Privacy Policy
This policy explains how Watching handles information. It covers the Android app listed on Google Play as Watching, including the parent experience and the child device experience in the same app. The project name inside the software is MeritScreen. The operator is Anajyo (anajyo.com) (“we”, “us”).
If you do not agree with this policy, do not create a parent account and do not pair a child’s device.
1. Who this policy is for
Watching is directed to parents and legal guardians. The child experience is for children aged 3–12 and is used only after a parent consents and pairs the device. A child cannot create an account.
You must be at least 18, or the age of majority where you live, to create a parent account.
2. The short version
- We collect a parent email and, after pairing, a child’s nickname, age band, screen-time minutes, quiz results, and the list of apps on the child device so the parent can approve them.
- We do not collect precise location, contacts, SMS, call logs, the photo library, or microphone recordings.
- We do not show ads and we do not sell personal information.
- Quiz generation may send a skill summary to Google’s Gemini models. It does not include the child’s name or email.
- A parent can delete the family in the app, or request deletion by email. See Delete account.
3. Information we collect
Parent account
- Email address, used to sign in with a one-time code, or a Google account if you choose Google sign-in.
- Optional display name.
- Firebase user id, created by the sign-in service.
- A parent PIN, stored only as a PBKDF2 hash with a random salt. We never store the PIN itself.
- Notification preferences, if you set them.
- A push token, if you allow notifications, so we can deliver alerts.
Child profile (not an account)
- Nickname.
- Age band (3–6, 7–9, or 10–12). Birth year is optional and we do not ask for a full date of birth.
- Language, a preset avatar, and a curriculum region the parent picks (for example India or the United States). That region is a setting, not GPS.
- Device id, platform, model, OS version, battery level, and whether Watching is still the Home app. These tell the parent whether the device is connected and whether setup is intact.
Screen time and learning
- Which approved app was in the foreground, and for how long. Totals are kept per app per day. This is not a keystroke log and not a screenshot stream.
- Quiz questions, the child’s answer, score, pass or fail, time taken, and a skill level per topic.
- Parent rules: allowed apps, time blocks, cooldown, daily ceiling, quiz settings, and rewards.
Apps installed on the child device
The child device sends the parent the launchable apps’ package names, labels, and a small icon thumbnail. The parent uses that list to allow or block apps. We do not sell this list.
Camera
The camera is used only to scan a pairing QR code. We do not save a photo or upload the camera image.
Diagnostics
If the app crashes, Firebase Crashlytics receives the crash and a short diagnostic log. Logs are passed through a sanitizer that is designed to strip emails, tokens, and pairing codes. Crashlytics also stores a device-role tag such as parent or child. We do not attach the PIN.
Firebase Analytics receives a short list of event names only, with no parameters. Examples: app open, quiz completed, parent signed in. On a child device, events that are not on the child allowlist are dropped before they are sent.
4. Information we do not collect
- Precise or approximate GPS, or location history.
- Contacts, SMS, call logs, or calendar.
- Photos, videos, or the microphone for recording.
- A child’s email address, school name, or government id.
- Advertising ids for ads. The child experience has no ad SDK.
- The contents of other apps, browsing history inside other apps, or keystrokes.
5. How we use information
- To create the parent account and pair child devices.
- To apply the parent’s time limits, quiz rules, and fail lock, including when the child device is offline. The last saved rules stay on the device.
- To show the parent reports and device status.
- To generate extra quiz questions and, when a parent has written custom learning notes, to suggest an educational video.
- To send a one-time sign-in code to the parent’s email.
- To send push messages such as “policy updated” or “device revoked”.
- To detect abuse of sign-in and pairing (rate limits and Play Integrity via Firebase App Check).
- To fix crashes.
We do not use children’s information for advertising, and we do not allow third parties to use it for their own marketing.
6. AI features
Extra quizzes are generated with Google Gemini through Firebase AI Logic. The request includes the age band, language, a skill snapshot (levels and weak topics), and question ids to avoid. It does not include the child’s name, email, or raw usage history. If AI is unavailable, the app uses a quiz bank stored on the device.
If a parent writes custom learning guidance, a video suggestion may also be sent to Gemini. That request can include the child’s nickname, age band, the parent’s curriculum region, and the parent’s notes. If you do not want the nickname sent to the model, leave custom learning guidance blank. The app then uses the on-device video list.
AI output can be wrong. It is a learning aid, not a teacher, a school, or professional advice.
7. YouTube lessons
Some lessons play a curated educational video with the YouTube IFrame Player inside the app. When a video plays, Google and YouTube receive information from that player under Google’s Privacy Policy and YouTube’s Terms. We do not control YouTube’s player. Watching itself does not add an advertising SDK. If the video cannot play, the child continues with an on-device quiz.
8. Who processes information
These providers process data so Watching can function. We do not sell personal information.
| Provider | Role |
|---|---|
| Google Firebase Authentication | Parent sign-in |
| Google Cloud Firestore | Family, child profile, rules, usage, quizzes |
| Google Cloud Functions | Sign-in codes, pairing, family deletion |
| Google Firebase Cloud Messaging | Push for policy sync and alerts |
| Google Firebase Crashlytics | Crash reports |
| Google Analytics for Firebase | Allowlisted event names |
| Google Firebase App Check (Play Integrity) | Reduce abuse of cloud APIs |
| Google Firebase AI Logic (Gemini, including Vertex AI in us-central1) | Quiz packs and optional video suggestions |
| Resend | Delivers the parent’s one-time email code. Resend receives the parent email and the message, not child profiles. |
| YouTube / Google | Only when a lesson video plays |
Google may process this information in the United States and other countries where it operates. See Firebase privacy information and Resend’s privacy policy.
9. Android permissions
Watching asks only for what the controls need:
- Internet and network state — sync rules and reports.
- Notifications — parent alerts and time reminders.
- Camera — scan a pairing QR code. Optional hardware.
- Usage access — see which app is in the foreground so time limits work.
- Display over other apps — show the quiz or time-limit screen.
- Foreground service and run at startup — keep time limits running, and restore them after reboot.
- Home app — on a child device, Watching can replace the stock launcher.
We do not request location, contacts, SMS, or microphone permission.
10. Security
- Traffic to Firebase uses HTTPS.
- Pairing secrets are stored in the Android Keystore. The parent PIN is stored as a slow hash, not as the PIN.
- Android backup of the app is turned off so a PIN hash and pairing secret are not copied off the device by backup.
- Cloud access is limited by Firebase Security Rules. A parent can read their own family. A child device token is limited to that child.
- After several wrong PIN attempts, the PIN entry locks for a short time.
- A parent can revoke a device. The device is told to unpair.
No phone is impossible to tamper with. A child who can change system settings or uninstall apps may be able to weaken controls. Watching is designed to fail closed to the lock screen when saved rules cannot be trusted, and to tell the parent when the Home app is no longer Watching. We do not use an Accessibility Service to trap the child, and the consumer app does not use Device Admin to silently block uninstall.
11. How long we keep information
We keep family information while the parent account exists. Parent reports look back at most 90 days. We do not promise a separate automatic purge of older rows beyond that report window.
One-time email codes are kept only as a hash, for minutes, and are rate-limited.
When you delete the family, we delete the cloud family records and the child sign-in users we created for devices, and we tell paired devices to wipe local learning and policy data. Crash reports already sent to Google, and mail-delivery logs at Resend, may remain for those companies’ own limited periods. A child device that is offline keeps its local data until it is online again or the app is removed.
12. Your choices and rights
- You can review and change rules, child nicknames, and notification settings in the app.
- You can turn off AI quizzes in the parent’s quiz settings.
- You can unpair a device or delete the whole family.
- You can refuse optional notifications and camera access. Time limits and pairing may not work fully without the permissions they need.
- You can ask for access, correction, or deletion by emailing privacy@anajyo.com from the parent email on the account. We may need to confirm you control that email. We aim to respond within 30 days.
If you are in India, you can use that address to exercise rights under the Digital Personal Data Protection Act, 2023. If you are in the EEA, the UK, or another region with a privacy law, you may also contact your local authority. This policy does not limit rights that the law does not allow us to limit.
Parents consent to collection of child information when they accept the in-app consent screen and pair a device. You can withdraw that consent by deleting the family or unpairing the device. Withdrawal does not undo processing that already happened, and the child device will no longer have Watching’s controls.
13. Changes
If we change this policy, we will update the date at the top of this page. If a change is material, we will also show a notice in the parent app or by email when we have a practical way to do so. Continued use after the update means you accept the new policy. If you do not accept it, delete the family.
14. Contact
Privacy and deletion requests: privacy@anajyo.com
Product help: support@anajyo.com
Please do not send a PIN, a one-time sign-in code, or a pairing code.
Related pages: Children’s privacy, Data safety, Delete account, Terms.