Privacy Policy

“Abby” (the “App”) is a mobile app for activities with children aged 2–6 with autism spectrum disorder (ASD) and developmental delays. The App is built on the principles of Applied Behavior Analysis (ABA) and uses an adaptive BKT (Bayesian Knowledge Tracing) engine to select tasks based on a child’s level of skill mastery.

The personal-data controller (the “Operator”, “we”) is the Abby team. As of the publication date of this policy, the App has no registered legal entity; the policy will be updated once one is established.

You can contact us about privacy at hi@abby.study. This policy is written to account for the GDPR, UK GDPR, the ICO Age Appropriate Design Code, COPPA (16 CFR Part 312) as amended in 2025, Apple App Store Review Guideline 5.1, the Google Play Families policy, and Russian Federal Law 152-FZ “On Personal Data”.

• Parent / legal guardian — the adult user who creates the account and the child’s profile and gives consent for processing.
• Child — the end user of the activities. We do not give the child independent access to the account, settings, network features, or chat. All decisions about a child’s data are made by the parent.

The “one profile per device” model (B2C): on a personal device, one child = one profile. For centers and specialists (B2B), multiple profiles with adult-operator access are allowed.

3.1. Parent (account) data

• email for sign-in via magic link or a 6-digit code through Supabase Auth;
• session identifier / authentication token;
• optionally — device country and language for localization.

We do not collect passwords (there are none — sign-in is by link or code), card numbers, phone numbers, geolocation, contacts, or photos.

3.2. Child profile data (entered by the parent)

• name or nickname (the parent may enter a nickname);
• age or date of birth;
• gender (optional);
• verbal / nonverbal status;
• interests (cartoons, food, colors) — for personalization.

3.3. Activity data (generated automatically)

• answer accuracy, response time, number and type of prompts, attempts;
• skill-mastery estimates from the BKT model;
• an activity log at the level of individual trials;
• aggregated weekly plans and recommendations.

3.4. Technical data

• app and OS version, device model, an anonymized device identifier (no advertising identifiers / IDFA);
• error logs (without answer content).

Special categories of data (GDPR Art. 9). The fact of using an ABA app and linking activities to a specific child may be interpreted as “data concerning health”. We assume such an interpretation is possible and additionally rely on Art. 9(2)(a) (explicit parental consent) and Art. 8 GDPR (consent of the legal guardian on behalf of a child below the age of consent). The parent may withdraw consent at any time without affecting the lawfulness of prior processing (GDPR Art. 7(3)).

• for the App’s basic on-device operation without cloud sync, we rely on the “internal operations” exception (§ 312.5(c)(7)), which does not require verifiable parental consent;
• for cloud sync and AI features, we obtain verifiable consent through an adult’s email sign-in with a magic link, a separate consent screen that logs the time, IP, and policy-text version, and — for U.S. users — optionally enhanced verification;
• we do not use the “email plus” method as the sole method for high-risk processing.

We engage the following sub-processors under GDPR Art. 28:

API keys are not stored in the client — all LLM calls go through a Supabase Edge Function. We send OpenRouter only de-identified aggregates: a child’s name is replaced with “child”, age is reduced to a range, and only skills and metrics are sent. We do not sell personal data and do not share it with advertising networks or data brokers.

Your data is stored in the EU region (Frankfurt, Germany) regardless of where you access the App from. Transfer to OpenRouter (USA) is carried out on the basis of the Standard Contractual Clauses (Module 2, controller → processor). We perform a Transfer Impact Assessment using the EDPB methodology.

We are working on one of the following solutions:

• moving the initial recording of Russian citizens’ personal data to a server in Russia, with subsequent synchronization to the EU;
• limiting distribution of the App in Russia until the matter is resolved;
• collecting separate informed consent from Russian users with explicit disclosure of the data-storage location.

Until the first option is implemented, Russian users who continue to use the App confirm that they have read this section. This does not remove the legal risk, and a parent may demand deletion of data at any time.

We process a deletion request within 30 calendar days (GDPR Art. 12(3)). Backups are purged automatically on rotation.

As a parent or legal guardian, you have the right:

• to access — obtain a copy of the data (Art. 15);
• to rectification of inaccurate data (Art. 16);
• to erasure / the “right to be forgotten” (Art. 17);
• to restriction of processing (Art. 18);
• to portability — a machine-readable export (Art. 20);
• to object to processing based on legitimate interest (Art. 21);
• not to be subject to automated decision-making (Art. 22) — our BKT/AI does not make legally significant decisions;
• to withdraw consent at any time (Art. 7(3));
• to lodge a complaint with a supervisory authority: in the EU — the DPA of your country of residence, in the UK — the ICO, in Russia — Roskomnadzor, in the U.S. — the FTC.

Under COPPA, a parent additionally has the right to review the child’s collected data, demand its deletion, and refuse further collection. Send requests to hi@abby.study — we identify the requester by the account email and respond within 30 days.

• encryption in transit: TLS 1.2 and above;
• encryption at rest: AES-256 on the Supabase side, Hive encryption on the device;
• Row-Level Security: all tables are protected, with access only for the owner-parent;
• API secrets are stored in Supabase Secrets and never reach the client;
• minimization: the LLM model receives only the fields it needs.

The App is made for children, but consent on their behalf is given by the parent. The child never interacts with network features, chat, purchases, or ads. Parental controls (PIN, kiosk mode) restrict leaving an activity. We do not accept accounts created directly by children under 13.

We will notify the parent of material changes 14 days before they take effect — by email and via a re-consent screen in the App. An archive of previous versions is available on request.

For any questions about privacy and data processing, write to hi@abby.study.