The short version
- We store only what the app needs: the parent’s sign-in, the child’s nickname, age and hero, and the family’s missions, stars and rewards.
- We never ask for a child’s real name, photo, birth date, location or contacts.
- No ads, no analytics, no tracking, no advertising ID. We never sell or share data for advertising.
- Data is stored with Google Cloud (Firebase) in the Middle East.
- A parent can delete everything at any time: Settings › Delete account.
1. Who we are
Abtali is made by Abtali Apps, run by an individual developer based in Riyadh, Saudi Arabia (“we”, “us”). We decide how the data in Abtali is used and we are responsible for it.
Contact: support@abtali.com
2. What we collect
The parent
- Sign-in: parents sign in with Apple or Google. We receive your name and email address from them (with Apple you can hide your email). We use it to keep your family safe and to show which parents are in the family.
- Family settings: app language, the day your week ends, notification choices and sound setting.
- Parent PIN: we never store the PIN itself, only a salted, one-way code (hash) made from it, so a linked child device can check it.
- Push tokens: if you allow notifications, we store a push token for each parent phone, with the phone type (iPhone / Android) and app language, so we can send you notifications.
- Plan: whether the family is on the free trial, the Free plan or Premium, and the trial dates.
The child
- Profile: a nickname (it does not need to be the real name), age (3–12), the chosen hero and hero look, and the targets you picked.
- Routine and progress: the missions you set, when each mission was done and how it was checked (timer, trust or your approval), stars, star history, streaks, rewards you created, reward claims, goals, stickers and badges, and the daily and weekly scores. Scores are calculated on our server, never on the child’s device.
- Child devices: when you link your child’s own phone or tablet with the family QR code, that device signs in anonymously. It gets a random ID with no name, email or phone number, linked to that one child.
Technical data
Like every online service, Google’s servers process technical data such as IP addresses and device type to run sign-in, keep the service secure and stop abuse. Our server logs hold technical IDs and errors, not your family’s content, and are deleted automatically after 30 days.
3. What we do not collect
- No child’s real name (unless you type it as the nickname), photo, voice, birth date, school or address.
- No location, contacts, calendar or files.
- No advertising ID and no tracking across other apps or websites.
- No ads, no analytics tools and no third-party tracking SDKs. We do not use Firebase Analytics.
- The app uses the camera only to scan the family QR code on a child’s device. No picture is taken or saved.
- Children never create an account, type an email or password, or make purchases.
4. How we use data
- To run the app: show missions, give stars, keep scores, sync the family between phones, and let parents approve missions and rewards.
- To send parents the notifications they switched on (mission to approve, reward claim, streaks, weekly report, trial reminders).
- To manage the free trial and subscriptions.
- To answer you when you write to us, and to keep the service safe.
We do not sell data, we do not use it for advertising, and we do not make profiles of children.
Legal basis: we use your family’s data because you, as the parent or guardian, agree to it when you set up the app, and because we need it to provide the service you asked for. You can withdraw your agreement at any time by deleting the account.
5. Where data is stored
We use Google Firebase (Google Cloud):
- Database (Cloud Firestore) and server code (Cloud Functions): Google Cloud region me-central1, Doha, Qatar.
- File storage (Cloud Storage): region me-central2, Dammam, Saudi Arabia. The current app does not upload photos or files.
- Sign-in (Firebase Authentication): run by Google on its global systems.
Data is encrypted while it travels (HTTPS) and while stored by Google. Security rules make sure a family’s data can only be read by that family’s parents and linked child devices.
6. Service providers
We share data only with these providers, only so the app can work:
| Provider | What for | What they receive |
|---|---|---|
| Google Firebase (Google LLC) | Database, server code, sign-in, storage | All app data described above |
| Apple and Google | Sign-in; App Store / Google Play purchases; delivering notifications | Sign-in details; purchase details; the notification itself |
| Expo push service (650 Industries, USA) | Sending notifications to parent phones | The push token and the notification text, which can include the child’s nickname and a mission or reward name |
| RevenueCat (USA) | Checking subscriptions | A random app user ID and purchase receipts. No name or email. |
Some of these providers may process data outside Saudi Arabia (for example in the USA). They are bound by their own privacy and security terms. Children’s devices never receive notifications.
7. Children’s privacy
Abtali is made for children, so we follow strict rules:
- Only a parent or guardian can set up the app and give the data for a child.
- Kid Mode has no ads, no prices, no purchase buttons, no links out of the app and no settings. Everything for parents sits behind the parent PIN.
- Children see stars, not percentages or rankings.
- Children never get notifications, and the app never contacts a child directly.
If you think a child’s data was given to us without a parent’s agreement, write to support@abtali.com and we will delete it.
8. How long we keep data
- We keep your family’s data while you use Abtali.
- When you delete the account, the family, all children, missions, stars, rewards, scores, push tokens and your sign-in are deleted from our database straight away. If another parent is still in the family, only your own sign-in and phones are removed and the family stays for them.
- Family QR codes expire after 10 minutes and parent invite codes after 48 hours, and both work only once.
- Server logs are deleted automatically after 30 days.
- Purchase records are kept by Apple and Google under their own rules.
9. Your rights (Saudi PDPL)
Under Saudi Arabia’s Personal Data Protection Law (PDPL) and similar laws, you can:
- know what data we hold and how we use it (this page);
- get a copy of your family’s data;
- correct it: most of it you can change yourself in the app;
- delete it: Settings › Delete account, or by email;
- withdraw your agreement at any time.
Write to support@abtali.com from the email you sign in with. We answer within 30 days. You can also complain to the Saudi Data & AI Authority (SDAIA).
10. How to delete everything
In the app: open Parent Mode (enter your PIN) › Settings › Delete account and all data › Delete everything. This cannot be undone. See all the steps, including how to ask by email.
To stop a subscription, cancel it in your App Store or Google Play settings as well; deleting the account does not cancel a store subscription.
11. Changes to this policy
If we change this policy, we will update the date at the top. If the change is important (for example a new kind of data, like photos), we will tell parents in the app before it applies.
12. Contact
Abtali Apps · Riyadh, Saudi Arabia
support@abtali.com