Privacy Policy
Last updated: 30 September 2026 · Version 1.0
Layaa is a security app, so it has to look at what is installed on a phone. This page says exactly what that means — and, just as importantly, what we never look at.
1. Who we are
Layaa is an Australian business operating under ABN 38 505 938 270, based in New South Wales, Australia. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Privacy enquiries: admin@layaa.io
2. The two people involved
Layaa is usually set up by a family member — the carer — on the phone of the person being protected (the protected person). We hold different information about each.
3. What we collect
From the protected phone
| What | Why |
|---|---|
| The list of installed apps — app name, package name, signing certificate, where it was installed from, the permissions it asks for, and when it was installed | This is the check. Without it there is nothing to look at. |
| How apps behave — how long each runs in the background, how often it opens itself, how many notifications it sends | Finds apps that show ads or run constantly |
| Whether an app can draw over other apps | The strongest single signal for pop-up ad apps |
| Phone model, Android version, and a scrambled one-way code identifying the device | Tells one phone in a household from another, so each gets the right protection |
| What we concluded about each app, and whether you removed or kept it | Improves detection and reduces false alarms |
From the carer
Your email address, and whether your subscription is active. Nothing else.
4. What we never collect
We do not collect:
- Any content. Not messages, emails, photos, documents, or anything typed. Layaa records that an app ran — never what was on screen.
- Browsing history or web activity.
- Location.
- Contacts, call logs, microphone or camera.
- Payment card details. See section 6.
Layaa also does not use Android’s accessibility service, which can read the screen. The app is built deliberately without it.
5. Consent from the protected person
The carer sets Layaa up, but the phone belongs to the protected person. During setup, their phone shows what Layaa will collect and asks the person holding it to confirm both that it is their phone and that their family may receive alerts about it. Layaa does not begin checking until that confirmation is given.
The protected person can withdraw consent at any time by uninstalling Layaa or by contacting us.
6. Payments
All subscriptions are purchased and processed through Google Play, with Google as the seller. Your payment details are given to Google, never to us. We receive only a record of whether a subscription is active, and Google pays us our share separately.
Google’s handling of your payment information is governed by the Google Privacy Policy.
7. Where your information is kept
- Stored in Australia, in Sydney, with our hosting provider Supabase.
- Encrypted while travelling over the internet and while stored.
- Records of individual app activity are deleted after 90 days.
- On the protected phone, the account password is never stored. It is exchanged at sign-in for a limited device key that can report check results and nothing else — it cannot reach billing or account settings.
8. Who we share it with
We do not sell personal information, and we never use it for advertising.
We share it only with:
- our hosting provider, acting on our instructions;
- Google, for processing your subscription;
- law enforcement or regulators, where the law requires it.
We use anonymous, combined statistics — for example, how common a particular app is across all Layaa phones — to improve detection. These cannot be traced back to any person.
9. Your rights
Under the Privacy Act you may ask us to give you access to your personal information, correct it, or delete it. Write to admin@layaa.io and we will respond within 30 days. There is no charge.
Deleting your account
You can delete your account and everything we hold at any time — in the app, or from our account deletion page. Deletion removes the household, every device record and all check history within 30 days, and from backups within a further 90 days.
Deleting your account does not cancel your Google Play subscription. Cancel that separately in the Google Play app — see our Terms.
10. Data breaches
If a breach occurs that is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
11. Children
Layaa is not directed at children and we do not knowingly collect information from anyone under 16.
12. Complaints
If you are unhappy with how we have handled your information, write to admin@layaa.io. We will acknowledge within 2 business days and respond within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
13. Changes
We will post any change on this page. If a change materially affects you, we will tell the carer in the app before it takes effect.