Privacy Policy

SKIDOSH ("we," "us," "our") is a children's educational app published by mlchronix. We are committed to protecting the privacy of children and their parents. This policy explains what information we collect, why, who we share it with, and the choices you have. SKIDOSH is designed for families and complies with the Children's Online Privacy Protection Act (COPPA), GDPR/GDPR-K, the UK Children's Code, and Google Play's Families policy.

1. Who provides information

SKIDOSH is intended to be set up and managed by a parent or legal guardian.

• Parents create the account and provide their email and a display name.
• Children use the app under a parent-created profile. We collect only the limited information needed to run the educational experience, and only after a parent has given verifiable consent (see Section 6).

2. Information we collect

From parents (account holders):

• Email address (account creation, sign-in, and parental-consent records).
• Display name (optional; from email sign-up or, if used, Google/Apple sign-in).
• Parental-consent records (the fact and date of consent, consent version, marketing opt-in choice, and the child's age band).
• Purchase history (which subscription was bought; processed by our payment provider — see Section 4).

From or about children (with parental consent):

• Child's first name or nickname, and date of birth (used to derive the child's age band so we show age-appropriate content, and to personalize the experience).
• An optional profile picture (avatar), if a parent chooses to add one. It is stored only on your device and is never uploaded to us or to any third party.
• Learning progress and in-app activity: games played, scores, XP, levels, streaks, achievements, time spent, and screens viewed.
• In-app family messages between a parent and their child. A parent's note shows the parent's first name, taken from their display name (never their email).
• Child-created content such as drawings saved in creative games, and personal notes (notes are stored only on the device).

We do NOT collect: precise location, contacts, microphone/audio, photos or video, or advertising identifiers. The app contains no third-party advertising. The microphone is disabled.

About install measurement: when the app is first installed, we record that an install happened so we can tell which of our own parent-facing ads or links brought a new family to SKIDOSH. This is handled by AppsFlyer (Section 4) in the most limited configuration they offer: no advertising identifier is ever read, reports are anonymized, and nothing is shared with any advertising network. It measures the install itself — not your child, and not anything they do in the app.

About notifications: if a parent turns on reminders in the Parent Zone, we store that device's push-notification token (a random identifier issued by the device) so we can deliver notifications, and share it with Expo's notification service solely to deliver them. Turning reminders off, signing out, or deleting the account removes the token. If reminders are never enabled, no token is collected.

About the camera: a few tracing activities can show a live camera preview, so a child can trace a shape on the screen over real paper underneath. The preview is drawn on the device only — no photo or video is ever captured, saved, or sent anywhere. The camera stays off unless a child opens one of those activities and the device permission has been granted.

3. Why we collect it (purposes)

• Account management — create and secure the parent account.
• App functionality — save progress across devices, personalize content to the child's age, enable family messaging, and unlock purchased features.
• Legal compliance — record verifiable parental consent (COPPA/GDPR-K).
• Analytics — understand which educational activities are used so we can improve the app. Profile-linked analytics are sent to our servers only after parental consent has been given.
• App performance — diagnose crashes and errors (see Section 4).
• Install measurement — understand which of our own parent-facing ads or links brought a new family to the app, so we can spend a small marketing budget sensibly. This is a count of installs by source; it is never used to build a profile of a child or to target anyone.

We do not sell personal information, and we do not use children's data for behavioral advertising or profiling beyond the educational personalization described above.

4. Who we share information with

We use a small number of trusted service providers ("processors") who handle data on our behalf. We do not sell data. The one advertising-related disclosure we make is to Meta, described below: a hashed parent email and purchase details after a subscription, so we can measure our own ads to parents. Nothing about a child is ever included.

• Supabase — our database and authentication backend. Stores account, child profile, progress, consent, messaging, and entitlement data. Data in transit is encrypted via HTTPS.
• RevenueCat — processes in-app subscription purchases and restores. We send it a non-identifying account ID to link purchases to your account. We do not send your name, email, or your child's information to RevenueCat.
• Cloudinary — content delivery for some of our own story and video content. It serves that media to your device and so sees your device's IP address. We do not upload profile pictures, or any other personal information about you or your child, to Cloudinary. We do not run facial recognition, identification, or create any biometric profile of your child.
• Cloudflare R2 — content delivery and hosting for our own educational media (story videos, storybook pages, and drawing/writing template images). It serves app content to your device; we do not upload or store any personal information about you or your child in R2.
• images.weserv.nl (Weserv) — an image resizing service that shrinks our own public cover art before it reaches your device, so pages load faster and use less data. We send it only the public web address of one of our own picture files; it fetches that picture, resizes it, and returns it. It therefore sees your device's IP address. No account, profile, or child information is ever sent to it, and it is never used for anything a child creates or uploads.
• Expo (EAS Update & notifications) — delivers over-the-air updates to the app (basic device and app-version information is sent when checking) and, when a parent has enabled reminders, delivers push notifications (Expo receives the device's push token for delivery only). No account, profile, or child information is sent.
• AppsFlyer — measures app installs, so we can tell which of our own ads or links brought a new family to SKIDOSH. It runs in the strictest child-directed mode available: it never reads your device's advertising identifier (on Apple devices the app is built against a version of their software that has no ability to access it at all; on Android we remove the permission that would allow it), reports are anonymized, and sharing with advertising networks is switched off entirely. AppsFlyer records that an install happened, an identifier it generates itself for the device, and the approximate region derived from the IP address used at the time of install. We do not send it your name, your email, or any information about your child, and none of it is used to profile or target your child.
• Meta (Conversions API) — when a subscription purchase completes, our server (never the app, and never a child's device) sends Meta three things: the parent's email address hashed with SHA-256 so Meta cannot read it, the country, and the purchase value. Meta uses this only to tell us whether an ad we showed to an adult led to a subscription, so we can measure our own parent-facing campaigns. We never send a child's name, age, profile, progress or anything else about a child, and nothing is sent for free accounts. You can opt out at any time by emailing m.usman003344@gmail.com and we will stop sending your purchases to Meta.
• Apple / Google — only if you choose "Sign in with Apple" or "Continue with Google," in which case the provider returns your name/email to create your account.

We may also disclose information if required by law or to protect the safety of a child or the public.

5. International data transfers

Our service providers may process data on servers located outside your country. Where required, we rely on appropriate safeguards for such transfers.

6. Children's privacy & verifiable parental consent (COPPA)

SKIDOSH does not knowingly collect personal information from a child under 13 without verifiable parental consent. Before a child's information is collected or transmitted, a parent must complete our consent step, confirming they are the child's parent or guardian and agreeing to our data practices. Until consent is given, profile-linked activity is held on the device and is not transmitted to our servers.

A parent may, at any time: review the personal information we have collected about their child; refuse further collection or use; withdraw marketing consent (Parent Dashboard); and request deletion (Section 8). To exercise these rights, use the in-app Parent Dashboard or contact us (Section 10).

7. How we protect data

• All data transmitted between the app and our providers is encrypted in transit using HTTPS/TLS.
• Access to our backend is restricted and protected by authentication.
• The parent area is protected by a parent PIN, stored on the device in hashed form.

8. Data retention and deletion

We keep personal information only as long as needed to provide the service or as required by law. You can delete your data at any time:

• In the app: open the Parent Dashboard → "Delete All Data." This removes your child's progress, achievements, profile, messages, drawings, and account data from your device and from our servers, and queues your account for full removal within 30 days.
• By web request: visit our Delete Your Data page and follow the instructions.
• By email: contact us (Section 10) and we will process your request.

The install record held by AppsFlyer (Section 4) is deliberately never linked to your account — we do not store any identifier that would connect it to you or your child — so deleting your account leaves no separate advertising or attribution profile behind.

9. No advertising

SKIDOSH contains no third-party advertising and no ad networks. We do not use advertising identifiers and do not engage in behavioral advertising.

We do advertise SKIDOSH to adults. We run ads on platforms such as Meta and TikTok aimed at parents and guardians — never at children — which point to our website or our store listing. No advertising network operates inside the app and none receives anything from the app itself. The one thing we do report is described in Section 4: when a parent completes a subscription purchase, our server tells Meta — using a SHA-256 hash of the parent's email, the country and the purchase value — so we can see which ads to adults actually led to a subscription. No child data is ever part of that, and you can opt out by emailing m.usman003344@gmail.com. On Apple devices the only other campaign reporting our advertising partners receive is aggregated and sent by the operating system itself, not by us.

Our website uses cookies; the app does not. So that we can tell which of our ads actually bring families to SKIDOSH, this marketing website can load measurement cookies from Meta and TikTok. They run only on the website, only for visitors who accept them when asked, and record only that someone visited a page or chose to go to an app store — never who they are, and never anything about a child. Declining changes nothing about the site or the app. The SKIDOSH app sets no cookies, contains no advertising or analytics SDK from any ad platform, and is entirely unaffected by this choice.

10. Contact us

mlchronix
Privacy: m.usman003344@gmail.com
Support: m.usman003344@gmail.com

11. Changes to this policy

We may update this policy from time to time. If we make material changes to how we handle children's data, we will re-request parental consent and update the "Last updated" date above.