Eyrie — Privacy Policy

Effective date: 7 October 2026 Last updated: 29 October 2026

1. About this policy

1.1 This Privacy Policy explains how the operator of Eyrie ("Eyrie", "we", "us", "our") collects, holds, uses and discloses personal information, and how we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). It also describes rights that may apply to users in other jurisdictions.

1.2 It applies to the Eyrie website (https://eyrie.au), the Eyrie mobile apps, the Eyrie API (https://api.eyrie.au), and all related services (the "Service").

1.3 "Personal information" has the meaning given in the Privacy Act: information or an opinion about an identified individual, or an individual who is reasonably identifiable. The health information in a Child's medical information (clause 4.5) is "sensitive information" under the Privacy Act and gets extra protection. We give a Child's precise location the same extra care.

1.4 By using the Service you acknowledge this policy. Where we rely on consent, we will seek it as described below.

2. Who we are and how to contact our Privacy Officer

2.1 Eyrie is an Australian business. We are the entity responsible (the "APP entity", and where the GDPR applies, the "controller") for the personal information described here.

2.2 You can reach our Privacy Officer by email at privacy@eyrie.au.

We handle account, subscription and payment on our website. The mobile apps are used to sign in, pair a device, share or receive location, and receive notifications — they do not create accounts or process payments.

3. What personal information we collect, why, and how long we keep it

3.1 We collect only what the Service needs. The table below summarises the main categories. "Legal basis" is stated for users to whom the GDPR/UK GDPR applies; for Australian users we handle information under the APPs as described in this policy.

3.2 We do not collect the content of a Child's messages, photos, calls, browsing or what is typed on their phone, and we do not use the microphone or camera for tracking. See What Eyrie Does.

3.3 We collect information: directly from you (account, family, settings, medical information, support); automatically from a paired device (location, telemetry, activity signals); and from our service providers (for example, a payment status from Stripe).

4. Children's personal information

4.1 Eyrie exists to help families keep children safe, so children's data is central and is treated with particular care.

4.2 A child cannot consent, so their parent or guardian does. Eyrie treats every Child as unable to give their own legal consent to location sharing. The parent or legal guardian who adds a Child gives consent, on the Child's behalf, to that Child's location and information being collected and shared with the Family as this policy describes, and confirms they have the legal right and authority to do so (see the Terms, clause 6).

4.3 The parent tells the Child. The parent or guardian is responsible for telling the Child, in a way suited to their age, that their location and the information in clause 3.1 are shared with the Family, who can see it, and why.

4.4 Data minimisation for minors. We collect only what the safety features need. We never collect the content of a Child's messages, photos, calls or browsing. Activity signals are totals and metadata, never content.

4.5 Simple medical information. On plans that include it, a parent or co-parent can choose to record simple medical information about a Child: medical conditions, allergies, blood type, and which Trusted Contact is the emergency contact. In particular:

(a) Why: so the adults caring for the Child have it to hand in an emergency — for example, to tell a paramedic about an allergy — and so a first responder can read it on the Child's phone during an SOS.

(b) Consent: it is entered only if the parent or co-parent chooses to, and doing so is their consent on the Child's behalf.

(c) Who sees it, and when:

• the Account Holder and co-parents can see it at any time in the app;
• the Child can see it on their own phone, beside the SOS button;
• when the Child sends an SOS, their phone shows the medical information on its lock screen until the SOS is resolved, so that a first responder can read it. While it is there, anyone holding the phone can read it without unlocking the phone;
• other Guardians (for example a grandparent with a narrower role) and Trusted Contacts cannot see it.

(d) What we do not do: we do not put it in SOS alerts or escalation texts, we do not send it to emergency services, and we never use it for advertising. It is stored separately from other data, with its own access controls.

(e) Changing or removing it: a parent or co-parent can edit or delete it at any time, and it is deleted with the Child or the Account.

4.6 The Child can see what is shared. Eyrie records, in a versioned "transparency contract", exactly what the Family can and cannot see about the Child. The Child can read it in the app and acknowledge it, and if the Family later widens what it can see, a new version is created and the Child is asked to acknowledge it again. The Child's acknowledgement is not the legal consent; that is given by the parent or guardian (clause 4.2). Eyrie is designed to be visible to the Child, not hidden.

4.7 Children's data is used only to provide the safety features to the Family. It is never sold, never used for advertising, and never disclosed to advertising networks, and is shared only within the Family and with the service providers and legal recipients described below.

4.8 If you believe a Child's personal information has been provided to us without proper authority, contact privacy@eyrie.au and we will investigate and, where appropriate, delete it.

4.9 We do not knowingly allow a person under 18 to be an Account Holder. Where laws overseas set a minimum age for a child's own consent (for example, COPPA in the United States, or GDPR digital-consent ages), we rely on the parent or guardian's consent and authority as described above.

5. How we use personal information

5.1 We use personal information to:

(a) provide the Service — show a Family where their Children are, draw the day's history, run Routines, and send safety alerts, SOS and notifications;

(b) let Guardians receive the alerts the Account Holder configures, and text Trusted Contacts when a Child's SOS goes unanswered;

(c) operate check-ins and text messages;

(d) keep the Service reliable and secure (reliability signals, crash and performance data, fraud and abuse prevention);

(e) manage entitlements based on your plan, and process billing;

(f) provide support and communicate with you about the Service (service messages);

(g) improve the Service, using aggregated or de-identified data where we can; and

(h) meet our legal, tax and safety obligations.

5.2 We do not sell your personal information. We never use or disclose the information in your Eyrie account — including anything about your Children — for advertising, and we never disclose it to advertising or data-broker networks. Some pages of our public website show ads served by Google; clause 11 explains what Google collects when you visit those pages.

6. When we disclose personal information

6.1 We disclose personal information only:

(a) Within your Family, as the Account Holder configures it. What a Guardian sees depends on the role the Account Holder gives them: a co-parent can see everything, including medical information; other roles see less (for example, location only). Trusted Contacts receive only the SOS text and email described in clause 3.1 — never a Child's location or medical information.

(b) To service providers ("processors") who help us run Eyrie, under contract and only for that purpose:

(c) For legal and safety reasons — where required or authorised by law, to respond to a valid legal request, to enforce our terms, to prevent fraud or abuse, or to protect the vital interests, life or safety of any person. See our Law Enforcement Guidelines.

(d) In a business transfer — if the Eyrie business is sold or transferred, subject to this policy.

6.2 We do not otherwise disclose your personal information to third parties.

7. Where your data is stored, and overseas disclosure (APP 8)

7.1 We store the Service's data with our cloud hosting provider, Amazon Web Services.

7.2 Some of our service providers (for example Stripe, Apple and Google) process personal information overseas, including in the United States, in order to provide their part of the Service (for example, delivering a push notification or processing a payment). Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contractual protections. Where the GDPR applies, we rely on appropriate safeguards such as standard contractual clauses.

7.3 By using push notifications and payment features, you acknowledge these overseas disclosures are necessary to provide those features.

8. Retention and deletion

8.1 We keep personal information only as long as we need it for the purposes in this policy, or as required by law. The main retention periods are in the table in clause 3.1. In summary:

(a) Location history is kept for the number of days included in your plan, then automatically deleted;

(b) account, family and subscription records are kept while the Account is active, and for a limited period afterwards where we must keep records (for example, financial records for tax purposes);

(c) support and moderation records are kept for a reasonable period.

8.2 Deleting your data. You can:

(a) delete individual items (a Child, a device, a Place) in the app or on the website, which stops future collection for that item;

(b) delete your whole Account and its data from your account settings on the website; or

(c) request deletion by emailing privacy@eyrie.au.

When you delete your Account, it stops working straight away, and we delete or de-identify your personal information within 30 days, except where we are legally required to keep it (for example, financial records) or need to retain limited information to resolve disputes or enforce our terms. Full details are in Data Deletion.

8.3 On plans that include data export, you can download a full export of your data from your account; a completed export file is available to download for 7 days and is then removed. On any plan, you can ask us for a copy of your personal information (clause 9).

9. Your rights and choices (APP 12 and 13)

9.1 You may, at any time:

(a) access the personal information we hold about you, and request correction of anything inaccurate, out of date or incomplete (APP 12 and 13);

(b) export your data yourself, on plans that include data export;

(c) delete your Account and data (clause 8.2);

(d) turn off location sharing on a device, or remove a device or Child, at any time — this stops future collection immediately;

(e) withdraw consent where we rely on it (this does not affect processing already carried out and may mean some features stop working); and

(f) opt out of non-essential communications (clause 10).

9.2 To exercise these rights, use the in-app/website controls or contact privacy@eyrie.au. We will respond within a reasonable time and within any period the law requires, and we may need to verify your identity first. We do not charge for access requests except where the law allows a reasonable cost-based fee. If we refuse access or correction, we will tell you why and how to complain.

9.3 Users in the EU/UK. Where the GDPR or UK GDPR applies, you also have rights to restriction, objection and portability, and to lodge a complaint with your supervisory authority.

9.4 Users in California/other US states. Where those laws apply, you have rights to know, access, delete and correct, and not to be discriminated against for exercising them. We do not "sell" personal information as those laws define it. The advertising cookies Google sets on some pages of our public website (clause 11) may count as "sharing" for cross-context behavioural advertising under some of those laws; you can turn off personalised ads as described in our Cookie Policy.

10. Direct marketing and communications (Spam Act 2003)

10.1 We send service messages you cannot opt out of while you have an Account (for example, safety alerts, security notices, billing and essential service updates), because they are necessary to provide the Service.

10.2 We will only send you marketing communications where we are permitted to (including under the Spam Act 2003 (Cth)), and every marketing email includes an unsubscribe option. You can also manage communication preferences in your account settings or by contacting privacy@eyrie.au. We do not sell or rent your contact details for others' marketing.

11. Cookies, advertising on our website, and similar technologies

11.1 Our website and web app use cookies and local storage that are essential to the Service (such as sign-in/session) and, optionally, preference storage.

11.2 Ads on some public website pages. Our home, features and pricing pages show ads served by Google AdSense. When you visit those pages, Google and its partners may use cookies and similar technologies to show ads — including ads based on your visits to this and other websites — to limit how often you see an ad, and to measure ads and prevent fraud. Google receives website-visit data only. It never receives information from your Eyrie account, and there are no ads in the Eyrie apps. See our Cookie Policy for details and how to turn off personalised ads.

12. How we protect personal information

12.1 We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include: encryption in transit (TLS); access controls and least-privilege access; separation of the most sensitive data (for example, a Child's medical information is stored separately with its own access controls); and designing the product to minimise what we collect (card numbers never reach our servers; support diagnostics never include a position).

12.2 No system is perfectly secure. We maintain safeguards appropriate to the sensitivity of the data, and we respond to security events as described below.

13. Data breaches (Notifiable Data Breaches scheme)

13.1 We maintain a data-breach response plan. If we experience a data breach that is likely to result in serious harm and is not remediated in time, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under the Privacy Act, and any other regulator the law requires. We will tell affected users what happened, what information was involved, and what they can do.

14. Permissions the app requests

14.1 The Eyrie app requests only the permissions its features need, and explains each before requesting it:

• Location (including background/precise) — to share a Child's position with the Family and power Places, Routines, alerts and SOS, including when the app is not open;
• Notifications — to deliver safety alerts and check-ins;
• Physical activity / motion — to tell moving from stationary for the timeline, and for driving-trip summaries;
• Contacts, call log and SMS (Android, Child Device) — so the phone can recognise numbers that are not in the Child's contacts for unknown-contact alerts. Only a masked number, a one-way hash and counts leave the phone — never message text, call audio or the full number;
• Usage access (Android, Child Device) — for app-usage totals;
• Run at start-up / exact alarms / ignore battery optimisation — so location sharing and time-based Routines keep working reliably on a Child Device.

You can change or revoke any permission in your device settings; some features will not work without the permission they depend on. Revoking location or disabling required permissions may trigger a "permission revoked" alert to the Family, consistent with Eyrie's transparency design.

15. Complaints

15.1 If you have a privacy concern, contact our Privacy Officer first at privacy@eyrie.au. We will acknowledge your complaint and aim to resolve it within a reasonable time (usually within 30 days).

15.2 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Users overseas may also complain to their local data-protection authority.

16. Changes to this policy

16.1 We may update this policy from time to time. We will post the new version at https://eyrie.au/legal/privacy with a new "last updated" date and, for material changes, notify you in the app or by email before they take effect. We will keep our Google Play Data Safety declaration and Apple privacy labels consistent with this policy.

17. Contact us

Privacy Officer: privacy@eyrie.au