Well Grounded privacy policy

Through the app, nothing. We don’t receive, store, sell or share any information about you or your children from Well Grounded. It has no accounts, no sign-in, no analytics, no advertising, no tracking and no code from other companies.

The app makes no internet connections of its own. The only things that go online are Apple’s: the App Store checking your purchases (whether Plus is on, and which version of Well Grounded you first downloaded), and taking care of it when you buy, restore or manage Plus. A link you tap, such as this policy, opens in Safari.

This web page has no advertising, no tracking cookies, no chat and nothing from other companies. enaayah.com counts visits with its own first-party analytics only if you agree when it asks; the app has none. Like most websites, the server that delivers it may keep a short technical log (such as the internet address a request came from) to keep the site running and safe. That log is not linked to the app or to your family.

If you email us

If you write to us, we receive your email address and what you write, including any attachments, and use them only to answer you. We never add you to a list or share what you send. Our email is hosted by Google. Please don’t put your children’s names or photos in emails. We delete the conversation 12 months after your last message, or sooner if you ask.

If you had the first Well Grounded

The first Well Grounded (version 1.0, from 2017) included tools from other companies: Google AdMob and Vungle for advertising, OneSignal and Firebase for notifications, and Firebase for analytics. This version is a complete rewrite and has none of them. The first time it opens, it removes the settings and files those tools left on the device. It also copies your children, their pictures and your history into the new app, once, on the device, turns your old cards into suggestions, and then deletes the first app’s own data file.

These stay on your iPhone or iPad, and in your device’s own backup if you use one:

• Your children’s first names, birth years and colours, and a picture if you choose one. The picture comes from your photo library through Apple’s photo picker, so the app only receives the one photo you pick.
• Your name, and a second grown-up’s if you add one, used on cards and summaries.
• The cards you agree together, your child’s finger signatures, and “I agree” recordings if you turn them on.
• History of draws, kept for as long as you choose (3 months, 1 year or for ever; 1 year unless you change it).
• Crystals and stickers, worked out from that history. The rewards you set for each child (for example “Ice cream trip, 3 crystals”), what they’re saving for, and the rewards they’ve spent crystals on.
• The name your child gives their sticker book and its pages, and their wishes.
• Faces your child picks in How I feel, with their dates.
• Groups you make, like “Big ones” and “Little ones”, and who is in them. Group names never appear on a widget, the Lock Screen or a summary.
• “What helps me”: up to three calm-down ideas each child chooses with you (like “Counting slowly”) and a few words of their own. They show on the child’s page and as a reminder when something happens, never on a widget, the Lock Screen or a summary.
• Installed action packs: sets of suggested actions and cards. They hold words only, never anything about a child.
• Moments a teacher or another grown-up sent you with a code, kept in their own “From others” list.
• Your settings, such as which tip sources you chose.

We never ask for surnames, dates of birth, school grades, health information or contact details. Where you type, the app refuses common health, learning-needs and safeguarding words, and doesn’t keep them.

How I feel

On their own page, your child can tap How I feel and pick a face: cross, sad, worried, embarrassed, tired or okay. It is always optional: nothing asks for it, reminds them or counts days in a row, and it doesn’t need the parent lock. The face is kept on the device with its date, like the rest of the history, and goes when that history is tidied away, when the child is removed, or with Delete everything. It is never shown back to your child as a list. Grown-ups see only how many of each, on This week and in the summary for a professional. It is in your backup file if you make one. It is off in Teacher mode.

Your device’s own backup

Well Grounded doesn’t sync with iCloud. If your iPhone or iPad backs up to iCloud or a computer, that backup includes Well Grounded’s data like any other app’s, apart from side notes and photos of what happened, which are always left out. We can’t see that backup.

The parent lock makes sure a grown-up is there for anything that adds, changes or ends a record, apart from a child’s own How I feel face. It uses Face ID, Touch ID or the device passcode. If you set an app PIN, it asks for the PIN instead. The app never sees your face, fingerprint or passcode: iOS checks them and tells the app only yes or no.

When you set up Well Grounded on a device that can check who you are, the lock is on unless you turn it off.

When the lock is on, it asks before starting a draw, ending a card, handing out or spending crystals, adding or changing a child, changing rewards, agreements or groups, opening Settings, making or restoring a backup, sharing anything (including the sticker book), sending or adding moments with a code, and adding, removing or sharing action packs. Looking at the jar, the sticker book, history and tips, and your child tapping How I feel, never asks.

An app PIN (4 to 8 digits) is for families where a child knows the device passcode. It is kept in the device’s Keychain as a salted hash, never as the PIN itself, and stays on this device only. After five wrong tries, the PIN is locked for five minutes. If the PIN is forgotten, Forgot the PIN? sets a new one after Face ID or Touch ID, never the device passcode, which a child may know.

Saying “Agreed”

If you turn on Agree by saying “Agreed” in Settings › More (it is off until you do), your child can tap Say “Agreed” and say it instead of signing. The screen shows “Listening…” while it listens. It stops as soon as it hears the word, or after 6 seconds.

• Checked on the device only. The app uses Apple’s speech recognition only where it can run on the device itself. If the device or its language can’t do that, the option isn’t offered. The sound is never sent to us, to Apple or to anyone else.
• No recording and no words. No sound is saved and no words are kept. The app saves only the fact that “Agreed” was heard: on the card, if it was said at a sit-down, or on that draw in the history, if it was said before a draw.
• It checks the word, not the person. It never makes a voiceprint and never tries to recognise whose voice it is.
• A no never counts. “No” or “I don’t agree” is not an agreement, and “That’s not what happened” is always there.
• Always optional. Signing always works. You can turn this off in Settings, and remove microphone and speech recognition access in iOS Settings.

The fact that “Agreed” was heard goes from a card when the card is changed or removed, and from the history when that draw is tidied away (never, if you keep history for ever). Removing the child or Delete everything removes it at once. If you make a backup file, it is in that too.

“I agree” recordings

If you turn on Record “I agree” at sit-downs in Settings › More (off until you do), your child can record “I agree” to a card at a sit-down, for up to 8 seconds while holding the button, and hear it later. The recording stays on the device, inside that card, and in your device’s own backup like the rest of the app’s data. It is never sent to us, transcribed or analysed. It is deleted when the card is changed or removed or its signature runs out. Settings › More › Your data › Delete voice recordings removes every “I agree” recording at once. Signatures stay; a card that was agreed only by a recording then needs agreeing again at a sit-down. Side notes and photos have their own button, Delete kept notes and photos. Recordings are never put in the backup file.

When you see it differently

If your child says “That’s not what happened”, or doesn’t sign before a card is drawn, each of you can give your side for your next sit-down:

• Voice notes, recorded only while you tap Record, up to the length you choose in Settings (30 seconds, 1 minute or 2 minutes; 1 minute unless you change it), or a typed note instead. The grown-up’s side is needed before drawing anyway; the child’s side is always optional.
• A photo of what happened, only if you turn it on in Settings. It is taken with the camera, never chosen from your library, and never saved to your library. Faces are found and blurred on the device before the photo is kept, and the unblurred photo is never stored. If the device can’t check for faces, no photo is kept. Location and other photo details are removed.

These are kept apart from everything else, as protected files on this device only. They are left out of iCloud and computer backups, the backup file, widgets and the summary for a professional. Your child can see what is being kept about them on their cards page (such as “Zara’s cards”). They are deleted as soon as the sit-down settles it, when it is let go, when a draw is undone, and in any case after 14 days. Settings › More › Your data › Delete kept notes and photos removes them at any time.

Well Grounded asks for a permission only when a feature needs it. You can change any of them in iOS Settings › Well Grounded.

• Notifications: to tell you when a card has finished. You are asked the first time a timed card starts.
• Microphone: only while an “I agree” recording or a side note is being made, and only while your child taps Say “Agreed”, if you turned that on. You are asked the first time you record, or when you turn on Say “Agreed” in Settings.
• Speech recognition: only for Say “Agreed”, and only on the device itself. You are asked when you turn it on in Settings, past the parent lock.
• Camera: only if you turn on Photo of what happened, and only when you tap Take a photo.
• Face ID or Touch ID: only for the parent lock.
• Photos: the app never asks to see your photo library. Choosing a child’s picture uses Apple’s photo picker, which gives the app only the one photo you pick. The app never saves anything to your Photos, including when you share.
• Motion: tilting the device moves things on screen, like the crystals in the jar and the bits you scratch away in Scratch it. While a card is shown, the app notices if the device is lying flat on a table, to turn the card towards your child (“Face to face”). Motion readings are used in the moment and never stored. No permission prompt is needed.
• Location, contacts, health data and advertising identifiers: never used.

The Home Screen widget shows how full the jar is and how long a card has left: the whole family’s crystals, or one child’s jar if you pick a child in the widget’s settings.

Children’s names and card words appear on a widget, in a Live Activity on the Lock Screen or in a reminder only if a grown-up turns on Show the card on the Lock Screen in Settings. It is off by default. Without it, the Lock Screen shows only that a card is running and how long is left, a reminder says only “A card has finished”, and a child’s widget shows a coloured initial and never shows that their card is running.

To do this, the app shares a small summary with the widget on the device: each child’s first name (so you can pick one in the widget’s settings) and colour, their crystal count, the emoji and price of what they’re saving for, and whether a card is running, with its words only if Show the card on the Lock Screen is on. It is never sent anywhere. If you pick a child in the widget’s settings, iOS keeps that choice with the widget until you remove it.

Tip of the day. Home shows a short parenting tip each day, from the faiths, philosophies and thinkers you choose in Settings. The tips are part of the app: nothing is fetched from the internet, and which sources you choose stays on the device. Tap ⓘ on a tip to see its source, its exact words and any translation.

Shortcuts and Siri. You can set a shortcut or the Action button to open “Good” or “Not so good” for one child. The child is chosen in the Shortcuts app, and children’s names are never added to Siri phrases. The Shortcuts app keeps the child you chose (their first name) with that shortcut until you delete it, and copies it to your other devices if you use iCloud for Shortcuts. First-time hints are shown by Apple’s TipKit, which keeps its state on the device.

Sounds. Sounds are made on the device. They follow the ring/silent switch, never interrupt music, and are off in quiet mode or when turned off in Settings.

Nothing leaves Well Grounded on its own. Each thing below is made only when a grown-up asks, and goes only where they send or save it. We never receive any of it.

Backup file

Made only when you ask (past the parent lock, if it’s on), in Settings › More › Moving to another device. It is locked with a passphrase you choose, at least 8 characters long, using AES-GCM encryption. We cannot open it, and nobody can without the passphrase. You choose where it is saved.

It holds your names, your children (first names, birth years, colours, wishes and their picture if you added one), cards and signatures, history (including How I feel faces), rewards and crystals, groups, “What helps me”, the sticker book’s names, installed action packs, when any free Plus months began and which children were kept, and the keys for any codes you made or typed in (so links keep working after a restore), together with what linked grown-ups sent. Voice recordings, side notes and photos of what happened are never included; a card agreed only with an “I agree” recording comes back as agreed aloud, without the recording.

Summary for a professional

A PDF you can choose to show someone like a family therapist, counsellor or teacher. It is made only when you ask (past the parent lock, if it’s on). It is about one child and holds their first name and age, counts and patterns from the last 2, 4 or 8 weeks, any feelings counts, their current agreements, and the name of the grown-up who made it. It never holds photos, recordings, side notes, signatures, groups or “What helps me”. The file is removed from the app when the share sheet closes, and you decide who receives it. The summary is part of Well Grounded Plus.

The Pact

A printable PDF of every child’s first name and signed cards, made only when you ask, in Settings (past the parent lock, if it’s on). It never includes history, photos, recordings or signatures. You decide who receives it.

The sticker book

Sharing the sticker book is off until a grown-up turns it on in Settings, past the parent lock. Each share asks for the parent lock again. You choose the whole book as a PDF or one page as a picture. It shows the book’s name (until your child renames it, that is their first name, as in “Zara’s sticker book”), its page names and your child’s stickers. What each sticker was for, and its date, are added only if you switch that on for that share. It never includes crystals, prices, brothers or sisters, not-so-good moments, photos, recordings or signatures. The file is made on the device when you ask, and removed from the app when the share sheet closes. The app never saves it to your Photos. You decide who receives it. Sharing the sticker book is not part of Plus.

Action packs

An action pack is a set of suggested actions and cards, shared as a .wgpack file. Five come with the app. You can share your family’s own ideas as a pack, only when you ask and past the parent lock. A pack holds categories, actions and cards in your family’s words, a title, a description, an optional author name, tags, an age range, its language and its licence. It never holds children’s names, ages, signatures, photos, voices, crystals or history.

Before the file is made, the app swaps any family names it knows for “my brother or sister” or “a grown-up”, leaves out anything with a phone number, email address or link, and shows you what it removed. A pack you receive, or one that comes with the app, is checked the same way before anything is added. Adding a pack only adds suggestions to the library: it changes nothing for any child, and every action still needs a sit-down and a signature.

Packs travel as files, by AirDrop, Messages, Mail or Files. There is no catalogue, no upload and no server, and we never see them. A pack isn’t private: anyone who gets the file can read the words in it, so share only what you’d be happy for anyone to see. It carries a seal, so a file changed by accident or on the way is refused; the seal is a tamper check, not encryption. Any tag you choose, such as a theme or a faith, is stored only inside the pack and on your device. You can remove installed packs in Settings › More › Action packs without touching anything already agreed.

A teacher, co-parent, guardian, tutor or club leader can send a child’s moments to that child’s parent. They can do this only with a code the parent made for them in the app (on the child’s page, under Grown-ups who can send), past the parent lock. The code starts with the child’s first name so you can each tell codes apart; the name is not part of the key.

The code is the only key. Everything sent is encrypted on the sender’s device with a key made from the code (PBKDF2, HKDF and AES-GCM), and in the app it can be opened only on the parent’s device that made the code, or one restored from its backup file. The sender’s device keeps the same key to seal with, and anyone who had both the code and what was sent could read it. So give the code in person or through your school’s usual channel, and make a new one if it goes astray. The keys are kept in the device’s Keychain, on that device only. What is sent travels as a link, a code or a file through whatever the two grown-ups already use, such as Messages, Mail or AirDrop. A copied code stays on that device’s clipboard for ten minutes at most. There is no server, and we never see it.

What is sent

One child’s moments, for one moment, today, this week or this month: the date, whether it was good or not so good, the words, the card if one was drawn, and whether the child disagreed. Also the sender’s name, role and subject, and an optional short note, which the app refuses if it looks like health, learning-needs, family or safeguarding information. The child’s name is never inside: it becomes “your child”.

Other children’s names are taken out before anything is sealed, as far as the app can tell. The other children on the sender’s device (brothers and sisters, or the rest of a class) are always replaced, and any other word that reads as a person’s name is replaced with “a classmate” (or “someone” at home), using the device’s own built-in name detection. A name written in lower case, or one the device doesn’t recognise as a name, can slip through. That is why the sender sees the exact words before choosing to send, and the parent sees them again before choosing to add them.

What the parent sees

The parent sees a preview and decides whether to add it, past the parent lock. Added moments sit in their own “From others” list and change nothing (no crystals, stickers or history) unless the parent brings one to a sit-down or gives a crystal for it. They are tidied away with the rest of your history, on the schedule you choose. The sender’s device keeps only the dates it sent on. A parent can rename a link, or remove it so that its code stops working, at any time; what was already sent stays until you remove it.

A grown-up can choose “A teacher with a class” in Settings › More › For teachers › Who uses this app. Teacher mode is part of Well Grounded Plus. It needs an app PIN, which is then asked for every time instead of the device passcode. Groups become classes (up to 150 pupils in all), and the app offers classroom actions and consequences.

Everything else works as for a family: pupils’ first names, birth years, cards, signatures and history stay on the device and are never sent to us. In Teacher mode, recordings, photos, Say “Agreed”, How I feel, Lock Screen details and the tip of the day are off.

A teacher using Well Grounded at school must follow their school’s data protection policy. The school, not us, decides what is recorded about pupils and for how long. Don’t record surnames, or health, learning-needs, family or safeguarding information; the app refuses common words of that kind.

Well Grounded Plus is an optional subscription, paid monthly or yearly. It adds more children, more rewards in the jar, sticker packs, choosing what each good thing earns and bonus goals, looks for the jar and sticker book, This week, the summary for a professional, more than three tip sources at once, and Teacher mode. One child, and everything that keeps a family safe and fair, are free, and nothing a child has earned ever depends on Plus.

• Plus is bought and managed entirely through Apple. We never see your name, card, address or any payment details; Apple takes the payment and keeps the receipt.
• To know whether Plus is on, the app asks Apple’s StoreKit on the device. There are no accounts and no server of ours, and nothing about who has Plus is collected or sent to us.
• The yearly plan starts with 7 free days for new subscribers. You can cancel any time in Settings › Apple Account › Subscriptions, or from Manage or cancel in the app. When Plus ends, nothing is deleted: every child, card, crystal and sticker stays where it is, and the app just asks before anything that needs Plus.
• Families who already had Well Grounded keep, for ever, every child they had when they updated, and get three months of Plus free. To know this, the app asks Apple, on the device, which version you first downloaded; nothing is sent to us. The app remembers on the device when the free months began and which children were kept, and both travel in your backup file. The start date stays even after Delete everything, so the free months don’t start again. It is also kept in the device’s Keychain (this device only, never synced), so deleting and reinstalling the app never starts them again. It is only a date: nothing about your family or your children, it is never sent anywhere, and it stays in the Keychain if the app is deleted.
• If you bought the one-time unlock in the first Well Grounded, it still gives you Plus, for ever, unless Apple refunded it.
• Ask to Buy works as with any App Store purchase: if a child’s own Apple Account is in a Family Sharing group with Ask to Buy on, they can’t buy Plus unless the family organiser says yes. In the app, the Plus screen is reached only by a grown-up, past the parent lock, or a short sum when the lock is off. In Teacher mode, it always asks for the PIN.

• History: for as long as you choose in Settings › More › Your data › Keep history (3 months, 1 year or for ever). Older history is deleted automatically. When an older moment goes, the sticker it earned stays, with its date and where it is stuck in the book; what happened, the words and any signature go. History brought across from the first Well Grounded is kept until you remove it, with Settings › More › Your data › Remove history from the earlier app.
• Side notes and photos of what happened: until the sit-down, and never more than 14 days.
• “I agree” recordings: until the card is changed or removed, or its signature runs out. A recording on a card that was never signed is removed.
• Files made for sharing: a summary, sticker-book or code file is removed when the share sheet closes, and a pack file the next time the app opens. The latest Pact stays in the app until you make a new one, remove a child or delete everything.
• Everything else: until you change it, remove the child, or delete everything.

Removing a child

Removing a child (on their cards page, such as “Zara’s cards”: Edit Zara, then Remove Zara) deletes everything about them. That means their cards, signatures, recordings, history, crystals, rewards, group membership and “What helps me”, any kept side notes or photos, their reminders in Notification Centre, any card of theirs on the Lock Screen, and any summary, Pact or sticker-book file the app made for sharing. It also removes their links to other grown-ups (with the keys behind them) and what those grown-ups sent.

Delete everything

Settings › More › Your data › Delete everything removes, from the app, all children, groups, cards, signatures, recordings, side notes, photos, rewards, crystals and history, and your settings. It also removes installed action packs, the app PIN, every link to another grown-up with its key and everything they sent, every reminder in Notification Centre and card on the Lock Screen, the widget’s summary, and any summary, Pact, sticker-book, pack or code file made for sharing.

It keeps only a few small facts, so nothing is repeated: that the first Well Grounded’s data was already copied across, and when any free Plus months began (or that the one-time unlock was found).

Deleting the app removes its data from the device. iOS may keep a few small items in the device’s Keychain after the app is deleted: the app PIN and any code keys, so use Delete everything first if you want those gone too, and the day any free Plus months began. Delete everything does not remove that date, so the free months don’t start again; it is only a date and is never sent anywhere.

A backup file, summary, Pact, sticker book or pack you have already sent or saved somewhere else is outside the app, so it is yours to delete there.

Well Grounded is made for parents to use with their children. The app collects no personal information from children, or from anyone. Settings that affect privacy start on the private side: nothing shows on the Lock Screen, and voice features, photos and sticker-book sharing stay off until a grown-up turns them on. On a device that can check who you are, the parent lock starts on. The Plus screen and any request to buy sit behind the parent lock, or a short sum for grown-ups when the lock is off, and nothing about Plus appears on a screen made for a child.

There is a page in the app to read together: Settings › Privacy › Explain it to my child.

For children: the short version

If a child is worried about their safety

If a child types something that sounds like a worry about their safety (for example in their wishes or their side of what happened), the app thanks them, tells them a grown-up they trust can help, and doesn’t keep what they typed. It never sends anything anywhere.

If you’re worried about a child’s safety, talk to someone who can help, such as their school, your doctor or a children’s helpline. Call the emergency services if a child is in danger.

Because everything is on your device, you are in charge of it. You can see, change, take away or delete it yourself, at any time, without asking us. Apart from any email you choose to send us, we hold nothing about you or your children, so there is nothing for us to hand over, correct or delete on our side.

• See it: each child’s page, cards, history and what is kept for a sit-down are all in the app.
• Change it: edit names, cards and rewards, or turn features off, in the app.
• Take it with you: make an encrypted backup file in Settings › More › Moving to another device.
• Delete it: remove a child, choose how long history is kept, or use Delete everything. To have an email to us deleted, just ask.
• Limit it: turn permissions off in iOS Settings › Well Grounded at any time.

If you have a question or a concern, write to us at contact@enaayah.com. You can also contact the data protection authority where you live.

If we change this policy, we will update this page and the date at the top. If a change affects what the app does with information, we will also say so in the App Store notes for that update.

Questions about privacy: contact@enaayah.com.

Help with the app: Well Grounded support.

Well Grounded is made by Enaayah Software Development and Services Private Limited.

This policy covers the Well Grounded app and its pages on enaayah.com. Enaayah’s games and the rest of the website have their own policy.