Privacy Policy

Last updated: October 10, 2026

Overview

Applowance ("we", "us", or "our") is a family screen time management app published by Ramses Works LLC. This policy explains what information we collect, how we use it, and what rights you have — including specific protections for children's data under COPPA and other applicable laws.

Information We Collect

We collect the following family and account data to operate the app, along with the usage and diagnostic data described under "Analytics and Tracking" below:

  • Parent account: Name and Apple ID identifier (via Sign in with Apple). Used for authentication and cross-device family management.
  • Child profile: Name (entered by the parent). Children do not provide email addresses or passwords.
  • Avatar emoji (optional): Any user — parent or child — may set a single emoji as their profile avatar. If set, it is synced across the family's devices so everyone sees the same avatar. It is optional, contains no personal information, and can be cleared at any time.
  • Chore data: Chore names, descriptions, reward minutes, recurrence settings, and completion records (status, timestamps).
  • Screen time balances: Available minutes, earned minutes, spent minutes, and active session state per child.
  • Screen time session records: Start time, end time, total duration, and whether the child ended a session early. These records describe the family-controlled screen time block (for example, "a 20-minute earned session") — not per-app usage. Apple's FamilyControls tokens identifying specific apps stay on the device and are never transmitted to us.
  • Manual balance adjustments: Minutes added or removed by a parent, with reason and timestamp.
  • Bonus time rules and awards: Where enabled for a family, streak/threshold rules configured by parents, plus records of automatically granted bonus minutes.
  • Custom rewards and redemptions: Premium and Lifetime plans only. Parent-defined non-screen-time rewards (e.g. "movie night") and child redemption records.
  • Allowance balances and transactions: Premium and Lifetime plans only. Dollar amounts attached to chores and per-transaction history. Applowance does not move real money — these are tracking records only.
  • Family activity log: Premium and Lifetime plans only. A timestamped audit trail of family actions (chore approvals, session events, redemptions) recording actor name, action, and target child name.
  • Parental consent records: Version-stamped acceptance of the in-app consent disclosure shown when a parent creates or joins a family.
  • Content reports: When a parent or child uses the in-app Report flow, we record the reporter's user identifier (Apple-issued for parents, anonymous Firebase UID for children), the target type and identifier, the reason text, and a timestamp so we can review and act on the report.
  • Device tokens: Firebase Cloud Messaging (FCM) registration tokens for the devices you are signed in on, so push and silent notifications can reach the right device. A registration token is a sending credential, so it is never stored as a field on your family member record, which every member of your family can read. Tokens are held in a separate per-device record that no app client can read or write in either direction — they are written and removed only by our server, and only for the device that owns the record. Signing out removes the record and then discards the token.
  • Age assurance signals: On iOS versions that provide Apple's Declared Age Range API, the App asks the operating system for a coarse age bracket (for example "under 13" or "adult") during new-family setup. An under-13 result prevents creating a parent family; other brackets and unresolved responses permit it. This check does not verify adulthood or parenthood. The answer is used for that decision in memory and is then discarded. No birthdate, exact age, or age range is written to your device or to our servers. If your Apple Account holder later withdraws consent, Apple notifies us and we record a revocation marker against the affected profiles so their access is paused; to match Apple's notification to the right family, we store an unreadable record linking an Apple-issued app transaction identifier to your family and member identifiers. It contains no age information.
  • Home Screen and Lock Screen widgets: If you add an Applowance widget, the App writes a small snapshot to its on-device shared container so the widget can render without launching the App. Depending on the widget and on whether the device belongs to a parent or a child, this can include display names and avatar emoji, available and earnable minutes, chore names and the number remaining, streak counts, pending approval counts, and session start and end times — on a parent's device, for each child in the family. The snapshot stays on that device and is never sent to us separately. Note that widget content can be visible to anyone who can see the device screen, including while it is locked — remove the widget if that is not what you want.
  • Optional PINs: If a parent sets a PIN for a child's profile, only a cryptographic hash (PBKDF2-HMAC-SHA256, 100,000 iterations, with a random per-PIN salt) is stored. The actual PIN is never stored. The optional family-wide PIN is stored exclusively in the iOS Keychain on the parent's device and is never synced to our servers.
  • Subscription and purchase data: Apple-issued transaction identifiers, product identifiers, and entitlement state are read from Apple's StoreKit so the app knows which premium features to unlock. Your active plan and product identifier are stored with your family record so your other devices resolve the same entitlements. Apple — not Applowance — holds your payment method and billing details.
  • Website forms: If you contact us through the website, we collect the email address you provide, your category, and your message. During the public beta and launch preparation, the website also took requests for TestFlight invitations and for a one-off App Store availability notification; for those submissions we also recorded the Privacy Policy and Terms versions you accepted and the acceptance time. A beta invite request also asked how you heard about Applowance; the answer was chosen from a short fixed list (for example "Google Search", "Reddit" or "Other") and was stored with the request so we could tell which channels reached families. We encrypt the email address and message at rest and use them only to respond to your request, or to complete a request made during the beta and launch period (such as sending the one-off App Store notification). Beta invitations were delivered by Apple through TestFlight once we added your address as a tester; Apple's handling of that address is governed by Apple's own privacy policy.

The Applowance app itself does not collect email addresses, phone numbers, location data, photos, contacts, browsing history, advertising identifiers (IDFA), biometric data, or per-app usage statistics from the child's device.

How We Use Your Data

Collected data is used to provide app functionality, improve reliability, and understand feature usage:

  • Authenticating parents and managing family membership
  • Syncing chores, approvals, balances, and activity across family devices
  • Delivering push notifications when chores are completed, sessions are starting/ending, or approvals are needed
  • Enforcing app restrictions via Apple's FamilyControls and ManagedSettings frameworks on the child's device
  • Preventing new parent-family setup when Apple returns an under-13 age bracket, and pausing profiles when Apple tells us the Apple Account holder has withdrawn age-assurance consent
  • Letting a parent grant ad-hoc free time and pair a child's device using a short-lived, single-purpose setup code
  • Resolving which premium features your plan unlocks, and keeping that entitlement consistent across your family's devices
  • Responding to website contact requests, and completing requests made prior to launch (such as sending requested App Store availability notifications and past TestFlight invitations)
  • Protecting families from abuse — for example, the invite-code lookup is rate-limited (5 attempts per 15 minutes per user) to prevent brute-force guessing, and content reports are routed to our team for prompt human review

We do not use your data for advertising or profiling. We use it only for the purposes described above. Current app usage and reliability reports are submitted only during consented parent sessions. Older beta reports can include information from child sessions, as described under "Analytics and Tracking" below.

Data Storage and Third-Party Services

Applowance uses the following third-party services to operate:

  • Firebase Authentication (Google): Manages parent sign-in (via Sign in with Apple) and anonymous authentication for children joining a family.
  • Cloud Firestore (Google): Stores and syncs family data (members, chores, completions, balances, sessions, adjustments, bonus rules and awards, allowances and allowance transactions, custom rewards and redemptions, activity log, consent records, subscription entitlement state, and content reports) across devices in real time. It also holds a number of records that no app client can read at all, kept server-only precisely because they are sensitive or security-critical: encrypted website form submissions, push registration tokens, invite-code reservations, hashed Screen Time setup codes, age-assurance revocation markers and device-binding records, rate-limit counters, and website form diagnostics. Access is enforced by Firestore security rules that distinguish parents from children, apply field-level whitelists, and deny client access to every server-only record above.
  • Firebase Cloud Messaging (Google): Delivers push notifications to parents and children. To protect privacy, FCM payloads intentionally omit child names — Apple's and Google's notification delivery logs are not under our control, so names are resolved locally on the receiving device using data already synced via Firestore.
  • Firebase Cloud Functions (Google): Powers the work that cannot safely run on a device: privacy-minimized push notifications (chore completions, reward redemptions, screen-time authorization loss, and silent wake-ups to a child's device), invite-code allocation and rate-limited validation, Screen Time setup-code issue and verification, parent-granted free time, push-device registration and removal, moderation alerts when content is reported, the multi-step account and child deletion pipeline together with its automatic retries, age-assurance consent revocation, and website form processing. Website submissions are validated, rate-limited, encrypted, and stored by onContactSubmit. Scheduled jobs delete expired rate-limit counters and website form diagnostics.
  • Apple App Store Server Notifications: Apple's servers notify ours about subscription lifecycle events and about withdrawal of age-assurance consent. We use these to keep entitlements correct and to pause profiles when consent is withdrawn.
  • Firebase App Check (Google): Verifies that requests to our backend come from authentic instances of the app or our protected website forms. Release app builds use Apple's App Attest provider, debug builds use a debug provider for development only, and website forms use reCAPTCHA Enterprise.
  • Firebase Crashlytics (Google), older beta builds only: Beta builds through build 47 included this service for crash reports, non-fatal error details, and diagnostic logs. Those reports can carry a parent's Firebase user identifier or a family identifier; logs can include child identifiers, and error details can contain user-entered content. Build 48 and later do not include this SDK. Previously collected data and any older builds still installed remain subject to the retention limits below.
  • Firebase Analytics (Google), older app beta builds only: Beta builds through build 47 included this SDK for feature-usage and subscription events. Build 48 and later do not include it. Current app reports use our own Firebase-hosted backend, as described under "Analytics and Tracking" below. Optional website analytics is separate and described in that section.
  • Apple FamilyControls / ManagedSettings / DeviceActivity: System-level frameworks for enforcing app restrictions on the child's device. The opaque tokens that identify specific apps to block stay on the device and are managed by Apple — they are not transmitted to Applowance.
  • Apple Declared Age Range and PermissionKit: System frameworks available on newer iOS versions. We request a coarse age bracket during new-family setup and can route a parental-consent request for an applicable significant app change. The age check does not verify adulthood or parenthood; its limits are described under "Children's Privacy" below. We do not receive a birthdate or exact age, and we do not store the returned age bracket.
  • Apple Sign in with Apple: Provides parent authentication. We receive only the user's name and a unique identifier — Apple may provide a private relay email address, which we do not store or use.
  • Apple StoreKit 2 and Family Sharing: StoreKit processes in-app purchases and subscriptions. We read transaction and product identifiers only to determine which features to unlock; we never see your payment method. Premium and Lifetime support Apple Family Sharing, so one purchase can extend access to your Apple Family group.

Data stored in Firestore is hosted on Google Cloud infrastructure and is protected by Google's security practices. We do not maintain additional servers. Local data is stored on-device using SwiftData within a shared app group container, protected by iOS device encryption.

Google processes data on our behalf as a data processor under their Firebase Data Processing Terms. We do not use any advertising services. Applowance uses no artificial-intelligence features and shares no data with any AI service or model provider.

Children's Privacy

Applowance is designed for families and is used by children under parental supervision. This section explains the setup, data collection, and controls available to families.

  • Family setup and consent: To set up a family, you sign in with Apple, confirm that you are 18 or older and the parent or legal guardian of children you add, and accept the in-app data-collection disclosure. Sign in with Apple authenticates the account; the parent or guardian declaration is your attestation. Consent is stored as a version-stamped record so we can identify which disclosure was accepted.
  • Data collected from children: The child's name (entered by the parent), chore completion records, screen time balance data, screen time session records, an optional single-emoji avatar the child may choose (synced across the family's devices), and — where the parent has enabled them — reward redemptions and bonus awards. Child-device connections also use a Firebase user identifier, an installation identifier, and a push-notification token. Children do not provide email addresses, passwords, or birthdates. Their identifiers and activity records can be linked to their family profile; anonymous sign-in does not make these records anonymous.
  • Child usage and diagnostics: Build 48 and later do not create new app usage or reliability reports from child sessions. Reports queued by older builds may still upload later. Family records, including chore completions and screen time sessions, still sync to provide the app's features. Older beta builds through build 47 recorded child app opens, sign-in restoration outcomes, and screen time session metadata with user identifiers and, when available, family identifiers. Older reports and retention limits are described under "Analytics and Tracking" below.
  • Age assurance: Where iOS provides it, we ask Apple for a coarse age bracket during new-family setup. A returned under-13 bracket prevents creating a new parent family. Other brackets are allowed, as are cases where sharing is declined or the API is unavailable or returns an error. This check does not establish that the person is an adult or a parent; the separate setup declaration asks them to attest that they are 18 or older and a parent or legal guardian. We do not receive a birthdate or exact age and do not store the bracket. If Apple notifies us that the account holder withdrew age-assurance consent, the affected profiles are paused until the matter is resolved with us directly.
  • No advertising: We do not serve ads or collect advertising identifiers (IDFA). App usage analytics and diagnostic reporting are described below.
  • No third-party data sharing: Children's data is not shared with any third party for their own purposes. Firebase processes data solely on our behalf.
  • No per-app usage transmitted: Applowance does not collect or transmit which specific apps a child has installed or how long they used each one. The app interacts with Apple's FamilyControls and DeviceActivity frameworks only to apply restrictions; the underlying tokens stay on the device.
  • Parental control: Parents can view, modify, and delete their children's family records through the app. Contact us about access to or deletion of diagnostic records.
  • Right to delete: Parents can delete family records using the in-app account deletion feature. Children can also request deletion of their own data from within the app; a parent approves the request from their own device, and the deletion then runs in full. See "Data Deletion" and "Data Retention" below for the scope and exceptions.
  • Demo mode: The pre-populated demo data shown during App Store review and in our marketing screenshots runs entirely in-memory on the reviewer's device and is never synced to our servers.

Data Deletion

You can delete your data at any time:

  • Parents: Go to Settings > Delete Account. This action requires re-authentication with Apple and cannot be undone. Applowance records a server-side deletion request before any destructive cloud work begins, then revokes the Sign in with Apple token, deletes the Firebase Authentication accounts for the family members, and cascade-deletes the entire family group's data — members, balances, allowances, chores, completions, sessions, manual adjustments, bonus rules and awards, custom rewards and redemptions, activity log, and consent records — along with the user-to-family mapping. The family document itself is removed when the family is deleted. Your Firebase Cloud Messaging token is also deleted and your parent notification topic is unsubscribed. Content reports are an exception and are retained for our safety records (see Data Retention below).
  • Children: Go to Settings > Delete My Data. Because this permanently erases family-visible records — including chores a parent created — it requires a parent's approval: the parent opens the child's profile in Applowance on their own device and allows the action, which opens a 15-minute window. Once approved, Applowance records a server-side deletion request, then permanently and irreversibly erases the child's own data — their profile (including name and avatar), chore completions, screen time balances and session records, manual adjustments, bonus awards, reward redemptions, allowance balance and transactions, chores assigned to them, and the activity-log entries that reference them — from both the local device (SwiftData) and our cloud database (Firestore), and deletes the child's anonymous Firebase Authentication account. Only that child's data is removed; the rest of the family and other members are unaffected.

When data is deleted, it is removed from both the local device (SwiftData) and our cloud database (Firestore). Firebase Authentication accounts are also deleted, and Sign in with Apple tokens are revoked.

Deleting your account does not cancel an App Store subscription. Apple manages subscription billing, so to stop being charged you must also cancel in the iPhone Settings app → tap your name → Subscriptions → Applowance.

If a network issue, function timeout, or partial cloud failure interrupts deletion, the app shows a pending deletion state instead of reporting completion. The server-side request is retried automatically until the scoped cloud purge finishes; local data and final sign-out are completed only after the backend confirms completion or the already-queued request has reached the final Firebase Authentication deletion step. If the pending state remains, contact us at privacy@applowance.app and we will verify or complete the deletion.

Data Retention

We retain family and account data while your account exists, subject to the retention periods and exceptions below. In-app deletion removes the family records described above and our diagnostic records linked to the deleted family or user identifiers. It does not itself erase reports previously sent to Firebase Analytics, Crashlytics, or Apple. Contact us at the address below about access to or deletion of diagnostic data.

Website contact and prior App Store notification submissions are retained only as long as needed to respond or send the requested notification. You may ask us to delete a website submission by contacting us at the address below.

Family activity log entries are retained for 365 days from the date of the entry, after which they are automatically deleted from both your devices and our servers; parents can review activity within that window. Entries still within the window are wiped together with the rest of the family's data when you delete your account. Content reports are kept indefinitely as safety records so we can demonstrate the actions we took in response — they are not erased by family deletion and remain accessible only to our moderation team. When a child's data is deleted, one activity log entry recording that deletion is retained for the same 365 days and is not erased with the rest of their records: it names the child and the date, so the family has a record that the deletion happened. It is readable only by parents in that family, and it carries no other information about the child.

Data Security

We implement appropriate security measures to protect your data:

  • All network communication uses HTTPS/TLS encryption
  • PINs (child profile PINs and the optional family PIN) are hashed with PBKDF2-HMAC-SHA256 using a random per-PIN salt and 100,000 iterations — the actual PIN is never stored
  • The family PIN is deliberately stored only in the iOS Keychain on the parent's device and is never synced to our servers
  • Firebase App Check (using Apple's App Attest in release builds) prevents unauthorized clients from accessing our backend
  • Cloud Functions enforce App Check and apply per-user rate limits to invite-code lookups to prevent brute-force
  • Screen Time setup codes are stored only as a salted hash, expire automatically, and are verified server-side under the same rate limits — the code itself is never stored
  • Push registration tokens are held in server-only records that no app client can read, so no member of your family can obtain another member's device token
  • Firestore security rules enforce role-based access control (parents vs. children) and field-level whitelists on every collection
  • Local data is protected by iOS device encryption and stored inside a shared app group container
  • Sign in with Apple uses cryptographic nonces to prevent replay attacks

Analytics and Tracking

Current app, build 48 and later. The app does not include Firebase Analytics or Firebase Crashlytics. Limited usage and reliability reports go to our own Firebase-hosted backend only while a parent is signed in and has accepted the current consent disclosure and terms. Reports cover parent app opens and screens, onboarding and sign-in restoration outcomes, paywall and purchase steps, coarse session-duration categories observed by the parent, and fixed categories of technical failures. They include the parent's Firebase user identifier, parent role, app version, build number, and OS version. Reports use fixed categories rather than names, free text, or raw error messages; they remain linked to the parent's account.

Current app reports start disabled on every launch. They are not submitted during child sessions or demo mode. Withdrawing consent stops new submissions and cancels pending requests. New reports have no persistent offline queue or automatic retry. These controls do not stop the family-data sync needed to provide features such as chores and screen time balances. Apple handles payment methods and billing details.

Older beta builds, through build 47. These builds included Firebase Analytics and Crashlytics. Usage reports included parent purchase, restore, subscription lifecycle, and trial events with product identifiers and plans. Older first-party reports also included child app opens, sign-in restoration outcomes, and screen time session timestamps, duration, and end reason. Reports carried user identifiers and, when available, family identifiers; crash logs could include child identifiers and user-entered content. Collection settings and queued reports could allow collection or uploads outside a consented parent session.

Changing profiles, withdrawing consent, or installing an update does not recall requests already sent or delete previously uploaded diagnostic data. Reports queued on a device by an older beta build may still upload later, including after an update. We do not collect the Identifier for Advertisers (IDFA) or participate in ad networks or data brokers. We may also receive anonymized, aggregate crash reports through Apple's built-in reporting if you opted in through device settings.

This website. The paragraphs above describe the Applowance iOS app. Website analytics is optional and separate from consent to submit a form. Only if you choose "Allow analytics" do we load Google Analytics 4 to measure public page views, navigation, pricing and FAQ interactions, theme changes, and form progress using fixed categories. Google receives standard browser and device information and processes network information when serving its tag and receiving events. Analytics cookies distinguish visits and expire after 90 days. We do not send your email, message, names, family identifiers, URL query strings, fragments, or referrers in our analytics events. Advertising storage, advertising personalization, Google signals, and user-provided data collection are disabled. Analytics is not loaded on the private help page, when you decline, or when your browser sends Do Not Track or Global Privacy Control. You can change your choice below; withdrawing it stops future collection and clears this site's analytics cookies, but does not recall data already sent. Google's Privacy Policy describes Google's processing.

Form diagnostics. When you submit the contact form — and, prior to general availability, when you submitted the launch notification or beta request — we record a small diagnostic entry so we can tell whether the form is working: which form you used, which stage of the request it reached, whether it succeeded or failed, and — if it failed — a fixed reason code from a short predefined list, such as "email-invalid" or "rate-limited". These entries never contain your email address or a hash of it, your message, your IP address, a device or visitor identifier, the page URL, referrer or user agent, or any raw error text. Each entry may carry a random reference generated for that single submission attempt, which is discarded when you leave the page and cannot be used to recognise you on a later visit or across sites. We keep these entries for 90 days, after which they are deleted automatically. Only Ramses Works staff can read them; they are not readable from this website or the app. If a submission fails, we show you that reference so you can quote it if you contact us.

Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you and your children
  • Request correction of inaccurate data
  • Request deletion of your data (available directly in the app)
  • Request a copy of your data in a portable format
  • Withdraw consent for data collection
  • Request that we stop processing your data

Deletion is available directly in the app (Settings > Delete Account for parents, Settings > Delete My Data for children, with a parent's approval). To exercise any other right — including requesting a copy of your data — contact us at privacy@applowance.app. There is no in-app data-export button today; we fulfill data-export requests manually and will respond within 30 days.

Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the app after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or our data practices, please contact us: