Privacy Policy.

The controller responsible for processing your personal data is:

Jebby is in its launch phase, with formal legal entity registration in progress. This policy is valid and binding from its publication date. Once the legal entity is formed, this policy will be updated with the controller’s new identity, and you will be notified by email.

Given Jebby’s current scale, no Data Protection Officer (DPO) has been appointed. Appointment is not currently required under Article 37 of the GDPR. This decision will be reassessed as the service grows.

Jebby collects only the data necessary to provide the co-parenting service. The data is organized by who it relates to.

2.1 Adult users

Location. We do not collect your precise location (GPS), and the app does not ask for access to your device’s location.

2.2 The invited other parent

The other parent only joins Jebby after being invited by email by a user and accepting the invitation — acceptance is always required. Without it, no account is created and no access is given to any data about the child or the routine.

Before acceptance, we only process: the email address provided by the inviting user; the information contained in the invitation itself (the inviter’s name and the child’s name); and the invitation’s status (pending, accepted, expired, or declined) and its dates.

If you receive an invitation you weren’t expecting, you can ignore it. If you’d like your email deleted, write to legal@jebby.app and we will review your request. The invitation itself (the date it was sent and its status) is part of the shared custody records and may appear in the Custody Reports of the user who invited you.

Once you accept the invitation and create an account, the categories in section 2.1 and all rights under this policy apply to you.

2.3 Children

Jebby does not collect data directly from minors. Data about children is entered by their parents or other responsible adults, and includes: name, date of birth (optional, if you complete the child’s profile), custody routine, associated events (for example, school or extracurricular activities), and swap schedules.

Date of birth is optional and is used so it can appear on the Custody Report (see section 7). If you don’t provide it, the report is generated without that information.

2.4 Website visitors

When you visit Jebby’s website, our hosting and traffic-protection providers log your IP address and technical request data (page visited, date and time, browser type, and referral source). See section 13.

• Directly from you, when you create your account and use the app.
• From the other parent, when they invite you (your email) and when they create or share events, assign calendar days, or make swap requests concerning you.
• From Google, when you use Google Sign-In: we receive your name, email, and Google account identifier.
• From RevenueCat, which receives your subscription status from the App Store and Google Play.
• Automatically, through your device and our servers.

We do not use your data for direct marketing without consent. We never sell data to third parties. We do not make automated decisions that produce legal effects concerning you.

Where processing is based on your consent (marketing communications), that consent is requested separately, never bundled with acceptance of the Terms of Use. You can withdraw it at any time, as easily as it was given, without affecting the lawfulness of processing carried out before the withdrawal.

Jebby is designed for parents and other adults responsible for children (for example, guardians). Minors are not permitted to create accounts on the platform.

By entering a child’s data, you declare that you have the legitimacy to do so. While the account is active, the data is managed by the adult account holders. Shared custody records concerning children remain in place after one account is deleted, as described in sections 10 and 11.

Each child’s data (name, routine, and shared events) is visible to both parents in the co-parenting circle. Jebby applies technical measures to ensure this data is not accessible to unauthorized third parties.

After accepting the invitation, the other parent sees: the calendar and the days assigned to each parent, events you mark as shared, swap requests and the messages you write in them, the children’s names, and the role you chose. Events you create as private are not visible to the other parent.

This sharing is inherent to the service and is under your control. Only the user who set up the routine can edit it; the other parent can create events and make swap requests.

• What it is: a PDF summary of custody days and events for a date range you choose.
• What it contains: personal data about you, the children, and, indirectly, the other parent (for example, the days assigned to each parent and shared events).
• How it’s sent: it’s generated on request and emailed to your account’s email address through our email delivery provider (Resend). It is not sent to any other recipients.
• Retention: Jebby does not keep a copy of the file in its own systems after sending, and only retains the technical record of the send (date, recipient, and status). Our email provider (Resend) retains sent messages and delivery logs, in the United States, for 30 days, after which they are deleted. For security and abuse-prevention purposes, the provider may review message samples. See sections 9 and 10.
• After delivery: the email and PDF remain in your inbox, outside Jebby’s control. You should protect it and only share the report lawfully, keeping in mind that it contains other people’s data.
• Document value: the Custody Report is not, at this time, a certified document (see Terms of Use).

Processors. We use the following processors, under data processing agreements (DPAs). Some process data in the United States (see section 9):

Google Sign-In. Google LLC processes authentication data under its own Privacy Policy. Jebby only receives your name, email, and Google account identifier.

App Store and Google Play. Apple and Google process payment and subscription data as independent controllers.

RevenueCat. Purchases and subscriptions are managed through RevenueCat, which acts as an intermediary between the app and the App Store or Google Play and processes data on behalf of Jebby. RevenueCat receives the internal identifier of your Jebby account (not your name or email), your subscription and trial status, and technical purchase data, and reports your subscription status to us. It does not receive your card or payment method details.

Other recipients. We do not share data with external third parties without consent, except where required by law (for example, by order of a competent authority).

Our providers are based in, or process data in, the United States. This includes our email delivery provider, which retains messages in the United States regardless of the region it sends from. These transfers rely on GDPR safeguards: the European Commission’s adequacy decision (Art. 45), via the EU-US Data Privacy Framework, which the providers declare adherence to, and/or Standard Contractual Clauses (Art. 46(2)), provided for in their respective data processing agreements.

Under the GDPR, you have the following rights:

Most of these can be exercised directly in the app (for example, under Privacy & Security, “Export my data,” and under Settings, “Delete Account”). You can also contact us at legal@jebby.app.

Response time: we respond within one month of receiving the request. This period can be extended by up to two further months where necessary, taking into account the complexity and number of requests. If that happens, we will inform you of the extension and the reasons within one month. We may ask you for additional information to confirm your identity.

Shared custody records. Calendar history, past requests, invitations, and reports are not deleted, even if both parents delete their accounts. They relate to the co-parenting relationship and the children, not just to you, and the other parent may need them long-term, including in legal proceedings. They remain visible to the other parent after your account is deleted and anonymized. The basis is the other parent’s legitimate interest in maintaining the children’s routine history (Art. 6(1)(f)) and, as regards the right to erasure, the exception under Art. 17(3)(e) GDPR (establishment, exercise, or defense of legal claims).

If you believe there is information about you that should not be retained, contact legal@jebby.app: we review each request under the GDPR.

These rights also apply to the other parent and to information other users have entered about you.

• Encryption in transit: all communications protected by TLS 1.2 or higher
• Encryption at rest: data stored in our database (Neon) is encrypted at rest with AES-256 by the provider
• Secure authentication: Google Sign-In with OAuth 2.0 tokens and email OTP verification
• Restricted access: only to staff with an operational need, subject to confidentiality obligations
• Security testing: periodic reviews before each release

In the event of a data breach, we notify the CNPD within 72 hours and affected users without undue delay, as required by Articles 33 and 34 of the GDPR.

The GDPR and Article 5 of Law No. 41/2004 apply: we only store or access information on your device with your prior consent, except where strictly necessary to provide the service.

The website uses Vercel Web Analytics, a cookieless analytics tool: it does not store or access information on your device, so it does not require prior consent under Law No. 41/2004. It collects aggregate traffic data (pages visited, device type, referral source), with no persistent identifiers that would let it track you across sites or sessions. The website also uses Vercel Speed Insights, which is also cookieless and measures page performance (such as load times) in aggregate, without identifying you. Processing is based on the legitimate interest in understanding and improving use of the website (Art. 6(1)(f)).

Beyond that, we only use strictly necessary cookies and identifiers, which also do not require consent:

We do not use advertising or third-party tracking cookies. If we introduce other analytics tools in the future that require cookies or consent, we will ask for your prior consent and update this policy.

IP addresses. When you visit the website or use the app, our infrastructure providers (Google Cloud, Vercel, and Cloudflare) record your IP address in their technical request logs. We do not store it in our own database for app users. We process it to serve the website and the app, ensure security, and prevent abuse (legitimate interest). It is kept only for as long as those logs last: 30 days for our API logs, and the period each provider sets for the website. We do not use it for advertising or to identify you individually.

In the event of substantial changes, we will notify registered users by email with at least 30 days’ advance notice. The version history is available on request at legal@jebby.app.

For privacy questions or to exercise your rights: legal@jebby.app. Response times are as stated in section 11.

Supervisory authority (Portugal):
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa
www.cnpd.pt · geral@cnpd.pt