Privacy Policy

What CallKin is

CallKin is a wristband with a unique tag that links to a page showing a wearer's emergency contact information. The wristband itself stores nothing except a web address: no names, phone numbers, or medical details are ever written to the physical band.

What we collect

We collect only what the product needs to function:

• Guardian account: your name, phone number, and email address, collected when you sign up.
• Child profiles: a first name and a decorative avatar color you choose. We do not collect last names, photos, or medical information.
• Emergency contacts: the names and phone numbers of the people you add as contacts for a child, the order you chose, whether each one is shown, and an end date if you set one. These numbers are the whole point of the band: they are shown to anyone who scans it, without logging in. Only add someone you have cleared it with.
• Lost-mode status: whether a child's lost mode is currently on, when it was turned on, and, while it is on, the time the band was most recently scanned. This applies on every plan, not just CallKin Pluss.
• Scan history: for guardians who subscribe to CallKin Pluss, a paid feature, the time a child's band is scanned while lost mode is on. We record the time and nothing else: no location, no IP address, and nothing about the person who scanned the band.
• Band tokens: the unique identifier printed on each physical band and which child (if any) it's linked to.
• CallKin Pluss subscription: if you subscribe, a reference to your customer record at Stripe (our payment provider), whether your subscription is active, and whether a payment has failed. We never see or store your card details. When you subscribe, we also store the time and language of your request for Pluss to start right away, as a record for the right of withdrawal.

Why we collect it

Your name and phone number are shown to anyone who scans a band linked to your child. That's the entire point of the product: letting a stranger who finds a lost child (or another person in your care) reach a guardian immediately. Your email is used only for authentication and account-related messages (confirmation, password reset, security notices), never for marketing. Your child's first name is shown on the tap page too, so whoever finds them can address them by name. You can turn that off per child in your dashboard, and the page then shows the contacts without the name.

Legal basis: your own details as a guardian are processed because they are necessary to provide the service you signed up for (contract necessity). The child's first name and the emergency contacts you add are processed under legitimate interest: the child's safety, and making sure an adult can be reached if the child goes missing. Neither the child nor the contacts are themselves party to the agreement with us, so contract necessity cannot be the basis for them. If a band is in lost mode, the processing may additionally rest on vital interests. We also rely on legitimate interest to run a bot-detection check (Cloudflare Turnstile) on our sign-in, sign-up, and password-reset forms, to prevent automated abuse of the service. The same legitimate interest covers the technical error reports we record when something goes wrong, which we need in order to keep the service working correctly. If you subscribe to CallKin Pluss, payment data is processed because it's necessary for that subscription (contract necessity), and payment records are kept because Norwegian bookkeeping law requires it (legal obligation).

Who else sees it

We use a small number of infrastructure providers to run CallKin, and don't sell or share your data beyond them:

• Supabase: hosts our database and handles authentication.
• Google: lets you sign in with your Google account instead of a password, if you choose to. If you use it, Google verifies your identity and shares your name, email address, and profile picture with us; we never see or store your Google password. Google's privacy policy
• Resend: delivers the emails the product needs to send: confirming your address, password resets, email-change notices, second-guardian invitations, lost mode scan alerts, the notice when scan alerts for a band are paused, the alert when lost mode has been on for 24 hours, contact expiry reminders, and CallKin Pluss confirmations and receipts. Several of these contain your child's first name, in the subject line as well as the body, because a scan alert is useless without it. Resend stores its account data, message metadata and logs in the United States regardless of the sending region.
• 46elks: sends the Lost Mode text message alerts. It receives your phone number and the child's first name, only at the moment a band in Lost Mode is scanned. We pass it to them because it is necessary to alert you that the band has been scanned. 46elks is based in Sweden, inside the EEA, and acts as an independent data controller for the delivery itself and for the traffic data it must retain under Swedish electronic communications law, rather than as our processor. What it does with the details beyond delivering the message is its own decision: 46elks' privacy policy
• Vercel: hosts the application. Vercel processes technical connection data, such as your IP address, to serve the pages and protect against abuse. We run no traffic analytics. When a band's page is opened, we also write a short technical line to Vercel's logs so we can find and fix problems with the page: the language the phone asked for, which language we showed, how we chose that language (for example from your saved language setting or the phone's own settings), the type of phone (iPhone, Android or other), whether the visit looked like an automated program (a bot) rather than a person, and what the page displayed, such as how many contacts were shown. It contains no IP address, name or phone number, is kept only for as long as Vercel keeps its logs, and rests on the same legitimate interest as our error reports.
• Shopify: handles the purchase of the physical band itself. As the seller we see your order in Shopify: name, shipping and billing address, email and what you ordered. We need that to pack and ship it, and to meet Norwegian bookkeeping law. We never see your card details; those are handled by Shopify's payment system. When we pack an order we note which band went to which order, so we can help you if something is wrong. That Shopify order number stays on the band's record even if you delete your CallKin account, as part of our order and bookkeeping records, which Norwegian bookkeeping law requires us to keep for 5 years. Shopify never sees your CallKin account data.
• Stripe: handles payment for CallKin Pluss, if you subscribe. Stripe receives your email address and payment details, sends your receipts, and processes your card. We never see your card details. Stripe also acts as an independent controller for fraud prevention and its own legal obligations. Stripe's privacy policy
• Cloudflare: runs a bot-detection check (Cloudflare Turnstile) on our sign-in, sign-up, and forgot-password forms, confirming you're a real visitor rather than an automated script. It processes your IP address, browser type, and similar technical signals for that purpose only, and doesn't build an advertising profile of you. It also stores an encrypted backup copy of our database (Cloudflare R2), used only to recover from a system failure. The backup is encrypted before it ever reaches Cloudflare's servers, so Cloudflare cannot read its contents, and backups are deleted after 30 days. Details: Cloudflare's privacy policy
• Sentry: records technical error reports when something goes wrong on our servers, so we can find and fix it. Reports contain the error and the code path that caused it, never your IP address, cookies, or the contents of your requests, and band and invite links are stripped out before anything is sent. Error data is stored in Sentry's EU region, in Germany. Sentry's privacy policy
• GitHub: hosts our source code and runs our scheduled backup and maintenance jobs. The data included in a backup is processed at GitHub while the job runs, and is used for nothing else. Those jobs run on servers outside the EEA.
• Namecheap: runs the mailbox for support@callkin.co and is our domain registrar. Anything you email us, including access and deletion requests, sits in that mailbox.

If you share a child's profile with a second guardian, the two of you can see each other. Each of you sees the other's email address in the guardian list, and a linked guardian's name and phone number appear as a contact on the child's tap page, which is the point of linking. Removing a guardian removes both. When you invite someone, we store the email address you sent the invitation to. An invitation expires after 7 days, and one that was never accepted is deleted 30 days after that. When an invitation is accepted, we remove the address from it.

Your IP address is processed in transit. Vercel receives it with every request, to serve the pages and to rate-limit abuse; Cloudflare receives it for the bot check; and we deliberately forward the real visitor address to our authentication provider so that sign-in throttling counts you rather than our server. The only place it is stored is your sign-in session: Supabase Auth, our authentication provider, keeps the IP address and the browser details your browser sends (the user agent) for each signed-in session in our database. They are removed when the session ends or expires, or when you delete your account. Your IP address is not stored anywhere else in our database.

Outside of the infrastructure providers listed above, we don't use any third-party analytics, ad-tech, or advertising trackers on this site, and we never sell or share your data with advertisers.

Most of the providers above are US-based, and transfers to them rest on the EU Standard Contractual Clauses (SCCs), which are incorporated into our data processing agreements with them. That covers Vercel, Resend, GitHub, and Namecheap. Supabase is a case of its own: our database and authentication run on servers in Frankfurt, Germany, but our contracting party is Supabase Pte. Ltd. in Singapore, which has no EU adequacy decision, so that transfer also rests on the SCCs. Our backup at Cloudflare R2 sits in a bucket restricted to EU jurisdiction, so it does not leave the EEA. For Cloudflare (Turnstile), Stripe, and Sentry, the agreements name the EU-U.S. Data Privacy Framework as the primary basis, with those same Standard Contractual Clauses as the fallback if a certification lapses; Sentry's error data is stored in its EU region in Germany, and our contracting party for Stripe is its Irish company. Our storefront agreement is with Shopify International Ltd. in Ireland, and Shopify's own processing in Canada relies on its corporate group's Binding Corporate Rules together with the EU's adequacy decision for Canada. Google is not a processor for us: if you sign in with Google, the contracting party is Google Ireland Limited, and Google is an independent controller for its own part.

Children and privacy

A CallKin account is created and controlled by an adult guardian. The guardian is the one who enters into the agreement with us and decides what is shown about the child. We have no direct customer relationship with the child, and we never contact a child.

We collect as little about the child as possible: a first name, an avatar colour, whether lost mode is on, when the band was last scanned while it was on, and how many scan alerts went out in the current 24-hour period. We never ask for age, date of birth, surname, address, photo, or health information, and the wristband itself stores none of it.

The only things published are the first name and the contacts the guardian has chosen to show. The first name can be turned off per child in the dashboard. Our basis for processing the child's information is legitimate interest in the child's safety, not consent from the child.

A child has the same rights of access, correction, and deletion as anyone else. While the child is young, those are exercised in practice by the guardian. If you are young and want to know what is stored about you, or want it deleted, you can contact us at support@callkin.co.

If your number is on a CallKin band

Then a guardian has added you as an emergency contact for a child. We received your name and phone number from them, not from you. The details are shown on that child's contact page to whoever scans the band, and are used for nothing else: no marketing, no profiling, no sharing. The legal basis is legitimate interest in the child's safety. You can ask for access, correction or deletion, or object to the processing, at any time by contacting us at support@callkin.co. The guardian can also remove you themselves, at any time.

How long we keep it

We keep your data for as long as your account is active. If you sign up but never confirm your email address, that incomplete signup is automatically deleted after 7 days. If you delete your account, your guardian profile and any children only you guard are removed immediately from our live systems, apart from the few records described below and the order number described under Shopify above. An encrypted backup copy of our database may persist for up to 30 days afterward, as part of our routine backup rotation, before being permanently deleted; it's used only to recover from a system failure, never to look up or restore an individual account. See "Your rights" below.

Lost mode scan history is kept for 30 days and then deleted automatically. It is also deleted immediately when the child it belongs to is deleted.

For guardians who subscribe to CallKin Pluss, a contact can be given an end date so it automatically stops showing on the tap page from that moment on. An expired contact is then permanently deleted 30 days later.

If you subscribe to CallKin Pluss, deleting your account also cancels your subscription and removes our own record of it at the same time. The 5-year bookkeeping duty is met by Stripe and by our accounting system, not by this app. Records of the statutory subscription notices we have sent you are kept for 4 years, and are used for nothing else. If a Pluss subscription ends and a child has more guardians than the free plan allows, the extra guardians' links to that child are paused rather than deleted, so they can be restored later. A paused link is kept for 6 months and then deleted.

We also keep a few technical records purely to stop abuse of the service, and delete them automatically. To limit how many sign-up, password-reset and similar account emails can be sent, we keep a simplified form of the email address they went to for up to 1 day, even if the account is deleted in the meantime. Lost mode text message alerts are part of CallKin Pluss: the phone number each one was sent to is kept in a send log for 32 days, even after the account or child is deleted, so we can enforce our spending limits on text messages. For each child we also count the scan alerts sent in the current 24-hour period, so we can cap how many go out; that count is kept for as long as the child's profile exists.

Cookies

We never use cookies or similar technology for advertising, analytics or tracking. We only store or access information on your device where it is strictly necessary to deliver the service you asked for. That use is exempt from the consent requirement under section 3-15 second paragraph of the Norwegian Electronic Communications Act, but we list it here for transparency:

• Sign-in session: keeps you signed in to your dashboard. Set by Supabase, our authentication provider, under a name beginning with “sb-”, and it lasts as long as you stay signed in.
• Language preference: remembers whether you last viewed the site in English or Norwegian. It is called NEXT_LOCALE and lasts 400 days. Usually it is set when you use the language switcher, but it is also set automatically if you arrive from callkin.no, which hands your language choice across to this site.
• Password reset: a short-lived marker called ck_recovery_flow, set only while you are resetting a forgotten password, so that a reset link cannot be turned into an ordinary login. It is deleted as soon as the password is changed.
• Error recovery: if a page fails to load correctly, we set a single flag in your browser's session storage so the page reloads once instead of looping. It disappears when you close the tab.

Cloudflare Turnstile (used only on the sign-in, sign-up and forgot-password forms) sets no cookie on this site at all. It does keep a value in your browser's local storage on Cloudflare's own challenge domain, with no expiry date. That is strictly necessary to protect the sign-in system from abuse, which regulators expect to be long-lived, so it is exempt on the same basis as the entries above.

Your rights

From your dashboard, you can at any time:

• Edit your profile and your children's information.
• Export a full copy of everything we store about you and your children in your account.
• Delete your account, which permanently removes your data (see the delete-account page for exactly what this affects).

If you're in the EU/EEA, these correspond to your GDPR rights of access, portability, and erasure, as well as the right to restrict or object to how we process your data. Contact us (below) for any request our dashboard doesn't cover directly. You also have the right to lodge a complaint with your national data protection authority; in Norway, that is Datatilsynet (datatilsynet.no).

Contact

CallKin is operated by Martin Gigstad, a sole proprietor (enkeltpersonforetak) registered in Norway. Organization number: 938 201 935, registered in the Register of Business Enterprises (Enhetsregisteret), not registered for VAT. John Strandruds vei 1, 1366 Lysaker, Norway. Phone: +47 469 15 921.

Questions about this policy or your data: support@callkin.co

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page and, for active accounts, note it in the dashboard.