Wenlo Privacy Policy

Last updated: September 25, 2026

This Privacy Policy explains how Wenlo Labs LLC, a New Jersey limited liability company ("Wenlo", "we", "us", "the app") collects, uses, and shares information when you use the Wenlo mobile application. By creating an account or joining a family in Wenlo, you agree to the practices described here.

If you have any questions, contact us at privacy@getwenlo.com.

What Wenlo is

Wenlo is a family location-sharing and ride-coordination app. Members of a household ("a family") share their real-time location with each other, request rides from each other, and receive notifications about each other's arrivals and departures. By default, your data is scoped to your own family.

There are exactly two exceptions, and both require an adult's explicit opt-in. First, carpools: Wenlo lets families coordinate carpools with other families (for example, parents taking turns driving kids to the same practice). When — and only when — an adult in your family affirmatively joins a specific carpool and accepts its sharing terms, a limited set of your family's information is shared with the other families in that carpool, for the duration of that carpool. Second, linked families: an adult may choose to be a member of more than one Wenlo family (for example, a relative who helps two households). In that case that adult's own live location appears in each of their families. A child's location and history never move between families this way — linked membership is adult-only, covers only the adult's own current location (never their family's), and either family can remove the link at any time. Both are described in the "Cross-family sharing" section below. Outside of these two opt-in mechanisms, no Wenlo data is shared beyond your family except with the infrastructure providers described here.

Information we collect

When you use Wenlo, we collect the following categories of information:

Account information

• Your email address and (if you use the email/password sign-in option) a password — passwords are stored only as hashed credentials by our authentication provider, Firebase Authentication; we never see or store your password in plain text
• Your name and role within the family (Guardian or Child)
• A profile photo, if you choose to upload one

Sign-in providers (Sign in with Apple, Sign in with Google)

You may also sign in to Wenlo using Sign in with Apple or Sign in with Google. When you do, the provider returns to Wenlo:

• A stable, opaque user identifier (so we can recognize you on subsequent sign-ins)
• An email address (which may be a real address or, for Apple, a private-relay address like xxx@privaterelay.appleid.com if you chose "Hide My Email")
• Your name, if you chose to share it

That's the only data the SSO providers share with us. We do not share data with Apple or Google in the other direction beyond the account-creation handshake — they don't see your family members, location, or any Wenlo activity.

Location information

• Your device's GPS coordinates (latitude, longitude, accuracy, heading, and speed), collected while location sharing is enabled. We collect more frequently while you are moving (for example, during a drive) and less frequently while you are still, to balance accuracy against battery life. If your device temporarily has no internet connection — for example, cellular data is switched off or you're on a plane — it may continue taking location readings and store them on the device only, for up to about 24 hours, then send them to us when a connection returns. Each stored reading keeps its original timestamp, is used solely to fill the gap in your own location history, and is never treated as a fresh reading — it will not move your live map pin or trigger arrival notifications as if it just happened. How often your device reports may also increase for a few minutes while a family member is actively viewing your location, and decreases again when they stop — so the map is freshest exactly when someone you've chosen to share with is looking, and your battery is spared when nobody is. When you view a family member's live location, we briefly record that you are viewing them (your member id and a timestamp, kept for a few minutes); we use this only to make their location fresher while someone is actually watching, it is not shown to other members, and it is not retained as a browsing history.
• The time of each location reading
• Your device's battery level and charging state, recorded alongside each location reading and periodically (about every 10 minutes) while the app is running
• Whether your device is currently inside any of the saved Places (geofences) your family has configured (e.g., Home, School)
• A road-aligned version of your recent trips, which we generate on our own servers by matching your location trail to the road network so the map can draw a clean route instead of a jagged line of points. This is a processed copy of the location data above, computed in-house — not a new kind of data — and a child's location trail is never sent to any outside company for this.
• A label describing how a trip looks to have been traveled — for example driving, walking, boating, a flight, or public transit such as a train, subway, or bus — which we compute on our own servers by comparing your trip's location trail to public transit maps (published station, stop, and route locations, and publicly available transit vehicle position data — public data we read in; your data is never sent out). This is a processed copy of the location data above, not a new kind of data collected from your phone. These labels are used only to describe your own trips to your own family circle — never for advertising and never shown to other families — and a child's location trail is never sent to any outside company to produce them.
• An occasional fresh location reading taken when a family member who is allowed to see you opens your place on the map and your last reading is stale. In that case our server asks your device to take a single new reading and send it, so the map isn't showing an out-of-date position. This collects the same location data described above; it just refreshes it on demand.

You can pause or stop location sharing at any time in your Wenlo profile. Because Wenlo is a family-safety app, if a device that was sharing stops reporting — for example, the phone loses signal or cellular data is switched off — we may notify that member's guardians (or, for adults, their family) that reporting stopped and approximately when. This alert describes the device's reporting status only; it never reveals any location the device did not already share, and it does not identify a cause. When reporting resumes, we may send the same people a one-time notice that it has.

Drive-completion notices (optional, off by default). A guardian can turn on per-member "drive reports": when that member's drive ends, the family's adults receive a notification with the drive's distance and duration (for example, "Adam completed a drive — 2.1 mi · 8 min"). A guardian may also set an optional per-member speed threshold; if a drive exceeds it, the family's adults receive a single notice that the threshold was exceeded. These notices are configured by guardians, are visible to the member they cover, are never sent for backfilled or repaired location history, and go only to adults in the member's own family.

Walk-completion notices. When a child family member finishes a walk, the family's adults receive a notification with the walk's duration and, when available, the number of steps for that walk (for example, "Adam completed a walk — 12 min · 892 steps"). These use only location and step information the family already sees in the app, are never sent for backfilled or repaired history, and go only to adults in the child's own family.

Family content

• Saved Places — addresses your family has labeled (e.g., Home, School, Gym), including the address text, latitude/longitude, and a notification preference per family member per place
• Ride requests and their lifecycle — pickup and destination addresses, who requested the ride, who claimed it, timestamps, and an optional note
• Emergency (SOS) alerts — when raised, the alert includes the originator's name and last known coordinates so other family members can respond
• "On my way" pickup alerts — when a guardian taps On My Way on a family member's card, we store who is being picked up and who is driving (first names), a one-time snapshot of the location where the pickup was requested, and a live estimate of the driver's arrival time. We use this solely to send that family member "on the way" and approach notifications (currently at about 10 and 2 minutes out). Pickup records are transient: they are deleted automatically when they expire (about 90 minutes), are overwritten by any new pickup for the same person, and are deleted with your family data.

Carpool information

• Carpools you create or join — the event/schedule details (title, destination, times, recurrence), which families are members, and which adult is coordinating for your family
• For each carpool, the children you choose to send as riders (first names) and their pickup addresses, and which adults have volunteered to drive which legs
• Carpool chat messages you send, and their timestamps

How carpool information is shared with other families — and the consent required first — is described in the "Carpools and cross-family sharing" section below.

Device and notification information

• A push notification token (Firebase Cloud Messaging token) used to deliver real-time notifications to your device
• Crash diagnostics and basic device metadata (operating system version, app version) collected via Firebase services, plus operational diagnostics the app sends to our own servers about its own health: when the location engine switched between active and idle and what triggered the switch, why the app was last closed (for example, whether the system stopped it) together with how much memory it was using, and the operating system's standard app-health summaries (Apple's MetricKit — exit reasons and memory statistics; no location, no content), and the app's device-integrity attestation status — whether the device passed the platform's app-integrity check and which check it used, a pass/fail-style status with no location or content. All of this is used only to verify the app is running correctly and to find and fix crashes and missed or delayed location updates — never for advertising or profiling, and never shared
• Motion and activity information from your device's motion sensors — on iPhone, the low-power motion coprocessor; on Android, the system's activity-recognition service — telling us whether you are stationary, walking, running, cycling, or in a vehicle. We use this for two things, and nothing else. First, to keep your location updates accurate and battery-efficient — for example, to know when to refresh your position more or less often. Second, to tell when a car trip has actually ended: knowing that a phone is still in a moving vehicle keeps a trip from being cut short at a long red light, and knowing that someone has just stepped out of a vehicle and started walking is what lets us tell their family they have arrived promptly, instead of several minutes late or at the wrong place. We never use it for advertising, analytics, or profiling, and we never share it. For adults, we may also upload a short recent history of these motion states (for example, the last 48 hours of "still / walking / driving" transitions) to our own servers, used solely to correct gaps and errors in that adult's own trip history; it is never used for advertising or profiling and is never shared. For children and teens, motion-state history and timelines never leave the device, with two narrow exceptions: the single per-walk step count described here, and the app-closed activity summary described below. The first is a single per-walk step count: when a walk ends and a parent or guardian has consented to Wenlo's location features for that child, the device may attach the number of steps taken during that walk to the walk entry the child's own family already sees in their timeline. That number is used only to describe the walk to the child's own family — never for advertising, never shared with other families or third parties — and we do not build a fitness or behavioral profile from it.
• Step counts for walks — when someone finishes a walk, the device may record the number of steps taken during that walk (from the phone's built-in pedometer) and attach it to that walk in their family's timeline (for example, "538 steps"). This is a single number per completed walk: we do not collect a continuous step stream, daily step totals, or any other fitness or health information, and step counts are deleted with the walk history they describe.
• Activity summaries for periods when the app was closed — if the Wenlo app on a device was closed or stopped while the phone kept moving, then when the app next opens it may read the phone's built-in motion history (from the same motion sensors described above) for that quiet period and show the family an honest summary — for example, "walked about 30 minutes — location unavailable." This is a coarse activity label and, for walks, the single per-walk step count described above; it contains no location, route, or place information — we never reconstruct where the phone went while the app was closed — and these summaries are deleted with the timeline history they describe. For children and teens this works only where a parent or guardian has consented to Wenlo's location features for that child.
• Location retrieval when the app is closed — if a family member checks on you while the Wenlo app on your phone is closed, Apple's location-push service may briefly wake a small part of the app to send one fresh location, so your family sees where you are now instead of an hours-old position. Each wake produces a single location reading — the same kind of reading the app normally sends — which appears in your family's map and your own history exactly like any other update; it is not a hidden or extra kind of tracking, and it works only where you have location sharing turned on (turning sharing off also stops these wakes). These requests are strictly limited — at most a few times per hour for any one person, with a daily cap for the whole family. Most wakes happen because a family member actually looked at that person's card. In addition, if a phone has stopped reporting for an extended period (roughly two hours with no location update), Wenlo may automatically attempt a small number of these same wakes so the family's map does not silently go stale — at most about once per hour and a few times per day for any one person, suppressed overnight while the phone is resting at a saved place like home, and never while the phone is reporting normally. Turning location sharing off stops both kinds of wake completely. For children and teens, both the family-initiated and the automatic wakes work only where a parent or guardian has consented to Wenlo's location features for that child.

We do not collect contacts, browsing history, advertising identifiers, microphone or camera access (other than when you choose to take or upload a profile photo), or social media account information.

How we use this information

• To show your family where each member currently is, on a live map
• To notify family members when ride requests are made, claimed, or completed
• To notify family members when someone arrives at or leaves a saved Place (when you've enabled this)
• To deliver SOS alerts to other family members during emergencies
• To compute estimated arrival times between guardians and a pickup point
• To let a guardian announce they are on the way to pick up a family member, and to time the approach notifications (currently about 10 and 2 minutes out) to that member
• To keep your account secure (authentication, abuse prevention)
• To diagnose crashes and improve the app
• To refresh a family member's location on demand — when you open the map on someone who is allowed to see and your last reading of them is stale, to ask their device for a single fresh reading so the map is current
• To send the family's account owner occasional product reminders — for example, if you created a family but haven't added anyone yet, a reminder of what Wenlo can do once you do. These are sent only to the adult who created the family, never to a child, and you can turn them off with the notification toggle in your profile.

We do not use your information for advertising, to build behavioral or marketing profiles, or to sell or promote anything other than your own use of Wenlo. The only non-transactional messages we send are the in-app product reminders described above, to the adult account owner.

How information is shared

Inside your family. Other members of your family can see your name, profile photo, current location (when sharing is on), battery level, ride requests you've made or claimed, and any SOS alerts you've raised. This is the core function of the app and is required for it to work.

With our infrastructure providers. We use the following services to operate Wenlo. Each is bound by their own privacy practices:

• Google Firebase (Authentication, Firestore database, Cloud Messaging, Cloud Functions, Cloud Storage, and Crashlytics for crash diagnostics) — hosts user accounts, family data, push notifications, and crash reports. We do not use Google Analytics for Firebase or any behavioral-analytics product; the only usage data we keep is aggregate, first-party counts we compute ourselves (e.g. how many families are active), which contain no personal information and are never shared. See Google's privacy policy at https://policies.google.com/privacy.
• Google Maps Platform — renders the in-app map, geocodes addresses, and computes driving distances/ETAs (including carpool pickup routing).
• Apple — push notifications to iPhones are delivered through the Apple Push Notification service, and beta builds are distributed through Apple's TestFlight. Apple relays notification payloads (for example, an arrival alert) to your device as part of delivering them, but is not otherwise given access to your Wenlo data.
• Resend — sends transactional email on our behalf, specifically the parental-consent notice emails described in the "Children's privacy" section. These emails are addressed to the parent's email and may contain a child's first name; they never contain location data. Resend is an email-delivery processor only.
• Stripe — processes the parental-consent card verification described in the "Children's privacy" section. Stripe receives the card details the parent enters on Stripe's own secure page (they never touch Wenlo's servers) and never receives any information about the child beyond the verification's internal reference. We keep no card on file; the $1 authorization is voided immediately and never charged.
• Map-matching for the road-aligned trip view described above is performed on Wenlo's own servers (hosted on Google's cloud infrastructure), not by any outside mapping company. A child's location trail is never sent to a third party to align it to roads.

With no one else. We do not sell, rent, share, or otherwise disclose your information to advertisers, data brokers, marketing affiliates, or any other third party. We do not "sell" or "share" personal information as those terms are defined under the California Consumer Privacy Act or other applicable state privacy laws, and we do not sell or share the personal information of any consumer, including consumers under 16. We do not have any third-party advertising SDKs in the app.

Legal requests. We may disclose information if required by law, valid legal process, or to protect the safety of users.

Cross-family sharing: carpools and linked families

Information moves between families in exactly two ways, and both begin with an adult's explicit, opt-in action. Nothing about your family is visible to another family until an adult takes one of them.

Carpools. Wenlo lets families coordinate carpools — for example, parents from different families taking turns driving kids to the same activity. Carpool sharing happens only when an adult in your family affirmatively joins a specific carpool and accepts its sharing terms.

Linked families (adult members of more than one family). An adult — never a child — may accept membership in a second Wenlo family (for example, a grandparent or a relative who helps two households). When they do, only that adult's own current location (with its freshness and battery state, as for any member) is visible in each family they belong to. Their families are not connected to each other: no child's location, no other member's location, and no location history crosses between the families. The adult can leave, and either family can remove them, at any time; removal immediately ends the sharing and deletes their mirrored presence from that family.

What is shared with the other families in a carpool you join

• Your family's display name and profile photo, and the name of the adult member coordinating for your family.
• The first names of the children you choose to send on that carpool (you pick which of your kids ride; you are not required to send any).
• The pickup address(es) you set for those children for that carpool.
• Live location of the participating driver and riders around the carpool's event window — from shortly before it starts until shortly after it ends (so a driver who is en route or running a little late still works) — so the driver can see who's where for pickup. Sharing turns on as the carpool becomes active and turns off automatically once the event has ended; it is never on outside that window.
• Messages you send in that carpool's chat (see below).

Only the families who are members of that specific carpool can see this, and only for that carpool. Members of one carpool cannot see your other carpools, your family's general location outside the event window, or anything about family members who aren't part of the carpool.

Who can join, drive, and host

• Only an adult (18 or older) may join a carpool as a member, host one, or volunteer to drive. Children and teens (under 18) are never carpool drivers or hosts.
• A child or teen can still be a rider — but only because an adult guardian in their family added them to the carpool and accepted the sharing terms on their behalf. A child's data flows to another family only through that guardian's explicit choice.

Carpool chat

Each carpool has a group chat so participants can coordinate (e.g. "running 5 minutes late"). Messages you send are visible to the other members of that carpool and are retained as part of the carpool's record. Do not share sensitive personal information in carpool chat. We do not use chat content for any purpose other than operating the carpool, and we do not use it for advertising or profiling.

Leaving a carpool

You can leave a carpool at any time, and a carpool admin can remove a family. When your family leaves or is removed, your cross-family sharing for that carpool stops. Joining a carpool never changes what your own family can see — that is always governed by the rest of this policy.

Who can drive your child

Within your own family, guardians and helpers you add can claim rides. In a carpool you join, adults from the other participating families may drive your child — that is what a carpool is, and it happens only after an adult in your family explicitly joins that specific carpool. Wenlo does not vet, screen, or endorse any driver; choosing who your family carpools with is always your decision. Any future feature that expands who can drive your child beyond this will require its own separate, explicit guardian consent, and we will update this policy before it launches.

Children's privacy

Wenlo is designed for families that include children. We comply with the U.S. Children's Online Privacy Protection Act (COPPA, 16 CFR Part 312) and apply high-privacy defaults for minors under 18, consistent with the design principles of the California Age-Appropriate Design Code. This section explains what that means for your child.

How a child's account is created

Children never create their own Wenlo account. Instead:

• A parent (or legal guardian, age 18+) creates the family in Wenlo first.
• The parent taps "Add a Child" inside Wenlo, enters the child's first name and date of birth on the parent's own device, and generates a one-time, single-use device-claim link.
• The child opens that link on their own phone, which signs them in anonymously and binds them to the pre-created child profile. The child is never asked for an email address, password, or any other personal information directly.

What we collect from children under 13

• First name — set by the parent at "Add a Child" time.
• Date of birth — set by the parent, used to determine age tier.
• Device location — coordinates and a small movement-history footprint, so the family can see the child on the map and detect arrivals. Movement history is kept for approximately 90 days and then deleted automatically (see "How long we keep your data").
• Device battery level — paired with each location ping.
• Offline catch-up — if the child's device is temporarily offline, it may store location readings on the device only (for up to about a day) and send them when a connection returns, used solely to complete the child's own location history.
• Sharing-status alerts — if the child's device stops reporting its location (for example, no signal or mobile data turned off), we record that reporting stopped and approximately when, and notify the child's guardians. This is information about the device's reporting state, not a new location, and it does not identify a cause.
• Push-notification device identifiers — so we can deliver family-coordination alerts to the child's phone.
• Pickup alerts — if a guardian announces they are coming to pick the child up, we store a one-time snapshot of the child's location at that moment and the guardian's estimated arrival time, so we can send the child "on the way" and "almost here" notifications. These records are deleted automatically when they expire (about 90 minutes).
• Crash and diagnostic data — if the app crashes on the child's device, a crash report (app version, operating-system version, and the technical error) is sent to Google Crashlytics so we can fix the problem. The app also sends app-health diagnostics from the child's device to our own servers: why the app was last closed and how much memory it was using (including the operating system's standard MetricKit summaries), the location engine's own state log (when it switched between active and idle and why), and the same device-integrity attestation status described above (whether the device passed the platform's app-integrity check and which check it used). These contain technical measurements, not the child's location or content, and are used only to find and fix problems on the child's device — never to build a profile of the child and never for advertising.
• Profile photo — set by the parent. A parent or guardian may set a profile photo for their child. The photo is visible to the child's family members and appears on family notifications about the child (for example, an arrival notification). Children under 13 cannot upload photos themselves — only a guardian can set or change a child's photo. Photos are deleted as part of the member-deletion cascade described below.

We do not collect from children: email addresses, phone numbers, passwords, photos uploaded by the child, social-graph data, school enrollment or education records, biometric data, or behavioral profiles. (A parent may save a school as a Place — that is a parent-provided address, described under "Family content" above, not information collected from the child.)

How we obtain verifiable parental consent

Wenlo does not collect any location or movement data from a child until the parent has completed the verification below. Until consent is verified, the child's profile exists but the app does not transmit the child's location to our servers.

To obtain verifiable parental consent, we use card verification, one of the methods approved for this purpose under COPPA (16 CFR §312.5(b)):

1. Immediately after the parent creates the child's profile, we email the parent a direct notice describing exactly what we collect from the child and how it is used.
2. The app then takes the parent to a secure page hosted by our payment processor, Stripe, where the parent confirms a payment card. We place a $1 authorization hold that is voided immediately — nothing is ever charged, no amount ever posts to the parent's statement, and the card details never reach Wenlo's servers; Stripe processes them and we retain only the verification's reference number as part of the consent record.

The parent's bank may briefly show the $1 as pending and may notify them of the authorization — that notification is part of what makes the consent verifiable. The verified consent record is logged immutably with the parent's email address, the date and time, the child's age tier, and the consent method used. (Children verified before this method was introduced were verified by a two-step, time-separated email confirmation; those consent records remain valid for family location sharing, and a card verification is required before such a child can join a carpool.)

Sharing your child's information with other companies and families

Some features require us to disclose a limited part of your child's information to third parties, separately from the data we use to run Wenlo internally:

• Mapping & routing — we send the child's location, and for carpools a pickup address, to Google Maps Platform to draw the live map and calculate routes and arrival times. We do not send a child's location trail to any outside company to align it to roads — that processing is done on Wenlo's own servers.
• Parental-consent notice email — to obtain your consent, we send the direct-notice email through our email provider, Resend. That email goes to your email and may include the child's first name; it never includes the child's location.
• Parental-consent card verification — to verify your consent, you confirm a payment card on a secure page hosted by our payment processor, Stripe. Stripe receives the card details you enter (never your child's information) and the $1 authorization is voided immediately, never charged.
• Carpools — only if you join a carpool, we share the child's first name, pickup address, and live location with the other families in that carpool, and only during the carpool's scheduled window.

By completing the consent steps above, and — for carpools — by separately accepting each carpool's sharing terms when you join, you consent to these specific disclosures. You can refuse any of them by not enabling the feature; declining carpool sharing does not affect your family's own use of Wenlo.

Parental rights

At any time, a parent may exercise the following rights from inside the Wenlo app (Profile → child's profile → Privacy & data):

• Review the data Wenlo holds on the child, including profile fields, activity-segment history, and the consent record.
• Export a complete JSON copy of the child's data, sent as an email attachment to the parent's email on file.
• Delete the child from the family. Deletion removes the child's profile, activity-segment history, push-notification tokens, and all other data we hold on them. We retain a minimal parental-consent record — the parent's email, the dates of consent, the child's first name and age tier at the time, and the consent method — solely as evidence that verifiable parental consent was obtained, even after the child is deleted. We similarly retain the record of legal acceptances — the dates and document versions of Terms acceptances and one-time safety acknowledgments made on an account — after account or member deletion, solely as evidence of the agreements that governed the account. We keep each of these records only as long as reasonably necessary for that evidentiary purpose, and no longer than the later of seven years after the child or account is deleted, or two years after the date the child turns eighteen, after which the record itself is deleted. Neither record contains location data, and neither is used to operate the app or to contact anyone.
• Withdraw consent at any time by deleting the child — this immediately stops all further data collection from the child's device.

For any of these rights, a parent may also contact us at privacy@getwenlo.com and we will action verified requests within 30 days.

Teens (13–17)

For users aged 13 to 17, Wenlo applies high-privacy defaults consistent with the design principles of the California Age-Appropriate Design Code: parental visibility on by default, no behavioral profiling, no third-party marketing. A teen joins a family with their own account, using an invite code their guardian shares with them (see the Terms of Service). Teens manage their own settings and may adjust visibility within Wenlo, but cannot disable parental visibility entirely while they remain in a family.

Restrictions on under-13 users

Children under 13 in Wenlo are restricted in the following ways, to prevent them from extending the data-collection surface beyond what their parent has consented to:

• Cannot see or share the family invite code.
• Cannot leave the family on their own — a parent must remove them.
• Cannot disable their own location sharing — it remains on so the parent can locate them.
• Cannot create their own Wenlo account or join a family without a parent-issued device-claim link.

If a child uses Wenlo without parental involvement

If we learn that a child under 13 has used Wenlo without verifiable parental consent, we will delete the child's account and all associated data, and we will revisit our parental-consent flow to close whatever gap allowed it.

How long we keep your data

This section is Wenlo's written data-retention policy, including for children's personal information (16 CFR §312.10). For each category we state why we collect it, why we keep it for the stated period, and when it is deleted. We never retain personal information indefinitely.

• Active accounts (profile, family membership, saved places, settings): collected to operate your family's shared map and coordination features; retained because the Service cannot function for your family without them; kept for as long as you remain a member of a family, except location history, which follows the rolling window below.
• Location history: activity segments — drives, walks, and place visits, including their route points — are collected to show your family your live location and recent trips; retained so the recent-history timeline works; kept for approximately 90 days and then deleted automatically. This applies to every member, including children.
• Pickup alerts: collected to notify a family member that a guardian is on the way; retained only for the duration of the pickup; each pickup record is deleted automatically when it expires (about 90 minutes).
• After you leave a family or delete your account: your member record (name, profile photo, location history, battery readings) is deleted. Ride history and SOS records may be retained by other family members in their own family's history.
• Consent and legal-acceptance records: collected to document verifiable parental consent and Terms acceptances; retained solely as evidence of consent and of the agreements that governed the account; kept no longer than the later of seven years after the child or account is deleted, or two years after the date the child turns eighteen, then deleted (see "Parental rights" above). These records contain no location data, are stored separately from operational app data with restricted access, and are not used to operate the app or to contact anyone.
• Backups and logs: kept for disaster recovery; where technical backups or point-in-time recovery copies of our database exist, they may retain data for up to 90 days after account deletion before being purged.

Your rights

Regardless of where you live, you can:

• Access the data we hold about you — email privacy@getwenlo.com to request an export.
• Correct your name, email, or profile photo at any time in the Wenlo profile screen.
• Delete your account and all associated data — email privacy@getwenlo.com or use the in-app "Delete my account" button on the profile screen.
• Stop sharing your location at any time using the toggle in the profile screen — Wenlo will stop writing location data to our database immediately.
• Withdraw consent for any optional processing — including, for guardians, withdrawing consent for a child's account.

Wenlo is currently offered in the United States. If you are a California resident, you have additional rights under the California Consumer Privacy Act, including the right to data portability and the right not to be discriminated against for exercising your rights. If we make Wenlo available in the European Economic Area or the United Kingdom in the future, we will provide the additional disclosures and rights the GDPR and UK GDPR require before doing so.

Security

We maintain a written information security program covering children's personal information, with safeguards appropriate to the sensitivity of the data we collect and to the size and scope of our operations, including a designated person responsible for the program and periodic risk assessments (16 CFR §312.8). The program is reviewed at least annually, and its technical safeguards are verified by automated test suites. In practice, it includes these industry-standard measures:

• All data in transit is encrypted via TLS (HTTPS).
• Authentication credentials are managed by Firebase Authentication; we never see plaintext passwords.
• Database access is restricted by Firestore security rules so that family data can only be read or written by authenticated members of that family.
• The geofence presence field used for arrival/departure detection can only be written by our backend (a Cloud Function) and is read-only to clients to prevent spoofed events.

No system is perfectly secure. If we discover a data breach affecting your information, we will notify you and any required regulators without undue delay and within the deadlines applicable laws require.

Website waitlist

If you join the Wenlo waitlist on getwenlo.com, we collect the information you submit — your name, email address, device type, and optionally a co-parent's email and the number of kids' devices in your household — solely to manage beta access and contact you about Wenlo. We never use it for marketing beyond Wenlo updates, never share it, and delete it when the waitlist no longer needs it or on request to privacy@getwenlo.com. If you provide a co-parent's email, only do so with their permission; we use it only to send their beta invitation.

Changes to this policy

We may update this policy as Wenlo evolves. When we do, we'll change the "Last updated" date at the top. Material changes — for example, collecting a new category of data or sharing data with a new third party — will be communicated to active users in-app or by email.

Contact

We typically respond within 7 business days and will action verified requests within 30 days.