English · Slovenčina

Privacy Policy

Bunky — shared family wiki for co-parents · Last updated: 26 October 2026 · Version 1.6

This Privacy Policy explains how Bunky ("Bunky", "we", "us") collects, uses, shares and protects personal data when you use our web application and website at bunky.ch and app.bunky.ch (the "Service").

We are based in Switzerland. We have built our privacy practices to meet the standards of the EU/EEA General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (revFADP/revDSG), which we apply as our global baseline. Depending on where you live, additional local rights may apply.

1. Who is responsible for your data (Controller)

Bunky — operated by Kralovic Services (Jan Kralovič), a sole proprietorship registered in Switzerland, Seestrasse 286, 8810 Horgen, Switzerland · UID CHE-317.332.653.
Contact for privacy matters: privacy@bunky.ch.

Our representative in the EU (Article 27 GDPR)

We have appointed EU Rep as our Representative under Article 27 of the EU General Data Protection Regulation (“GDPR”). All GDPR queries from EU Data Subjects or Data Protection authorities should be submitted to eurep.ie via their dedicated form. BizLegal Limited trading as EU Rep have their registered office at 27 Cork Road, Midleton Co. Cork, Ireland. Company number 635921. You may also contact us directly at privacy@bunky.ch.

2. A note on tracking and advertising

Bunky does not use third-party analytics, advertising networks, tracking pixels or advertising cookies. We do not sell or share your personal data for advertising or marketing by third parties. We use only the storage strictly necessary to run the app (see §9).

3. What data we collect

Account & profile

When you create an account — with Google Sign-In or with an email address and password — we store your name, email address and account identifier. With Google Sign-In these come from your Google account. Your password is handled by our authentication provider (Google Firebase Authentication) and is never stored in our database. You may add a display avatar, preferred language, and an optional phone number (used for the emergency card shown to the other parent).

Family & children data (entered by you)

Bunky is a shared wiki for a child's information. Parents enter data about their child(ren), which may include: name, date of birth/age, general information, health information (allergies, intolerances, blood group, height and weight, medications, vaccinations, medical history), doctors and their specialisation/contact details, school information and timetable, contacts, custody and vacation schedules, handovers and requests to swap days, calendar events, shared expenses and how they are settled, notes and tasks, wishes and ideas (a gift, an experience or something to try — with a short note, and who marked it done and when), agreements between the parents (a category, a title and optional details, and the other parent’s yes or no with an optional note), and emergency ("SOS") details.

Health information is a special category of personal data. We process it on the basis of each parent’s explicit consent (Art. 9(2)(a) GDPR). Consent is asked for separately — it is not part of accepting our Terms, and the rest of Bunky works without it — and each parent gives their own, as the child’s guardian. Until you have given yours, our servers do not give you the child’s health information — neither the Health section nor allergies, intolerances, blood group, height and weight. When you consent, we record on our server what you consented to, the version of this policy you were shown, and the time.

ID numbers and insurance details. Before you can add a child’s birth number or national ID number, ID document or health-insurance details, the app asks for your separate consent, recorded the same way. These values — and any field in General info you choose to PIN-protect — are encrypted in your browser (AES-256-GCM) before they are saved, with a key that belongs to that child. The key is stored with the child’s record so that both parents can read these fields: the encryption keeps the values out of plain view in our database, but it is not end-to-end encryption. To show them, the app asks for your personal PIN, which our server checks; they are hidden again after 30 seconds, and each time they are shown is recorded in the family’s history.

Messages, photos and files

Chat. Parents in a family can write to each other in the app. A new message waits 60 seconds before it is delivered, and until then you can change it or take it back; after that it can no longer be edited or deleted by anyone — like the family’s history, it is a record both parents can rely on. You can mark a message as urgent; the mark stays on the message.

Photos and files. You can add photos to a child’s Chronicle (a shared album), a photo or PDF of a receipt to an expense, and a photo of the school timetable. Photos are re-encoded in your browser before upload, which removes the details cameras embed in them, including where a photo was taken. For the Chronicle, before that, we read only the date and time the photo was taken, so that the album can be put in order. A photo that cannot be re-encoded is not uploaded. PDF receipts are stored as you upload them. Photos and files are stored with Google Cloud Storage for Firebase in the EU, and only the people who can see the rest of the family’s information can open them. In the Chronicle you can add a caption, a place and a category that you type yourself, react to photos, and agree photo rules with the other parent.

Notifications. If you switch on notifications on a device, we store that device’s push address and the keys needed to send to it. Notifications are delivered, encrypted, through the push service of your browser’s maker (for example Google for Chrome and Android), and they only say what kind of thing is waiting — for example a new message — never its text, a name or an amount. Switching notifications off on that device deletes this. If none of your devices has notifications switched on, a new chat message is announced by email instead, at most once every six hours, and that email does not contain the message either.

Family structure

Family membership, roles, and invitations (including the email address of a person you invite).

Waitlist

Until 22 October 2026, when Bunky launched, you could join a waitlist on bunky.ch; we have since removed the form. For the entries we still hold, we store your email address (as a hashed identifier plus the address), your language, and, where present, the campaign parameters (utm_*) in the link you arrived on and the address of the referring website. Those last two tell us which channel a signup came from; they were recorded only the first time you signed up and are capped in length. To limit abuse of the form we also kept a short-lived counter against a hashed version of your IP address — the raw address was never stored.

We only counted you as signed up once you confirmed through the link in the email we sent you. An entry that was never confirmed is deleted automatically 30 days after the form was submitted (see §7). Every email we send to that list carries a one-click unsubscribe link, and unsubscribing deletes your entry — we do not keep it marked as inactive.

We use this to notify you at launch and to understand which channels reached people. Basis: your consent (Art. 6(1)(a)), and our legitimate interest in preventing abuse of the form.

Payment data

Subscriptions are sold and processed by our Merchant of Record (payment provider). Your card/payment details are handled by that provider — we do not receive or store your full payment details. We store only your subscription status and provider customer/subscription identifiers.

Technical data

Standard server logs generated by our hosting providers (e.g. IP address, timestamps, device/browser type) for security and to operate the Service; a security check by Google reCAPTCHA, through Firebase App Check, which uses signals from your browser and device to confirm that requests come from our genuine app; calendar-feed (iCal) access tokens if you enable them; and an activity/history log of actions within a family (with server-set timestamps).

4. How we use your data and our legal bases

You can withdraw consent at any time (this does not affect processing already carried out).

5. Children's data

Bunky is intended for use by adults (parents/guardians). Children do not create accounts and do not enter their own data. Parents enter and control information about their child(ren) and are responsible for ensuring they are entitled to do so. The Service is not directed to children. If you believe data was entered without proper authority, contact us (§10).

A child who is old enough to form their own views — as a guide, from about 14 — may contact us directly at privacy@bunky.ch, for example to object to how information about them is used. We consider each such request on its own merits, verify it in a way that fits the risk, and never through the parent the request concerns.

6. Who we share data with (processors)

We share data with other members of your family (that is the purpose of the app) and with service providers who process data on our behalf under data-processing agreements:

We do not sell your personal data.

7. Retention

We keep account and profile data while your account is active. If you delete your account, there is a 30-day cancellable grace period; after that your authentication account and user record are deleted (see also our Account Deletion page). If you are the only parent in a family, that family and everything in it are deleted with your account.

Shared family records (information about a child that both parents share) are retained for the other parent and the child even after a parent leaves or deletes their account. The other parent holds that information on their own footing: they need it to care for the child under their contract with us (Art. 6(1)(b) GDPR) and, for health information, on the basis of their own consent as the child’s other guardian (Art. 9(2)(a)). Retention may also be necessary for the establishment, exercise or defence of legal claims (Art. 17(3)(e) GDPR), and the equivalent under Swiss law.

The departing parent’s name stays on the entries they created. In a two-parent family the remaining parent knows who the other parent is, so replacing the name with a label would not make anyone less identifiable — while it would make the family’s shared history, and any court export drawn from it, inconsistent about who did what.

Deleting things in the app. Most things you delete — entries, health records, school items, expenses, tasks, wishes, a child — disappear for both parents and can be restored from the family’s history for 30 days, so a mistake or a disputed deletion can be undone; they stay stored, hidden, until the family is deleted. Calendar events, notes and holidays are removed at once, but the history keeps what they said. Deleting a Chronicle photo, removing a receipt from an expense or replacing the timetable photo removes the file from storage; a deleted expense keeps its receipt, hidden, like the expense itself. Chat messages, agreements and the history cannot be deleted. If you want something erased for good earlier, write to privacy@bunky.ch; where it is shared with the other parent, we weigh your request against their rights (above).

If you withdraw your consent for health information, we stop relying on it for you: the child’s health information in that family — the Health section, allergies, intolerances, blood group, height and weight, also on the emergency card and in its offline copy — is locked for you, so you can no longer see, add or change it, and the family’s history shows you only that a health record changed, not what. The copy of your own data you can export (§10) still includes the health records you created yourself. Health information already in the family stays while the other parent’s own consent is still active, because they hold it on their own footing (above). When no parent’s consent remains, we stop processing that family’s health information for anyone; it is deleted together with the family’s records, or earlier on request at privacy@bunky.ch. Withdrawal does not affect processing already carried out. If you withdraw your consent for ID fields, you can no longer add them; values already stored stay.

Families without a subscription. Every new family starts with a free trial of 30 days. Paid plans have not started yet, so today no family becomes read-only or is deleted for not having a subscription. Once paid plans start, it will work like this: we remind the family’s parents by email 7, 3 and 1 days before the trial ends; if it ends without a subscription, the family becomes read-only. If it still has none 30 days later, we email its parents that the family will be deleted, and again one day before; five days after the first of these emails the family is deleted together with everything in it, in the same way as when a family is deleted in the app.

Waitlist entries have a hard time limit. An unconfirmed entry is deleted 30 days after you submit the form. A confirmed entry is deleted 730 days (about 24 months) after you confirm, or as soon as you unsubscribe — whichever comes first. Both limits run automatically. Server logs are kept for a limited period for security. Anything deleted from our database stays in its point-in-time recovery copies for up to 7 days before it is gone for good.

8. International transfers

Your family’s information, photos and files are stored in the EU (Firestore in europe-west1, files in Google’s EU multi-region). Sign-in (Firebase Authentication) runs in the US, and some other providers (§6) may also process data outside your country, including in the US. Where required, such transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses and equivalent Swiss safeguards.

9. Storage on your device

To work reliably and offline, Bunky stores some data locally in your browser: functional flags (e.g. onboarding progress and which messages and changes you have already seen), a local copy of the family information you have opened, so the app loads quickly and keeps working without a connection, and an offline copy of the emergency card (both in IndexedDB). The emergency card copy contains allergies, intolerances, blood group, height and weight only if you have given your consent for health information. If you choose to keep a child’s ID fields available offline, they are stored there encrypted, with the key protected by your PIN. Signing out deletes these copies from that browser. On the marketing site bunky.ch we keep one small value in your browser’s own storage: your chosen language, which stays until you clear your browser data. We do not use advertising or analytics cookies.

If you switch on current medications on the emergency card, that offline copy also contains the medication name, dosage and timing — unencrypted, so that the card can be read in an emergency without signing in or entering a PIN. This is off by default, it is one switch per child, and you can turn it off at any time; the medications are then removed from the offline copy the next time the card is refreshed.

10. Your rights

Subject to applicable law, you have the right to: access your data; correct it; delete it (subject to the shared-records retention in §7); restrict or object to processing; data portability; and to withdraw consent. Much of this you can do directly in the app (edit/export/delete), including withdrawing your consent for health information. What deleting something in the app does is explained in §7 and on our Account Deletion page. To exercise other rights, contact us at privacy@bunky.ch.

You may also lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or your local EU/EEA data protection authority.

11. Security

We use encryption in transit, access controls limiting data to members of your family, encryption of ID fields, which are shown only after your PIN is checked, and an append-only activity log with server-set timestamps. No system is perfectly secure, but we take reasonable measures to protect your data.

12. Changes to this policy

We may update this policy. Material changes will be indicated by updating the "Last updated" date and, where appropriate, by notice in the app.

13. Contact

Bunky — operated by Kralovic Services (Jan Kralovič) — privacy@bunky.ch — Seestrasse 286, 8810 Horgen, Switzerland · UID CHE-317.332.653.
EU representative: EU Rep (BizLegal Limited), 27 Cork Road, Midleton, Co. Cork, Ireland — see §1.

This is a plain-language privacy notice describing the actual data practices of the Service. If anything here is unclear, or you want to exercise a right described above, write to privacy@bunky.ch.