Data Controller and Contact Information

Rawaa Tales Ltd is the data controller responsible for the personal information collected through the Application and website.

If you have any questions about this Privacy Policy, your personal data, or wish to exercise any of your statutory data protection rights, please contact us at contact@rawaatales.com.

Parents, Guardians, and Children’s Information

The Application is designed for family use and children's entertainment and learning. We are committed to protecting the privacy of young users and supporting parental supervision.

Accounts, subscriptions, and purchases may only be created, purchased, and managed by a parent or legal guardian aged 18 or older. We do not knowingly permit children under 13 to create independent accounts or collect personal data directly and independently from children under 13.

When a parent or guardian registers an account, we collect parent contact information (such as the parent's name and email address) for account administration, authentication, subscription management, and essential customer communications.

Within the parent's account, the parent may optionally create a child reading profile by providing details such as a chosen nickname or first name, age, and preferred avatar or gender. This profile information is provided entirely under parental direction and is used solely to tailor the reading experience (for example, providing age-appropriate story recommendations, personalized avatars, and series progress tracking).

Parents can review, update, modify, or delete their child's profile information at any time directly within the Application settings, or by contacting us at contact@rawaatales.com.

Information We Collect

We collect information in the following ways when you use the Application:

1. Information Provided by Parents or Guardians: When creating an account or managing profiles, you provide your name, email address, password/authentication credentials (via Firebase Authentication, Google Sign-In, or Apple Sign-In), optional child profile details (age, avatar/gender, profile nickname), and any correspondence you send to our support team.

2. Reading Progress and App State: To provide a continuous reading experience across devices, we record reading history, chapter progress, unlocked stories, bookmarks, completed quizzes, and virtual token balances linked to your account in secure cloud storage.

3. Automatically Collected Technical Data: When you access the Application, we automatically collect technical details such as your device model, operating system version, unique device characteristics, IP address, app version, language settings, and timestamps of app launches to monitor service reliability and performance.

4. Notification and Reminder Data: If you opt in to push notifications, we generate and store a device-specific push notification token to deliver story updates and service alerts. If you enable daily reading reminders, the Application stores your selected reminder time locally on your device (and synced to your account) to schedule local reminder notifications.

The Application does not collect precise GPS location data.

Advertising Attribution and Measurement

To sustainably grow our readership, we run advertisements on platforms such as Meta and TikTok. We use privacy-restricted attribution technology to measure whether our marketing campaigns result in new app installs and first launches. This measurement helps us understand advertising effectiveness without profiling children or conducting behavioral advertising.

We integrate Singular's React Native Kids SDK (singular-react-native-kids-sdk), which is specifically built for child-directed applications. Rawaa Tales activates Singular's Limited Data Sharing setting from the very first app launch.

When the Application is installed and opened, Singular records the install event and basic app session metadata. For this purpose, Singular may process technical network information (IP address), device make and operating system specifications, the Identifier for Vendors (IDFV) on iOS, the App Set ID on Android, and Google Play Install Referrer data.

Strict Privacy Safeguards Applied to Attribution:

• The Kids SDK does not collect Apple's Identifier for Advertisers (IDFA) or the Google Advertising ID (GAID), and never prompts for iOS App Tracking Transparency (ATT) permission.

• On iOS, campaign measurement relies on Apple's aggregate SKAdNetwork framework, which transmits aggregated install signals to ad networks without including the IDFV or user-level identifiers.

• Rawaa Tales does not send Firebase account UIDs, user names, email addresses, RevenueCat customer identifiers, subscription transactions, story reading activity, or custom in-app events to Singular.

• The sole purpose of this integration is determining whether advertising resulted in an install—not building profiles of children or serving personalized/behavioral ads.

Please note that some network security tools, firewalls, or privacy-blocking DNS services may prevent attribution measurement. Blocking attribution will not affect your ability to use the Application or read stories.

Third-Party Services

We work with trusted third-party service providers to deliver core application functionality, secure authentication, cloud database infrastructure, subscription billing, notifications, and privacy-restricted advertising measurement. These providers process information on our behalf under strict data processing agreements and their respective privacy policies:

Advertising Measurement Recipients (Meta and TikTok): While neither the Meta SDK nor the TikTok SDK is installed in the Application, Meta and TikTok may receive restricted, aggregate campaign measurement signals via Singular and native platform attribution mechanisms (such as Apple SKAdNetwork and Google Play Install Referrer) to confirm campaign delivery.

Firebase services, including Firebase Cloud Messaging, collect aggregated diagnostics to ensure message delivery and help us detect technical bugs.

OneSignal is used to send parent newsletter updates, product announcements, and customer service communications. You can unsubscribe at any time using the link included in each email.

How We Use Information and Our Lawful Bases

Under the UK General Data Protection Regulation (UK GDPR), we must have a valid lawful basis to process your personal data. We process your information for the following purposes and legal bases:

1. Performance of a Contract (Article 6(1)(b) UK GDPR): Creating and maintaining parent accounts; authenticating logins via Firebase, Google, or Apple; syncing story reading progress, unlocked content, and bookmarks; managing Explorer subscription entitlements and token balances via RevenueCat and app store billing; and providing customer support.

2. Legitimate Interests (Article 6(1)(f) UK GDPR): Protecting the security and integrity of the Application; monitoring app performance, crash diagnostics, and uptime; calculating aggregate daily app usage trends; and measuring the effectiveness of our advertising campaigns through privacy-restricted install attribution via Singular (with Limited Data Sharing enabled) without tracking children or engaging in behavioral profiling.

3. Consent (Article 6(1)(a) UK GDPR): Delivering push notifications via Expo/Firebase (which you can enable or disable at any time in device or app settings); sending marketing emails via OneSignal (which you can opt out of at any time via the unsubscribe link); and scheduling local daily reading reminders.

4. Legal Obligation (Article 6(1)(c) UK GDPR): Fulfilling accounting, tax, statutory reporting, and consumer protection requirements.

We do not sell personal information. We share information only with service providers and advertising-measurement partners for the purposes described in this policy, where we have an appropriate legal basis, or where disclosure is required by law.

International Data Transfers

Some of our service providers (including Google Firebase, RevenueCat, Singular, and OneSignal) are based in or operate infrastructure located outside the United Kingdom (UK) and the European Economic Area (EEA), notably in the United States.

When transferring personal data outside the UK, we ensure appropriate safeguards are implemented in accordance with UK GDPR requirements. These safeguards include UK International Data Transfer Agreements (IDTAs), Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office and European Commission, and reliance on the UK-US Data Bridge (Data Privacy Framework) where applicable.

Data Retention

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law:

• Account and Profile Information: Retained for the lifetime of your active account to maintain your access and sync reading progress across devices.

• Account Deletion: If you delete your account through the Application or by emailing contact@rawaatales.com, we will delete or irreversibly anonymize your personal data and associated child profile data within 30 days, except where retention is strictly required for legal, tax, or fraud-prevention obligations (such as financial records retained for up to 6 years in accordance with statutory requirements).

• Push Notification Tokens: Removed or marked disabled immediately upon account sign-out or when notifications are turned off in settings.

• Attribution and Telemetry Data: Attribution metadata processed by Singular is retained on rolling operational cycles in accordance with Singular's privacy practices, and diagnostic crash logs are retained on short operational cycles (typically 30 to 90 days).

Your Data Protection Rights

Under UK data protection law, parents and guardians have specific rights regarding their personal data and that of their children:

• Right of Access: You have the right to request a copy of the personal information we hold about you and your child's profile.

• Right to Rectification: You can ask us to correct inaccurate or incomplete information.

• Right to Erasure (Right to be Forgotten): You can request that we delete your account and associated personal data.

• Right to Restriction: You have the right to request that we restrict the processing of your data in certain circumstances.

• Right to Object: You have the right to object to processing based on our legitimate interests.

• Right to Data Portability: You can request the transfer of data you provided to us in a structured, commonly used machine-readable format.

• Right to Withdraw Consent: Where processing is based on consent (such as marketing emails or push notifications), you may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please email us at contact@rawaatales.com. We respond to all verified requests within one month.

Right to Complain to the Regulator: If you have concerns about our data handling practices, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by telephone on 0303 123 1113.

Security

We implement appropriate technical, organizational, and physical safeguards designed to protect personal information from unauthorized access, loss, misuse, or alteration. These measures include encrypted communications (HTTPS/TLS), secure cloud access controls, and least-privilege administrative access.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our legal obligations, features, or privacy practices. When updates are published, we will revise the effective date at the top of this page. We encourage you to review this policy periodically.

Contact Us

If you have questions, comments, or requests regarding this Privacy Policy or our privacy practices, please contact Rawaa Tales Ltd at contact@rawaatales.com.