Privacy policy
Last updated: October 15, 2026
Ganiko is an app for communication and management between kindergartens, daycares and afternoon programs and the parents. It is operated by OD Apps (“we”). This policy explains what information the app and the site collect, why, who sees it, how long it’s kept and what your rights are. The Hebrew version is the binding one.
Our rule is simple: information about children is used only by the kindergarten and the family. No ads, we don’t sell data, and children’s information is never used to train AI models.
Who is responsible
- The institution (kindergarten, daycare or afternoon program) owns the database of its children, parents and staff. It decides what is collected and why, and is responsible for obtaining consents where needed.
- We hold and process that information on the institution’s behalf and according to its instructions, to run the service.
- For your account details (name and phone) and technical information about app use, we are directly responsible.
What we collect
Account: first and last name, phone number (for signing in with a one-time code), preferred language and notification preferences.
Children (entered by the institution or the parents): name, birth date, group and school year, profile photo, people authorized to pick up, and “important to know” notes for staff.
Consents: whether the child may be photographed and whether they may appear in group photos, who approved and when. A consent can be changed at any time.
Activity at the kindergarten: attendance, reported absences (a general reason only, no medical details), daily reports, photos, messages, events and RSVPs, and payment status where the institution uses it.
Technical information: crash reports and basic usage statistics. They’re identified only by a random internal id and include no name, phone number or information about children. There’s no screen recording and no screenshots.
How we use it
- To run the service: connecting parents to their child and the kindergarten, photos, reports, messages, events, attendance and payments.
- For secure sign-in (a code sent to your phone) and to send invitations and notifications.
- AI-assisted weekly summary: staff can ask for a draft weekly summary. Only the content the summary needs from that week is sent to the AI provider. “Important to know” notes and medical information are never sent. Staff edit and approve every summary before parents see it. The provider is bound not to use the data for training.
- To fix problems and improve the app, based on the technical information above.
- To comply with the law.
Who sees what
- A parent sees only their own children. A photo is shown to a parent only if their child is tagged in it, or if it’s a group photo and every child tagged in it has group-sharing consent. A photo of a child without photo consent is not published.
- Group staff (teacher, assistant) see the children in their groups. “Important to know” notes are visible only to the staff of the child’s group and are stored encrypted.
- The institution’s manager sees what happens in their institution. Payment information is visible only to the manager and the family itself.
- Supervisors and networks, if any, never see photos, individual reports, parents’ messages or children’s details.
- Revoked access (a parent or a staff member) is blocked immediately.
Providers that help us run the service
We use infrastructure providers that process information for us, under agreement and only on our instructions:
- Supabase (database and sign-in): servers in the European Union (Frankfurt).
- Cloudflare (photo storage and website): photos are stored in the European Union.
- Google Firebase, and on iPhones also Apple (push notifications): receive a device token and the notification’s content, including the child’s first name.
- Anthropic (AI for weekly summary drafts): United States, with no use of the data for training.
- Sentry (crash reports) and PostHog (usage statistics): servers in the European Union, with no information about children.
- An SMS provider for sign-in codes and invitations.
Some providers are outside Israel. Such transfers follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations. We don’t pass information to anyone else unless the law requires it.
Security
- Encrypted connections, and information encrypted at rest.
- Permission rules in the database itself, so every request is checked against the sender’s permissions.
- Photos have no public address. Every view is checked and uses a link that expires after a few minutes.
- Location (GPS) and device details are removed from photos on the phone, before upload.
- Photo views and downloads, permission changes and deletions are logged.
No system is completely secure. If we discover a security incident affecting information, we’ll act as the law requires and inform the institution and the affected users.
How long we keep it
- Photos from a previous school year are deleted after a period the institution chooses (3, 6 or 12 months; 12 by default). Parents are notified a month before.
- Deleted content (a photo, message or event) disappears at once, is kept 30 days as deleted and then removed permanently.
- A deleted account: signed out of every device at once; personal details are deleted after 30 days. The child’s record stays with the institution and with the child’s other parents.
- An institution that stopped using Ganiko: its information is exported to the institution and the parents and fully deleted after 90 days.
- Backups rotate within 7 to 30 days, and until then deleted information may remain in them.
Your rights
- To see the information about you and your children and to ask to correct anything wrong. Most of it can be seen and updated directly in the app.
- To change or withdraw photo and sharing consent at any time, in the child’s profile.
- To delete your account, in the app or as described on the Delete your account page.
- For requests about information the institution is responsible for, contact the institution or us, and we’ll pass the request on.
Children
Children don’t use the app. Their information is entered by the institution and the parents and is for the institution and the family only.
The website
The ganiko.app site uses no cookies, loads no third-party services and doesn’t track visits. Invitation links open without passing the address on to other sites.
Changes
If we change this policy in a material way, we’ll announce it in the app before the change takes effect. The date at the top shows the last update.
Contact
Privacy questions and requests: [email protected].