Privacy Policy

The data controller is ILAN LABS, a registered business in Israel. Privacy contact: [email protected] or WhatsApp +972-55-779-6070. We reply within one business day, usually much sooner.

• The account is created and managed by a parent. Children have no account and no way to sign in on their own.
• The child's details are supplied by the parents, who also provide consent for processing them.
• There are no ads in the service, no behavioural advertising, and no sale of information.
• The name of the app in the foreground on the child's device is processed on the device itself and is not sent to our servers as usage history. The single exception — the gentle-block journal — is described in full in section 4.
• The account and all of its data can be deleted at any time.

a. Parent information

• Email address and display name, for creating an account and signing in.
• Subscription status (free / trial / Pro), purchase identifier, and billing dates.
• Notification and email preferences.

b. Child information (provided by the parent)

• First name, age or date of birth, gender, school grade.
• Hebrew and English reading levels, active subjects, interests, and learning preferences.

c. Learning data

• Questions answered, answer correctness, response times, help usage, and skips.
• Mastery per subject and skill, daily streaks, and activity summaries.
• Operational product events (sign-up, onboarding completion, lesson completion, purchase).

d. Protection settings and the protection journal

• Settings the parents choose per child: the daily minute cap, number of questions per lesson, quiet hours (a time range with no lesson and no minute spending), and a pause of protection.
• The allowed-apps list is chosen on the parent screen on the child's device and is stored on that device only — it is not sent to our servers.
• The gentle-block journal: when minutes run out mid-app, the system grants a few grace minutes and writes one row to the parents' journal.

e. Device information and protection health

• The paired device identifier and push notification token, used to message the parents.
• The device "health beacon": app version, which permissions are granted (app usage, display over other apps, accessibility, battery, notifications), and the time of last contact. This is what lets us show parents "protection is active" or "the device is not reporting".

f. Payment information

• We do not collect or store credit-card details. For website purchases, card details go directly to the secure page of the payment processor Sumit; for in-app purchases, payment is processed by Google Play.
• We store subscription status, the customer and purchase identifiers held by the payment provider, the billing cycle, and the renewal date. The receipt is issued and emailed by Sumit (website purchase) or by Google (in-app purchase).

For the screen-time gate to work, the child app reads on the device itself which app is currently in the foreground (via the accessibility permission — the only permission the app asks for). This is processed locally on the device for lock/unlock only and is not sent to our servers as usage history. This matches the Google Play data-safety declaration.

One deliberate exception — the gentle-block journal: when minutes run out mid-app and the system grants grace minutes, one journal row is uploaded with the name of the app the grace was spent in (its package name and display label), the time, and the number of minutes. This is the only way any app name leaves the device. That journal row:

• is stored in that family's own journal and visible only to parents in that family — so they can see "Friday 17:05 · Roblox · +12 minutes";
• is deleted automatically after 14 days;
• is not used for advertising, not sold, and not passed to any third party for its own purposes;
• is deleted together with the account.

Other than those journal rows, we do not upload app-usage history, a list of the apps installed on the device, or browsing history. In addition: we do not collect precise location, do not access contacts, and do not record audio or video.

The Android AccessibilityService

The "accessibility" permission enables a service called "KidiPass · Screen Time" ("KidiPass · זמן מסך"). KidiPass is not an assistive tool for people with disabilities; the service exists for the product's core function: detecting which app is in the foreground, and drawing the KidiPass block screen over it when screen time is up, plus a remaining-minutes timer over the app in use during allowed play. An accessibility window is the only window type that reliably shows the lesson screen over another app on every device. The service also shows the family-code pad over the uninstall screen of KidiPass itself. The device Settings are never locked.

• What is read: the foreground app's package name and the class name of the window it opened — not the content inside it. The service is declared with canRetrieveWindowContent=false: KidiPass does not read screen content, does not log keystrokes, passwords, or notifications, and does not record the screen or calls. One exception: when an uninstall confirmation screen opens, the service reads its title (the name of the app being removed) only to recognise whether it is KidiPass. The title is not stored or sent.
• Where it goes: it is processed on the device, for locking/unlocking and for drawing the block screen and the minutes timer only. We do not upload app-usage history, an app inventory, or browsing history. The sole exception is the gentle-block journal described above: one row with the app name, the time and the number of grace minutes, visible only to the parents in that family and deleted after 14 days. When the accessibility permission is on, the app name in that row comes from it.
• Without the permission: KidiPass runs in practice mode — lessons and stars, but it does not stop any other app. The accessibility permission is the only way KidiPass can stop YouTube or games when the child's time is up.
• Consent: before the request, a dedicated disclosure screen is shown on the device with two choices — accept or decline. It can be revoked at any time from Settings → Accessibility → "KidiPass · זמן מסך".
• Uninstalling KidiPass: while the permission is on, KidiPass itself can be uninstalled only with the family code. With the right code the uninstall continues; cancel closes the uninstall screen. The device Settings always open. Uninstalling any other app is not affected, and app stores work as usual. When the uninstall screen of KidiPass opens, parents are notified immediately (push + email). No Device Admin permission is used, and parents can always uninstall with the code or remotely from play.google.com.

• Adapting learning content to the child's level and progress.
• Operating the screen-time gate, the minute wallet, quiet hours, and the daily cap.
• Managing the account and subscription and issuing receipts.
• Sending operational messages to parents (email verification, summaries, system alerts, payment issues).
• Improving content quality, product performance, and service safety.
• Meeting legal obligations (for example retaining accounting documents).

Processing rests on the parent's consent, on the necessity of performing the contract (delivering the service and subscription), and on legal obligations. Consent for processing the child's information is given by the parent and may be withdrawn at any time (withdrawal means the service stops for that profile).

We rely on providers that process information only on our behalf and under our instructions:

• Google Firebase — authentication, the Firestore database, cloud functions, file storage, and push messaging. Data is stored in European Union regions (Firestore in eur3; functions and storage in europe-west1).
• OpenAI — generating personalized question packs (since August 31, 2026). Only learning-context text is sent — subject, grade, level, skills, interests, and a few earlier questions. No surname, email, phone number, payment details, account identifiers, or images are sent.
• Google Gemini — the parent help chat, summaries, content quality checks, a fallback path for question generation, and the photo of a book page when a parent chooses to turn a photo into a lesson. The photo goes to Gemini and to no other provider. Same accompanying scope of information as above.
• Sumit — payment processing for website purchases and receipt issuance. Receives the parent's name, email, and the family identifier. Card details are held by the processor only.
• Google Play Billing — processing subscriptions purchased inside the app.
• Zoho ZeptoMail — sending operational email from [email protected].
• Meta Platforms — two separate uses: (1) WhatsApp — when you write to us on WhatsApp, your phone number and the message content pass through Meta's WhatsApp Cloud API, and we store the conversation thread so we can reply and follow up; (2) the Meta measurement pixel, which runs on the marketing landing pages of the website only — not on product pages and not in the parent dashboard.
• Microsoft Clarity — anonymized usage measurement (heatmaps, scroll depth, and recordings of in-page interactions) on the public marketing pages of the website only, when the tool is enabled. It is not loaded on signed-in dashboard screens and does not exist in the child's app. The cookies it sets (_clck and _clsk) and how to opt out are detailed in the Cookie Policy.
• Google reCAPTCHA and App Check — abuse prevention and request attestation.
• Google Crashlytics — crash reports from the release build of the child's app.
• Dicta — an academic Hebrew vocalization service, which receives generated question text (with no identifying details).

We do not sell personal information and do not pass information to third parties for advertising. Information is disclosed to an authority only where the law requires it.

• The website and the parent dashboard are served from a dedicated server of ours, hosted with a hosting provider in Israel.
• Application data — accounts, profiles, learning data, settings, journals, and photos — is stored on Google Cloud in European Union regions (Firestore in eur3; functions and storage in europe-west1).
• Some providers process information outside the European Union — mainly the AI provider (OpenAI), the email sender (Zoho ZeptoMail), Meta, and Microsoft's measurement tool — subject to data-processing agreements and accepted transfer mechanisms. Using the service constitutes consent to such transfer.

• Active account — information is retained while the account is active.
• Account deletion — the account can be deleted from the parent dashboard or by writing to [email protected]. Deletion removes the parent account, child profiles, learning data, settings, and uploaded photos. Some data is deleted immediately and the rest within 30 days, except information we must retain by law (such as accounting and payment documents).
• Deleting a child — a single profile can be deleted without deleting the account.
• Automatic deletion — generated question packs after 90 days, lesson records after one year, and the gentle-block journal after 14 days.
• Help-chat transcripts — deleted automatically after one year (and older chat threads from the previous version after 90 days).
• Operational product events — operational usage events (sign-up, lesson completion, purchase, and so on) and abandonment records are deleted after 180 days. We use them for measurement and support only.
• Tokens and devices — push tokens and paired devices are kept while actually in use; an unused token is cleaned up automatically.

Information is transmitted encrypted (HTTPS). The website and the parent dashboard run on a dedicated server of ours, and application data is stored on Google Cloud infrastructure as described in section 8. Access is restricted by server-side authorization rules, and every write from the child's device goes through authenticated cloud functions with request attestation (App Check). No security method is perfect; we take reasonable and accepted measures.

• Push notifications — sent to the parent's device for meaningful events. They can be turned off in device settings or in account settings.
• Email — operational messages (verification, payment issues, subscription status) and content email (weekly summaries, tips). Every content email carries an unsubscribe link at the bottom; unsubscribing is immediate and requires no sign-in. Preferences can also be managed on the account screen.

The service uses essential cookies (secure account sessions) and a language-preference cookie. Full details, including measurement tools, are in the Cookie Policy.

You have the right to access, correct, and delete your information, to receive a copy of it, and to withdraw consent. Some of these are available directly on the account screen (data export and account deletion); for the rest, write to [email protected]. We respond within the period set by law.

There are no ads in the app and no ads to children. We do not use children's information for advertising. On marketing landing pages of the website only, a Meta measurement pixel may run — details and how to opt out are in the Cookie Policy.

We may update this policy from time to time. A material change will be posted on this page with an updated "Last updated" date, and by email where required.

Any privacy question: [email protected] or WhatsApp +972-55-779-6070.