Official Regulatory Statement

Flightless Code Ltd — Regulatory Compliance & Safeguarding

This statement outlines the formal regulatory standing, data protection controls, and statutory safeguarding frameworks enforced across all operations of Flightless Code Ltd.

1. UK Information Commissioner’s Office (ICO) Registration

Flightless Code Ltd is registered as a Data Controller with the UK Information Commissioner's Office (ICO) under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

Data Controller: Flightless Code Ltd
Nature of Processing: Provision of courier route optimization, mutual-consent family protection platforms, and digital applications.
Data Protection Officer (DPO): [email protected]

2. UK Age-Appropriate Design Code (Children's Code)

In operating Family Safety Lab, Flightless Code Ltd strictly implements the 15 standards of the UK Information Commissioner's Age-Appropriate Design Code:

Standard 1: Best Interests Child safety and family autonomy are prioritized over engagement and corporate profits.

Standard 7: Geolocation Defaults Location is OFF by default. Requires mutual parent and child activation to enable.

Standard 8: Data Minimization Only current coordinates are retained with an automatic 15-minute TTL. No historical tracking trails.

Standard 9: Zero Data Sharing Coordinates are encrypted and never shared with third-party brokers, advertisers, or insurers.

Standard 11: Zero Nudge Profiling No behavioral nudging or dark patterns designed to encourage children to extend location sharing.

Standard 12: Mutual Transparency Children receive real-time notifications whenever a family member views their location.

3. US COPPA & Google Play Families Policy Adherence

Zero Advertising Identifiers: The Google Advertising ID (AD_ID) is stripped from all child profiles. Zero advertising SDKs are included.
No Background Location: The app does not request ACCESS_BACKGROUND_LOCATION. Location tracking runs exclusively during active foreground sessions with an ongoing, un-dismissible notification.
Verifiable Parental Consent (VPC): Children cannot register independently. Child profiles are onboarded solely via 6-digit pairing PINs created by an authenticated parent/guardian.

4. UK GDPR Statutory Rights

All users retain complete statutory rights to access, inspect, rectify, or erase their personal data. To exercise any data subject right, contact our Data Protection Officer at [email protected] or [email protected].