the move described in section 5, in Germany and Finland). Some of the providers above, such as Google and Cloudflare, may process data in other countries; where they do, we rely on the safeguards they offer, such as standard contractual clauses. We may update this policy; the current version is always here with its date, and we will tell you in the app about important changes.
11. Contact
Questions and requests about your data: [email protected]. Data controller: Airstream SRL, Republic of Moldova.