21days Privacy Policy

Effective date: October 30, 2026

parentingnow (the “Company”) explains the personal information processed by the 21days app and related services, its purposes, retention and deletion, and user rights below.

1. Personal Information and Purposes

We process the following information depending on how you use the service and which features you choose.

The Company does not collect your Google, Apple, or Kakao account passwords.

Pro payments are processed by the App Store or Google Play. The Company does not directly collect credit card numbers or bank account passwords through the app’s checkout process.

You may use a nickname instead of your child’s real name. Date of birth, gender, and profile photo are optional; you can register a child without providing them. A default avatar is used if no profile photo is uploaded.

2. Photos and Device Permissions

Selected child profile and routine photos are resized, compressed, or otherwise processed before upload. Your entire photo library is not uploaded.

• Android: Selected images are accessed through the system photo picker. The READ_MEDIA_IMAGES permission for broad photo access is not used.
• iOS: Photo access permission may be requested depending on the operating system and usage environment.
• You can use other features without registering photos.

3. Family Sharing and Family Board

Family sharing is private to the guardian who registers and manages a child and guardians connected by accepted invitations. Child profiles, photos, routines, progress records, and reward information are not publicly available or searchable by other users.

Connected guardians use family information within permissions based on their account’s connection to the child and guardian role.

Family Board displays routines and progress on a shared device registered by a guardian, allowing children to start and complete routines themselves.

Family Board displays information according to the signed-in guardian’s permissions. Family members using or viewing the shared device may see displayed child information without separate sign-in. Guardians should manage device access and screen visibility.

4. Notifications and Marketing

The Company uses device notifications for routine starts, routines not started, timer completion, and other service features.

Push tokens and generic messages are processed through Expo and Google FCM or Apple APNs to deliver notifications. Notification content does not include child or routine names.

Manage notifications through device settings and Settings > Notifications and Permissions in the app.

With separate consent, parentingnow may send app push advertisements about new 21days features, events, and Pro promotions. Device push tokens and marketing push consent status are used for this purpose until consent is withdrawn or the account is deleted. Consent is optional and declining it does not restrict service use.

Withdraw marketing consent at any time on the same settings screen. Withdrawal stops marketing push messages and use for that purpose. Routine, timer, and other service notifications follow separate settings, so tokens needed for them may remain after withdrawal. Disabling device notification permission is separate from withdrawing consent. See the advertising consent guidance for details.

5. Advertising Information

Android does not serve ads and does not use the Google Mobile Ads SDK or advertising ID permission.

On iOS, advertising services such as Google AdMob may be used only in environments where ads are served. Advertising services may process device and advertising information for delivery and measurement.

If advertising-related tracking is required, permission is requested through the operating system. Non-personalized ads may still appear in applicable environments if tracking is declined.

6. Personal Information Processing Providers

The Company entrusts the following processing tasks to providers as needed to deliver the service. Providers process information within their assigned tasks, and the Company protects information through processing agreements and access controls.

7. International Transfers of Personal Information

Core service data is hosted in Seoul, South Korea. Email delivery, push notifications, and some operational or support activities may involve overseas processing. Currently identified details are listed below.

Supabase support information may be accessed by global support staff and is not limited to processing within the EU.

8. Operational Logs and Backup Retention

IP addresses, access times, service activity, and error records may be generated to operate and secure the service and investigate errors. The main retention periods are:

• Service operational logs (Supabase): 7 days
• Email content and sending logs (Resend): 30 days
• Database backups: the latest 7 days

After consent withdrawal or account deletion removes source data, copies may remain in backups for up to 7 days. Photo files are not included in these database backups.

9. Disclosure and Sharing

The Company does not sell personal information.

When external disclosure is necessary, required notices and consent procedures are followed unless applicable law permits otherwise. Information may be disclosed within the scope of a lawful request.

10. Retention and Deletion

Personal information is generally retained during service use and destroyed without delay when its purpose is fulfilled. Family data and consent evidence are handled as follows on account deletion.

When an account is deleted

• Personal account data such as account and profile information, and the account’s family connections, are deleted.
• For each child with another active guardian, ownership is transferred to that guardian and the child’s information, routines, records, and photos are retained.
• If no guardian can receive the data, the child’s information and associated routines and records are deleted.
• Author identifier links to the deleted account are removed from certain retained family records.
• Server photos linked to children and routines being deleted are removed through a separate cleanup process, which may not finish at the same time as account deletion.

Transferred family data is retained while the remaining guardian uses the service, until that data is deleted. Removing author links does not automatically anonymize all personal information contained in record content.

Sign-in information, settings, and scheduled notifications on the device are also cleared after account deletion. Device access errors may prevent some cleanup from completing.

Transaction records independently retained by the App Store or Google Play are not deleted merely by deleting an app account.

Retention and Deletion of Legal Guardian Consent Evidence

The Company retains minimum evidence needed to verify consent and processing and deletion history, such as document versions, consent time and method, verification emails, and consent status.

The deletion reference date is not simply the account deletion date. It is the date on which both of the following conditions are met:

• The evidence is no longer needed to verify consent or related personal information processing and deletion history.
• Deletion of all child data and photos related to that consent has been completed.

Evidence is destroyed without delay and within 7 days of that date at the latest. This is a maximum processing deadline, not permission for unnecessary retention. Electronic records are deleted so they cannot be recovered or reproduced; backup copies follow the retention cycle in Section 8.

If family data is transferred and retained, account deletion alone does not satisfy these deletion conditions. Transfer does not justify indefinite evidence retention: the Company reviews the need and destroys unnecessary evidence without delay.

11. How to Delete Your Account

In the app, go to Settings > Account > Delete Account, review the guidance, and proceed with deletion.

Without installing or signing in to the app, you may request account deletion or deletion of child data only while keeping your account by email. Follow the account and data deletion guidance; requests are processed under its stated standards after identity and deletion authority are verified. Deleted accounts cannot be restored.

Deleting your account does not cancel an App Store or Google Play subscription. Cancel separately through the store used for purchase.

12. User and Legal Guardian Rights

You can view or change your information and service settings through the features available in the app.

Contact us below to exercise rights under applicable law, including access, correction, deletion, restriction of processing, and withdrawal of consent. The Company verifies identity and necessary authority before processing requests under applicable law.

Permissions to change or delete family data may vary by guardian role.

13. Children’s Personal Information

Guardians manage registration, settings, and subscriptions; children may use Family Board under their supervision. The age-14-or-older registration confirmation concerns the account holder, not the age of children using the board. Child information processed is listed in Section 1.

Legal Guardian Consent: Procedure and Scope

Legal guardian consent must be completed through the guardian account before registering a new child profile. The process is as follows:

1. A consent link is sent to the email address associated with the guardian account.
2. The guardian opens the email link and reviews the consent document in the app.
3. The guardian checks the confirmation that they are the child’s legal guardian and completes consent.

Consent is collected at the guardian account level. Once completed, it applies to that account’s existing child profiles and child profiles registered in the future.

What happens when consent is withdrawn

When legal guardian consent is withdrawn in the app, child profiles and related data linked to that consent are removed and are no longer displayed or available in the accounts of other caregivers connected to those children. Related photo files may be deleted through a separate server cleanup process, so deletion may not finish at the time of withdrawal.

Deletion following consent withdrawal is distinct from family data transfer on account deletion described in Section 10. Separate retention and deletion of consent evidence also follows Section 10.

14. Security Measures

The Company applies the following measures to protect personal information.

• HTTPS/TLS communication between the app and servers
• Hashed password storage in the authentication system
• Access control based on account authentication and family connections
• Storage access policies and time-limited access URLs for child profile and routine photos
• Restricted use of server administration privileges and credentials

15. Policy Changes, Privacy Officer, and Contact

The Company revises this policy when services or information processing practices change and provides notice of significant changes before they take effect.

• Company: parentingnow
• Service: 21days
• Business registration number: 890-14-02558

Privacy inquiries: parentingnow.support@gmail.com

Privacy officer: 김하늘 (Kim Haneul)