Tsaskhan Privacy Policy

Last updated: 6 October 2026 · Applies to the Tsaskhan app on Android and iPhone, and to the website tsaskhan.com (buying a plan and the school request form)

Tsaskhan is a live map for one family: parents, children and grandparents in a family circle. It only works if it handles your location, so this page says plainly what the app collects, who can see it, how long it is kept and how to delete it.

The short version

Your location is shown only to the people in your family circle. Tsaskhan has no friends, no strangers and no public profiles: nobody outside the family can find or contact a child.
Children have no email account. Only a parent can add a child, with a one-time QR code from the parent's own phone. That is the parent's consent. We never ask for a child's date of birth, only an age group.
Tsaskhan keeps sharing while the app is closed. Your phone shows this the whole time: a notification on Android, the blue location mark on iPhone.
Only a child's route is recorded, from the child's own phone. It is kept for 30 days and only the child and their parents can see it. Parents' and other adults' routes are not recorded.
The first 14 days are free. After that the Family plan is paid on tsaskhan.com (QPay) or in the app (App Store, Google Play). Card and bank details never reach Tsaskhan. SOS keeps working even when no plan is paid.
No ads. We do not sell your data. There is no analytics or advertising code in the app.
Chats are encrypted on their way to the server, but they are not end-to-end encrypted.
You can delete your account and your data from inside the app at any time.

1. Who is responsible

Tsaskhan is made by Tulga Dashdorj, an individual developer in Ulaanbaatar, Mongolia. In this policy "we" means him. He decides how your data is handled and answers for it. Payments for Tsaskhan are received through QPay by NANA SPA, the developer's registered business (section 8). Contact details are at the end.

2. What Tsaskhan collects, and why

What	Why
Email address and password (adults only)	To sign you in to the app and to tsaskhan.com, confirm the address and reset a forgotten password. Passwords are handled by Firebase Authentication; we never see them. Your address is used only for signing in and is not shown to other users. When you sign up you confirm that you are 18 or older.
The name you choose, or for a child the name the parent typed, and the look you choose (a picture or emoji, and a colour)	What your family sees on your pin, in the chats and in notifications.
A child's age group: 8–12, 13–14 or 15–17, chosen by the parent	To decide what the child's phone shows (section 6). We never ask for a date of birth.
Your location: latitude, longitude, accuracy, speed and the time it was taken	To put you on the map for your family, to work out distances and routes, and to notice when you arrive at or leave a family place.
A child's route history: one record per child per day, saved only from the child's phone: points along the way (about every 30 m while moving, every 10 minutes while still) and arrivals at and departures from family places	So the child's parents can see the day's route. Not recorded for parents or other adults, and not during private time.
Battery level and whether the phone is charging	Shown next to your pin, so your family knows why you might go quiet, and to warn parents when a child's battery is low.
Whether Share my location is off (adults) or private time is on (teenagers), and since or until when	So your family sees that you are hidden; the setting is remembered across restarts so it cannot switch itself off.
Family circles: the circle's name and join code, who is in it, and each person's role (parent, child or member)	To run the family circle and decide who sees what.
Family places (Home, School, Training or another place, each with a size of 30–300 m) and arrival and leaving lines ("Anu arrived at School, 08:02")	For the family circle.
Messages in the family chat and in two-person chats inside a family, with the time sent and when each person last read the chat	To deliver the chats and show the unread dot.
"I'm here", "Pick me up" and a parent's "I'm coming" and "Picked up", and a teenager's start of private time, with the time	To tell the right people in the family (section 7).
SOS with where you were at that moment, and the "I'm on it" answers to it	To raise the alarm in the family and tell the sender who is coming (section 7).
Private names you give family members	Shown only to you.
Whether a child's location is on (on, off, or not allowed on the phone)	So parents are told when a child's location stops.
A random ID for this installation, and whether the phone is Android or iPhone	So that only one of your phones shares your location if you are signed in on two.
Push notification tokens, one per phone, with the app's language	To deliver notifications to that phone. See section 7.
Your inbox: a copy of each notification sent to your account (other than chat messages), with its time and whether you have read it	So you can find an alert again in the app. Kept for 30 days (section 7).
Your plan, until when it runs, how it started (free trial or QPay), and whether you have used the free trial	To unlock what your plan includes and remind you before it ends.
Orders made on tsaskhan.com/pay: your account ID, the term (1, 6 or 12 months), the amount, the QPay invoice number, the status and the times	To check the payment with QPay and turn the Family plan on (section 8).
School requests sent from the form on tsaskhan.com	To answer the school (section 9).

The camera is used only to scan a QR code: a parent's code on a child's phone, or a family circle's code. The picture is read on the phone and is never stored or sent.

Street addresses. In a child's history, a stop that is not a family place shows its street address. To find it, the phone that opens the history sends the stop's coordinates to the phone's own address service (Google on Android, Apple on iPhone). Tsaskhan does not store the address.

What Tsaskhan does not collect: your phone number (except one a school types into the request form), contacts, photos from your phone, microphone, files, advertising ID, browsing, card or bank details, or anyone's date of birth. The compass direction shown under your own pin stays on your phone. The app has no analytics, advertising or crash-reporting code of its own.

Lists of known places. The app contains lists of Ulaanbaatar's schools, kindergartens, gyms, pools, sports clubs and other places to train, from OpenStreetMap (© OpenStreetMap contributors, ODbL), so a parent can pick a child's school or training place. The lists are built into the app, hold no personal data, and nothing about you is sent anywhere to use them.

3. Who can see what

People in your family circle see your name, look, location, battery, and when your location last updated, plus the circle's places and arrival lines. A family member's phone also receives which kind of phone you share from (Android or iPhone); the app does not show it.
A child aged 8–12 does not see their parents' location (except during an SOS; section 7). A child aged 13–17 sees their parents.
Parents see more about their child. See section 6.
A child's route history is visible only to that child and to the child's parents in that family circle. Other members, such as grandparents, do not see it.
Chats. The family chat is readable only by the members of that family circle; a two-person chat only by those two people.
Only you can read your inbox, your push tokens and your plan.
Orders and school requests cannot be read by any user, in the app or on the website. Only the developer sees them, in the Firebase console.
Joining a circle. An adult joins a family circle with its six-character code or its QR code, so treat the code like a key and give it only to your family. A child joins only through a parent's one-time QR code.
Nobody else. There is no way in the app to search for a person, add a friend or message someone outside your family. We do not sell data, share it with advertisers, or show ads. The companies that run the service for us are listed in section 10. We will hand over data to the authorities only when Mongolian law requires it.

4. Location, including in the background

If you allow location and are sharing it, Tsaskhan keeps updating your position while the app is not on screen, so your family does not see a pin from an hour ago. It sends an update when you have moved, when your battery changes, and every few minutes while you stand still.

On Android, a notification (such as "Tsaskhan is sharing your location") stays on the whole time sharing runs in the background.
On iPhone, the blue location mark shows at the top of the screen while Tsaskhan shares in the background.
When you are not sharing, neither the notification nor the blue mark shows, because nothing runs in the background.
On a child's phone only, Tsaskhan asks for location "all the time" ("Allow all the time" on Android, "Always" on iPhone), so that the child's phone shares again by itself after it restarts or the app is updated. The child can refuse. Parents and other adults are never asked for it.

An adult can stop sharing with the Share my location switch (section 5). Location also stops if the system closes the app, or if you switch it off in the phone's settings; if a child's location stops, their parents are told.

When you ask for a route to a family member, your position and theirs are sent to Google to work out the route.

5. Share my location (adults)

An adult can turn off Share my location in Settings (this used to be called ghost mode). It does not just hide your pin: it deletes your coordinates, accuracy, speed and battery from the server and from every family circle you are in. While it is off, nothing new is sent. It stays off after a restart and on your other phone.

Children cannot hide from their parents. Teenagers have private time instead (section 6).

6. Children and parents

Tsaskhan is a family app. Adults sign up with email and password and confirm they are 18 or older. A person under 18 does not sign up with email: they join only through a parent.

How a child's account is made, and the parent's consent

In their own app, a parent types the child's name, chooses an age group (8–12, 13–14 or 15–17) and shows a one-time QR code. The code works once, for 15 minutes. The child's phone scans it, and our server creates the child's account and puts the child in the family circle. Every time someone is added as a child (a new child's code, or a member made a child), the app first asks the parent "Are you this child's parent or guardian?", and we keep who confirmed it and when. By confirming, the parent confirms that they are the child's parent or legal guardian and that they agree to Tsaskhan handling the child's data as this policy describes. Children under 13 use Tsaskhan only this way, with that consent, on an account their parent set up. Mongolia's Law on Personal Data Protection (article 8.5) asks for the consent of a minor's legal representative, and this is how that consent is given.

A parent can move a child's account to a new phone with a new QR code; the old phone is then signed out.

What the age group changes

8–12: a simple screen with big buttons. The child does not see their parents' location. No private time.
13–14: the full app. The child sees their parents, and may have up to 3 hours of private time a day, as the parent allows.
15–17: the same, with up to 6 hours of private time a day.

Private time (13–17)

The teenager turns it on for 1–3 hours, or "until home", within the daily limit the parent allows. It is never available between 22:00 and 06:00.
During it, the family sees only an area about 2 km across. The exact position stays on the child's phone.
The parents are told when it starts and until when.
It ends when the child arrives home, at 22:00, or when the child presses SOS or "Pick me up", which always show the exact position.
No route history is recorded during private time.

What a parent can see about their child

The child's location and battery, and when the location last updated.
A warning when the child's location is switched off, not allowed, or has been quiet for a while.
When the child arrives at or leaves a family place, such as Home or School.
The child's route history: the last 7 days while the Family plan runs. The server keeps no more than 30 days.
The child's "I'm here", "Pick me up" and SOS.
When the child leaves the family circle or deletes their account, with the child's name. For this, the name the parent typed stays in the circle.

What Tsaskhan does not do

It does not read the child's other apps, messages, photos or calls, block apps, or limit screen time.

The child always knows

The child's screen always shows who can see them, and on Android the notification says so too. On iPhone the blue location mark stays on.
Tsaskhan never hides its icon, never runs in secret, and cannot be installed on somebody's phone without them.

Removing a child's account

A child's account can be deleted from the child's own phone with Delete my account. A parent can also ask us to delete it (section 13).

If you believe a child is using Tsaskhan without a parent's agreement, write to us (section 16) and we will delete the child's data.

7. Notifications, the inbox, "I'm here", "Pick me up" and SOS

If you allow notifications, the app stores a push token for each of your phones. It is an address for delivering notifications to that phone, not your phone number. When something happens (a chat message, an arrival, a warning about a child, private time, an SOS, a reminder that your plan ends), our code on Google Cloud (Cloud Functions) sends the notification through Firebase Cloud Messaging, and on iPhone through Apple's push service. A notification can show a name and a short text, such as "Bolor arrived at Home" or the start of a message, and may appear on your lock screen. You can turn notifications off in the phone's settings. Tokens are deleted when you sign out or delete your account.

The inbox. Every notification sent to your account, except chat messages and the every-minute repeats of an SOS, is also kept in the app's inbox for 30 days, then deleted. It has two tabs: Family (SOS, arrivals, "I'm here", pickups, warnings about a child's phone) and Tsaskhan (what is new in the app, plan reminders).

"I'm here" and "Pick me up" from a child go to that child's parents and appear as a card in the family chat. A parent answers "I'm coming", then "Picked up", and the child and the other parents are told. An adult's "I'm here" goes to the family chat.

SOS sends an alarm with where you are at that moment. A child's SOS goes to the parents in the family circle. A parent's SOS goes to the other parents, children aged 13–17 and other members, never to children aged 8–12. The alarm rings until someone answers "I'm on it". During a child's SOS, a child aged 8–12 sees the nearest parent's location for up to one hour. SOS works only with an internet connection and is not an emergency service. In an emergency, call 102 (police), 103 (ambulance) or 101 (fire).

8. Paying for the Family plan

The Family plan is bought on tsaskhan.com/pay with QPay (a bank app or a QR code). Prices: ₮9,900 for a month, ₮47,000 for 6 months, ₮79,000 for a year. On an iPhone it can also be bought inside the app: with Apple's In-App Purchase on an iPhone, and with Google Play on Android, at the store's own price.
The page signs you in with your Tsaskhan email and password, through Firebase Authentication. A child's account cannot buy.
For each payment we store an order: your account ID, the term, the amount, the QPay invoice number, its status (waiting, paid or failed), when it was made and paid, and until when the plan then runs.
Your card and bank details are handled by QPay and your bank. They never reach Tsaskhan and we never store them. We only ask QPay whether the invoice has been paid in full.
Your bank app shows the receiver as NANA SPA. That is the developer's registered business, whose QPay account receives Tsaskhan's payments.
When you buy on an iPhone, Apple takes the payment with your Apple ID. We check Apple's signed record of the purchase (transaction number, product, date, environment) and keep it with your account ID. Your card and Apple ID details never reach Tsaskhan. Refunds are handled by Apple.
When you buy on Android, Google Play takes the payment with your Google account. We check the purchase with Google (order number, product, status) and keep it with your account ID. Your card and Google account details never reach Tsaskhan. Refunds are handled by Google.
An adult gets the Family plan free for 14 days, by itself, the first time they open the app, once per account.
A plan never renews and never charges you by itself: it runs longer only when you pay again. We remind you 3 days before a plan or the free days end.
When no parent in a family has a running plan, the family's app is paused — the map, chat, places and history — and shows a screen to buy the plan. SOS keeps working, and the map opens during an SOS. Nothing is deleted; renewing brings everything back.

9. The school request form

On tsaskhan.com a school or class can ask for a group offer. The form asks for the school's name, the class, how many families, the contact person's name, phone number and role (teacher, class parents' representative, school management or other), and an optional message. The request is stored where only the developer can read it, and he gets a notification about it. It is used only to answer the school. To stop the form being flooded (no more than five requests an hour from one address), a one-way scrambled (hashed) form of the sender's internet address is stored.

10. Services Tsaskhan uses

These companies process data for us, only to run the app and the website:

Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, Hosting): stores and delivers everything in section 2, and serves the website tsaskhan.com. Google processes it on our behalf under the Firebase privacy and security terms. For security, Google also handles technical data such as the IP address your phone or browser connects from.
Google Maps Platform (Maps SDK and the Routes API): draws the map and works out routes. Your phone talks to Google directly, and Google's Maps software can collect usage and diagnostic data for Google. See the Google Privacy Policy.
The phone's address service (Google on Android, Apple on iPhone): turns a stop's coordinates into a street address (section 2).
Google Fonts: the app downloads its two fonts from Google, which sees your phone's IP address.
Apple Push Notification service: delivers notifications to iPhones.
QPay and your bank, Apple App Store, Google Play: handle payments for the Family plan (section 8).
Codemagic and Apple TestFlight: used only to build the app and give it to testers. They do not receive the data in section 2.

11. Where it is stored, and how it is protected

Your data is stored by Google Firebase in Google's data centres in Singapore (asia-southeast1), and our Cloud Functions run in Singapore (asia-southeast1). Both are outside Mongolia, so using Tsaskhan means your data is stored abroad.

Everything travels over encrypted connections (HTTPS/TLS), and Google encrypts it on its disks.
Security rules on the server decide who can read each record, so another user's phone cannot fetch anything it is not allowed to see.
Chats are not end-to-end encrypted. Messages are stored on the server in a form that the developer's administrator account could read. We do not read your messages or look at your location, except when you ask us to fix a problem with your account, or when the law requires it.

12. How long it is kept

Your location: one record, overwritten on every update. It is deleted when you turn off Share my location or delete your account.
A child's route history: 30 days on the server, then deleted automatically every night.
Your inbox: 30 days, then deleted.
Family chat messages, "I'm here" and "Pick me up", arrival and leaving lines: until the person who wrote them deletes their account.
Family places: until a parent deletes them.
SOS: the alarm ends when the sender says they are safe, or after one hour. The note that an SOS happened stays on the family page until the sender deletes their account.
A child's QR code: useless after 15 minutes or after one use.
Orders and App Store / Google Play purchase records: kept for 10 years as the record of a payment, then deleted. They are not deleted automatically when an account is deleted.
School requests: until the developer deletes them.
Your account: until you delete it. We do not delete inactive accounts automatically.
Push tokens: until you sign out, delete your account, or the token stops working.

We do not make our own backups of the database. After something is deleted, Google may keep it in its own backup systems for a limited time before it is overwritten.

13. Deleting your data and your account

In the app (Android and iPhone)

Open Settings (on the simple 8–12 screen, the child's own card), tap Delete my account, and confirm. If the app asks you to sign in again, do so and repeat.

This deletes: your profile and last position, your membership of every family circle, the family chat messages you wrote, your own route history, your arrival lines, your "I'm here", "Pick me up", SOS and other alerts, your inbox, your private names, your phones and push tokens, and your sign-in. It cannot be undone.

What stays: a family circle you created stays for the people still in it, with its name, code and places. If a child deletes their account, the child's name stays in the circle so the parents know which child left. In two-person chats, the messages you wrote are deleted with your account; the other person's messages stay with them.

Without the app

Write to tsaskhan.support@gmail.com with the subject "Delete my Tsaskhan account", from the address you sign in with. A parent can ask the same for their child's account. We delete the same data within 30 days and reply when it is done.

Deleting some data but keeping the account

Turning off Share my location deletes an adult's location.
Leaving a family circle deletes your position from it.
Parents can delete family places.
A child's route history and your inbox delete themselves after 30 days.

14. Your rights, and Mongolian law

Tsaskhan handles personal data under Mongolia's Law on Personal Data Protection (Хүний хувийн мэдээлэл хамгаалах тухай хууль). We rely on consent. An adult gives it when they create an account, allow location and join a family circle. For a child, the parent gives it by making the QR code (section 6). You can withdraw it at any time by turning off Share my location, by leaving the circle, or by deleting your account; a parent can do the same for their child.

You have the right to know what we hold about you, to get a copy, to have it corrected, to have it deleted, and to withdraw your consent. Most of this you can do in the app. For a copy of your data, or anything else, write to us; we answer within 30 days. If you are not satisfied, you can complain to the National Human Rights Commission of Mongolia, which oversees personal data protection.

Tsaskhan is made for Mongolia. If you use it elsewhere, your local law may give you further rights, and we will honour them when you write to us.

15. Changes to this policy

If we change what is collected or who can see it, we will update the date at the top and tell you in the app before the change takes effect.

16. Contact

Questions, a copy of your data, or a request to delete it:
tsaskhan.support@gmail.com
Tulga Dashdorj · Tsaskhan · https://tsaskhan.com · Ulaanbaatar, Mongolia

Монгол хувилбар: Нууцлалын бодлого