1. Introduction & Products Covered
This Privacy Policy explains how Naviwebs ("we", "our", or "us"), developer of the Kando ecosystem, processes information. Kando is a parental control launcher, digital wellbeing tool, and companion smartwatch service designed to create a safe, monitored sandbox environment for children on Android devices while providing parents with seamless supervision tools.
This Privacy Policy applies to:
- MobileKando - Kids Space & Parental Control (Package:
com.naviwebs.app.kando): The primary Android launcher and parental control sandbox installed on smartphones and tablets used by children and configured by parents. - Wear OSKando Companion for Wear OS (Package:
com.naviwebs.app.kando.wearable): The companion smartwatch application, complications, and tiles worn and operated exclusively by parents or guardians to monitor screen time and send quick controls (pause, add time, lock).
If you have any questions or concerns regarding this policy, you can contact us at:
- Company: Naviwebs
- Website: www.naviwebs.com
- Email: info@naviwebs.com
2. Compliance with Children's Privacy Regulations (COPPA & GDPR-K)
Because Kando is an application suite intended for families and children under parental supervision, we rigorously comply with the Children's Online Privacy Protection Act (COPPA) in the United States, the General Data Protection Regulation (GDPR / GDPR-K) in the European Economic Area (EEA), and Google Play's Families Policy requirements:
🛡️ Children's Data Safeguards
- No Personal Data Collection from Children: We do not knowingly collect, request, or store any personally identifiable information (PII) from children, such as real names, email addresses, phone numbers, precise GPS location, photos, voice recordings, or social media handles.
- Zero Advertising: The entire Kando ecosystem is 100% free from behavioral, targeted, or commercial third-party advertising.
- Advertising Identifiers Permanently Disabled: Google Advertising ID (AAID) and SSAID collection are explicitly blocked and removed from our application manifest to prevent profiling or commercial tracking of minors.
- Parents as Exclusive Administrators: The parent or legal guardian is the sole administrative user who configures the sandbox, sets parental PIN or biometric credentials, approves allowed applications, and pairs the Wear OS companion smartwatch. The Wear OS companion app is designed strictly for adult parents/guardians.
3. Data Processed Locally on Your Devices
To deliver its parental control and timer features without compromising privacy, Kando processes nearly all operational data locally on your device. This data is never transmitted to our servers or third parties:
- Parental PIN & Biometric Authentication: Your parental PIN is hashed using one-way cryptographic SHA-256 and stored locally in encrypted private storage. Biometric authentication (fingerprint or facial unlock) is performed entirely on-device by Android's secure system Keyguard / BiometricPrompt hardware enclave; Kando never accesses, collects, or stores raw biometric data.
- Child Profile & Daily Limits: Profile labels (e.g., "Child"), daily total playtime quotas, bedtime schedules, and individual app limits are stored solely in a local Room database on the phone.
- Local Usage Counters: Daily screen time counters (minutes used today) are stored on-device to enforce daily caps and automatically reset at midnight.
- Blocked Notifications History: Information regarding notifications silenced while in Kids Mode is kept strictly in an encrypted local log on the device so parents can review what was silenced during playtime.
- Watch Companion Local Cache: The Wear OS smartwatch app caches the active session status and remaining seconds locally in memory to power watch face complications and glanceable tiles.
4. Wear OS Smartwatch Companion & Cross-Device Communication
Kando includes a dedicated Wear OS companion application (com.naviwebs.app.kando.wearable) created for parents to check remaining screen time from their wrist and trigger parental actions (such as pausing the session, adding time, or locking the device). Cross-device communication is architected with strict privacy principles:
⌚ Cross-Device Data Synchronization Mechanisms
- Local Bluetooth / Wi-Fi Synchronization (Google Play Services Wearable Data Layer): When the parent's smartwatch and the child's phone are connected locally via Bluetooth or local Wi-Fi, session state and commands are exchanged directly peer-to-peer via Google Play Services. No external cloud servers or third-party databases are involved in local Data Layer transmissions.
- Cloud Relay Synchronization (Firebase Firestore & Anonymous Authentication):
To enable parents to monitor remaining screen time and send commands when away from direct Bluetooth range (e.g., via standalone LTE or separate Wi-Fi), Kando provides an optional Cloud Relay channel powered by Google Cloud Firestore:
- Ephemeral 6-Digit Pairing Codes: When pairing a watch by numeric code or QR code, a temporary pairing document is created with a strict 5-minute expiration (TTL). Once redeemed or expired, it is permanently deleted.
- Anonymous Handshake: Pairing uses anonymous Firebase Authentication. We do not require, collect, or store parent or child email addresses, phone numbers, or passwords.
- Strictly Operational Telemetry: The relay only synchronizes operational counters:
isActive,isPaused,isBlocked,secondsRemaining, the child profile's display nickname, and parental commands (e.g., "+10 minutes", "pause"). No personal identity, browsing history, app content, or location data is ever transmitted through the relay.
- Google Code Scanner (QR Pairing): To pair the watch effortlessly, the parent phone can scan the pairing QR code displayed on the watch screen. This utilizes Google Play Services' on-device Code Scanner module. The Kando app does not request or access camera permissions, and no camera frames, photos, or images are ever stored or uploaded.
- Watch Face Complications & Tiles: The remaining playtime complication provides a glanceable widget on Wear OS watch faces. Complication updates are rendered locally on the watch hardware without network tracking.
5. Android System Permissions & Technical Justification
Kando requires specific Android system permissions to operate effectively as an isolated sandbox and parental monitoring service. Each permission is used solely for its documented purpose:
| Permission | Platform | Purpose & Justification | Data Sharing |
|---|---|---|---|
| PACKAGE_USAGE_STATS (Usage Access) |
Mobile | Enables Kando to detect which approved app is in the foreground and calculate elapsed playtime against the child's daily allowance. | Processed strictly on-device. Never uploaded or shared. |
| SYSTEM_ALERT_WINDOW (Display over other apps) |
Mobile | Renders the floating countdown timer bubble over approved apps and displays the session-expired overlay when playtime runs out. | Visual UI overlay only. No data captured. |
| BIND_NOTIFICATION_LISTENER_SERVICE (Notification Access) |
Mobile | Silences incoming personal notifications (messages, emails, social media) while Kids Mode is active to protect family privacy and eliminate distractions. | Dismissed locally. No content is stored remotely or shared. |
| QUERY_ALL_PACKAGES (Installed Apps) |
Mobile | Allows parents to view the list of installed applications in the Parent Dashboard to select which ones are permitted in the kids' safe space. | Filtered on-device. Never transmitted to servers. |
| POST_NOTIFICATIONS & FOREGROUND_SERVICE_SPECIAL_USE | Mobile | Maintains an active, uninterrupted parental monitoring background service with a persistent system notification so the session is never killed unexpectedly. | System service management only. |
| USE_BIOMETRIC (Biometrics) |
Mobile | Allows parents to quickly authenticate and exit Kids Mode using their fingerprint or face recognition as an alternative to the PIN. | Handled entirely by Android Keyguard. Raw biometrics are never accessible to Kando. |
| BIND_DEVICE_ADMIN (Device Administration) |
Mobile | Optional feature: When activated by the parent, protects Kando from unauthorized uninstallation or force-close during a session and locks the screen upon session expiry. | Local system enforcement only. |
| REQUEST_IGNORE_BATTERY_OPTIMIZATIONS | Mobile | Prevents aggressive OEM battery management from freezing the background screen time counter and terminating smartwatch communication. | Local system setting toggle only. |
| RECEIVE_BOOT_COMPLETED | Mobile | Optional setting: Allows Kando to automatically restore Kids Mode if the child reboots the device. Disabled by default; toggled only by parents. | Local system broadcast only. |
| INTERNET | Both | Used for validating Google Play In-App Billing subscriptions, transmitting anonymous Crashlytics crash traces, and optional cloud relay synchronization between watch and phone. | Encrypted HTTPS/TLS network transmission. |
| VIBRATE | Both | Provides gentle haptic feedback when approaching time limits and for timer alerts on phone and smartwatch. | Hardware vibration motor control only. |
| BIND_COMPLICATION_PROVIDER | Wear OS | Allows the companion app to serve the "Remaining Time" complication data to the parent's chosen watch face. | Delivered locally to the Wear OS watch face system service. |
6. In-App Subscriptions & Google Play Billing
Kando offers optional premium features through Google Play In-App Subscriptions (com.android.billingclient):
- Payment Processing: All financial transactions, subscriptions, and renewals are handled directly and securely by Google Play.
- Zero Financial Data Access: Naviwebs never collects, receives, processes, or stores your credit card numbers, bank account information, or billing address. We only receive an anonymous purchase token from Google Play to verify your subscription status.
7. Third-Party Diagnostic & Cloud Infrastructure Services
To ensure high stability, prevent bugs, and monitor technical crashes across diverse Android and Wear OS hardware, Kando integrates trusted services provided by Google:
- Google Firebase Crashlytics: Collects anonymous crash stack traces, device model information, and operating system versions when an unexpected crash occurs. This diagnostic data contains no personal identifiers or children's data and is used solely to resolve stability issues.
- Google Firebase Analytics: Configured in strictly anonymized mode with demographic tracking, advertising identifiers (AAID), and SSAID permanently disabled. We collect only aggregated, non-identifying operational metrics (e.g., successful session starts, app version updates) to improve application performance.
- Google Cloud Firestore & Firebase Auth: Powers the optional cloud relay for Wear OS synchronization and ephemeral pairing codes using anonymous authentication, as detailed in Section 4.
- Google Play Services: Powers the Wearable Data Layer, Google Code Scanner, and Google Play Billing.
For more details on Google's privacy practices, please refer to the Google Privacy Policy and Firebase Data Security Documentation.
8. Data Retention & User Rights (Access & Deletion)
Because all profile information, usage rules, and logs are stored exclusively in the application's private local storage sandbox on your Android device, you retain total control over your data:
- Immediate Local Deletion: You can completely erase all data, profiles, and history at any time by clearing the App's storage via Android Settings > Apps > Kando > Storage > Clear Data, or by simply uninstalling the application.
- Smartwatch Unlink & Cloud Purge: When you tap "Unlink" in the Kando Watch Settings or companion app, the device association is immediately purged from device storage and Firestore. Ephemeral pairing codes are automatically deleted after 5 minutes.
- No Cloud Accounts: Since we do not maintain user accounts or persistent user databases, no personal records remain on our servers when you uninstall the Applications.
9. Security Safeguards
We implement industry-standard security safeguards to protect local parental controls and device-to-device communication:
- Parental PINs are cryptographically hashed using SHA-256 and stored in sandboxed private preferences.
- Android Keyguard integration prevents unauthorized bypass through biometric verification backed by the device's hardware security enclave.
- All network transmissions (Play Billing, Crashlytics, and Firestore Relay) use industry-standard Transport Layer Security (TLS/HTTPS) encryption.
- Firestore security rules enforce strict read/write restrictions ensuring that pairing documents can only be accessed with valid temporary codes.
10. Changes to This Privacy Policy
We may periodically update this Privacy Policy to reflect technical enhancements, new platform features (such as Wear OS updates), or legal requirements. Any modifications will be posted directly on this page with an updated "Effective Date". We encourage parents to review this policy periodically.
11. Contact Us
If you have questions, comments, or requests regarding this Privacy Policy or your family's data protection, please reach out to us: