MiniHiki

Privacy Policy

MiniHiki — Privacy Policy

Last updated: 22 October 2026 Application: MiniHiki (iOS, Android) Data controller: N2N Trading Ltd (N2N Trading Oy, business ID 2922437-4) Address: Tulikivimylly 12, 60200 Seinäjoki, Finland Data protection contact: Niku Peltokangas Email: privacy@minihiki.com

1. General

MiniHiki is a physical activity motivation app for children, in which a coach (usually a parent or an adult acting in a coaching role) plans daily exercises for children, and the children complete them on their own device.

This privacy policy describes what personal data we collect, how we process it and what rights you have. The app is designed specifically for use by children under 13, so our privacy practices follow the EU General Data Protection Regulation (GDPR), in particular Article 8 (child's consent) and Articles 12–22 (rights of the data subject).

Geographic availability of the service: The service is available in those countries where distribution of the app has been opened in the Apple App Store and Google Play. The distribution area is limited to the EU/EEA and the United Kingdom, and the service is not directed at residents of other countries.

2. Whose data we process and why

2.1 Coach (adult)

  • Email address and password — for signing in (Firebase Authentication).
  • Team name — displayed within the app.
  • Club name and sport — when a team is created, a sport (e.g. football) and a club (e.g. Ilves) are selected. These are used to categorise the team and for statistics (see sections 2.5 and 2.6).

Legal basis: contract (GDPR 6(1)(b)) — providing the service requires signing in.

2.2 Child (under 18)

  • First name or nickname (no surname) — visible to the child themselves and to the coach of the same team.
  • Avatar emoji — chosen by the child or the coach.
  • Year of birth — the year only, used to determine whether guardian consent is required (under 13, GDPR Article 8). The exact date of birth is not collected.
  • Completions and stars — which exercises the child has done and when.
  • Feedback answers — if the coach asks for feedback after an exercise, the child's answer (e.g. easy / OK / hard, a 1–5 scale, a number or yes / no). Answers are visible only to the team's coaches.
  • Confirmation status — if the coach has asked an adult to confirm an exercise, whether the completion has been confirmed, when and how (PIN code, email or coach). See section 2.7.
  • Test results — if the coach uses tests (Premium), the child's results in coach-defined test exercises (e.g. a 30 m sprint time, push-ups in 30 seconds), the attempts, the date and whether the child or the coach recorded the result. Results are visible to the team's coaches and to the child; to other children in the team only if the coach has chosen the team leaderboard. Results are used to follow the child's own progress from one test session to the next. They are not health data, and no health-related conclusions are drawn from them.
  • Pseudonymous Firebase identifier (UID) — an internal user identifier, processed as personal data in accordance with GDPR Recital 26 (pseudonymised data is still personal data, not anonymous data).

We do not collect:

  • The child's surname
  • The child's exact date of birth
  • Photos or videos of the child (a coach may add images to exercise instructions, but these are not images of individuals)
  • Location data
  • Contact details (phone, email)
  • Any data from advertising networks or third-party analytics

Legal basis: guardian's consent (GDPR 6(1)(a) and 8(1)). A child cannot be added to a team without the guardian's confirmation.

2.3 Guardian

  • Email address — for the purpose of the guardian's confirmation and communication (sending login codes, confirming completions as described in section 2.7, GDPR requests).
  • Phone number (optional) — the coach may store it in order to send the child's login codes via WhatsApp. The field can be left empty, and MiniHiki never sends anything to the number itself: the coach sends the message from their own app.

Legal basis: legal obligation (GDPR 6(1)(c) and 8(2)) and contract (6(1)(b)).

2.4 Subscription and payment data (coach)

If a coach takes out a paid subscription, the payment is handled in full by Stripe (Stripe Payments Europe, Ltd., Ireland). The payment takes place on Stripe's own page (Stripe Checkout), so we never see or process:

  • Card numbers, CVC codes or bank credentials
  • Any other payment instrument details

Stripe acts as our processor and itself stores the billing data, including the payer's email address and name, as well as invoices and receipts for the period required by accounting obligations.

From Stripe we store in our own system only the following data:

  • Customer and subscription identifiers (customer id, subscription id) — pseudonymous identifiers which, combined with your account, are personal data
  • Product and price identifiers and the subscription tier (e.g. Coach, Team)
  • Subscription status and timestamps (start, renewal, cancellation, termination, payment failure)
  • Monthly price and VAT country

We do not store receipts or invoices in our own system — they are held by Stripe, which acts as the source system for accounting purposes.

We use this data for:

  • Verifying that a subscription is valid (access to paid features)
  • Meeting tax and accounting obligations (EU legislation requires receipts to be retained for 6 years)
  • Fraud prevention and preventing duplicate use

Separation of data after account deletion: When a user deletes their account, we transfer the minimum data required for accounting (time of payment, amount, VAT country, product ID) to a separate accounting register without any reference to a user identifier or email address. After this, transaction data can no longer be linked to an individual by reasonable means. The user account itself and its related data are deleted immediately (see section 6).

Legal basis: contract (6(1)(b)) and legal obligation (6(1)(c) — accounting, value added tax).

The payment processor's own privacy practices:

  • Stripe: https://stripe.com/privacy

2.5 Aggregated statistical data (not personal data)

For the purpose of developing the service we collect aggregated statistical data which cannot be linked to an individual:

  • Counters by sport and club — how many teams have been created per sport and club.
  • Daily completion counts per sport — how many exercises have been marked as done.
  • Number of active teams per day — how many teams show activity (based on team ID, not individual users).

This data is stored in a separate Firestore collection (analytics) which contains no user identifiers, names, email addresses or any other personal data. The data is used solely for developing the service and for business planning (e.g. which sports are most popular).

Because aggregated statistical data is not personal data within the meaning of the GDPR (Recital 26 — information which cannot by reasonable means be linked to an identified person), the GDPR's obligations concerning the processing of personal data do not apply to it. We do not transfer this data to third parties.

2.6 Team-level training statistics

We also develop the service and its content using team-level training statistics. When a child marks an exercise as done, the server updates a statistic kept at the level of team, training day and exercise:

  • the number of children who completed it and the number of feedback answers given by children (easy / just right / hard)
  • the exercise's category, main goal (e.g. strength, coordination), estimated duration, target value and number of sets
  • the team's sport, club and country

The statistic does not contain the child's name, identifier or any other information that can be linked to a child, nor the exercise's name or instructions. The team and the exercise are stored as keyed hashes (HMAC) from which the original identifier cannot be derived.

As long as the team exists, the statistic can by reasonable means be linked to the team and through it to the coach. It is therefore pseudonymised personal data and is processed in accordance with the GDPR. When the team is deleted, the link is permanently broken and the remaining statistic is anonymous.

Purposes:

  • developing the service and its training content (e.g. which exercises are completed and how regularly)
  • summaries and comparisons shown to teams, clubs and content creators, where the comparison group always contains at least five teams
  • scientific research and statistics in anonymous, aggregated form (e.g. cooperation with universities in research on children's physical activity)

Only anonymous, aggregated data in which every figure is based on at least five teams is disclosed to research or other partners. Data about an individual team or club is not disclosed without the club's permission.

Legal basis: legitimate interest (GDPR 6(1)(f)) — developing the service and producing statistics. The impact is minimal because no data relating to children is stored. The team's administrator may object to the processing by sending a request to privacy@minihiki.com (see section 6).

2.7 Adult confirmation of completions

A coach may mark an exercise, a challenge or a test as requiring an adult's confirmation. For tests, confirmation applies only to results the child records themselves. In that case we process the following:

  • Confirmation PIN — a 4-digit PIN is sent to the guardian's email, which an adult who is present uses to confirm the completion on the child's device. The PIN is stored only as a hash: we cannot see it afterwards, and the coach never sees it.
  • Evening summary — at most once a day, an email is sent to the guardian listing unconfirmed exercises with the child's first name, the exercise names and dates, and a link to the confirmation page. The link is valid for 7 days.
  • Confirmation status — the coach sees whether a completion has been confirmed, when and how.

Leaving an exercise unconfirmed does not affect the child's stars or completions: the coach simply sees it as unconfirmed. The guardian's email is not used for this unless the coach has enabled confirmation.

Legal basis: legitimate interest (GDPR 6(1)(f)) — reliable tracking of the team's training at the coach's request. The guardian may object by contacting the coach or privacy@minihiki.com, after which we stop sending confirmation emails to them (see section 6).

3. Guardian's confirmation (GDPR Article 8)

Before the data of a child under 13 is stored in the service:

  1. The coach adds the child to a team and enters the guardian's email address.
  2. An email is sent to the guardian containing a confirmation link and the child's login codes.
  3. The guardian clicks the link and confirms their consent. Only after this can the child sign in to the app.
  4. The guardian may withdraw their consent at any time by clicking the link in the same email or by contacting privacy@minihiki.com.

4. Data retention and location

  • Location: All data is stored in Google Cloud Firestore and Firebase Storage, in location eur3 (europe-west). Data does not leave the EU in normal use.
  • Retention period for user data: Data is retained for as long as the user is active. If a user has not signed in for 24 months, the accounts and their related data are deleted automatically.
  • Retention period for subscription and payment data: Receipts, invoices and transaction data are retained for 6 years as required by the Finnish Accounting Act (1336/1997), after which they are permanently deleted. When a user account is deleted, accounting data is separated from identifiers linked to user data (see section 2.4) so that it can no longer be linked to an individual by reasonable means. The account itself is deleted immediately.
  • Retention period for the marketing list: An email address is removed from the marketing mailing list as soon as you unsubscribe, and no later than within 7 days.
  • At the guardian's request, a child's data is deleted immediately (see section 6).
  • Confirmation of completions (section 2.7): confirmation links are deleted when they expire (7 days). The PIN hash is deleted when the child is removed from the team. The confirmation status is kept with the completion and deleted with it.
  • Test results (section 2.2) are kept as long as the child belongs to the team, so that progress can be compared across seasons. When the child is removed from the team, their test results are deleted. Otherwise the user data retention period (24 months) applies.
  • Team-level training statistics (section 2.6) are kept indefinitely. After the team is deleted they can no longer be linked to it and are anonymous.

5. Disclosures to third parties

We use the following sub-processors for processing data:

| Service | Purpose | Location | Privacy policy | |---|---|---|---| | Google Firebase (Auth, Firestore, Cloud Functions, FCM) | Authentication, data storage, push messages | EU (europe-west) | https://firebase.google.com/support/privacy | | Apple iCloud / APNs | iOS push messages | EU/USA | https://www.apple.com/legal/privacy/ | | Google Play Services | Android push messages | EU | https://policies.google.com/privacy | | Resend (resend.com) | Guardian confirmation messages, confirmation PINs and evening summaries, password resets, coach newsletters | USA (EU SCC) | https://resend.com/legal/privacy-policy | | Stripe (Stripe Payments Europe, Ltd.) | Processing of subscription payments, invoicing and receipts | Ireland (EU), parent company USA | https://stripe.com/privacy |

We do not sell or rent personal data to third parties. We do not use third-party advertising networks, analytics services or SDKs in relation to children's data.

5.1 International transfers of data

Although the servers and the data are located in the EU (europe-west), some of the sub-processors we use (Google LLC, Apple Inc., Stripe, Inc.) have US parent companies, and their personnel may have technical access rights to the data in connection with maintenance or support requests. Under the GDPR, such access is interpreted as a transfer of data to a third country.

We protect transfers with the following mechanisms:

  • EU-U.S. Data Privacy Framework (DPF) — Google LLC, Apple Inc. and Stripe, Inc. are DPF-certified companies (European Commission adequacy decision of 10 July 2023, C(2023) 4745).
  • European Commission Standard Contractual Clauses (SCC, 2021/914) — applied as a supplementary safeguard to all sub-processors that have access rights from the USA or elsewhere outside the EU.
  • Technical safeguards — all data is encrypted at rest (AES-256) and in transit (TLS 1.2+), which reduces the risk of access by third-country authorities.

We do not transfer personal data to countries for which the European Commission has not issued an adequacy decision or for which SCC clauses are not in force.

6. Rights of the data subject

You (or a guardian on behalf of a child under 13) have the following rights:

  • Access — to request a copy of all data stored about you or your child.
  • Rectification — to correct inaccurate data.
  • Erasure ("right to be forgotten") — in the app, a coach can delete their own account and all of their team's data with the button "Settings → Delete account". Locking of the account and the principal deletion of data from the active database take place immediately when the button is pressed (in accordance with Apple App Store Guideline 5.1.1(v)). A guardian may request the deletion of a child's data either directly from the coach or by contacting privacy@minihiki.com.
    • Immediately: Firebase Auth credentials, user profile, the child's data, completions, teams and related documents are deleted within seconds.
    • Up to 30 days: Google's and Apple's system-level backups are overwritten through the normal rotation cycle.
    • 6 years (pseudonymised): transaction data required for accounting (see sections 2.4 and 4) — separated so that it can no longer be linked to an individual.
    • Remains in anonymous form: team-level training statistics (section 2.6), which can no longer be linked to the team once it is deleted.
  • Withdrawal of consent — see section 3.
  • Data portability — to request your data in a machine-readable format.
  • Objection — to object to processing based on legitimate interest (Article 21 GDPR), e.g. the team-level training statistics (section 2.6). Send the request to privacy@minihiki.com. We handle it within one month: the team's statistics are deleted and no new ones are collected.
  • Complaint — you may lodge a complaint with the data protection supervisory authority of your country of residence if you suspect a data protection infringement:
    • Finland and the rest of the EU/EEA: Office of the Data Protection Ombudsman, https://tietosuoja.fi/en (or the corresponding authority in your own country)
    • United Kingdom (UK GDPR): Information Commissioner's Office (ICO), https://ico.org.uk

These rights are based on the EU General Data Protection Regulation (GDPR) and, correspondingly in the United Kingdom, on the Data Protection Act 2018 / UK GDPR. In substance the rights are practically identical in both areas.

Contact: privacy@minihiki.com. We respond within 30 days.

7. Information security

  • All data is encrypted at rest (Google Cloud) and in transit (TLS 1.2+).
  • Firebase access rules restrict reading of data to members of the same team — other users cannot read a team's data.
  • The coach's password is stored in Firebase Authentication; we neither see it nor are able to recover it.
  • A child signs in with a team code (6 characters) + their own code (4 characters) — no password and no email address for the child. The codes are generated randomly and delivered to the guardian by email together with the guardian's confirmation (see section 3).
  • Invalidating codes: If codes fall into the wrong hands or a guardian suspects misuse, the coach can change or invalidate the codes at any time from team management in the app. Old codes stop working immediately. A guardian may request new codes from the coach or from privacy@minihiki.com.
  • Confirmation of completions: the confirmation PIN is stored only as a hash, and it is locked for 15 minutes after five incorrect attempts. The evening summary link is random and personal, and merely opening the link does not confirm anything.

8. Notifications and messages

8.1 Push notifications

The app may send push notifications (exercise reminders, messages from the coach) to your device if you have allowed them. You can disable them at any time in your device settings.

8.2 Functional emails (to all users)

We send email for functional reasons without separate marketing consent. These include:

  • Guardian confirmation requests and login codes
  • Confirmation PINs and evening summaries for completions (only if the coach has enabled confirmation, see section 2.7)
  • Password resets
  • Important account changes (e.g. password change, email change)
  • Responses to GDPR requests
  • Notifications relating to a subscription (e.g. failed renewal, declined payment, end of subscription)
  • Any security notifications

Legal basis: contract (GDPR 6(1)(b)) and legitimate interest (6(1)(f)).

8.3 Newsletters and product updates (coaches only, opt-in)

We send coaches by email:

  • Announcements about new features and updates
  • Usage tips and guidance
  • The most important product news

These messages are sent only to coach users who have explicitly given their consent to this communication (opt-in). We do not send newsletters to guardians or to children. We do not send advertisements for third-party products, nor do we sell email address lists.

Legal basis: consent (GDPR 6(1)(a) and section 200 of the Finnish Act on Electronic Communications Services 917/2014). Direct marketing to a natural person by email requires prior consent.

Giving and withdrawing consent:

  • Consent is requested via a separate checkbox during registration (default: not selected) or in the app settings.
  • Consent can be withdrawn at any time as easily as it was given (GDPR 7(3)):
    • From the Settings → Email communication settings toggle in the app
    • From the one-click unsubscribe link at the end of every newsletter ("Unsubscribe")
    • By contacting privacy@minihiki.com
  • Withdrawal is processed immediately and the email address is removed from the marketing mailing list no later than within 7 days.
  • You cannot opt out of functional emails (section 8.2) for as long as you have an active account — these are necessary for the operation of the service and are not based on marketing consent.

9. Cookies and tracking technologies

The app does not use cookies (it is not a web application). Firebase uses device-specific pseudonymous identifiers (Firebase Installation ID, FCM token) to deliver notifications. These identifiers are personal data in accordance with GDPR Recital 26 (a pseudonymous identifier that can be linked to a user account), but they are not used for cross-tracking between different apps or websites, nor for advertising purposes.

10. Minors and app store requirements

The app is used both by adult coaches and by children. In the app stores it is listed in the Health & Fitness / Sports category, not in Apple's Kids Category. Age ratings:

  • Apple App Store: Age Rating 4+
  • Google Play: Everyone (IARC)

Because children use the app, we follow the requirements for children's data regardless of the category:

  • the child privacy provisions of Apple's App Store Review Guidelines (including section 5.1.4)
  • Google Play Families Policy
  • EU GDPR Article 8 (child's consent in information society services)
  • UK GDPR / Age Appropriate Design Code (ICO)

COPPA (United States): The service is not directed at residents of the United States, and it is not available in the United States App Store or Google Play store (see the distribution limitation in section 1). For this reason the United States Children's Online Privacy Protection Act (COPPA) does not apply to the service. If the distribution area is later extended to the United States, this privacy policy and the practices for processing children's data will be updated to meet COPPA requirements before release.

11. Changes to this policy

If we make significant changes to this policy, we will notify users in the app and by email to coaches. Minor updates are made by updating the "Last updated" date at the beginning of this document.

12. Contact details

Data protection matters and GDPR requests: privacy@minihiki.com

Technical support: support@minihiki.com

Postal address: N2N Trading Ltd (N2N Trading Oy) Tulikivimylly 12, 60200 Seinäjoki, Finland

Supervisory authority: Office of the Data Protection Ombudsman Lintulahdenkuja 4, 00530 Helsinki, Finland https://tietosuoja.fi/en

←Back to home