Privacy

Mochilu is the family's place to look after a child, in one home or two: calendar, parenting time, photos, expenses, conversations, child profile, documents and school notices. This page says what we collect, where it goes and what we don't do. The service is run by Rômulo Carvalho (contact: romulorgc@gmail.com).

What we collect

• Your display name. What your family calls you. We don't ask for a surname or ID.
• Children's details. A first name or nickname, a color and, if you want, the grade, the date of birth and a profile photo.
• Calendar items and parenting time. Events and tasks, with dates, places, notes, checklists, comments and who is doing it; the parenting-time schedule between homes, day-swap requests and proposed changes.
• Family photos. The photos family members choose to upload, with a caption and a "Moment" mark. When a photo reaches our server it is resized and its location and camera data (EXIF/GPS) are removed.
• Child profile. Emergency contacts, who can pick up, allergies, conditions, medicines, blood type, pediatrician, health insurance, school, sizes and routine — only what you fill in. Health data is saved only after your specific consent.
• Documents. Files (PDF or image) you add, such as a birth certificate or an insurance card.
• Expenses. Amount, currency, date, category, split, note and, if you want, a photo of the receipt. Mochilu never moves money and never connects to a bank.
• Conversations. Messages, handoff notes and attachments shared in family conversations.
• Notices you ask to read. The notice text, up to 20,000 characters. The text is read on your phone first. The image is only sent when the phone can't read the text well, and only if you agree to AI reading.
• Your device and account. The app creates an anonymous account on the device. We store a random device identifier, a hash of its secret, the language and the time zone. To send notifications, we store the notification token that Apple (iPhone) or Google (Android) gives the device. We store a salted hash of the network address, only to limit abuse. There is no email and no password.
• Subscription status. Apple (App Store) or Google (Google Play) processes the payment. We receive the transaction identifier or purchase token and the expiry date, never your card.
• Your choices. The version of each consent you accepted (AI reading, children's photos, health data) and when.

Consent for children's data

Children's photos and health data need special care. That is why the app asks for your consent as a parent or guardian, prominently and separately from everything else, at the first photo and at the first health detail. You can withdraw each consent in Settings; from then on nothing new of that kind is sent. What was already sent stays visible to the family until you delete it, and deleting is for real.

Where it goes

• Our server. Data and files are stored on a server rented by the person who runs the service. A backup copy of the database is made every hour and kept for 48 hours on the same server.
• Notifications (Apple and Google). To let the right people know, the server sends Apple (iPhone) or Google (Android, through Firebase Cloud Messaging) a short sentence and the device token. The sentence never includes the text of a message, health details or the title of a health expense.
• AI reading (only with your consent). The text of a notice (and, when needed, an image) goes to OpenRouter and to the model provider it uses, with zero retention and no training on your data. Children's names never go to the AI: our server matches the names to the notice. Family photos, the child profile, documents, expenses and conversations never go to the AI.
• Apple and Google. For purchases and subscription notices: Apple on the App Store, Google on Google Play. On Android, Google also checks the purchase for us.
• No one else. We don't sell or share data for advertising.

How long we keep it

• The original of a notice (text and images) is deleted 30 days after you finish reviewing it, or 30 days after an abandoned draft. Images are deleted right after reading. The calendar items you approved stay, marked "source removed".
• A file that is uploaded and not used within 24 hours is deleted.
• A basic activity log (who did what, never the content) is kept for 180 days. Command receipts, used only to avoid duplicates, are kept for 90 days.
• When someone leaves the family, what was shared (items, photos, messages, expenses, swaps) stays for the others, with the writer's name; what was private to that person is deleted. When the family is dissolved, everything in it is deleted, files included.
• Everything else stays until you or your family delete it, or until you delete your account.

What we don't do

• No ads, no data sales, no tracking across apps or websites, no behavioral profiles.
• No training of AI models on your data.
• No location: the app doesn't ask for your location and removes location from photos.
• No child accounts. The app is for adults.

Who sees what inside the family

Each person sees only what their role allows. Parents and guardians have the same power, and none can remove another. Every photo, document and item has "Who sees": family, parents only, some people or only you. Expenses are seen only by the two people involved. Conversations, only by the people in them. The child profile shows each role only its part (a helper sees the emergency section, not the health insurance; a teacher doesn't see the profile). A teacher can send notices but never sees the family calendar. Paying for the plan never gives access to anything.

Your rights

You can export your data and delete your account inside the app (Settings). You can also ask by email: see the "Delete my data" page. You can withdraw the AI reading, photo and health consents at any time; readings not yet sent are cancelled.

Contact

romulorgc@gmail.com