Privacy Policy

Effective and last updated: August 13, 2026

This Privacy Policy explains how Regola ("Regola," "we," "us," or "our") handles personal data when you use the Regola mobile application, this website, and related support and communications (together, the "Services"). Regola is operated by Bahadır Kacar, an individual developer established in Türkiye and the controller of personal data handled through Regola. This notice is written for a global service and applies wherever Regola is offered, subject to any additional mandatory rights in the country where you live. Regola is a family service in which an adult account holder creates and manages a household and authorizes child profiles.

This policy is intended to give parents and other users a clear account of our practices. It does not replace any just-in-time notice or permission request shown when a feature accesses a device capability such as the camera, photos, notifications, app-usage access, or parental controls.

1. Personal Data We Collect

Information you or the adult account holder provide

Adult account data: name or display name supplied by Apple or Google, email address, authentication provider, authentication tokens, language, and account identifiers.
Child profile data: a first name or nickname, optional age, assigned tasks, daily allowance, daily cap, reset time, and other settings entered and managed by the adult. We encourage adults to use a nickname and provide only what is needed.
Onboarding and family activity: onboarding answers about family goals and preferred app categories; chores or other tasks; completion, rejection and approval status; optional parent rejection notes; time rewards; balances; and minute-ledger history.
Task-proof photos: a child may take or choose a photo when a task requires proof. The photo is uploaded to private family storage for adult review. Regola does not use the camera to recognize exercises, identify a person, or derive biometric information.
Communications: information in support, privacy, safety, or legal requests.
Waitlist and survey data: email address, family size, children's age ranges, screen-time challenges, and device types submitted through this website.

Information collected when you use the Services

Device and technical data: platform and operating-system information, app version, language, IP address, timestamps, anonymous child-device account ID, crash and performance data, app-update information, security events, and similar technical identifiers.
App-control and usage data: on Android, the package names and labels of the Reward Apps selected on the child device; on iOS, Apple's opaque Family Controls selection tokens; aggregate minutes used for selected Reward Apps; permission and protection state; device check-ins; and events needed to apply, remove, or report a restriction. Android may inspect the current foreground app locally, but Regola does not read screen contents, passwords, messages, browsing contents, or the full installed-app list. iOS uses Family Controls, ManagedSettings, and DeviceActivity, not MDM, a configuration profile, or a VPN.
Notifications: push-notification tokens and delivery status if you enable notifications. You can disable notifications in device settings.
Purchase data: subscription or purchase status, product, renewal or expiration status, and transaction identifiers. Apple or Google processes payment-card details; Regola does not receive full payment-card numbers.
Product analytics: in Parent Mode, app-open, onboarding, sign-up, paywall, subscription, child-added, chore-created, and approval events, associated with the adult's Regola account ID. PostHog is disabled in Kid Mode and is not sent child names, ages, or photos.

Website technologies

This website uses browser storage to remember onboarding answers and your analytics choice. If you choose "Allow analytics" in the website banner, TikTok Pixel receives website event, browser, device, IP-address, cookie or similar identifier, referrer, page, and timestamp data to measure advertising performance. We do not send the contents of Regola app accounts or child profiles to TikTok. You can withdraw your choice at any time using . Blocking optional analytics does not limit core website features.

Fonts are delivered by Google Fonts, which receives ordinary connection data such as your IP address and browser request. Website forms are delivered through Web3Forms to our email inbox; Web3Forms processes the fields you submit and related technical logs for delivery and abuse prevention. Its published documentation says it does not retain form submissions and periodically deletes server logs.

2. How and Why We Use Personal Data

create, authenticate, administer, and secure adult and household accounts;
provide profiles, chores, approvals, rewards, time banks, app controls, and notifications;
process purchases and confirm subscription entitlements;
respond to support, safety, privacy, and account-deletion requests;
diagnose errors, prevent fraud or misuse, and improve reliability and accessibility;
send requested waitlist, launch, service, security, or policy communications; and
measure website campaigns only when you allow optional analytics.

Depending on applicable law, we process data because it is necessary to enter into or perform our agreement with the adult account holder; because the adult has requested a feature; to comply with law; to establish, exercise, or defend legal rights; or for legitimate interests such as service security, fraud prevention, support, and reliability where those interests do not override individual rights. We rely on consent where the law requires it, including for optional website advertising analytics, promotional email, device permissions, and the adult's authorization of child participation. Consent can be withdrawn without affecting prior lawful processing, although a requested feature may then stop working.

Regola automatically applies the adult's selected Reward Apps, schedules, limits, and earned minute balance to allow or restrict app access. This is the requested service logic, not profiling that produces a legal or similarly significant decision about a person. The adult account holder can change the underlying settings and review family activity in the app.

3. Children's Privacy and Parental Control

Kid Mode may be used by a person under 18, but a child cannot independently create the contractual family account. An adult parent or legal guardian must create and manage the household, authorize each child's participation, pair the device, choose settings, and review activity. A paired child device uses an anonymous technical session rather than a child email account. We collect child data only to provide the parent-managed service, protect it, and comply with law—never for sale or targeted advertising.

A parent or guardian may review, correct, export, or delete a child's information, revoke a child's access, or refuse further collection by using the controls in the app or emailing [email protected]. If we learn that a child profile was created without required parental authorization, we will take reasonable steps to delete it. Deleting a child profile may make family features unavailable for that child.

Regola should not be used to submit sensitive information about a child that the service does not request. Adults should review task descriptions and photos before they are submitted and should avoid images showing addresses, schools, documents, or unrelated people.

We disclose data only as needed for the purposes described above:

Within the household: the adult account holder and authorized household members can see profile, task, approval, and time-bank information according to their role.
Mobile service providers: Supabase provides authentication, database, realtime, server functions, and private photo storage; PostHog provides Parent Mode product analytics and subscription lifecycle analytics; Sentry provides app and server diagnostics; RevenueCat validates and manages subscription entitlements; Expo provides app updates and push-notification delivery; and Loops provides transactional and lifecycle email.
Platform and sign-in providers: Apple and Google process sign-in, app downloads, operating-system permissions, purchases, and subscriptions under their own terms and privacy notices.
Website providers: Web3Forms forwards form submissions; Google supplies website fonts; and TikTok processes website analytics only after opt-in.
Legal and safety: we may disclose information when reasonably necessary to comply with law or valid legal process, enforce our terms, investigate fraud, or protect a person, the public, or the Services.
Business transfer: data may transfer as part of a merger, financing, reorganization, or sale, subject to this policy and legally required notice.

We do not sell personal data. We do not share child-profile data for cross-context behavioral advertising, and we do not permit service providers to use it for their own advertising.

5. Retention and Deletion

We apply the following retention rules unless a longer period is required by law:

Adult accounts, child profiles, selected-app settings, tasks, submissions, balances, and minute-ledger records are kept while the family account or relevant child profile remains active. In-app account deletion begins immediately; verified email requests are completed within the period required by applicable law.
Task-proof photos are kept with the household's submission history until the adult deletes the relevant child profile or family account, or asks us to remove the specific photo.
In-app notification records are configured to expire after 90 days. Pairing codes can be used for 15 minutes and are replaced when a new code is generated. Unlinked anonymous device sessions are scheduled for deletion after 24 hours.
Waitlist and onboarding submissions are kept until the launch communication has been sent and for no more than 24 months after the last interaction, unless you ask us to delete them sooner.
Support and privacy correspondence is generally kept for up to 24 months after resolution.
Product-analytics, diagnostic, email-delivery, security, rate-limit, subscription, transaction, fraud-prevention, dispute, and legal-compliance records are kept for the shortest of the configured provider period, the time reasonably necessary for the stated purpose, or the period required by law. Store and payment providers may retain transaction records under their own legal obligations even after a Regola account is deleted.
Website onboarding answers stay in your browser until submitted, cleared by you, or removed through browser controls. Protected backup copies expire under the hosting provider's ordinary backup schedule and are not returned to normal use after a valid deletion request.

6. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data, including encrypted network transport, access controls, least-privilege access, and service-provider review. No system is completely secure, and we cannot guarantee that unauthorized access or loss will never occur. Please use a strong password, keep adult controls confidential, and contact us if you suspect unauthorized use.

7. International Data Transfers

Regola is offered internationally and its providers may process data in Türkiye, the European Economic Area, the United Kingdom, the United States, or another country where they or their subprocessors operate. Those countries may have different privacy laws. Where a restricted transfer requires a safeguard, we use the mechanism available and required for that transfer, such as an adequacy decision, contractual safeguards, the European Commission's Standard Contractual Clauses, the UK Addendum, or a mechanism permitted by Article 9 of the KVKK. Contact us to request information about the safeguard applicable to your data.

8. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent, receive a portable copy, or appeal our response. You may also complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.

In Türkiye, Article 11 of the KVKK gives you the right to learn whether your personal data is processed; request information about processing; learn its purpose and whether it is used accordingly; learn the recipients in Türkiye or abroad; request correction, deletion, or destruction when the legal conditions apply and notification of those actions to recipients; object to an adverse result produced exclusively by automated analysis; and claim compensation for damage caused by unlawful processing.

In the EEA or UK, applicable law may also provide rights to restriction, objection, portability, and a complaint to a supervisory authority. In certain U.S. states, applicable law may provide rights to know, correct, delete, or obtain a copy of personal information and to opt out of sale, sharing, or targeted advertising. Regola does not sell personal information and does not use child-profile information for targeted advertising.

Account and child data: use in-app settings or follow the instructions on our Delete Account and Data page.
Emails: use any unsubscribe link or email us. Essential service and security messages may continue while your account remains active.
Permissions: change camera, photos, notifications, and app-control permissions in device settings. A related feature may stop working.
Website analytics: use or your browser controls.

To protect the household, we may verify your identity and authority over an account before fulfilling a request. An authorized agent may submit a request where local law permits, but we may require proof of authorization. We respond within the period required by applicable law.

9. Third-Party Services

Third parties handle data under their own notices when they act independently. Relevant public notices include Supabase, PostHog, Sentry, RevenueCat, Expo, Loops, Apple, Google, TikTok for Business Privacy, and Web3Forms Privacy. The Services may link to other sites that we do not control.

10. Changes to This Policy

We may update this policy to reflect changes in the Services, law, or our practices. We will change the date above and, when required, provide prominent notice or request consent before a material change takes effect. We will not materially reduce protections for previously collected child data without any consent required by law.

11. Contact Us

The data controller and Regola developer is Bahadır Kacar, Yayla Mahallesi, Ahu Sokak, No: 7/13, 34933 Tuzla, İstanbul, Türkiye. For privacy questions or requests, email [email protected] or call +90 551 070 7538. Use the same email for general support or legal questions. Please write "Privacy Request" in the subject line and do not send passwords or unnecessary information about a child.