Privacy Policy

1. Who We Are

MB Djump (trading as Jumzy Kids) is the data controller responsible for your personal information under the EU General Data Protection Regulation (GDPR) and the Lithuanian Law on Legal Protection of Personal Data.

2. Camera Data — Critical Information

How Camera Data Works

• On-Device Processing: Camera frames are processed entirely on your device using Google ML Kit Pose Detection (Android) and Apple Vision framework (iOS, where applicable)
• Real-Time Only: Each camera frame is analyzed instantly in memory and immediately discarded — never written to storage
• No Storage: No images or video are ever saved to device storage, cloud, or any backend server
• No Transmission: Visual data never leaves your device or is sent to any server, third party, or analytics provider
• Pose Coordinates Only: The AI extracts only numerical coordinate points of body position (17 keypoints as x/y/confidence values) which are used in-memory to count exercise repetitions, then discarded
• No Facial Recognition: We do not perform face detection, facial recognition, or any form of biometric identification

3. Information We Collect

From Parents (Account Holders)

• Email address (for account creation, login, and essential service communication)
• Password (stored as a cryptographic hash via Supabase Auth — we never see your plaintext password)
• Parental PIN (stored as a PBKDF2-HMAC-SHA256 hash with 150,000 iterations and a unique salt)
• Preferred language and age group settings
• Subscription status (free or premium)
• Family display name (optional, parent-chosen)

From Children's App Usage (Anonymous, Non-Identifying)

• Child display name (parent-chosen, can be a nickname — not required to be a real name)
• Age group (4-6, 7-10, or 11-14)
• Avatar selection (from a preset list of icons)
• Exercise completion statistics (number of repetitions, duration, exercise type)
• Session history (timestamps of completed workouts)
• Achievements unlocked and points earned
• Current and longest exercise streak
• Parent-configured blocked apps list and screen time schedule

4. Legal Basis for Processing (GDPR Art. 6)

We process personal data under the following lawful bases:

• Consent (Art. 6(1)(a)): Parents explicitly consent during account creation to the processing of their data and their children's data. Parental consent under GDPR-K (Art. 8) is required for users under 16 (under 13 under COPPA in the US).
• Contract (Art. 6(1)(b)): Processing necessary to provide the app services you subscribe to.
• Legitimate Interest (Art. 6(1)(f)): Crash reporting and service stability (minimal technical data only, via Firebase Crashlytics).
• Legal Obligation (Art. 6(1)(c)): Tax and accounting records required by Lithuanian law.

5. Android Permissions and Accessibility Services

The Jumzy Kids Android app requests the following sensitive permissions, each used exclusively for the purposes described below. Data collected via these permissions never leaves the device.

6. iOS Family Controls and Screen Time API

Where supported (iOS version), Jumzy Kids uses Apple's Family Controls framework, ManagedSettings, and DeviceActivity frameworks to provide parental controls consistent with Apple's privacy-preserving design:

• Opaque ApplicationTokens: Blocked apps are represented as opaque tokens. We never see the actual names or bundle IDs of blocked apps — Apple handles this entirely via the FamilyActivityPicker UI.
• On-Device Enforcement: All shielding and activity monitoring happens on-device. No app usage data is transmitted to our servers.
• No Screen Time Reports: We do not access or store reports about which apps children use.
• Parental Consent: iOS requires explicit parental consent through Apple's native Family Controls authorization flow before our app can apply any restrictions.

7. Third-Party Service Providers (Processors)

We use the following processors under data processing agreements:

We do not use any advertising networks, behavioral analytics, attribution SDKs, or data brokers. Jumzy Kids is not financed by advertising.

8. International Data Transfers

Some of our processors (notably Supabase and RevenueCat) are located in the United States. When personal data is transferred outside the European Economic Area (EEA), we rely on EU Standard Contractual Clauses (SCCs) as approved by the European Commission under GDPR Art. 46, plus supplementary technical measures (TLS 1.2+ in transit, encryption at rest).

9. Data Retention

• Active account data: Retained as long as the account is active.
• After account deletion: Personal data is permanently deleted within 30 days of request. Hashed authentication tokens and cryptographic identifiers are purged immediately.
• Anonymous aggregate statistics: May be retained indefinitely for service improvement, as they contain no personal data.
• Purchase and tax records: Retained for 10 years as required by Lithuanian accounting law (VMI requirements).
• Crash reports: Retained by Firebase for 90 days, then anonymized aggregate data only.

10. Children's Privacy (COPPA & GDPR-K)

Jumzy Kids is designed for children ages 4-14 under the direct supervision of a parent or legal guardian. We comply with:

• COPPA (US): We do not knowingly collect personal information from children under 13 without verifiable parental consent, which is obtained during parent account creation.
• GDPR-K (EU Art. 8): Parental consent is required for children under 16 in the EU. Our account creation flow requires the parent to confirm they are 18 or older and acting on behalf of their child.
• No child-directed advertising: We do not serve any advertising whatsoever, behavioral or otherwise.
• No third-party tracking: No third-party SDKs track children across apps or websites.
• No social features: Children cannot chat, post content, or communicate with anyone outside their family group. All "social" features are limited to the parent-controlled family unit.

11. Your Rights as a Parent / Data Subject

Under GDPR and COPPA, you have the right to:

• Access: Request a copy of all personal data we hold about you and your child
• Rectification: Correct inaccurate or incomplete data
• Erasure ("Right to be Forgotten"): Request deletion of your account and all associated personal data
• Restriction: Ask us to temporarily stop processing your data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Revoke consent at any time without affecting the lawfulness of prior processing
• Review child's data: Review, modify, or delete information collected from your child
• Disable data collection: Stop further collection of your child's information (by disabling account or uninstalling)

To exercise any of these rights, contact us at start@djump.io. We will respond within 30 days as required by GDPR Art. 12.

12. Data Security

We implement technical and organizational measures appropriate to the risk:

• All data transmissions encrypted with TLS 1.2 or higher
• Database encryption at rest (AES-256)
• Passwords hashed with bcrypt (Supabase Auth default)
• Parental PINs hashed with PBKDF2-HMAC-SHA256 (150,000 iterations, 16-byte salt)
• Row-Level Security (RLS) policies on all database tables
• Camera permission required at runtime with clear user consent
• Parental PIN rate limiting with escalating lockouts (30s → 2min → 10min → 30min)
• Cleartext network traffic disabled at the Android manifest level
• Code obfuscation (R8/ProGuard) in release builds
• Regular dependency security updates
• Limited access: only authorized personnel at MB Djump can access production systems

13. Cookies (Website Only)

The Jumzy Kids mobile app does not use cookies. Our marketing website (jumzykids.com) uses only strictly necessary cookies required for locale preference and basic functionality. We do not use analytics, marketing, or tracking cookies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page
• For material changes affecting children's data, notify parents by email and require renewed consent on next app launch
• Post a notice in the app for 30 days

15. Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the supervisory authority in your country of residence. The Lithuanian supervisory authority is:

EU consumers may also use the European Commission Online Dispute Resolution platform.

Contact Us