Privacy Policy

Last updated: August 27, 2026

Overview

Applowance ("we", "us", or "our") is a family screen time management app published by Ramses Works. This policy explains what information we collect, how we use it, and what rights you have — including specific protections for children's data under COPPA and other applicable laws.

Information We Collect

We collect only the minimum data necessary for the app to function:

Parent account: Name and Apple ID identifier (via Sign in with Apple). Used for authentication and cross-device family management.
Child profile: Name (entered by the parent). Children do not provide email addresses or passwords.
Avatar emoji (optional): Any user — parent or child — may set a single emoji as their profile avatar. If set, it is synced across the family's devices so everyone sees the same avatar. It is optional, contains no personal information, and can be cleared at any time.
Chore data: Chore names, descriptions, reward minutes, recurrence settings, and completion records (status, timestamps).
Screen time balances: Available minutes, earned minutes, spent minutes, and active session state per child.
Screen time session records: Start time, end time, total duration, and whether the child ended a session early. These records describe the family-controlled screen time block (for example, "a 20-minute earned session") — not per-app usage. Apple's FamilyControls tokens identifying specific apps stay on the device and are never transmitted to us.
Manual balance adjustments: Minutes added or removed by a parent, with reason and timestamp.
Bonus time rules and awards: Where enabled for a family, streak/threshold rules configured by parents, plus records of automatically granted bonus minutes.
Custom rewards and redemptions: Premium and Lifetime plans only. Parent-defined non-screen-time rewards (e.g. "movie night") and child redemption records.
Allowance balances and transactions: Premium and Lifetime plans only. Dollar amounts attached to chores and per-transaction history. Applowance does not move real money — these are tracking records only.
Family activity log: Premium and Lifetime plans only. A timestamped audit trail of family actions (chore approvals, session events, redemptions) recording actor name, action, and target child name.
Parental consent records: Version-stamped acceptance of the in-app consent disclosure shown when a parent creates or joins a family.
Content reports: When a parent or child uses the in-app Report flow, we record the reporter's user identifier (Apple-issued for parents, anonymous Firebase UID for children), the target type and identifier, the reason text, and a timestamp so we can review and act on the report.
Device tokens: Firebase Cloud Messaging (FCM) registration tokens for the devices you are signed in on, so push and silent notifications can reach the right device. A registration token is a sending credential, so it is never stored as a field on your family member record, which every member of your family can read. Tokens are held in a separate per-device record that no app client can read or write in either direction — they are written and removed only by our server, and only for the device that owns the record. Signing out removes the record and then discards the token.
Age assurance signals: On iOS versions that provide Apple's Declared Age Range API, the App asks the operating system for a coarse age bracket (for example "under 13" or "adult") when a new family is created, to confirm the person setting up the family is an adult. The answer is used to make that single allow-or-block decision in memory and is then discarded. No birthdate, exact age, or age range is written to your device or to our servers. If your Apple Account holder later withdraws consent, Apple notifies us and we record a revocation marker against the affected profiles so their access is paused; to match Apple's notification to the right family, we store an unreadable record linking an Apple-issued app transaction identifier to your family and member identifiers. It contains no age information.
Home Screen and Lock Screen widgets: If you add an Applowance widget, the App writes a small snapshot to its on-device shared container so the widget can render without launching the App. Depending on the widget and on whether the device belongs to a parent or a child, this can include display names and avatar emoji, available and earnable minutes, chore names and the number remaining, streak counts, pending approval counts, and session start and end times — on a parent's device, for each child in the family. The snapshot stays on that device and is never sent to us separately. Note that widget content can be visible to anyone who can see the device screen, including while it is locked — remove the widget if that is not what you want.
Optional PINs: If a parent sets a PIN for a child's profile, only a cryptographic hash (PBKDF2-HMAC-SHA256, 100,000 iterations, with a random per-PIN salt) is stored. The actual PIN is never stored. The optional family-wide PIN is stored exclusively in the iOS Keychain on the parent's device and is never synced to our servers.
Subscription and purchase data: Apple-issued transaction identifiers, product identifiers, and entitlement state are read from Apple's StoreKit so the app knows which premium features to unlock. Your active plan and product identifier are stored with your family record so your other devices resolve the same entitlements. Apple — not Applowance — holds your payment method and billing details.
Website forms: If you contact us through the website, request an invite to the public beta, or ask to be notified when Applowance reaches the App Store, we collect the email address you provide and, for contact requests, your category and message. For beta invite requests and App Store notifications, we also record the Privacy Policy and Terms versions you accepted and the acceptance time. We encrypt the email address and message at rest and use them only to respond to your request, send you a TestFlight beta invitation, or send the App Store availability notification you requested. A beta invitation is delivered by Apple through TestFlight once we add your address as a tester; Apple's handling of that address is governed by Apple's own privacy policy.

The Applowance app itself does not collect email addresses, phone numbers, location data, photos, contacts, browsing history, advertising identifiers (IDFA), biometric data, or per-app usage statistics from the child's device.

How We Use Your Data

Collected data is used to provide app functionality, improve reliability, and understand parent-session feature usage:

Authenticating parents and managing family membership
Syncing chores, approvals, balances, and activity across family devices
Delivering push notifications when chores are completed, sessions are starting/ending, or approvals are needed
Enforcing app restrictions via Apple's FamilyControls and ManagedSettings frameworks on the child's device
Confirming that an adult is setting up a new family, and pausing profiles when Apple tells us the Apple Account holder has withdrawn consent
Letting a parent grant ad-hoc free time and pair a child's device using a short-lived, single-purpose setup code
Resolving which premium features your plan unlocks, and keeping that entitlement consistent across your family's devices
Responding to website contact requests, issuing requested TestFlight public-beta invitations, and sending requested App Store availability notifications
Protecting families from abuse — for example, the invite-code lookup is rate-limited (5 attempts per 15 minutes per user) to prevent brute-force guessing, and content reports are routed to our team for prompt human review

We do not use your data for advertising or profiling. We use it only for the purposes described above. We use Firebase Analytics during parent sessions only to understand feature usage and improve the app. Analytics is automatically disabled during child sessions to protect children's privacy.

Data Storage and Third-Party Services

Applowance uses the following third-party services to operate:

Firebase Authentication (Google): Manages parent sign-in (via Sign in with Apple) and anonymous authentication for children joining a family.
Cloud Firestore (Google): Stores and syncs family data (members, chores, completions, balances, sessions, adjustments, bonus rules and awards, allowances and allowance transactions, custom rewards and redemptions, activity log, consent records, subscription entitlement state, and content reports) across devices in real time. It also holds a number of records that no app client can read at all, kept server-only precisely because they are sensitive or security-critical: encrypted website form submissions, push registration tokens, invite-code reservations, hashed Screen Time setup codes, age-assurance revocation markers and device-binding records, rate-limit counters, and website form diagnostics. Access is enforced by Firestore security rules that distinguish parents from children, apply field-level whitelists, and deny client access to every server-only record above.
Firebase Cloud Messaging (Google): Delivers push notifications to parents and children. To protect privacy, FCM payloads intentionally omit child names — Apple's and Google's notification delivery logs are not under our control, so names are resolved locally on the receiving device using data already synced via Firestore.
Firebase Cloud Functions (Google): Powers the work that cannot safely run on a device: privacy-minimized push notifications (chore completions, reward redemptions, screen-time authorization loss, and silent wake-ups to a child's device), invite-code allocation and rate-limited validation, Screen Time setup-code issue and verification, parent-granted free time, push-device registration and removal, moderation alerts when content is reported, the multi-step account and child deletion pipeline together with its automatic retries, age-assurance consent revocation, and website form processing. Website submissions are validated, rate-limited, encrypted, and stored by onContactSubmit. Scheduled jobs delete expired rate-limit counters and website form diagnostics.
Apple App Store Server Notifications: Apple's servers notify ours about subscription lifecycle events and about withdrawal of age-assurance consent. We use these to keep entitlements correct and to pause profiles when consent is withdrawn.
Firebase App Check (Google): Verifies that requests to our backend come from authentic instances of the app or our protected website forms. Release app builds use Apple's App Attest provider, debug builds use a debug provider for development only, and website forms use reCAPTCHA Enterprise.
Firebase Crashlytics (Google): Collects crash reports during parent sessions only. We deliberately omit the verbose error description from non-fatal reports so user input is not echoed into crash logs.
Firebase Analytics (Google): Collects feature-usage analytics during parent sessions only — automatically disabled at app launch and only enabled once we confirm the active session is a parent.
Apple FamilyControls / ManagedSettings / DeviceActivity: System-level frameworks for enforcing app restrictions on the child's device. The opaque tokens that identify specific apps to block stay on the device and are managed by Apple — they are not transmitted to Applowance.
Apple Declared Age Range and PermissionKit: System frameworks, available on newer iOS versions, used to confirm that an adult is creating a family and to route any parental-consent request Apple requires for a significant app change. Apple answers with a coarse age bracket only; we do not receive a birthdate or exact age, and we do not store what Apple returns.
Apple Sign in with Apple: Provides parent authentication. We receive only the user's name and a unique identifier — Apple may provide a private relay email address, which we do not store or use.
Apple StoreKit 2 and Family Sharing: StoreKit processes in-app purchases and subscriptions. We read transaction and product identifiers only to determine which features to unlock; we never see your payment method. Premium and Lifetime support Apple Family Sharing, so one purchase can extend access to your Apple Family group.

Data stored in Firestore is hosted on Google Cloud infrastructure and is protected by Google's security practices. We do not maintain additional servers. Local data is stored on-device using SwiftData within a shared app group container, protected by iOS device encryption.

Google processes data on our behalf as a data processor under their Firebase Data Processing Terms. Both Crashlytics and Analytics are automatically disabled during child sessions to protect children's privacy. We do not use any advertising services. Applowance uses no artificial-intelligence features and shares no data with any AI service or model provider.

Children's Privacy (COPPA Compliance)

Applowance is designed for families and is used by children under parental supervision. We take children's privacy seriously and comply with the Children's Online Privacy Protection Act (COPPA) and other applicable children's privacy laws.

Parental consent: A parent must sign in with Apple and provide explicit consent via an in-app consent screen before any child data is collected. The parent's verified Apple identity serves as the basis for verifiable parental consent, and the consent is stored as a version-stamped record so we can demonstrate which disclosure was shown at the time of consent.
Data collected from children: The child's name (entered by the parent), chore completion records, screen time balance data, screen time session records, an optional single-emoji avatar the child may choose (synced across the family's devices), and — where the parent has enabled them — reward redemptions and bonus awards. Children do not provide email addresses, passwords, birthdates, or other personal information.
Analytics and crash reporting are off for children: Firebase Analytics and Firebase Crashlytics are disabled at app launch and only re-enabled once the active session is confirmed to belong to a parent profile. Subscription-related analytics events are gated by the same check — no child session ever triggers a tracked event.
Age assurance: Where iOS provides it, we ask Apple for a coarse age bracket when a family is first created so that an adult, not a child, is the one setting it up. We receive a bracket — never a birthdate or exact age — and we do not store it. If the Apple Account holder withdraws consent, Apple tells us and the affected profiles are paused until the matter is resolved with us directly.
No tracking or advertising: We do not track children, serve ads, or use third-party analytics. NSPrivacyTracking is set to false in our privacy manifest.
No third-party data sharing: Children's data is not shared with any third party for their own purposes. Firebase processes data solely on our behalf.
No per-app usage transmitted: Applowance does not collect or transmit which specific apps a child has installed or how long they used each one. The app interacts with Apple's FamilyControls and DeviceActivity frameworks only to apply restrictions; the underlying tokens stay on the device.
Parental control: Parents can view, modify, and delete all of their children's data at any time through the app.
Right to delete: Parents can delete all family data (including all children's data) using the in-app account deletion feature. Children can also delete their own data from within the app. See "Data Deletion" below.
Demo mode: The pre-populated demo data shown during App Store review and in our marketing screenshots runs entirely in-memory on the reviewer's device and is never synced to our servers.

Data Deletion

You can delete your data at any time:

Parents: Go to Settings > Delete Account. This action requires re-authentication with Apple and cannot be undone. Applowance records a server-side deletion request before any destructive cloud work begins, then revokes the Sign in with Apple token, deletes the Firebase Authentication accounts for the family members, and cascade-deletes the entire family group's data — members, balances, allowances, chores, completions, sessions, manual adjustments, bonus rules and awards, custom rewards and redemptions, activity log, and consent records — along with the user-to-family mapping. The family document itself is removed when the family is deleted. Your Firebase Cloud Messaging token is also deleted and your parent notification topic is unsubscribed. Content reports are an exception and are retained for our safety records (see Data Retention below).
Children: Go to Settings > Delete My Data. Applowance records a server-side deletion request, then permanently and irreversibly erases the child's own data — their profile (including name and avatar), chore completions, screen time balances and session records, manual adjustments, bonus awards, reward redemptions, allowance balance and transactions, chores assigned to them, and the activity-log entries that reference them — from both the local device (SwiftData) and our cloud database (Firestore), and deletes the child's anonymous Firebase Authentication account. Only that child's data is removed; the rest of the family and other members are unaffected.

When data is deleted, it is removed from both the local device (SwiftData) and our cloud database (Firestore). Firebase Authentication accounts are also deleted, and Sign in with Apple tokens are revoked.

Deleting your account does not cancel an App Store subscription. Apple manages subscription billing, so to stop being charged you must also cancel in the iPhone Settings app → tap your name → Subscriptions → Applowance.

If a network issue, function timeout, or partial cloud failure interrupts deletion, the app shows a pending deletion state instead of reporting completion. The server-side request is retried automatically until the scoped cloud purge finishes; local data and final sign-out are completed only after the backend confirms completion or the already-queued request has reached the final Firebase Authentication deletion step. If the pending state remains, contact us at applowance@ramses.works and we will verify or complete the deletion.

Data Retention

We retain app data only for as long as your account exists. When you delete your account through the app, all associated app data is permanently deleted from our systems. We do not retain backups of deleted data. Anonymous authentication sessions for children are ephemeral and tied to the device — logging out effectively abandons the session.

Website contact, public-beta invite, and App Store notification submissions are retained only as long as needed to respond, issue the invitation, or send the requested notification. You may ask us to delete a website submission by contacting us at the address below.

Family activity log entries persist for the lifetime of the family account so parents can review historical activity. They are wiped together with the rest of the family's data when you delete your account. Content reports are kept indefinitely as safety records so we can demonstrate the actions we took in response — they are not erased by family deletion and remain accessible only to our moderation team.

Data Security

We implement appropriate security measures to protect your data:

All network communication uses HTTPS/TLS encryption
PINs (child profile PINs and the optional family PIN) are hashed with PBKDF2-HMAC-SHA256 using a random per-PIN salt and 100,000 iterations — the actual PIN is never stored
The family PIN is deliberately stored only in the iOS Keychain on the parent's device and is never synced to our servers
Firebase App Check (using Apple's App Attest in release builds) prevents unauthorized clients from accessing our backend
Cloud Functions enforce App Check and apply per-user rate limits to invite-code lookups to prevent brute-force
Screen Time setup codes are stored only as a salted hash, expire automatically, and are verified server-side under the same rate limits — the code itself is never stored
Push registration tokens are held in server-only records that no app client can read, so no member of your family can obtain another member's device token
Firestore security rules enforce role-based access control (parents vs. children) and field-level whitelists on every collection
Local data is protected by iOS device encryption and stored inside a shared app group container
Sign in with Apple uses cryptographic nonces to prevent replay attacks

Analytics and Tracking

We use Firebase Analytics and Firebase Crashlytics during parent sessions only to understand feature usage and collect crash reports that help us improve the app. Both services are automatically disabled when a child is signed in. We do not collect the Identifier for Advertisers (IDFA). We do not participate in ad networks or data brokers. We may also receive anonymized, aggregate crash reports through Apple's built-in crash reporting if you have opted in via your device settings.

Parent-session analytics include paywall views, purchase and restore outcomes, subscription lifecycle events (renewal, expiration, upgrade, downgrade, cancellation), and trial conversion. These record the product identifier and plan involved so we can understand which plans families choose — they never include your payment method, billing details, or any child's data.

We also mirror a curated, PII-safe subset of these usage and reliability events to our own backend to power an internal product-health dashboard. For child sessions this is limited to non-personal session metadata (session duration, end reason, and timestamps).

This website. The paragraphs above describe the Applowance iOS app. This website carries no advertising, analytics or tracking scripts and sets no analytics cookies. When you submit the contact form or the public-beta invite request, we record a small diagnostic entry so we can tell whether the form is working: which form you used, which stage of the request it reached, whether it succeeded or failed, and — if it failed — a fixed reason code from a short predefined list, such as "email-invalid" or "rate-limited". These entries never contain your email address or a hash of it, your message, your IP address, a device or visitor identifier, the page URL, referrer or user agent, or any raw error text. Each entry may carry a random reference generated for that single submission attempt, which is discarded when you leave the page and cannot be used to recognise you on a later visit or across sites. We keep these entries for 90 days, after which they are deleted automatically. Only Ramses Works staff can read them; they are not readable from this website or the app. If a submission fails, we show you that reference so you can quote it if you contact us.

Public Beta (TestFlight)

Applowance is currently available as a public beta through Apple's TestFlight. Taking part is optional, and this section describes what that adds to everything above.

What we do with your email address: We use it for one purpose — to add you as a tester so Apple can send you a TestFlight invitation — plus any reply you have asked for. We do not sell or rent it, we do not share it with anyone other than Apple for the purpose of delivering your invitation, and we do not add it to a marketing list. There is no newsletter. You can ask us to delete it at any time at applowance@ramses.works, and we will also remove you as a tester on request.
Your email address is shared with Apple: Adding you as an external tester means giving Apple the address you gave us, so that Apple can send the invitation and operate TestFlight. Apple's handling of it is governed by Apple's own privacy policy, not this one.
Apple collects beta data we do not control: While you use a TestFlight build, Apple collects installation, usage, and crash information, and any feedback or screenshots you submit through TestFlight go to Apple and then to us. That is part of Apple's beta programme rather than something the App does, and it applies in addition to the analytics described above.
Beta builds use your real family data: A TestFlight build is the same app talking to the same live systems, not a sandbox. Chores, balances, and family members you create during the beta are real records, and the deletion rights described above apply to them in exactly the same way.
Purchases during the beta are not real charges: In-app purchases in a TestFlight build run against Apple's sandbox. You will not be billed, and a sandbox purchase does not create a real subscription or a payment record with Apple.
Beta builds expire: TestFlight builds stop working after a period set by Apple, and we may end the beta at any time. Your family data is unaffected and remains available when you move to a released version.

Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you and your children
Request correction of inaccurate data
Request deletion of your data (available directly in the app)
Request a copy of your data in a portable format
Withdraw consent for data collection
Request that we stop processing your data

Deletion is available directly in the app (Settings > Delete Account for parents, Settings > Delete My Data for children). To exercise any other right — including requesting a copy of your data — contact us at applowance@ramses.works. There is no in-app data-export button today; we fulfill data-export requests manually and will respond within 30 days.

Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the app after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or our data practices, please contact us: