Privacy Policy

1. Who We Are

The data controller responsible for your personal data is Kathos Intelligence Ltd, Silverstream House, 45 Fitzroy Street, London, United Kingdom, company number [number] (“we”, “us”). You can contact us about privacy at eugene@kathos-intelligence.com.

This policy is available in the App Store and Google Play listings and at https://askyourkid-legal.lovable.app/privacy-policy.

2. Data We Collect

• Account data: your email address and user ID, received from Google or Apple when you sign in, and your display name. If you sign in with Apple on iPhone, we also store an Apple sign-in token, used only to revoke your Apple sign-in when you delete your account.
• Profile settings: your child's age band (e.g. 4–7), your language and time zone, from you and your device.
• Your content: the private conversation notes you write, the cards you mark as favourites, the cards you have already seen, and the decks you unlock by watching a video.
• Notification data: your push token and a log of notifications sent to you and whether you opened them, from your device and OneSignal.
• Advertising data: your advertising ID (IDFA on iPhone, Android Advertising ID), the ads shown and your interactions with them, and your consent choices, collected by Google AdMob and UMP.
• Device and technical data: IP address, approximate location derived from it (country or city), device model, operating system and app version, from your device, AdMob and Capgo.
• Diagnostics: crash reports, performance data (e.g. launch time) and app update events, collected by AdMob and Capgo.

We do not collect your precise location, contacts, photos, microphone recordings, or your child's name, date of birth or photo. Please do not include your child's name or other identifying details in notes.

Sign in with Apple lets you hide your real email address. If you choose this, we receive an Apple relay address instead.

3. How We Use Your Data and Our Legal Bases

If you are in the UK, EU or EEA, we process your data only on one of these legal bases: contract (GDPR Art. 6(1)(b)), consent (Art. 6(1)(a)), legitimate interests (Art. 6(1)(f)) or legal obligation (Art. 6(1)(c)). Where we rely on legitimate interests, we always balance them against your rights.

• To create and run your account and sign you in, using account data. Legal basis: contract.
• To show questions suited to your child's age, in your language, using profile settings. Legal basis: contract.
• To save and sync your notes and favourites, using your content. Legal basis: contract.
• To send reminders you agreed to, using notification data, user ID and time zone. Legal basis: consent (device permission).
• To show personalised ads, using advertising and device data. Legal basis: consent (UMP / ATT).
• To show non-personalised ads, limit ad frequency and prevent ad fraud, using device, technical and advertising data. Legal basis: legitimate interests (funding a free app).
• To deliver app updates, fix crashes and keep the App secure, using device data and diagnostics. Legal basis: legitimate interests.
• To comply with the law and handle legal claims, using any relevant data. Legal basis: legal obligation or legitimate interests.

We do not use your notes for advertising, and we do not sell your personal data or share it for cross-context behavioural advertising beyond the AdMob uses described in section 4. We do not make automated decisions that have legal or similarly significant effects on you.

4. Advertising and Your Consent

The App is free and funded by ads from Google AdMob. Ads may appear as banners, as full-screen ads (for example, when you move to the next card), and as optional rewarded videos that unlock locked decks.

Google acts as an independent controller for some advertising data and uses it under its own privacy policy and partner sites policy.

Your choices:

• Consent form (UMP). If you are in the UK, EU, EEA or Switzerland, or in a US state with privacy laws, we show Google's consent form when you first open the App. You can accept or refuse personalised ads. You can change your choice later in the App's settings via [“Privacy choices” / name of the menu item].
• App Tracking Transparency (iPhone). iOS asks whether the App may use your advertising ID to track you across other companies' apps. If you choose “Ask App Not to Track”, we do not access the IDFA. You can change this in iPhone Settings → Privacy & Security → Tracking.
• Android. You can reset or delete your advertising ID in your device settings (Settings → Privacy → Ads, or Google → Ads).

If you refuse personalised ads, you will still see ads, but they will not be based on your activity in other apps.

5. Push Notifications

If you allow notifications, we send reminders through OneSignal, which uses Apple Push Notification service on iPhone and Firebase Cloud Messaging on Android. To send them, we process your push token, your user ID, your time zone, and the content of the notification. Our own notification service, hosted on Google Cloud and shared across our apps, receives the notification text and your user ID so it can deliver the message. We keep a log of notifications sent to you.

You can turn notifications off at any time in your device settings.

Device permissions. The App asks for your permission before using device features such as notifications and, on iPhone, tracking. You can withdraw permission at any time in your device settings. Refusing a permission may limit some features but will not stop you using the App.

6. Children

The App is designed for parents and carers. It is not directed at children, and accounts are for adults only (see section 3 of our Terms). We do not knowingly collect personal data from children.

To show age-suitable questions, we ask only for your child's broad age band, never their name, date of birth, school or photo. If you believe a child has created an account, contact us and we will delete it.

7. Who We Share Data With

We share data only with the providers below, so they can run parts of the App for us, and with authorities when the law requires. We do not sell your personal data.

• Supabase provides our database, sign-in and server functions. It receives account data, profile settings, notes, favourites, seen cards, unlocked decks and the notification log. Role: processor.
• Google Sign-In lets you sign in with Google. It provides us with your email and Google account ID. Role: independent controller.
• Sign in with Apple lets you sign in with Apple. It provides us with your email (or a relay address) and an Apple ID token. When you delete your account, we ask Apple to revoke the app's access to your Apple ID. Role: independent controller.
• Google AdMob and UMP show ads and the consent form. They receive your advertising ID, IP address, device data, ad interactions, consent choices, and crash and performance data. Role: processor and, for some ad data, independent controller.
• OneSignal sends push notifications. It receives your push token, user ID, time zone, and notification content and opens. Role: processor.
• Firebase Cloud Messaging (Google) delivers notifications on Android. It receives your push token and notification content. Role: processor.
• Google Cloud hosts our own notification service. It receives your user ID and the notification text. Role: processor.
• Capgo delivers app updates. It receives a random app-specific device ID, app version, platform, IP address and update events. Role: processor.

We may also disclose data if required by law, to protect our rights or users' safety, or as part of a sale or merger of our business, in which case the new owner will be bound by this policy.

8. International Transfers

Some providers process data outside the UK and EEA, including in the United States. When this happens, we rely on safeguards such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or the EU–US / UK–US Data Privacy Framework where the provider is certified.

9. How Long We Keep Data

Account data, profile settings, notes, favourites, seen cards, unlocked decks and notification log: kept for as long as you have an account. When you delete your account, all of this is deleted immediately. Copies may remain in our automatic database backups until they expire, within 7 days, and are never restored or used.

• Advertising and diagnostic data held by Google: under Google's retention policies.
• Capgo update statistics: under Capgo's retention policies.

Technical and security logs, such as sign-in attempts and server logs, are kept for up to 90 days for troubleshooting and security, then deleted or anonymised.

We may keep limited data longer if the law requires it or to resolve a dispute.

10. Your Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data;
• delete your data;
• object to or restrict how we use it, including use based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time (for example, for personalised ads or notifications), without affecting earlier use;
• if you live in a US state with privacy laws (such as California), opt out of the “sale” or “sharing” of personal data for targeted advertising, and not be treated differently for using your rights.

To use any of these rights, email eugene@kathos-intelligence.com. We may ask for information to confirm your identity first. We will reply without undue delay and within one month. Where the law allows, we may extend this by up to two more months for complex or numerous requests, and we will tell you why. Some rights have legal exceptions.

If you have a concern about how we handle your data, please contact us first and we will try to resolve it. You also have the right to complain to a data protection authority. In the UK, this is the Information Commission. In the EU or EEA, it is the authority in the country where you live, work or where the issue happened. In Ukraine, it is the Ukrainian Parliament Commissioner for Human Rights.

Notice for U.S. residents. We do not sell personal information for money. Giving your advertising ID to Google AdMob for personalised ads may count as “sharing” or targeted advertising under some state privacy laws, such as the CCPA/CPRA. You can opt out by refusing personalised ads in the consent form, choosing “Ask App Not to Track” on iPhone, or turning off ad personalisation in your Android settings.

11. Deleting Your Account

You can delete your account in the App under [Settings → Delete account], or by following our account deletion guide.

When you delete your account, we immediately delete your account data, profile settings, notes, favourites, seen cards, unlocked decks and notification log, unlink your device from push notifications, and, if you signed in with Apple on iPhone, revoke your Apple sign-in. Data held by Google for advertising is handled under Google's policies; you can reset your advertising ID in your device settings.

12. Security

Data is encrypted in transit (HTTPS). Our database uses access rules so each user can access only their own data. No system is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.

13. Changes to This Policy

We may update this policy from time to time and will change the effective date when we do. If a change is significant, we will tell you in the App or by email before it takes effect.

14. Contact Us

If you have questions about this policy or your data, contact us at eugene@kathos-intelligence.com.

Kathos Intelligence Ltd
Silverstream House, 45 Fitzroy Street, London, UK
+44 7893 926416