Privacy Policy — Rondo

Last updated: October 2026

Rondo is an app for parents to coordinate rides to children's activities. It is intended for adults (18+). Child profiles are created and managed by a parent, except a first-name-only guest entry a group admin can add — see "Children" below.

What we collect

Account details: name and email at sign-up
Phone number: optional, so parents in a group can contact each other
Usage data: practice schedules, driver assignments, swap requests, and ride offers you create
Location: only with your permission.
- Drivers: when you mark "on my way" for a ride, your location is shared with group members until the ride ends.
- Children (Live ETA): when a parent enables Live ETA, the child's device shares location — including in the background, even when the app is closed — only during the ride window, so parents can see an estimated arrival time.
Contacts: with your permission, contacts access is used only to fill in a group member's or child's details from your address book. The app does not upload or store your address book.
Calendar: with your permission, the app adds rides assigned to you and reminders to your device's calendar.
Google Calendar (optional, Premium): if you choose to connect Google Calendar, you sign in with Google and let Rondo create and manage only a dedicated calendar named "Rondo" that Rondo creates for you. Rondo cannot see your other calendars or events. We store an encrypted Google refresh token and the IDs of the events we created, and we send the details of the sessions you chose (title, time, location and reminders) to Google Calendar so it can create those events.
Push token: to send you notifications about swap requests and schedule changes.
Verification emails: to confirm your email address at sign-up, or to let you sign in with a one-time code, we send a short code to your email address via a third-party email delivery service (Resend).
Analytics: anonymous usage events (e.g. "swap requested") via PostHog, stored in the EU. The only identifier is the internal user ID; no names, emails, or content are sent. No PostHog usage analytics are collected from child accounts.
Approximate country (service logs): when the app contacts our servers, our hosting provider (Google Cloud) may tell us which country the request came from, estimated from the request's network address. We record only that two-letter country code (e.g. "IL") in our service-health logs, to see where the service is used and to spot outages. These log entries do not include your name, email, or user ID, and we do not record your city, precise location, or IP address in them. This is separate from the GPS location described above. It applies to every device that uses the app, including a child's device, and is not used for advertising.
Schedule text for parsing: if you choose to paste a WhatsApp message so the app can turn it into a practice schedule, the text you paste is sent to Anthropic's AI service solely to parse it. We recommend removing unnecessary personal details before pasting.

How we use this information

Showing the ride schedule to group members
Sending notifications about swap requests and changes
Coordinating rides between parents in a group
Adding rides to your Google Calendar, if you connect it
Showing live location and estimated arrival (Live ETA) to group members during an active ride
Improving the app based on anonymous usage data
Monitoring that the service works reliably (service logs, including approximate country)

Children

The app is intended for parents. A child profile is created by a parent inside the app, and a child's device joins only via a pairing code issued by the parent (or, for a guest kid, by a group admin — see below).
Children cannot sign up on their own; a child's device signs in only with a pairing code, issued by the parent for a parent-created profile or by a group admin for a guest entry.
Guest kids: when a child's parents don't use the app yet, a group admin may add the child to the group roster by first name (and optionally a last initial) so drivers know whom to pick up. No location is shared and no PostHog usage analytics are collected for the child. An admin may connect the child's phone with a short-lived code so it can see the schedule, get and confirm pickup times, and see drivers on the map; the phone never shares its own location, and the admin gets no access to it. The admin can send the parent a single-use link; a parent who claims it manages the child like any child profile from then on. The phone's push token is stored only to deliver schedule and pickup-time notifications. The phone is signed out when the guest entry is deleted (see Data retention) or a parent takes over, and the parent can pair it again.
A child's location is shared only when a parent has enabled Live ETA, only during the ride window, and only with the parents in the group. The child's device shows an explanation and asks for permission before location sharing starts.
No PostHog usage analytics are collected from child accounts.
A parent can at any time remove the child from a group, unpair the device, or permanently delete the child profile from Settings → Manage children.

Data retention

Account data is kept for as long as the account exists.
Location shared during a ride is stored on that ride's record and is deleted together with the ride, the group, or the account.
Screenshots attached to a bug report are automatically deleted after 90 days.
Raw Cloud Logging service entries, including the approximate country field, are deleted automatically after 30 days. Aggregated monitoring metrics derived from those logs may retain country totals for longer.
Pending invites and requests that are never approved expire and are deleted automatically.
Google Calendar connection: the encrypted token and event IDs are kept until you disconnect Google Calendar in Settings or delete your account. Events already created stay in your Google Calendar unless you choose to delete the Rondo calendar when disconnecting.
A guest kid entry is kept until a group admin removes it, a parent claims it, or the group is archived or deleted. If the admin who added it leaves the group, it passes to another admin; it is deleted if no admin remains. Unused claim links expire after 7 days. The guest's sign-in record and phone session are deleted with the entry.

Sharing information

Personal information is never sold to third parties.
Details (name, phone, location during a ride) are shown only to members of your own group.
Service providers that process data on our behalf:
- Firebase (Google) — authentication, data storage, notification delivery, and service logs
- Google Maps Platform — place search and arrival-time estimates (the relevant location is sent to Google for the calculation)
- PostHog (EU) — anonymous usage analytics
- Anthropic — parsing schedule text you paste, only at your request
- Expo — delivering push notifications to your device
- Resend — delivering email verification and sign-in codes to your email address
- Google Calendar API (Google) — only if you connect Google Calendar: creating and updating events in the Rondo calendar

Security

Data is stored on Firebase servers with defined security rules — only members of a group can see that group's data. Sensitive operations (joining, deleting, pairing a child) run server-side with permission checks.

Data deletion

You can leave a group at any time from Settings.
Parents: permanently delete your account from Settings → Delete account. This removes your profile from every group and cannot be undone. If you created child profiles, delete those first. Past rides may still show the name that appeared on them.
Children: a parent deletes a child profile from Manage children; a child who still has an older account they created themselves (before independent kid sign-up was closed) can delete it from Settings.
Guest kids: a group admin removes the entry from the Admin panel, which also signs out its phone; a parent can also ask us to delete it using the contact below.
Google Calendar: disconnect at any time from Settings → Calendar. Rondo then revokes its Google access and deletes the stored token, and can also delete the Rondo calendar. Deleting your account does the same (the calendar itself stays in your Google account). You can also remove Rondo's access from your Google Account settings.
Request deletion outside the app: carpool-f22db.web.app/delete-account.html

Contact

For privacy questions or data-deletion requests: ozgilat@gmail.com