TwoHavenPrivacy policy
TwoHaven is a parental control and screen time app. To work, it needs to process some information about you as a parent and about your child's devices. This policy explains what information that is, why we need it and what rights you have.
1. Data controller
TwoHaven is operated by Peter Landin (sole proprietorship), Östra Storgatan 89A, 554 52 Jönköping, Sweden. Contact: twohaven.app@gmail.com.
2. What data we process
| Data | Why |
|---|---|
| Parent account: name, email address, password (stored only as an encrypted hash), chosen language | So you can sign in and control your family's devices. |
| Children: the name or nickname you enter | To show which child a device belongs to. |
| Devices: name, model, Android or Windows version, battery level, whether the device is online | To show the device status in the parent app. |
| Apps: the list of installed apps/programs and which app is in use right now | For app approval, blocking and showing what is being used. |
| Screen time: minutes per day and per app | To count down the time bank and show the weekly report. |
| Settings: schedules, limits, locks, week-on/week-off schedule, event log | So the rules apply on your child's devices. |
| Notifications: a technical address for push notifications to your phone or browser | To send notifications such as "a new app is waiting for approval". |
| Payment: if you subscribe, payment is handled by Google Play | We only learn that a subscription is active – never card details. |
We do not collect: location/GPS, the content of messages or calls, photos, what is typed or shown on screen, browsing history, window titles or contacts.
3. Permissions on your child's device
- Accessibility service (Android): used to see which app is open, so blocked apps can be closed and picture-in-picture can be stopped. Only the app's name is used – never text or content on the screen.
- Device administrator (Android): prevents the child from uninstalling TwoHaven.
- VPN (Android): used only locally on the device to turn off the internet when a parent has chosen to. No traffic is sent to us or anyone else.
- Usage access (Android): used to count screen time per app.
- Camera (parent's phone): used only to scan the pairing code. No images are stored.
- Windows: the computer app sees which program is in front and whether the computer is in use, to count screen time and block programs.
4. Legal basis
We process the data to perform our agreement with you – that is, to provide the service you have chosen to use (Article 6(1)(b) GDPR). Data about the child is processed on behalf of you as the guardian, who decides over the child's devices.
5. Where data is stored and who receives it
Data is stored on a server operated by Hetzner Online GmbH in Germany (within the EU). We do not share data with others, except the service providers needed for the service to work:
- Hetzner Online GmbH (Germany) – server hosting.
- Google – Google Play for download, updates and payment, and Google's push service for notifications.
- Apple and Mozilla – their push services if you use the parent app in Safari or Firefox.
We never sell data and do not use it for advertising or profiling.
6. How long data is kept
Data is kept for as long as the account exists. If you remove a device in the app, its pairing key is deleted immediately. If you ask for your account to be deleted, we delete all data about your family within 30 days. Backups are kept for at most 14 days.
7. Delete your account
Send an email to twohaven.app@gmail.com from the email address you use in TwoHaven and say that you want your account deleted. We will then delete the family, all parent accounts, children, devices, schedules and all screen time statistics within 30 days and confirm when it is done. Please also cancel any subscription in Google Play.
8. Your rights
You have the right to know what data we hold about you, to have it corrected or deleted, to restrict processing, to object to it and to receive your data (data portability). Contact us at twohaven.app@gmail.com. If you are unhappy you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the data protection authority in your country.
9. Security
All traffic between the apps and the server is encrypted (HTTPS). Passwords are stored only as encrypted hashes. Your child's devices are identified by a random key that cannot be guessed.
10. Changes
If we change this policy we update the date above. For larger changes we will notify you in the app.