Family disclosures updated October 7, 2026.
Zonifyr Inc. (“Zonifyr,” “we,” “our”) provides distinct products for school phone-policy operations, parent-controlled personal-device tools, institutionally managed devices, and community recognition. This policy describes those products separately because they involve different users, data, and authority relationships.
Zonifyr Family Privacy Policy
Zonifyr Family is a parent-controlled product provided by Zonifyr Inc. This notice describes Zonifyr Family. The other product notices below remain separate from this Family notice.
Parent authority and local controls
A school may recommend a schedule. A parent decides whether to adopt it and authorizes Apple Family Controls. Enforcement occurs locally through Apple’s supported APIs. Schools do not receive Family Controls authorization, selections, enforcement status, device check-ins, or child-device compliance reports.
Information used by the Family service
- Parent accounts: name, email address, a protected password representation, account identifiers, and session credentials, used to create and secure your account.
- Child links: parent-child relationship identifiers, linked child and school display names, and enrollment invitation and account-security records. A Zonifyr child link is separate from Apple Family Sharing authorization.
- Catalog requests: app search text and storefront are sent to our public catalog service to return matching public app metadata. Requests do not include a child identifier or your selected app list. Loading app icons may contact the image host. Network services necessarily receive connection information, including IP addresses.
- Support: information you choose to send when asking for help. Do not send passwords, invitation secrets, Apple selection tokens, or private child records.
Parent-approved configuration sync and local information
When a parent reviews and publishes settings, the Family service stores the approved configuration for the paired child iPhone. This includes opaque Apple selection data when the parent confirms the same Family Sharing group, explicit website restrictions, verified app restrictions, schedules and time zones, pause settings, and an optional fixed school-zone boundary. These are private Family settings and are not available to schools. A saved local change is not sent until the parent publishes it.
Pairing uses an expiring single-use invitation. The service retains scoped parent, child-link and installation identifiers, hashed invitation/device credentials, credential epochs, configuration revisions and bounded security audit metadata. Parent sign-in tokens are never supplied to the child iPhone.
The child keeps an encrypted last-verified configuration and device-only Keychain credentials. It evaluates schedules and school-zone membership locally. Current device coordinates, movement history, zone membership, enforcement status, installed-app inventory, browsing history and app-usage history are not uploaded by Child Mode. Camera frames used for QR scanning stay on the device. Linked-child lists are held in memory after authenticated retrieval and cleared when the account changes or signs out.
Protection/status reporting
Remote device protection/status reporting and live alerts are not active in this release. An unavailable or unknown status does not mean a device is protected or that an app was removed. We will update the notice and obtain any required consent before activating additional collection.
Use and sharing
We use Family account and relationship information to provide, secure, and support the service. DigitalOcean hosts the Family production service and its self-hosted database and cache. We use infrastructure and service providers only as needed to operate the service. Family Controls selections and device status are not shared with schools. The Family app does not use advertising identifiers, advertising SDKs, or cross-app tracking.
Configuration retention
Pairing invitations expire after ten minutes. Published configurations expire after 30 days. A child may use verified settings offline for up to 24 hours, never beyond the configuration expiration. The service removes expired private payloads through its asynchronous cleanup process; revision, credential and audit metadata can remain until unlink or account deletion. Unlinking removes the corresponding private runtime record. Revocation invalidates pairing authority. Offline devices receive changes when they reconnect or run a local expiry check; immediate offline clearing is not guaranteed.
Account deletion and retention
Open My Children → Parent Account → Delete Account, enter your account password, and confirm. Deletion removes the canonical parent login/profile, your child links, parent-specific registration and password-reset records, private child-runtime configurations, pairing records, and any parent-specific protection records from the live Family service. It revokes sessions. After the service confirms success, the app signs out and clears its local account cache and saved configuration for linked children on that phone. Check other devices separately.
Shared enrollment records have your parent references removed. Invitations remain unusable and keep their existing expiration. Anonymized enrollment audit events retain event type, role and time for security review for 30 days after deletion, then become eligible for automatic removal. Automatic database expiration is asynchronous. Other parents’ accounts, canonical student records, and school/operator records are not deleted with your account because they are independently owned records. This does not change Apple Family Sharing.
Our documented backup procedure uses operator-run encrypted backups retained for at least 30 days, with the last verified backup preserved. Backup copies can therefore remain after live account deletion. We have not implemented an automatic deletion deadline or maximum backup-erasure period. Information subject to a valid legal preservation requirement is retained only as required and is not used to restore ordinary account access. Contact us for information about applicable retention and privacy rights.
Contact
For privacy requests, email privacy@zonifyr.com. For product help, visit Zonifyr Support.
1. Product Roles and Data Boundaries
Zonifyr does not operate under a single data role across every product. The role depends on the product and relationship involved.
- Zonifyr Schools processes school-authorized records used to operate a school phone-policy program and related school workflows.
- Zonifyr Family is a separate parent-controlled product for personally owned devices. Family Controls, Screen Time, app selections, restriction state, and personal-device usage telemetry are not transmitted to Zonifyr Schools.
- Zonifyr Managed is a separate enterprise product for school-owned or legitimately institutionally managed devices. It is built within Apple’s approved MDM framework. Android Enterprise support is in development subject to applicable enrollment modes and platform requirements.
2. Student Privacy and Education Records
Zonifyr is being designed so school deployments can satisfy applicable student-privacy obligations, including FERPA, COPPA where applicable, and applicable state requirements. Final production practices and contracts remain subject to formal legal and security review.
- School student records are used only for authorized school-program purposes and are not intended for unrelated advertising or commercial profiling.
- Access to school records is designed to be role-based, school/tenant scoped, and auditable.
- Parent/guardian access to school records is designed to require a verified guardian-student relationship.
3. Children Under 13 / COPPA
- Where children under 13 use a Zonifyr product, the applicable consent and notice model depends on the product, purpose, and legal relationship.
- School authorization for educational use is not treated as permission to reuse children’s information for unrelated commercial purposes.
- Where verifiable parental consent is legally required, Zonifyr will implement the applicable consent process before production use of the relevant feature.
4. Information We Expect to Process
A. Zonifyr Schools
- School-issued or internal student identifiers and school/grade associations as needed for the program
- Guardian relationships and contact information needed for policy acknowledgement and school communication
- Policy acknowledgements, compliance-method declarations, and school-defined eligibility states
- School-observed incident records, parent-facing summaries, internal staff notes, and audit records, with access controls appropriate to each record type
- Policy configurations, policy versions, staff accounts, and school/district administrative settings
Zonifyr Schools does not receive Family Controls, Screen Time, app selections, personal-device restriction state, or personal-device usage telemetry from Zonifyr Family.
B. Zonifyr Family
See the Zonifyr Family Privacy Policy above for current Family account, pairing, configuration, retention and deletion practices.
C. Zonifyr Managed
- For legitimately institutionally managed devices, Zonifyr may process device-management identifiers, enrollment state, configurations, compliance information, and administrative data that the applicable Apple/Android management framework permits for that enrollment mode
- Managed-device data is separate from ordinary personally owned student-device data and is not used to create a workaround for unauthorized personal-device management
D. SchoolSafeZone
SchoolSafeZone is designed to use the minimum information necessary for positive recognition and reward redemption. Local businesses should receive only what is needed to validate a reward, not discipline records, personal-device data, or sensitive education records.
5. How Information Is Used
- Operate school phone-policy and related school-authorized workflows
- Provide parent-controlled Family features within the applicable platform rules
- Provide legitimate institutional device-management functions where Zonifyr has the required vendor access and the customer has authority to manage the device
- Support privacy-preserving recognition and reward redemption through SchoolSafeZone
- Maintain security, reliability, support, auditing, and legal compliance
6. Location and Device Data
- Zonifyr Schools does not collect continuous location data from personally owned student devices. Zonifyr Family does not provide personal-device location telemetry to schools.
- If a future Zonifyr Managed deployment uses device-management location or device-status capabilities, such processing will be limited to legitimately managed devices and the capabilities permitted by the applicable platform and customer authorization.
7. Retention and Deletion
- Retention periods will be defined by product, school contract, legal requirements, and operational need.
- Deletion, return, and account-termination workflows will be documented and tested before production school deployment. Parent/student rights requests will be handled according to the applicable legal and contractual process.
8. Security
- Encryption in transit and, where appropriate, at rest
- Server-side role-based authorization and tenant/school isolation for school records
- Audit logging for material school-record mutations and restricted internal access
- Data minimization, secure secrets management, and controls intended to prevent sensitive information from appearing in logs
9. Sharing and Service Providers
- School records may be shared with the applicable school/district and authorized service providers only as needed to provide the service and subject to applicable contractual/privacy requirements.
- Zonifyr does not intend to sell student data or use school student data for advertising. SchoolSafeZone merchants are not given student discipline records or personal-device telemetry.
- A current subprocessor list and product-specific disclosures should be maintained as the production architecture is finalized.
10. Rights of Parents and Eligible Students
- Access rights are handled according to the applicable product, law, and school relationship.
- Correction/amendment requests for school education records may require coordination with the school or district that controls the record.
- Deletion requests are handled according to applicable law, contract, retention obligations, and the product involved.
Zonifyr will provide clear request channels before production deployment.
11. Changes to This Policy
Zonifyr may update this policy as products, platform approvals, laws, and data practices evolve. Material changes will be communicated as required by applicable law or contract.
12. Contact
Zonifyr Inc. | privacy@zonifyr.com