Privacy Policy — Tofy

Last updated: September 11, 2026

Operator: Rani Ophir · Haim Bar-Lev St 17, Ramat Gan, Israel · +972-52-444-4244 · ranioph@gmail.com

Tofy is an educational app for children and their parents. Children answer learning questions to earn screen time, and parents set the rules. We take your privacy, and your children's privacy, seriously. This policy explains what information we collect, why we collect it, how it is stored, and the choices and rights you have.

This policy covers the Tofy app for iPhone and iPad (including its Apple Watch app and widgets) and our website, tofyapp.com. In this policy, "Tofy," "we," and "us" mean Rani Ophir, the operator of Tofy.

Contents

• Children's privacy (COPPA)
• Information we collect
• What we don't collect or do
• How we use information
• When information is shared
• Parental consent
• Parents' rights and choices
• Data retention
• Security
• Device permissions
• Our website
• Where information is processed
• Changes to this policy
• Contact us

Children's privacy (COPPA)

Tofy is directed to children and is designed to comply with the U.S. Children's Online Privacy Protection Act (COPPA). The app is meant for family use under a parent's guidance. Children do not create their own accounts: a parent signs in, agrees to this policy as the child's parent, and creates each child's profile. A child's device joins the family only through a code or QR code created on the parent's device.

We collect from children only the information reasonably necessary for them to use the app's learning and play features. We don't require a child to share more information than an activity needs.

Information we collect

From parents

• Parent account: email address and name, through Sign in with Apple, Google, or email. Passwords are handled by the sign-in provider and are not stored by us. You can also start as a guest, in which case we don't receive an email address or name.
• Parent code: the code that locks parent settings is stored hashed on the device and is never sent as plain text.
• Purchases: purchases are processed by Apple. We receive a record of the transaction (such as the product and dates) so we can unlock what you bought. We never receive your payment card details.
• Messages to us: if you send feedback or contact support, we receive your message along with your account identifier, app version, and language setting so we can respond.

About children (entered by a parent or created as the child uses the app)

• Child profile: first name or nickname, grade, approximate age, and the character chosen in the app. A profile photo is optional; if a parent adds one, a small compressed copy syncs to the family's devices.
• Optional chore photo: a child can attach a photo as proof that a house chore was done. The photo is stored on that chore, is visible only to the parents in the same family, and is deleted automatically as soon as a parent approves or archives the chore — and after 7 days at most. It is never used for face recognition, advertising, or any other purpose.
• Learning progress: questions answered, results, stars, diamonds, minutes earned, and a daily learning history used for parent reports.
• Family activity: chores and approvals, requests for help sent to a parent, and requests for new content ("Ask Mom or Dad").
• Friends and live quiz: if a child adds friends, a friend list and a leaderboard card showing the child's first name or nickname, character, and star count. In a live quiz, the child's answers and score for that game.
• Question reports: if a question is reported as wrong or confusing, we receive the question, the reason given, and the child's first name so we can fix it.

Technical information

• A technical user ID (from Google Firebase) used to sync the family's devices.
• Push notification tokens and each connected device's name, role (parent or child), and language setting, so notifications reach the right device in the right language.
• Internet protocol (IP) address: our hosting providers necessarily process it to deliver data to your device. We don't use it to determine location or to track anyone.

What we don't collect or do

• No analytics. In line with the App Store Kids category rules, the Firebase Analytics component is not included in the app at all, so no analytics usage data is collected or sent.
• No advertising. There are no ads in Tofy. We don't collect the advertising identifier (IDFA), and there is no ad tracking, behavioral advertising, or cross-app tracking.
• No selling. We don't sell or rent personal information, and we don't share it with third parties for their marketing.
• No location. We don't collect precise or approximate location.
• No chat. Children can't send messages, chat, or post free text or photos to other users.
• No browsing history. App blocking runs through Apple's Screen Time framework, which keeps the selected apps on the device. We don't receive a list of the apps your child uses or their browsing history.

How we use information

We use information only to run the app: saving progress, syncing between the family's devices, choosing questions at the right grade and level, showing parents reports and recommendations, handling purchases, and sending notifications. We also use it to respond to support requests, fix problems, keep the service secure, and comply with the law.

On our own servers we may calculate aggregate totals that don't identify anyone (for example, how many families are active) to maintain and improve Tofy. No third-party analytics tools are involved.

Parents may receive notifications about their children's activity and about new worlds or offers in the app; you can turn notifications off at any time in iOS Settings. Children may see in-app announcements about new worlds, but never prices — any purchase has to be made by a parent, on the parent's device, behind a parental gate.

When information is shared

• Within your family: parents and co-parents in the same family, and the devices connected to that family, can see the family's information. Other families cannot.
• Friends and leaderboards: a child's leaderboard card (first name or nickname, character, and star count) is visible to friends who connected with a friend code, and on the "All players" leaderboard it can be seen by other Tofy users. Players in the same live quiz see each other's first name or nickname, character, and score. No photos, contact details, or messages are ever shared. Parents can see and remove any friend from the parent dashboard, and deleting a child's profile removes the card.
• Service providers: we use Google (Firebase Authentication, Cloud Firestore, Cloud Functions, and Firebase Cloud Messaging to store data and deliver notifications, and Gmail to handle support and launch-update emails) and Apple (Sign in with Apple, App Store payments, push notification delivery, and Screen Time). If you choose Google sign-in, Google handles that sign-in. These providers process information on our behalf to run Tofy, not for their own advertising.
• Legal reasons: we may disclose information if required by law, or if needed to protect the safety of a child or others.

Parental consent

Before any child profile is created, the parent sees a summary of how Tofy handles children's information, with a link to this policy, and confirms "I agree and consent as a parent" on their own device. Child profiles, settings, and device connections are then created by the parent. Parental settings are protected by a parent code.

We don't knowingly collect personal information from a child without a parent's involvement. If we learn that we have, we will delete it. If you believe this has happened, please contact us.

Parents' rights and choices

As a parent, you can at any time:

• Review your child's information in the parent dashboard, and export it: Parent settings → Privacy & data → "Export my data (JSON)."
• Correct or update your child's profile from the parent dashboard.
• Delete a single child's profile from that child's card, or delete everything with Parent settings → Privacy & data → "Delete all my data." Deletion removes the data from the cloud as well, including the child's progress history, chores, leaderboard card, and connected-device records.
• Remove friends from your child's friend list in the parent dashboard.
• Stop further collection by deleting your child's profile or all your data and no longer using the app.

You can also make any of these requests by emailing ranioph@gmail.com. To protect children, we'll verify that the request comes from the child's parent before acting on it, and we'll respond promptly.

Data retention

We keep children's information only as long as reasonably necessary to provide Tofy to your family:

• Account, profile, and progress information is kept while your family account is active, and is deleted when you delete a child's profile or all your data.
• Inactive families. If no one in your family uses Tofy for 18 months, we send the parents a notice — by push notification and, where we have a parent's email address, by email — that the family's information will be deleted in 30 days. If anyone opens Tofy during those 30 days, the family's information is kept and the notice is cancelled. Otherwise the family's information — the children's profiles, progress and learning history, chores, leaderboard cards, connected-device records, and the parent account record — is deleted about 30 days after the notice. Deletion is reviewed by a person before it happens, so it may take a little longer than 30 days, and we check again at that moment that the family is still inactive.
• Launch-update email addresses from our website are deleted automatically 12 months after the sign-up, and sooner if you ask us to remove them.
• Chore photos are deleted when a parent approves or archives the chore, and after 7 days at most.
• Records of connected devices that haven't been active for 60 days are removed automatically.
• Backups. Our database keeps a rolling point-in-time recovery window of up to 7 days, so deleted information can still exist there for up to 7 days. Any manual backup copy we export for a specific recovery is deleted within 30 days.

Security

Information is stored with Google Firebase. Access to a family's data is limited to members of that same family and enforced by security rules. Data is encrypted in transit and at rest by our hosting provider, access to production data is limited to the operator, and the parent code is stored hashed on the device. No system is perfectly secure, but we work to protect your family's information and will notify you as required by law if a breach affects it.

Device permissions

• Notifications: for parent updates, and for live quiz invitations between friends (optional).
• Camera: to scan a QR code when connecting a child's device, to take a profile photo, and to take a chore photo (all optional).
• Screen Time / Family Controls: to block the apps you choose until your child earns time. These settings stay on the device.

Our website

tofyapp.com has no ads and doesn't use analytics or advertising cookies. Fonts are served from our own server rather than from Google Fonts, so opening a page doesn't send your IP address to any third party. If you sign up for launch updates, we collect your email address and, if you provide them, your name and your child's age range, and use them only to email you about Tofy's launch. The sign-up form is intended for parents.

Your language choice — the 🇮🇱 / 🇺🇸 flags in the header — is kept in your browser's local storage, so the site opens in that language next time. Until you choose, a visitor whose browser isn't set to Hebrew and whose clock isn't Israeli is sent to the English pages automatically. That preference stays in your browser and is never sent to us.

Where information is processed

Tofy is operated from Israel. Information is stored and processed on Google Cloud and Apple infrastructure, including in the United States.

Changes to this policy

We'll update this policy when needed and change the "Last updated" date above. If we make a material change to how we collect, use, or share children's information, we'll notify parents in the app or by email, and ask for consent again where the law requires it.

Contact us

Questions or requests about privacy — the operator of Tofy is:

Rani Ophir
Haim Bar-Lev St 17, Ramat Gan, Israel
Phone: +972-52-444-4244
Email: ranioph@gmail.com