Well Grounded privacy policy

Through the app, nothing. We don’t receive, store, sell or share any information about you or your children from Well Grounded. It has no accounts, no sign-in, no analytics, no advertising, no tracking and no code from other companies.

The app makes no internet connections of its own. The only things that go online are Apple’s: the App Store checking your purchases (whether Plus is on, and which version of Well Grounded you first downloaded), and taking care of it when you buy, restore or manage Plus. A link you tap, such as this policy, opens in Safari.

This web page has no advertising, no tracking cookies, no chat and nothing from other companies. enaayah.com counts visits with its own first-party analytics only if you agree when it asks; the app has none. Like most websites, the server that delivers it may keep a short technical log (such as the internet address a request came from) to keep the site running and safe. That log is not linked to the app or to your family.

If you email us

If you write to us, we receive your email address and what you write, including any attachments, and use them only to answer you. We never add you to a list or share what you send. Our email is hosted by Google. Please don’t put your children’s names or photos in emails. We delete the conversation 12 months after your last message, or sooner if you ask.

If you write from the app (Settings, then Help and feedback), it opens your own email app and adds one line at the end: the app’s version and build, the iOS version and the device model, so we can help. Nothing else is added, you can delete that line, and nothing is sent unless you send it.

Now and then, in Settings, the app may ask Apple to show its standard rating prompt; Apple decides whether it appears, and nothing is given for a review. To avoid asking too often, the app keeps the version and date it last asked, on the device only. They are never sent anywhere.

If you had the first Well Grounded

The first Well Grounded (version 1.0, from 2017) included tools from other companies: Google AdMob and Vungle for advertising, OneSignal and Firebase for notifications, and Firebase for analytics. This version is a complete rewrite and has none of them. The first time it opens, it removes the settings and files those tools left on the device. It also copies your children, their pictures and your history into the new app, once, on the device, turns your old cards into suggestions, and then deletes the first app’s own data file.

These stay on your iPhone or iPad, and in your device’s own backup if you use one:

• Your children’s first names, birth years and colours, and a picture if you choose one. The picture comes from your photo library through Apple’s photo picker, so the app only receives the one photo you pick.
• Your name, and a second grown-up’s if you add one, used on cards and summaries.
• The cards you agree together, your child’s finger signatures, and “I agree” recordings if you turn them on.
• History of draws, kept for as long as you choose (3 months, 1 year or for ever; 1 year unless you change it).
• Crystals and stickers, worked out from that history. For each good action, whether its crystal and sticker come every time or as a surprise in the draw, and, for a surprise draw, which it brought: a crystal, a sticker, both, or one of your own surprises. The rewards you set for each child (for example “Ice cream trip, 3 crystals”), what they’re saving for, and the rewards they’ve spent crystals on.
• The name your child gives their sticker book and its pages, and their wishes.
• Groups you make, like “Big ones” and “Little ones”, and who is in them. Group names never appear on a widget, the Lock Screen or a summary.
• “What helps me”: up to three calm-down ideas each child chooses with you (like “Counting slowly”) and a few words of their own. They show on the child’s page and as a reminder when something happens, never on a widget, the Lock Screen or a summary.
• Installed action packs: sets of suggested actions and cards. They hold words only, never anything about a child.
• Moments a teacher or another grown-up sent you with a code, kept in their own “From others” list.
• Your settings, such as which tip sources you chose.

We never ask for surnames, dates of birth, school grades, health information or contact details. Where you type, the app refuses common health, learning-needs and safeguarding words, and doesn’t keep them.

Feelings

Well Grounded doesn’t ask or record how your child feels. An earlier version had How I feel, where a child could pick a face. Any faces it kept are deleted from the device, once, the first time this version opens, and restoring an older backup file leaves them out.

Your device’s own backup

Well Grounded doesn’t sync with iCloud. If your iPhone or iPad backs up to iCloud or a computer, that backup includes Well Grounded’s data like any other app’s, apart from side notes and photos of what happened, which are always left out. We can’t see that backup.

The parent lock makes sure a grown-up is there for anything that starts, changes or ends a consequence or surprise, or spends a crystal. In a family it is always on, and it is the parent PIN: 4 to 8 digits that only the grown-ups know. It never takes Face ID, Touch ID or the device passcode instead, because a child may know the passcode.

The parent PIN asks before starting a draw with Good or Not so good, ending a card, giving or spending crystals, changing rewards, sit-downs and changing cards, sharing anything (including the sticker book and the Pact), sending or adding moments with a code, adding, removing or sharing action packs, and opening a child’s page that has its own PIN. A child’s page is their own space: looking at their jar, sticker book, cards and their own history, reading tips, adding wishes and naming their sticker book never ask.

Settings opens with the device’s own unlock: Face ID, Touch ID or the passcode. Anyone who knows the device’s passcode can open Settings, look, and choose a new parent PIN there, so keep the passcode to yourself. Inside Settings, the parent PIN still asks before changing a child, their cards or rewards, turning on voice features or sharing, sharing anything, and removing a child or deleting data. Everyday choices, such as sounds, looks and the jar’s size, don’t ask. Buying Plus is confirmed by Apple with your Apple Account. On a device with no passcode, Settings asks for the parent PIN instead. The app never sees your face, fingerprint or passcode: iOS checks them and tells the app only yes or no.

You can set the parent PIN when you first set up Well Grounded, or the first time a grown-up needs it, after the device’s own unlock. It is kept in the device’s Keychain as a salted hash, never as the PIN itself, and stays on this device only. After five wrong tries, it rests for five minutes. If it is forgotten, a grown-up changes it in Settings › More › Parent PIN, after Face ID, Touch ID or the device passcode; the old PIN isn’t needed. On a device with no passcode, turn one on and Settings opens with it.

A child’s own PIN

Each child can have their own PIN of four numbers, if you want one. You choose it together in Settings › your child’s name, and it is changed or turned off only there, after the parent PIN. It only opens that child’s own page, so a brother or sister can’t look in, and it never starts or changes anything. The parent PIN opens every child’s page too. It is kept like the parent PIN: in the Keychain, on this device only, as a salted hash. It is never in a backup file, a share, a summary or iCloud; the app records only that a PIN was chosen. After five wrong tries, that child’s page rests for five minutes, with no timer shown. Child PINs are for families only, not Teacher mode.

Saying “Agreed”

If you turn on Agree by saying “Agreed” in Settings › More (it is off until you do), your child can tap Say “Agreed” and say it instead of signing. The screen shows “Listening…” while it listens. It stops as soon as it hears the word, or after 6 seconds.

• Checked on the device only. The app uses Apple’s speech recognition only where it can run on the device itself. If the device or its language can’t do that, the option isn’t offered. The sound is never sent to us, to Apple or to anyone else.
• No recording and no words. No sound is saved and no words are kept. The app saves only the fact that “Agreed” was heard: on the card, if it was said at a sit-down, or on that draw in the history, if it was said before a draw.
• It checks the word, not the person. It never makes a voiceprint and never tries to recognise whose voice it is.
• A no never counts. “No” or “I don’t agree” is not an agreement, and “That’s not what happened” is always there.
• Always optional. Signing always works. You can turn this off in Settings, and remove microphone and speech recognition access in iOS Settings.

The fact that “Agreed” was heard goes from a card when the card is changed or removed, and from the history when that draw is tidied away (never, if you keep history for ever). Removing the child or Delete everything removes it at once. If you make a backup file, it is in that too.

“I agree” recordings

If you turn on Voice agreements in Settings › More (off until you do), your child can record “I agree” to a card at a sit-down, for up to 8 seconds while holding the button, and hear it later. The recording stays on the device, inside that card, and in your device’s own backup like the rest of the app’s data. It is never sent to us, transcribed or analysed. It is deleted when the card is changed or removed or its signature runs out. Settings › More › Your data › Delete all voice recordings removes every “I agree” recording at once. Signatures stay; a card that was agreed only by a recording then needs agreeing again at a sit-down. Side notes and photos have their own button, Delete kept notes and photos. Recordings are never put in the backup file.

When you see it differently

If your child says “That’s not what happened”, or doesn’t sign before a card is drawn, each of you can give your side for your next sit-down:

• Voice notes, recorded only while you tap Record, up to the length you choose in Settings (30 seconds, 1 minute or 2 minutes; 1 minute unless you change it), or a typed note instead. The grown-up’s side is needed before drawing anyway; the child’s side is always optional.
• A photo of what happened, only if you turn it on in Settings. It is taken with the camera, never chosen from your library, and never saved to your library. Faces are found and blurred on the device before the photo is kept, and the unblurred photo is never stored. If the device can’t check for faces, no photo is kept. Location and other photo details are removed.

These are kept apart from everything else, as protected files on this device only. They are left out of iCloud and computer backups, the backup file, widgets and the summary for a professional. Your child can see what is being kept about them on their own page. They are deleted as soon as the sit-down settles it, when it is let go, when a draw is undone, and in any case after 14 days. Settings › More › Your data › Delete kept notes and photos removes them at any time.

Well Grounded asks for a permission only when a feature needs it. You can change any of them in iOS Settings › Well Grounded.

• Notifications: to tell you when a card has finished. You are asked the first time a timed card starts.
• Microphone: only while an “I agree” recording or a side note is being made, and only while your child taps Say “Agreed”, if you turned that on. You are asked the first time you record, or when you turn on Say “Agreed” in Settings.
• Speech recognition: only for Say “Agreed”, and only on the device itself. You are asked when you turn it on in Settings.
• Camera: only if you turn on Photo of what happened, and only when you tap Take a photo.
• Face ID or Touch ID: only to open Settings, to set or change the parent PIN, and in Teacher mode to set a new PIN if it is forgotten.
• Photos (add only): only when a grown-up taps Save to Photos in the sticker book (see The sticker book). The app asks only to add pictures, never to read: it can’t see, read or change anything already in your Photos. The sticker book’s pages are the only thing it ever puts there. The app never asks to see your photo library: choosing a child’s picture uses Apple’s photo picker, which gives the app only the one photo you pick.
• Motion: tilting the device moves things on screen, like the crystals in the jar and the bits you scratch away in Scratch and see. While a card is shown, the app notices if the device is lying flat on a table, to turn the card towards your child (“Face to face”). Motion readings are used in the moment and never stored. No permission prompt is needed.
• Location, contacts, health data and advertising identifiers: never used.

The Home Screen widget shows how full the jar is and, while a card is running, the time it ends, as a clock time (“Until 5:15 pm”): the whole family’s crystals, or one child’s jar if you pick a child in the widget’s settings.

Children’s names and card words appear on a widget, in a Live Activity on the Lock Screen or in a reminder only if a grown-up turns on Show the card on the Lock Screen in Settings. It is off by default. Without it, the Lock Screen shows only that a card is running and when it ends, a reminder says only “A card has finished”, and a child’s widget shows a coloured initial and never shows that their card is running.

To do this, the app shares a small summary with the widget on the device: each child’s first name (so you can pick one in the widget’s settings) and colour, their crystal count, the emoji and price of what they’re saving for, and whether a card is running, with its words only if Show the card on the Lock Screen is on. It is never sent anywhere. If you pick a child in the widget’s settings, iOS keeps that choice with the widget until you remove it.

Tip of the day. Home shows a short parenting tip each day, from the faiths, philosophies, poets and thinkers you choose in Settings. The tips are part of the app: nothing is fetched from the internet, and which sources you choose stays on the device. Tap ⓘ on a tip to see its source, its exact words and any translation.

Shortcuts and Siri. You can set a shortcut or the Action button to open “Good” or “Not so good” for one child. The child is chosen in the Shortcuts app, and children’s names are never added to Siri phrases. The Shortcuts app keeps the child you chose (their first name) with that shortcut until you delete it, and copies it to your other devices if you use iCloud for Shortcuts. First-time hints are shown by Apple’s TipKit, which keeps its state on the device.

Sounds. Sounds are made on the device. They follow the ring/silent switch, never interrupt music, and are off in quiet mode or when turned off in Settings.

Nothing leaves Well Grounded on its own. Each thing below is made only when a grown-up asks, and goes only where they send or save it. We never receive any of it.

Backup file

Made only when you ask, past the parent PIN, in Settings › More › Moving to another device. It is locked with a passphrase you choose, at least 8 characters long, using AES-GCM encryption. We cannot open it, and nobody can without the passphrase. You choose where it is saved.

It holds your names, your children (first names, birth years, colours, wishes and their picture if you added one), cards and signatures, history, rewards and crystals, groups, “What helps me”, the sticker book’s names, installed action packs, when any free Plus months began and which children were kept, and the keys for any codes you made or typed in (so links keep working after a restore), together with what linked grown-ups sent. Voice recordings, side notes, photos of what happened, the parent PIN and children’s own PINs are never included; a card agreed only with an “I agree” recording comes back as agreed aloud, without the recording.

Summary for a professional

A PDF you can choose to show someone like a family therapist, counsellor or teacher. It is made only when you ask, past the parent PIN. It is about one child and holds their first name and age, counts and patterns from the last 2, 4 or 8 weeks, their current agreements, and the name of the grown-up who made it. It never holds photos, recordings, side notes, signatures, groups or “What helps me”. The file is removed from the app when the share sheet closes, and you decide who receives it. The summary is part of Well Grounded Plus.

The Pact

A printable PDF of every child’s first name and signed cards, made only when you ask, in Settings. It never includes history, photos, recordings or signatures. You decide who receives it.

The sticker book

Sharing the sticker book is off until a grown-up turns it on in Settings › More, past the parent PIN. Each share asks for the parent PIN again. You choose the whole book as a PDF or one page as a picture. It shows the book’s name (until your child renames it, that is their first name, as in “Zara’s sticker book”), its page names and your child’s stickers. What each sticker was for, and its date, are added only if you switch that on for that share. It never includes crystals, prices, brothers or sisters, not-so-good moments, photos, recordings or signatures. The file is made on the device when you ask, and removed from the app when the share sheet closes. You decide who receives it.

Save to Photos. In the same place, behind the same switch and the parent PIN, a grown-up can add the open page, or every page with a sticker on it, to Photos as pictures. They show only the pages and their stickers: no name, book name, page names, reasons or dates, and no location or other details. They are drawn in memory and added straight to Photos; the app keeps no other copy. The first time, the device asks whether Well Grounded may add to Photos. It asks only to add, so it never sees, reads or changes your other photos, and photos of what happened are never saved there. Once in Photos, the pictures are yours and follow your Photos settings, such as iCloud Photos.

Sharing the sticker book and Save to Photos are not part of Plus, and are never available in Teacher mode.

Action packs

An action pack is a set of suggested actions and cards, shared as a .wgpack file. Thirteen come with the app (five themes and eight games). You can share your family’s own ideas as a pack, only when you ask and past the parent PIN. A pack holds categories, actions and cards in your family’s words, a title, a description, an optional author name, tags, an age range, its language and its licence. It never holds children’s names, ages, signatures, photos, voices, crystals or history.

Before the file is made, the app swaps any family names it knows for “my brother or sister” or “a grown-up”, leaves out anything with a phone number, email address or link, and shows you what it removed. A pack you receive, or one that comes with the app, is checked the same way before anything is added. Adding a pack only adds suggestions to the library: it changes nothing for any child, and every action still needs a sit-down and a signature.

Packs travel as files, by AirDrop, Messages, Mail or Files. There is no catalogue, no upload and no server, and we never see them. A pack isn’t private: anyone who gets the file can read the words in it, so share only what you’d be happy for anyone to see. It carries a seal, so a file changed by accident or on the way is refused; the seal is a tamper check, not encryption. Any tag you choose, such as a theme or a faith, is stored only inside the pack and on your device. You can remove installed packs in Settings › More › Action packs without touching anything already agreed.

A teacher, co-parent, guardian, tutor or club leader can send a child’s moments to that child’s parent. They can do this only with a code the parent made for them in the app (in Settings › the child’s name › From others › Grown-ups who can send), past the parent PIN. The code starts with the child’s first name so you can each tell codes apart; the name is not part of the key.

The code is the only key. Everything sent is encrypted on the sender’s device with a key made from the code (PBKDF2, HKDF and AES-GCM), and in the app it can be opened only on the parent’s device that made the code, or one restored from its backup file. The sender’s device keeps the same key to seal with, and anyone who had both the code and what was sent could read it. So give the code in person or through your school’s usual channel, and make a new one if it goes astray. The keys are kept in the device’s Keychain, on that device only. What is sent travels as a link, a code or a file through whatever the two grown-ups already use, such as Messages, Mail or AirDrop. A copied code stays on that device’s clipboard for ten minutes at most. There is no server, and we never see it.

What is sent

One child’s moments, for one moment, today, this week or this month: the date, whether it was good or not so good, the words, the card if one was drawn, and whether the child disagreed. Also the sender’s name, role and subject, and an optional short note, which the app refuses if it looks like health, learning-needs, family or safeguarding information. The child’s name is never inside: it becomes “your child”.

Other children’s names are taken out before anything is sealed, as far as the app can tell. The other children on the sender’s device (brothers and sisters, or the rest of a class) are always replaced, and any other word that reads as a person’s name is replaced with “a classmate” (or “someone” at home), using the device’s own built-in name detection. A name written in lower case, or one the device doesn’t recognise as a name, can slip through. That is why the sender sees the exact words before choosing to send, and the parent sees them again before choosing to add them.

What the parent sees

The parent sees a preview and decides whether to add it, past the parent PIN. Added moments sit in their own “From others” list and change nothing (no crystals, stickers or history) unless the parent brings one to a sit-down or gives a crystal for it. They are tidied away with the rest of your history, on the schedule you choose. The sender’s device keeps only the dates it sent on. A parent can rename a link, or remove it so that its code stops working, at any time; what was already sent stays until you remove it.

A grown-up can choose “A teacher with a class” in Settings › More › For teachers › Who uses this app. Teacher mode is part of Well Grounded Plus. It needs a parent PIN, which is then asked for every time, Settings included, instead of the device passcode. If it is forgotten, Forgot the PIN? sets a new one after Face ID or Touch ID, never the device passcode, which a pupil may know. Groups become classes (up to 150 pupils in all), and the app offers classroom actions and consequences.

Everything else works as for a family: pupils’ first names, birth years, cards, signatures and history stay on the device and are never sent to us. In Teacher mode, recordings, photos, Say “Agreed”, Lock Screen details and the tip of the day are off.

A teacher using Well Grounded at school must follow their school’s data protection policy. The school, not us, decides what is recorded about pupils and for how long. Don’t record surnames, or health, learning-needs, family or safeguarding information; the app refuses common words of that kind.

Well Grounded Plus is an optional subscription, paid monthly or yearly. It adds more children, more rewards in the jar, 40 sticker packs, choosing what each good thing earns and bonus goals, looks for the jar and sticker book, This week, the summary for a professional, more than three tip sources at once, and Teacher mode. One child, and everything that keeps a family safe and fair, are free, and nothing a child has earned ever depends on Plus.

• Plus is bought and managed entirely through Apple. We never see your name, card, address or any payment details; Apple takes the payment and keeps the receipt.
• To know whether Plus is on, the app asks Apple’s StoreKit on the device. There are no accounts and no server of ours, and nothing about who has Plus is collected or sent to us.
• The yearly plan starts with 7 free days for new subscribers. You can cancel any time in Settings › Apple Account › Subscriptions, or from Manage or cancel in the app. When Plus ends, nothing is deleted: every child, card, crystal and sticker stays where it is, and the app just asks before anything that needs Plus.
• Families who already had Well Grounded keep, for ever, every child they had when they updated, and get three months of Plus free. To know this, the app asks Apple, on the device, which version you first downloaded; nothing is sent to us. The app remembers on the device when the free months began and which children were kept, and both travel in your backup file. The start date stays even after Delete everything, so the free months don’t start again. It is also kept in the device’s Keychain (this device only, never synced), so deleting and reinstalling the app never starts them again. It is only a date: nothing about your family or your children, it is never sent anywhere, and it stays in the Keychain if the app is deleted.
• If you bought the one-time unlock in the first Well Grounded, it still gives you Plus, for ever, unless Apple refunded it.
• Ask to Buy works as with any App Store purchase: if a child’s own Apple Account is in a Family Sharing group with Ask to Buy on, they can’t buy Plus unless the family organiser says yes. In the app, the Plus screen opens only for a grown-up: in Settings, which opens with the device’s own unlock, after the parent PIN, or once at the end of a grown-up’s own first setup, before any child’s page, with Not now to skip it.

• History: for as long as you choose in Settings › More › Your data › Keep history (3 months, 1 year or for ever). Older history is deleted automatically. When an older moment goes, the sticker it earned stays, with its date and where it is stuck in the book; what happened, the words and any signature go. History brought across from the first Well Grounded is kept until you remove it, with Settings › More › Your data › Remove history from the earlier app.
• Side notes and photos of what happened: until the sit-down, and never more than 14 days.
• “I agree” recordings: until the card is changed or removed, or its signature runs out. A recording on a card that was never signed is removed.
• Files made for sharing: a summary, sticker-book or code file is removed when the share sheet closes, and a pack file the next time the app opens. The latest Pact stays in the app until you make a new one, remove a child or delete everything.
• Everything else: until you change it, remove the child, or delete everything.

Removing a child

Removing a child (in Settings, tap their name, then Name, age and colour, then Remove, such as “Remove Zara”) deletes everything about them. That means their own PIN, their cards, signatures, recordings, history, crystals, rewards, group membership and “What helps me”, any kept side notes or photos, their reminders in Notification Centre, any card of theirs on the Lock Screen, and any summary, Pact or sticker-book file the app made for sharing. It also removes their links to other grown-ups (with the keys behind them) and what those grown-ups sent.

Delete everything

Settings › More › Your data › Delete everything removes, from the app, all children, groups, cards, signatures, recordings, side notes, photos, rewards, crystals and history, and your settings. It also removes installed action packs, the parent PIN, every child’s own PIN, every link to another grown-up with its key and everything they sent, every reminder in Notification Centre and card on the Lock Screen, the widget’s summary, and any summary, Pact, sticker-book, pack or code file made for sharing.

It keeps only a few small facts, so nothing is repeated: that the first Well Grounded’s data was already copied across, when any free Plus months began (or that the one-time unlock was found), and that Plus was already shown once at the end of setup.

Deleting the app removes its data from the device. iOS may keep a few small items in the device’s Keychain after the app is deleted: the parent PIN, children’s own PINs and any code keys (use Delete everything first if you want those gone too; installing the app again also removes them before setup starts), and the day any free Plus months began. Delete everything does not remove that date, so the free months don’t start again; it is only a date and is never sent anywhere.

A backup file, summary, Pact, sticker book or pack you have already sent or saved somewhere else is outside the app, so it is yours to delete there.

Well Grounded is made for parents to use with their children. The app collects no personal information from children, or from anyone. Settings that affect privacy start on the private side: nothing shows on the Lock Screen, and voice features, photos and sticker-book sharing stay off until a grown-up turns them on. In a family, the parent PIN is always on. A child’s page is their own space: they can look and play, and anything that starts, changes or ends something needs the parent PIN. The Plus screen and any request to buy open only for a grown-up (in Settings, after the parent PIN, or once at the end of a grown-up’s own first setup, before any child’s page, with Not now to skip it), and nothing about Plus appears on a screen made for a child. Apple’s own messages about a subscription, such as a billing problem or a price change, are held and shown only when a grown-up opens Settings, never over a child’s screen.

There is a page in the app to read together: Settings › Privacy › Explain it to my child.

For children: the short version

If a child is worried about their safety

If a child types something that sounds like a worry about their safety (for example in their wishes or their side of what happened), the app thanks them, tells them a grown-up they trust can help, and doesn’t keep what they typed. It never sends anything anywhere.

If you’re worried about a child’s safety, talk to someone who can help, such as their school, your doctor or a children’s helpline. Call the emergency services if a child is in danger.

Because everything is on your device, you are in charge of it. You can see, change, take away or delete it yourself, at any time, without asking us. Apart from any email you choose to send us, we hold nothing about you or your children, so there is nothing for us to hand over, correct or delete on our side.

• See it: each child’s page, cards, history and what is kept for a sit-down are all in the app.
• Change it: edit names, cards and rewards, or turn features off, in the app.
• Take it with you: make an encrypted backup file in Settings › More › Moving to another device.
• Delete it: remove a child, choose how long history is kept, or use Delete everything. To have an email to us deleted, just ask.
• Limit it: turn permissions off in iOS Settings › Well Grounded at any time.

If you have a question or a concern, write to us at contact@enaayah.com. You can also contact the data protection authority where you live.

If we change this policy, we will update this page and the date at the top. If a change affects what the app does with information, we will also say so in the App Store notes for that update.

Questions about privacy: contact@enaayah.com.

Help with the app: Well Grounded support.

Well Grounded is made by Enaayah Software Development and Services Private Limited.

This policy covers the Well Grounded app and its pages on enaayah.com. Enaayah’s games and the rest of the website have their own policy.