1What we do everywhere
- Privacy by design: no microphone, no listening content, raw motion processed on the phone, location only at earbud events and deleted after 7 days.
- Explicit consent for health-related measurements; parents give every consent for children.
- No ads, no trackers, no third-party analytics in the app, no data sale, no profiling of children.
- No hidden mode: the person monitored always sees it and who can see their data.
- In-app data download and account deletion; clear retention periods.
- EU hosting, encryption in transit and at rest, logged staff access.
2European Union and EEA: GDPR
Requirement How we meet it Art. 6 and 9: legal basis, health data Contract for the account; explicit consent for listening, dose and posture data and for event location Art. 8: children A parent creates every child account and gives consent; a recorded consent declaration before pairing a child under 13 Art. 12 to 14: transparency Privacy policy, children's notice with a part for kids, GDPR notice Art. 15 to 22: rights Download and deletion in the app; other requests answered within one month Art. 25: privacy by design and default Data minimisation, location off until allowed, friends off until a parent turns them on Art. 27: representative Named in the privacy policy once appointed Art. 28 and 44 to 49: processors and transfers Data processing agreements; EU hosting; Data Privacy Framework or Standard Contractual Clauses Art. 32 to 34: security and breaches Encryption, access control, logging; notification within 72 hours Art. 35: impact assessment Data protection impact assessment for the monitoring of children ePrivacy Directive No tracking cookies; analytics only after opt-in; refusing is as easy as accepting Details: GDPR notice. Accessibility follows the European Accessibility Act target of WCAG 2.2 AA; see the accessibility statement.
3United Kingdom: UK GDPR and the Children's Code
UK GDPR and the Data Protection Act 2018 apply as in the EU, with the UK Addendum for transfers and PECR for cookies. We follow the ICO's Age Appropriate Design Code (Children's Code): the child's best interests, high-privacy defaults, no nudging towards weaker settings, no profiling, geolocation off by default and an obvious sign to the child whenever a parent can see their data. Details: UK GDPR notice.
4United States
Law How we meet it COPPA (FTC Rule, as amended in 2025) Parental consent before collecting from children under 13; parents can review, delete and stop collection; written retention periods and security programme; no behavioural advertising CCPA / CPRA (California) Notice at collection; no sale or sharing; sensitive data used only to provide the service; rights to know, delete and correct; Global Privacy Control honoured Other state privacy laws The same rights for residents of every state; no targeted advertising or profiling Consumer health data laws (Washington My Health My Data Act, Nevada, Connecticut) Consumer health data only with consent, never sold, shared only with processors; consumer health data policy in the privacy notices FTC Act §5 and Health Breach Notification Rule Truthful privacy promises; breach notification to users and the FTC where required Automatic renewal laws Clear renewal terms before purchase; cancellation in Apple Account settings Details: US privacy notice and COPPA notice.
5Canada: PIPEDA and Québec Law 25
Requirement How we meet it PIPEDA fair information principles Accountability, meaningful consent, limited collection, safeguards, openness, individual access Children (OPC guidance) Consent from a parent; no behavioural advertising and no covert monitoring Québec Law 25 A person in charge of personal information reachable at the privacy mailbox; privacy by default; assessment before transfers outside Québec; parental consent under 14; portability Breach of security safeguards Report to the regulator and notify people where there is a real risk of significant harm CASL No marketing email without express consent; one-click unsubscribe 6Türkiye: KVKK
Law No. 6698 on the Protection of Personal Data: information notice (aydınlatma metni, Art. 10), explicit consent for special-category data (Art. 6) and for event location, consent from parents for minors, security measures (Art. 12), transfers abroad under Art. 9, rights under Art. 11 and an application form. Before offering the service in Türkiye we register with VERBİS and, if required, appoint a data controller representative. Consumer rules for subscriptions follow Law No. 6502 and the Distance Contracts Regulation. Details: KVKK notice.
7Brazil: LGPD
Legal bases under Art. 7 and, for sensitive health data, Art. 11; children's data processed in their best interest with specific consent from a parent (Art. 14); rights under Art. 18; international transfers under Art. 33. Details: LGPD notice.
8Japan: APPI
Purposes of use stated in advance; consent before acquiring health-related information (special care-required personal information); consent or equivalent safeguards for transfers abroad, with information about the destination; security control measures and breach reporting to the Personal Information Protection Commission. Details: APPI notice.
9App Store and Apple Health
Apple Health data is never used for advertising, marketing or data mining and is never sold. The app does no tracking, so it does not ask for App Tracking Transparency permission. The App Store privacy details match the privacy policy.
10Not a medical device
Earbunny provides awareness and habit information. It makes no diagnostic or treatment claims and is not intended to be a medical device under the EU MDR, US FDA rules or similar laws. See the health disclaimer.
11Questions
Compliance questions: . Legal questions: . Security researchers: see the security page.
Legal
Compliance overview
Children's and health-related data sit under the strictest rules in every country. This page maps each law to what Earbunny actually does. It is a summary: the binding texts are the privacy policy, the terms of use and the regional notices linked below.