Bilipito Privacy Policy

Bilipito is a family-safety service. It helps parents see where their child is, how the child’s day went and when the child needs help. This policy explains what data we collect and why, how long we keep it, who we share it with and what rights you have.

The personal data controller:

• AIRSTREAM SRL, Republic of Moldova
• IDNO (fiscal code): 1018600007654 · VAT code (cod TVA): 0508154
• Registered address: MD-2008, mun. Chișinău, str. Vasile Lupu 34/1, ap. 59
• Postal address (office): MD-2004, mun. Chișinău, str. Sfatul Țării 59, et. 2
• Personal data requests and data protection questions: [email protected]
• Anything else: [email protected]

In this policy, “we” means AIRSTREAM SRL. “You” means an adult user of Bilipito: a parent, a legal guardian or an adult they invited. How to use the service is set out in the Terms of Use, and how to pay in the Payment and Subscription Terms.

Bilipito works on Android, iPhone, iPad and in the browser. If a version for another platform appears, we will update this policy in advance and name the additional providers that take part in running it.

App identifiers: Bilipito: pasitos.airstream.md (Google Play), md.airstream.pasitos (App Store); Bilipito Kids: pasitoskids.airstream.md (Google Play), md.airstream.pasitoskids (App Store).

• We collect data so that the family knows where the child is and whether the child is all right.
• We do not sell personal data and do not use it for advertising.
• The child does not enter into a contract with us and does not create an account. We process the child’s data with the consent of a parent or other legal guardian. From a certain age, the child’s own consent is needed too (section 7).
• Bilipito Kids works openly: the child is shown what the family will see, and a notice that the app is running is always visible on the child’s phone.
• Sound and camera work live only; nothing is recorded (section 11).
• The detailed movement history is kept for 30 days and then deleted automatically.
• You can delete your account and data at any time (section 16).

We do not receive bank card details: Google Play or the App Store handles the payment entirely.

The family owner can invite other adults: a second parent, a grandmother, a grandfather, a nanny.

An invited adult does not pay for the subscription: they take one of the places in the owner’s subscription.

The child does not enter into a contract with us. Nor is the contract with the parent in itself a basis for processing the child’s data. We rely on these legal bases:

• for most data, the consent of the child’s legal guardian and, if the child has reached the age of digital consent in their country, also the child’s own consent (section 7);
• for the SOS signal, performance of the contract with the parent and the child’s vital interests;
• for the log of live sound and camera sessions, technical logs and crash reports, our legitimate interest: the child’s safety, protection against abuse, running the service;
• for consent records, a legal obligation to prove consent.

What we do not collect: contacts, text messages, call history, browser history, conversations in other apps, photos from the gallery (except a photo the user chose for an avatar or sent in the family chat), typed text and screen content. The Android accessibility service in Bilipito Kids is used for two things only: to see which app is open right now and apply the parent’s rules, and to close the picture-in-picture window of an app the parent has blocked. To do so, the service looks at which app is on the screen and at the title of such a window, to tell which app it belongs to. The title is checked only on the phone and is not sent anywhere. The service does not read typed text or screen content; only the name of a blocked app goes into the parent’s report.

If Bilipito Kids runs on an iPhone. The purposes and retention periods are the same as in the table above, but iOS collects some data differently:

• Permissions: location “Always”, “Motion & Fitness” (steps), notifications, microphone and camera (only for live sessions) and Screen Time. The purposes are the same as on Android.
• Screen time and limits work through Apple’s Screen Time API (Family Controls, ManagedSettings, DeviceActivity). The parent chooses apps and websites in Apple’s system picker. We receive and keep only Apple’s opaque tokens for the chosen apps and the parent’s rules; these tokens do not tell us the names of the apps. Detailed app usage reports on the iPhone are built by Apple itself on the device (DeviceActivityReport) and do not reach our server. Our server receives only the fact that a rule fired or a limit was reached, and which rule it was. The list of installed apps and “Open now” are not available on the iPhone.
• The accessibility service is not used on the iPhone.
• Crash reports are collected by the same Firebase Crashlytics, with the same data and retention period.

Anonymised footpaths. If the same line has been walked on different days and a member of our staff has confirmed that it is a real path, we add it to our map. Only the line stays on the map, with no child, family, device, date or time. Such a line cannot identify a person, so it is not personal data. These lines are kept indefinitely as part of the map.

6.1. Bilipito Kids and the rules for children’s apps

Bilipito Kids is meant for children and teenagers and is installed by an adult. It has no advertising, no advertising identifiers (AAID/IDFA), no behavioural analytics and no purchases. We do not collect serial numbers, IMEI, IMSI, MAC addresses or Wi-Fi network names and addresses from the child’s phone. To protect the free trial, an irreversible hash of the device identifier (not the advertising one) is sent when the phone is connected; it cannot be used to identify the child or the phone (section 6).

On Android, Bilipito Kids contains these third-party components, all made by Google:

• Firebase Cloud Messaging: delivers notifications; receives the push token, the Firebase installation ID and the notification text;
• Firebase Crashlytics: crash reports, from the first launch of the app; receives the technical trace of the error, the phone model, the system and app versions, free memory, the installation ID and app session information; kept for 90 days;
• ML Kit barcode scanner: reads the pairing QR code on the phone itself. This Google component sends Google anonymous metrics about how the feature is used and how it performs, together with an installation identifier; the camera image and the content of the code are not sent;
• Google Play services: determine location on the phone and check, through the Google Play app, whether a newer version of Bilipito Kids exists. We receive no data from the update check.

On an iPhone, notifications are delivered by Apple Push Notification service, the QR code is read by the iPhone’s own camera system, and location is determined by iOS Location Services.

The child’s data is not sold to third parties or shared for their own purposes, except the ML Kit technical metrics, which Google uses to run and improve that feature.

The legal guardian can at any time review the child’s data in the Bilipito app, get a copy, correct or delete it, and refuse further collection (unpair the child’s phone or delete the profile): see section 16 or write to [email protected]. Consent to collecting the child’s data to run Bilipito is not consent to sharing it with third parties for their own purposes; we do not share it that way.

We keep the child’s data only as long as Bilipito features need it, for the periods in section 15, and never keep a child’s personal data indefinitely.

7.1. Verifiable consent of the legal guardian

A child does not sign up for Bilipito on their own. The child’s phone is paired by an adult with a Bilipito account.

1. At the first sign-in the adult ticks two separate boxes. The service cannot be used without both:
   • accepts the Terms of Use and confirms having read this policy;
   • confirms being the child’s parent or other legal guardian and consents to the processing of the child’s data. An invited adult instead confirms that the child’s parent invited them.
2. When adding a child the adult states the child’s age group relative to the age of digital consent in their country (section 7.2). We do not ask for the date of birth.
3. Verification. We verify the adult by reasonable means proportionate to the risk: signing in to an account with a verified email, a Google Play or App Store subscription in the owner’s name, physical access to the child’s phone for pairing (a code or a QR code), and an open notice on the child’s phone.
4. Record. Each consent is saved as a separate record that cannot be changed. It holds the kind of consent, the version and fingerprint (hash) of the text shown, the server time, the platform, the app version, the language and the sign-in method. The IP address is not stored in it.
5. Withdrawal. Consent can be withdrawn at any time: unpair the child’s phone, delete the child’s profile or the account, or write to [email protected]. Processing before the withdrawal remains lawful. After withdrawal, we stop collecting data from the child’s phone.
6. If the confirmation turns out to be false. Sometimes a phone is paired by a person without the right to do so: for example, someone who is not the parent and is following another person’s child or an adult. If we learn of this or have reasonable doubts, we may stop collecting data from that phone and ask for confirmation of authority. If there is none, we will delete the data collected without proper authorisation and block the account (see the Terms of Use). You can report such a case to [email protected].

7.2. The child’s age and the child’s own consent

The age of digital consent differs from country to country. In the Republic of Moldova it is 14 (Law No. 195/2024). In EU and EEA countries the national ages from 13 to 16 apply, and in the United Kingdom and the United States, 13. If the country is unknown, we apply 16.

• A child under the threshold. The legal guardian decides. During pairing, the phone shows the child in plain words what the family will see, and the child taps “Continue”. This is a notice, not consent. We keep a record that it was shown.
• A child from the threshold to 17 (or if the age is not given). In addition to the legal guardian’s consent, the child’s own consent is needed. The same text is shown on the child’s phone, and the child taps “I understand and agree to continue”. Without it, the phone is not paired.

7.3. When the child grows up

• The child reaches the age of digital consent. If the child was added as “under the threshold”, then when the child reaches the threshold the legal guardian must write to us at [email protected] (we will change the age group) and pair the child’s phone again. During pairing the child will again see what the family can see and can give their own consent. If the child does not agree, the phone is not paired and data collection from it stops.
• Coming of age (18). Bilipito is not meant for monitoring adults. When the child turns 18, monitoring must stop: the legal guardian unpairs the phone and deletes the child’s profile. If the grown-up child asks, a copy of their data can be given to them before deletion. To arrange this, write to [email protected].

7.4. What the child sees

Before asking for permissions and before scanning the code, Bilipito Kids shows the child a “What the family will see” screen with a link to this policy. While the app is running, a notice is always visible on the child’s phone. During a live sound or camera session, a separate notice and the system microphone or camera indicator appear.

• The family owner is the adult who created the family and pays for the subscription. The owner invites and removes other adults, sets their permissions, and adds and removes children. The owner is responsible for making sure that the invited adults have a lawful basis to see the child’s data.
• An invited adult (a second parent, a grandmother, a nanny…) joins the family by invitation. For each child, the owner decides whether the invited adult may view the history, manage zones, and start sound and camera.
• A family can have up to 4 adults (including the owner) and up to 8 children.
• Revoking access. The owner can withdraw an invitation or remove an adult from the family at any time. Access ends immediately. An invited adult can also leave the family on their own. The family’s data stays with the owner.
• The child sees which adults are in the family and who they are (“mom”, “dad”, “grandma”).

An adult in the family can create a temporary link and show someone close where the child is right now.

• Who can open it: anyone who has the link, with no account. The link contains a random key that is practically impossible to guess.
• What is visible: the child’s display name, where the child is now on the map, the accuracy and time of the reading, and how long the link is valid. The history, battery, address and other data cannot be seen through the link.
• Validity: from 15 minutes to 72 hours, as the adult chooses. A link can be revoked instantly.
• Logs: we record when a link is created and revoked (the security log, 90 days). We do not record who opened the link or when. We need the IP address of the person opening it for a few minutes only, to protect against abuse. The record of the link itself is kept for 30 days after it expires or is revoked.
• The link page is closed to search engines.
• When an account is deleted, all links it created are revoked.
• Whoever created a link is responsible for who it was sent to.

Data of the link’s recipient: the IP address (for a few minutes) and map image requests to OpenFreeMap (section 14).

Cloudflare Web Analytics works without cookies and does not track you across other sites. The website has no forms and no advertising or behavioural cookies. Fonts (Google Fonts), the site’s libraries (jsDelivr) and map images (OpenFreeMap) are loaded from these providers’ servers, so they see your IP address.

Our visit counter runs on our own server, without cookies, without browser storage and without third-party services. It receives only known page addresses, never identifiers or tokens; the device type is worked out from the browser’s details (user agent). To count a visitor once a day, the server computes a hash with a secret “salt” from the network part of the IP address (/24 or /64), the browser’s details and the date. This hash is kept only in the server’s memory (Redis) for at most 48 hours and is then deleted; the IP address itself is not stored. Only daily totals (views and visitors) per page, language, source, country and device type are kept. They are not linked to accounts, children or location data.

Where data comes from in general: from you; from the child’s phone (Bilipito Kids); from Google Play or the App Store (the purchase); from Google (sign-in with Google: name and verified email); from Apple (sign-in with Apple: name and email or Apple’s private relay address).

An adult with the required permission can listen to what is happening around the child or look through the child’s phone camera. For example, when the child is not answering.

• Only an adult can start a session. It lasts no longer than 10 minutes; if needed, the adult can start a new one.
• While a session is running, a notice and the system microphone or camera indicator are visible on the child’s phone.
• Sound and image are streamed live, encrypted, between the phones (WebRTC). If a direct connection is not possible, our relay server forwards the stream. It cannot decrypt it.
• Nothing is recorded: not on our servers, not on the child’s phone, not on the parent’s phone. Bilipito has no recording feature.
• We keep only the fact of the session (who, for which child, when) for 90 days.

These features may be used only in line with the Terms of Use. For example, you may not listen to or film other adults and strangers, record a session by other means, or use the features where people expect particular privacy.

The family chat is available to families with an active subscription.

• The server works as a “postman”. A message is deleted from the server as soon as all recipients have received it, and no later than 48 hours after it was sent. Photos are handled the same way; an unsent photo is deleted after 1 hour.
• The conversation history is kept only on the phones of family members, encrypted. Also in the browser, if you opened the chat in the web dashboard; it is erased when you sign out of the dashboard.
• Messages are encrypted in transit (HTTPS), but there is no end-to-end encryption of messages. While a message is waiting on the server for delivery (no longer than 48 hours), the server could technically read it. We do not do so, except where the law requires it.
• The beginning of a message (up to 140 characters) is shown in the push notification. Notifications are delivered by Google Firebase Cloud Messaging, and on iPhone and iPad by the Apple Push Notification service.
• Metadata is removed from photos, including the GPS coordinates of where they were taken.
• Moving the chat history to the browser: the last 7 days, with end-to-end encryption; a transfer request is valid for 30 minutes.
• An “I’m here” message contains a single location point of the sender.

Bilipito automatically determines the type of movement (on foot, vehicle, still), builds routes and stops, marks arrivals at and departures from zones, suggests making a frequently visited place a zone, awards achievements and applies the app limits set by the parent.

These decisions are there for the family’s convenience and have no legal or similarly significant effects on the child or the adult. We do not build profiles for advertising and do not sell conclusions about behaviour.

We share data only with those who help us run the service, and only what they need.

Addresses and routes are calculated by our own servers (Nominatim, OSRM on OpenStreetMap data), so coordinates are not sent to third parties for this. Location on the child’s Android phone is determined by Google Play services. If the phone’s system setting “Google Location Accuracy” is on, Google receives information about Wi-Fi networks and cell towers under its own rules; this setting does not depend on Bilipito and can be turned off in the phone’s settings. On an iPhone, location is determined by iOS Location Services. We do not send text messages (SMS).

Other adults see a child’s data only if the family owner has invited them.

We may disclose data if the law requires it (for example, at the request of a court or an authorised body), or to protect someone’s life and health.

International transfers. Some recipients process data outside the Republic of Moldova. For such transfers we rely on adequacy decisions, and on these providers’ standard contractual clauses and standard data processing terms. You can ask for a copy of the safeguards applied at [email protected].

Data with a retention period is deleted automatically once a day.

You can delete your account in the Bilipito app on Android, iPhone or iPad (Settings → Account → “Delete account”) or in the web dashboard: sign in at my.bilipito.com, open “Account settings” → “Delete account” and confirm. For your protection, we will ask you to sign in again. Step-by-step instructions: bilipito.com/delete-account. You can also simply write to [email protected].

The account is deleted immediately. Together with it we delete: the families you own, the children’s profiles and photos, movement history, zones, screen time, achievements, rewards, notifications, SOS, chat messages on the server and consent records. The children’s phones are told to stop and to erase whatever they have not sent yet. Your sign-in account at Google Firebase is deleted. The links you created are revoked. The subscription account is told that the subscription has ended. Your name and language are deleted there, and the email remains only with the payment records and is deleted with them.

If you are a member of someone else’s family, you simply leave it. That family’s data stays with its owner.

For some time we still keep: the security log (90 days), payment records without the link to the family (section 15), and information we are required to keep by law.

If the family had already taken out a subscription (including a free trial), an irreversible fingerprint of the email address and the sign-in method remains (3 years): the address cannot be recovered from it, but it shows that the free trial has already been used.

Deleting the account does not cancel a Google Play subscription. We ask Google to stop renewal, but it is safer to cancel the subscription yourself: Google Play → profile icon → “Payments & subscriptions” → “Subscriptions” → Bilipito → “Cancel subscription” (play.google.com/store/account/subscriptions). We cannot stop an App Store subscription; you cancel it yourself: on your iPhone or iPad open Settings → your name → “Subscriptions” → Bilipito → “Cancel Subscription” (apps.apple.com/account/subscriptions).

You can also delete a single child; that child’s data is deleted in the same way. Or you can just unpair a child’s phone: collection stops, and the history is kept until it is deleted or its period runs out.

You have the right to:

• know which of your data we process and get a copy of it;
• correct inaccurate data (most of it directly in the app);
• delete data (section 16);
• restrict processing;
• object to processing based on our legitimate interest;
• receive data in a machine-readable format (portability);
• withdraw consent at any time (section 7.1);
• not be subject to decisions based solely on automated processing where they have significant effects (section 13);
• lodge a complaint with a supervisory authority or a court.

The rights of a child who has not reached the age of digital consent are exercised by the legal guardian. A child who has reached it can also contact us directly.

How to make a request. You can send a request from the account settings or to [email protected]. To protect your data, we confirm your identity first of all by signing in to the account or by a code sent to the verified email. We ask for more information only if there are reasonable doubts about the requester’s identity, and only as much as the check needs. A copy of an identity document is usually not needed.

We reply without undue delay, as a rule within one month. If a request is complex or there are many requests, this period can be extended by two further months. We will then tell you and explain why. If we refuse a request, we will explain why and remind you that you can turn to a supervisory authority or a court.

Supervisory authority: the National Center for Personal Data Protection of the Republic of Moldova (Centrul Național pentru Protecția Datelor cu Caracter Personal), MD-2004, mun. Chișinău, str. Serghei Lazo 48, datepersonale.md. Residents of the EU and EEA can also turn to the supervisory authority of their country.

Settings in the app: you can switch off notification groups (including “Bilipito news”) and revoke permissions in the phone’s settings. Some features will then stop working.

• The website bilipito.com: no cookies. Only the chosen language is kept in browser storage. Our visit counter (section 10) keeps nothing in the browser.
• The web dashboard my.bilipito.com: uses strictly necessary browser storage, for sign-in (session tokens, your email, the push token) and for the family chat history (IndexedDB). These data are erased when you sign out of the dashboard. The dashboard cannot work without this storage, so we do not ask for separate consent to it. Cloudflare Web Analytics and our visit counter work without cookies and without browser storage.
• The Android and iOS apps: sign-in tokens are kept in the phone’s secure storage (on iPhone and iPad, in the Keychain); the chat history and the email are kept on the phone in encrypted form. Technical details of requests (including coordinates) are not written to the phone’s system log. App data is not copied to cloud storage.
• There are no advertising or behavioural cookies, no advertising identifiers and no behavioural analytics. We do not use Firebase Analytics. On iPhone and iPad we do not track you within the meaning of App Tracking Transparency, do not ask for permission to track and do not use Apple’s advertising identifier (IDFA).

If we add new analytics systems or cookies, we will update this policy in advance and, where required, ask for your consent.

All traffic is encrypted (HTTPS/TLS), and live sound and camera sessions are encrypted between the phones. On every request the server checks that the child’s data is requested by a member of the child’s family with the required permissions. Profile photos are not public. Staff access to data is restricted. No system is perfectly secure, but we take reasonable technical and organisational measures. If a breach creates a high risk for you, we will tell you and the supervisory authority within the time limits set by law.

We may update this policy, for example when new features appear. The current version, with its number and date, is always available at bilipito.com/privacy. We will tell you about significant changes in advance in the app or by email. If a change requires new consent, we will ask for it separately.

• Personal data requests and data protection questions: [email protected]
• Anything else: [email protected]
• Controller: AIRSTREAM SRL, IDNO 1018600007654, registered address: MD-2008, mun. Chișinău, str. Vasile Lupu 34/1, ap. 59, Republic of Moldova; postal address: MD-2004, mun. Chișinău, str. Sfatul Țării 59, et. 2
• Supervisory authority: the National Center for Personal Data Protection of the Republic of Moldova, datepersonale.md