The controller responsible for the processing described here is VML Development GmbH, Rugenbarg 35j, 22549 Hamburg, Germany (Amtsgericht Hamburg, HRB 166547, VAT ID DE 340365764). Represented by Sergey Pikalev.
For access, correction, export or deletion requests, and for any other question about this policy, write to info@vml-development.com.
Account identifier, email address when provided by the sign-in service, display name, family membership and role, device identifier (including a hashed Android identifier for device recognition), device name, app version and build, battery level and charging state, coarse motion state (moving, stationary, or unknown), push notification tokens, message content, safety zones, Screen Time rules and requests for child devices, selected-app identifiers and app display names included in per-app requests, Screen Time usage per app group and selected app (see the platform-specific explanations below), precise location — the latter only while location sharing is switched on for that account or dependent child device — and, to measure which channel brought a family to Lomari and to calculate the reward of the partner who referred it, any partner or campaign code you entered or that a lomari.app/p/<code> link prefilled, or the partner's offer code you redeemed, and, for Apple Search Ads, the campaign, ad group and keyword ids Apple's own attribution service returns, together with whether that install later became a Lomari Plus trial, subscription or refund.
Lomari can show usage estimates for today and recent days to the parents of the family and the child whose device it is. Group and selected-app usage reports are kept for 30 days. App identifiers and device-linked usage are personal data; encoding or hashing an identifier does not make it anonymous.
Apple's Screen Time API supplies usage thresholds rather than exact minutes: category estimates use 5-minute increments up to 4 hours. For up to 10 apps a parent has explicitly selected, per-app estimates use 5-minute increments up to 2 hours, then 15-minute increments up to 4 hours. Apple's API identifies a selected app with an opaque Apple app identifier, rather than giving our server its app name. An Apple device with the relevant family selection can render that identifier. A per-app request may separately include a display name supplied by the client. These are estimates, not exact counts; the Apple API's identifier and threshold limits do not describe Android's data flow.
On Android, the launchable-app picker is processed on the device so apps can be assigned to Screen Time groups; the complete picker list is not uploaded. After the separate in-app agreement and Android Usage access permission, Lomari reads UsageStats events locally to measure time in selected blocking-group apps, including while Lomari runs in the background. It sends selected package identifiers, their groups and daily usage totals to the Lomari server for family reports and daily limits. Per-app requests may also include an app display name and a package identifier in reversible Base64 form. These identifiers can identify the selected apps and are not opaque Apple tokens.
Android usage totals are reported as lower-bound estimates rounded down to 5-minute steps. Unavailable or incomplete history, delayed events and permission changes can make a report incomplete; it must not be treated as an exact, complete account of the day. Lomari does not collect app content, typed text, or usage of unselected and Always Allowed apps for these reports. Revoking Usage access in Android settings stops new UsageStats collection. This does not delete previously stored reports; their retention and deletion controls still apply.
With the separate Accessibility agreement and permission, Lomari processes foreground app package events locally to show a blocking screen when a family Screen Time rule applies. It does not read screen content, messages, passwords or typed text, and does not perform taps or gestures in other apps. Foreground event history is not uploaded. Lomari sends permission, enforcement and recent service-activity status to its server so the family can see whether Screen Time is working. Revoking this service in Android settings stops its foreground-app processing and blocking. Usage access is a separate permission; disabling one does not automatically disable the other or delete previously stored reports.
To operate the family safety features you asked for: showing the last known position of consenting family members, delivering messages and alarms, and notifying parents about safe-zone events. We do not sell personal data, do not use location for advertising, and do not track users across other companies' apps or websites.
| Data | Retention |
|---|---|
| Last known location (one point per device) | replaced by each new point; deleted after 7 days |
| Debug/TestFlight movement history | up to 7 days only while internal diagnostics are enabled for development or TestFlight; disabled in public production unless this policy and App Store privacy labels are updated first |
| Safe-zone events | 30 days |
| Screen Time rules, requests and device enforcement state (group identifiers, selected-app identifiers and any display name supplied with a per-app request; iOS uses opaque Apple app identifiers, Android uses package identifiers) | requests and removed rules 30 days; active rules until removed or the device is disconnected; audit events 90 days |
| Screen Time usage per app group (estimated totals; see platform-specific processing above) | 30 days |
| Screen Time usage per selected app (iOS opaque identifiers with the selection limits above; Android package identifiers) | 30 days |
| Audit and configuration events (no coordinates) | 90 days |
| Delivery diagnostics (no message content, no tokens) | 14 days |
| Device-uploaded local diagnostic logs (no coordinates or tokens) | 14 days |
| Messages | until the account or the family space is deleted |
| Sessions | until expiry, at most 30 days |
| US parent verification record (outcome and timestamps only, never a card number) | while the account exists; deleted with the account |
| Partner or campaign code you entered, or that a lomari.app/p/<code> link prefilled, or a partner's offer code you redeemed — used to measure which channel brought your family to Lomari and to calculate the reward of the partner who referred you. Partners only ever receive aggregated amounts and counts, never personal data | while the account exists; deleted with the account |
| Apple Search Ads attribution (campaign, ad group and keyword ids Apple returns, and whether the install later became a Lomari Plus trial, subscription or refund). It is never collected for a child's account. | 365 days; on account deletion, kept only as an anonymous campaign/ad-group/keyword statistic with every account and device link removed |
The product map uses only the latest known location: a new position atomically replaces the previous one there. Public production does not keep a route or movement history. During internal development or TestFlight debugging we may temporarily keep a short movement history to diagnose background delivery reliability; it is shown only in diagnostics and must stay disabled in public production unless the legal and App Store privacy disclosures are updated first. Our database provider retains point-in-time backups for up to 30 days for disaster recovery; those backups are not used to reconstruct movement history and expire automatically.
Data is encrypted in transit (TLS) and encrypted at rest by our infrastructure providers. This is not end-to-end encryption: our servers can technically access coordinates and message content in order to deliver them.
Cloudflare (API and database), Supabase (account authentication), and Apple (Sign in with Apple, push notifications, Location Push Service) process data on our behalf under data processing agreements. Stripe processes card details for United States parent verification only (see below); those details are entered on Stripe's own page and never reach us.
On Android, Google provides Google Sign-In, Firebase Cloud Messaging for push delivery, and Google Maps for map display. Firebase processes installation and delivery identifiers; Lomari does not enable Firebase Analytics. The Google Maps SDK processes network and device metadata, IP addresses, SDK identifiers and crash metrics, and map interaction data when its camera APIs are used, including for Google's service-improvement purposes. These SDK flows are separate from Lomari's optional diagnostic-log upload. See Google's Firebase data disclosure and Maps SDK data disclosure.
RevenueCat processes account-linked purchase history, subscription and entitlement information for Lomari Plus, together with the relevant app store's billing service. An account identifier is used to associate subscription status with the correct Lomari account. Payment card details for store purchases are handled by the store, not entered into Lomari. Provider processing and retention are also governed by the applicable provider terms and privacy notices; the 30-day Screen Time report period does not describe every provider record.
If you installed Lomari from an Apple Search Ads advertisement, the app asks Apple's on-device AdServices framework for an attribution token and sends it to us. We exchange that token with Apple for the campaign, ad group and keyword that led to the install, and store those ids together with your account so we can tell which ads lead to installs and, later, to a Lomari Plus trial, subscription or refund. This does not use IDFA, does not require App Tracking Transparency, and does not track you across other companies' apps or websites — it only tells us which of our own ads worked. It is never done for a child's account. This is kept for 365 days and, if you delete your account, is kept only as an anonymous campaign/ad-group/keyword statistic with the account and device link removed.
Adults switch their own location sharing on and off. For dependent child devices, a parent can switch app-level location sharing on or off, and may also temporarily pause updates to save battery. This does not grant system permissions: location permissions on iOS and Android are still controlled on the device. Android background location is used, including when the app is closed, for family location sharing and arrival or safe-zone alerts after sharing and the required permissions are enabled. A person whose location is shared can see in the app that sharing is active and who requested their position.
A parent or legal guardian confirms guardianship when inviting a child; we record that confirmation with a timestamp and the version of the consent text. The applicable age of digital consent differs by country and is applied accordingly.
On installations that support parent approval, leaving a family or deleting a child account requires a parent to enter the family's six-digit PIN on the child's device, even if Screen Time has not been configured. Earlier installations keep the previous Screen Time lock behavior: a parent-locked child cannot leave or delete their account through the app, while other child accounts can. A parent can also remove a child's device from their own phone. A child may turn off location sharing at any time without the PIN. If you cannot obtain parent approval and need your account or personal data deleted, contact us using the details in "Your rights" below.
If your App Store account is in the United States, the Children's Online Privacy Protection Act requires your verifiable consent before we collect anything from your child's device. This section is that notice.
Until verification succeeds, we do not let you create a child invitation, and no location, device, or message data from your child's device reaches us.
Precise location; device name, model and app version; battery level and charging state; and any messages your child sends inside your family space.
Location: shown to the family members you authorize, and to trigger the arrival and safe-zone alerts you configure. Device information: to keep the family map and diagnostics accurate. Messages: delivered to their intended recipients inside your family space. None of it is used for advertising, sold, or used to train AI models.
The only recipients of your child's location and messages are the members of your own private family space — people you invited or who invited you. Sharing location within the family is the entire service you are requesting, so this disclosure is integral to it. We do not disclose your child's data to advertisers, data brokers, or anyone outside your family space.
You may consent to our collecting and using your child's data without consenting to this disclosure only where the disclosure is not integral to the service. Because sharing within the family is the service, we do not offer a version of Lomari that collects a child's location but withholds it from the family: if you do not want a device's location shared with the family, do not enable sharing for that device.
The Rule (16 CFR 312.5(b)(2)(ii)) permits verification through a payment card or online payment system that provides notification of each discrete transaction to the primary account holder. You enter your card on our payment provider's own secure page — never in this app, never on our servers. We create a temporary authorization of USD 1.00 and cancel it immediately: it is never captured, you are never charged, and nothing is purchased. Your card number is never sent to us and never stored by us.
Only the outcome (succeeded or failed), the times it was started and completed, the version of the consent and notice texts you were shown, an opaque reference supplied by the payment provider, and the App Store storefront country that told us to ask. See our data retention policy below for how long. No card number, no card network reference beyond the payment provider's own opaque identifier, and no other payment details are ever stored by us.
You may review the categories of data we hold about your child, request its deletion, stop further collection, and withdraw your consent at any time — see "Your rights" below and the controls in Settings. Withdrawing consent stops further collection from your children's devices and prevents new child invitations. We record that you withdrew consent and when, so the history of what was permitted stays accurate; we do not silently erase the fact that consent once existed. To make a request that this notice does not cover a self-service control for, contact us using the details in "Your rights" below — we verify that a request comes from the account that gave consent before acting on it.
We did not collect any separate contact information from you solely to seek this consent: verification uses your existing signed-in account and the payment provider's own page directly.
This notice is also published as our online notice under 16 CFR 312.4(d). Our written, published data-retention policy is in the "How long we keep it" section above and in the retention document referenced in "Your rights."
Our website uses no cookies, no third-party analytics and stores nothing on your device. To understand which campaigns bring visitors, our own server records each page view, each click on the App Store button or on a link to another website, each visit through one of our short links (lomari.app/go/…), and each use of a page control (the feature tabs, the monthly/yearly switch, the screenshot viewer, or opening a FAQ question, recorded with the question text only). For each of these it stores the page and language, which control or link was used, the campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the domain of the referring website, the country derived from your IP address, and a coarse device class (phone, tablet or desktop and its operating system). The IP address itself is not stored, no identifier is created and visits cannot be linked to a person or to each other. The legal basis is our legitimate interest in measuring our marketing (Art. 6(1)(f) GDPR); the browser signals “Do Not Track” and “Global Privacy Control” are respected. The data is kept in Cloudflare Workers Analytics Engine for 3 months and then deleted. When you tap the App Store button, Apple receives the campaign name in the link; Apple’s own privacy policy applies from there.
If you write to us through the contact form, we process your name (optional), email address and message to answer you (Art. 6(1)(b) GDPR for questions about the app or a contract, otherwise our legitimate interest in answering, Art. 6(1)(f)). The message is stored in Cloudflare D1 and forwarded to our inbox by email; to limit abuse we keep a keyed hash of your IP address for one day, never the address itself. Messages are deleted after 6 months unless a longer retention is legally required. Processor: Cloudflare, Inc.
You can access, correct, export and delete your data, including a child's data if you are their verified parent. Account deletion is available in the app and removes membership, devices, locations, zones, messages, tokens and consents. To review the specific personal information collected from your child, request its deletion, or stop further collection without deleting the account, contact info@vml-development.com; we authenticate the request against your verified-parent record before acting on it. You may also lodge a complaint with your local supervisory authority.
Lomari depends on iOS or Android, Apple Push Notification service or Firebase Cloud Messaging, device permissions, network availability and battery. It cannot guarantee delivery or availability and is not a substitute for the emergency services.
Last updated: 5 October 2026.