Privacy Policy

1. About This Policy

This Privacy Policy explains how Ras Innovate (“we,” “us,” “our”) handles information when you use Ras Kids, a parental control launcher for Android devices. Ras Innovate is a software developer based in Addis Ababa, Ethiopia.

Version 1.0.5 of Ras Kids uses a hybrid model: parental control configuration (whitelist, PIN, bedtime, session limits, usage statistics) stays on your device, while your parent account (phone number), device metadata, and trial/subscription entitlement are stored on Ras Innovate servers operated via Supabase in the European Union.

Paid subscription checkout via Chapa is not yet enabled in the Play Store build. When billing goes live, we will update this policy and the Google Play Data Safety form before activating payments.

This policy is written in compliance with Google Play Developer Policies and is informed by Ethiopia's Personal Data Protection Proclamation (Draft, 2021) and international best practices including GDPR principles applicable to Ethiopian data subjects interacting with digital services.

2. Who This App Is For

Ras Kids is designed to be installed and configured by a parent or legal guardian on a device that will be used by a child. The app provides a restricted launcher experience for children under parental supervision.

We do not market this app to children. The intended user of the parental dashboard and all configuration screens is an adult parent or guardian.

3. Data Stored Locally on Your Device

The following information is stored in the app's local SQLite database and Android SharedPreferences. Parental control data below is not uploaded to Ras Innovate servers:

Encryption at rest: Local data is not encrypted with a separate database cipher in v1. The parent PIN is hashed before storage and is never stored in plain text. We recommend protecting the device with a screen lock.

4. Account & Entitlement Data (Server)

When you enter your phone number on the welcome screen (with an internet connection), the app creates or restores a parent account on our Supabase backend. The following is transmitted over HTTPS:

What stays off the server: child profile details, parent PIN hash, whitelist rules, bedtime/session settings, and on-device usage statistics are not uploaded in this release.

Signing out or using Delete All Local Data in the app clears your on-device session and local parental-control data. To request deletion of server-side account records, email hello@rasinnovate.com (see our Data Deletion Guide).

5. Data Shared With Third Parties

5.1 Google Firebase Crashlytics

If the app crashes, diagnostic data may be automatically sent to Google Firebase Crashlytics over HTTPS to help us identify and fix stability issues. This data may include:

• Crash stack traces and error logs
• Device model, Android OS version, and app version
• Firebase installation identifiers and session identifiers used by the Crashlytics SDK

This data is used solely for stability improvement. We do not use it for advertising, profiling, or marketing. Google processes this data under Google's Privacy Policy (https://policies.google.com/privacy).

Ras Kids v1 does not use Firebase Analytics, Google Analytics for Firebase, or the Android Advertising ID (AD_ID). No advertising identifiers are collected or transmitted.

5.2 Supabase (Ras Innovate backend)

We use Supabase (hosted in the EU) as our account and entitlement database. Supabase processes parent phone numbers, device hashes, trial/subscription status, and authentication tokens on our behalf under a data processing agreement. Supabase does not use this data for advertising. See Supabase Privacy Policy.

5.3 No Other Third-Party Sharing

We do not sell, rent, or disclose whitelist, PIN hash, child profile, or on-device usage data to advertising networks, data brokers, or analytics platforms. Google Firebase Crashlytics and Supabase are the only third-party processors for app-related personal data in this release.

6. Sensitive Android Permissions

Ras Kids requests the following permissions, each used only for its declared parental control purpose:

Before the Accessibility Service is enabled, the app displays a prominent in-app disclosure screen explaining exactly what the service does and requires the parent's explicit consent. This disclosure appears before the user is directed to Android system settings to grant the permission.

PACKAGE_USAGE_STATS is a special-access permission that cannot be granted via a standard runtime dialog. The app guides parents to Settings > Special App Access > Usage Access with a clear explanation of why it is needed.

7. What We Do Not Do

Ras Kids is a transparent parental control tool, not spyware. We explicitly confirm:

• We do not secretly record calls, SMS messages, keystrokes, browsing history, or any communications.
• We do not hide the app’s presence — Ras Kids is visible as the launcher and in Android system settings at all times.
• We do not sell, rent, or monetize personal data.
• We do not use Accessibility Service for purposes unrelated to app blocking and parental enforcement.
• We do not collect or transmit the Android Advertising ID (AD_ID).
• We do not show advertisements in the app.

8. Children's Privacy

Ras Kids is a tool for parents to manage a child's device. We do not knowingly collect personal information directly from children for our own purposes, marketing, or accounts.

Child profile information (name, avatar) is entered by the parent and stored locally on the device. Crash logs sent to Google Firebase Crashlytics may incidentally include technical device data but do not include child names, identifiers, or behavioral data as advertising inputs.

If you believe we have handled a child's information incorrectly, please contact us at hello@rasinnovate.com and we will respond within 30 days.

9. Data Retention and Deletion

9.1 On-Device Data

All locally stored data remains on the device until you delete it in the app or uninstall Ras Kids. Uninstalling the app removes all app data from the device automatically.

To delete all local data manually: Parent Settings → Profile → Device & Privacy → Delete All Local Data. This action requires the parent PIN and entering the word DELETE to confirm. It permanently removes all profiles, PIN hash, whitelist rules, and settings from the device.

A public data deletion instructions page is available at: https://kids.rasinnovate.com/am/data-deletion/

9.2 Server Account Data

Your parent account and entitlement records on Supabase are retained while you use the app. To request deletion of server-side account data, email hello@rasinnovate.comwith the subject line “Ras Kids — Account Deletion Request” and the phone number used in the app. We aim to process requests within 30 days.

9.3 Crashlytics Data

Crash diagnostic data is retained by Google according to Firebase Crashlytics and Google's own data retention policies. If you need assistance requesting deletion from Google's systems, contact us at hello@rasinnovate.com.

10. Network Use

After your first successful account sync, core parental control features — app blocking, whitelist enforcement, screen time display, bedtime rules, and PIN protection — work offline using cached entitlement timestamps.

Internet is required for:

• Welcome screen login (phone-session account creation or sign-in)
• First-time entitlement and remote config sync after onboarding
• Starting your free trial (start-trial)
• Background entitlement refresh when online (approximately every 15 minutes when stale)
• Opening hosted legal pages in a browser
• Loading optional mini-app web content if allowed by the parent
• Sending crash diagnostic reports to Google Firebase Crashlytics

Whitelist, PIN, child profile, and usage statistics are not transmitted over the network in this release.

11. Future Features

Paid subscription checkout via Chapa and the external checkout website will be enabled in a future update after merchant approval. We will update this Privacy Policy and the Google Play Data Safety form before payments go live. Multi-device policy sync and a parent web portal are planned for later phases and are not active in this release.

12. Your Rights (Ethiopian and International Users)

Consistent with Ethiopia's Personal Data Protection Proclamation (Draft) and international data protection principles, you have the right to:

• Access the personal data held about you (all data is viewable within the app)
• Correct inaccurate personal data (editable in parent settings)
• Delete your personal data (see Section 8 above)
• Withdraw consent for data processing at any time by disabling permissions in Android settings or uninstalling the app

To exercise any of these rights or to raise a concern, contact hello@rasinnovate.com.

13. Security

We take reasonable measures to protect locally stored data:

• The parent PIN is stored as a cryptographic hash — never in plain text
• Account and entitlement API traffic uses HTTPS (TLS) to Supabase
• Crash diagnostic data is transmitted to Firebase Crashlytics over HTTPS
• We recommend enabling Android screen lock on the device to prevent unauthorized physical access

As noted in Section 3, local data is not encrypted with a separate database cipher in v1. We plan to add at-rest encryption in a future release.

14. Changes to This Policy

We may update this Privacy Policy when the app or legal requirements change. The effective date at the top of this document will be revised. Material changes will be communicated via the Play Store listing update notes or an in-app notice where appropriate.

Continued use of the app after an update constitutes acceptance of the revised policy.

15. Contact

We aim to respond to all privacy-related inquiries within 30 days.