Privacy Policy

1. About This Policy

This Privacy Policy explains how Ras Innovate (“we,” “us,” “our”) handles information when you use Ras Kids, a parental control launcher for Android devices. Ras Innovate is a software developer based in Addis Ababa, Ethiopia.

Version 1.0.6 of Ras Kids uses a hybrid model: parental control configuration (whitelist, PIN, bedtime, session limits, usage statistics) stays on your device, while your parent account (phone number), device metadata, trial/subscription entitlement, and — if you choose to subscribe — payment-related data are stored on Ras Innovate servers operated via Supabase in the European Union.

Paid subscription checkout is available through our official Telegram bot and Chapa, an independent Ethiopian payment processor. The Android app itself has no purchase screen, price list, or payment form — see Section 5 for exactly what that flow collects.

This policy is written in compliance with Google Play Developer Policies and is informed by Ethiopia's Personal Data Protection Proclamation (Draft, 2021) and international best practices including GDPR principles applicable to Ethiopian data subjects interacting with digital services.

2. Who This App Is For

Ras Kids is designed to be installed and configured by a parent or legal guardian on a device that will be used by a child. The app provides a restricted launcher experience for children under parental supervision.

We do not market this app to children. The intended user of the parental dashboard, all configuration screens, and the Telegram payment bot is an adult parent or guardian.

3. Data Stored Locally on Your Device

The following information is stored in the app's local SQLite database and Android SharedPreferences. Parental control data below is not uploaded to Ras Innovate servers:

Encryption at rest: Local data is not encrypted with a separate database cipher in v1. The parent PIN is hashed before storage and is never stored in plain text. We recommend protecting the device with a screen lock.

4. Account & Entitlement Data (Server)

When you enter your phone number on the welcome screen (with an internet connection), the app creates or restores a parent account on our Supabase backend. The following is transmitted over HTTPS:

Child profile backup:your child's name and birth year are backed up to our secure servers for one reason only — so you don't lose their profile if you reinstall Ras Kids or set it up on a new phone. This backup is never sold and never shared with advertisers. You can delete it at any time from inside the app.

What stays off the server:your child's avatar and display title, parent PIN hash, whitelist rules, bedtime/session settings, and on-device usage statistics are not uploaded in this release.

Signing out or using Delete All Local Data in the app clears your on-device session and local parental-control data. To request deletion of server-side account records, email hello@rasinnovate.com (see our Data Deletion Guide).

5. Telegram & Payment Data (If You Subscribe)

The Ras Kids Android app does not link to our Telegram bot anywhere — there is no button or prompt in the app that leads to it. If you choose to subscribe, you find and message our official Ras Kids Telegram bot yourself, entirely outside the app. This section describes what is collected only if you choose to message that bot — it does not apply to families who never do.

What we do not see: we do not read your other Telegram messages, contacts, or chat history — only the conversation you have with the Ras Kids bot itself, and only the fields above. We never see or store your card number, Telebirr PIN, or other payment credentials; those are handled directly by Chapa.

6. Data Shared With Third Parties

6.1 Google Firebase Crashlytics

If the app crashes, diagnostic data may be automatically sent to Google Firebase Crashlytics over HTTPS to help us identify and fix stability issues. This data may include:

• Crash stack traces and error logs
• Device model, Android OS version, and app version
• Firebase installation identifiers and session identifiers used by the Crashlytics SDK

This data is used solely for stability improvement. We do not use it for advertising, profiling, or marketing. Google processes this data under Google's Privacy Policy (https://policies.google.com/privacy).

Ras Kids v1 does not use Firebase Analytics, Google Analytics for Firebase, or the Android Advertising ID (AD_ID). No advertising identifiers are collected or transmitted.

6.2 Supabase (Ras Innovate backend)

We use Supabase (hosted in the EU) as our account, entitlement, and — if you subscribe — payment-record database. Supabase processes parent phone numbers, device hashes, trial/subscription status, Telegram and payment data, and authentication tokens on our behalf under a data processing agreement. Supabase does not use this data for advertising. See Supabase Privacy Policy.

6.3 Telegram (only if you subscribe)

Our subscription bot runs on Telegram's platform. Messages you send to the bot pass through Telegram's own infrastructure under Telegram's Privacy Policy. We only receive what the bot conversation itself sends us — see Section 5.

6.4 Chapa (only if you subscribe)

Payment itself is processed by Chapa, an independent, licensed Ethiopian payment processor, under Chapa's own terms and privacy policy at https://chapa.co. We receive confirmation that a payment succeeded and its reference — we do not receive or store your card, Telebirr, or bank credentials.

6.5 No Other Third-Party Sharing

We do not sell, rent, or disclose whitelist, PIN hash, child profile, or on-device usage data to advertising networks, data brokers, or analytics platforms. Google Firebase Crashlytics, Supabase, Telegram, and Chapa are the only third-party processors for app-related personal data in this release, and Telegram/Chapa only apply if you choose to subscribe.

7. Sensitive Android Permissions

Ras Kids requests the following permissions, each used only for its declared parental control purpose:

Before the Accessibility Service is enabled, the app displays a prominent in-app disclosure screen explaining exactly what the service does and requires the parent's explicit consent. This disclosure appears before the user is directed to Android system settings to grant the permission.

PACKAGE_USAGE_STATS is a special-access permission that cannot be granted via a standard runtime dialog. The app guides parents to Settings > Special App Access > Usage Access with a clear explanation of why it is needed.

8. What We Do Not Do

Ras Kids is a transparent parental control tool, not spyware. We explicitly confirm:

• We do not secretly record calls, SMS messages, keystrokes, browsing history, or any communications.
• We do not hide the app’s presence — Ras Kids is visible as the launcher and in Android system settings at all times.
• We do not sell, rent, or monetize personal data.
• We do not use Accessibility Service for purposes unrelated to app blocking and parental enforcement.
• We do not collect or transmit the Android Advertising ID (AD_ID).
• We do not show advertisements in the app.
• We do not read your Telegram messages, contacts, or chat history beyond your own conversation with the Ras Kids bot.

9. Children's Privacy

Ras Kids is a tool for parents to manage a child's device. We do not knowingly collect personal information directly from children for our own purposes, marketing, or accounts. The Telegram payment bot and all account/billing flows are intended for the adult parent only.

Child profile information (name, avatar, birth year) is entered by the parent. The name and birth year are backed up to our secure servers only so the profile can be restored after a reinstall or device switch — never sold, never shared with advertisers, and deletable at any time from inside the app. The avatar and other profile details stay on the device only. Crash logs sent to Google Firebase Crashlytics may incidentally include technical device data but do not include child names, identifiers, or behavioral data as advertising inputs.

If you believe we have handled a child's information incorrectly, please contact us at hello@rasinnovate.com and we will respond within 30 days.

10. Data Retention and Deletion

10.1 On-Device Data

All locally stored data remains on the device until you delete it in the app or uninstall Ras Kids. Uninstalling the app removes all app data from the device automatically.

To delete all local data manually: Parent Settings → Profile → Device & Privacy → Delete All Local Data. This action requires the parent PIN and entering the word DELETE to confirm. It permanently removes all profiles, PIN hash, whitelist rules, and settings from the device.

A public data deletion instructions page is available at: https://kids.rasinnovate.com/en/data-deletion/

10.2 Server Account, Telegram & Payment Data

Your parent account and entitlement records on Supabase are retained while you use the app. To request deletion of server-side account, Telegram, or referral data, email hello@rasinnovate.comwith the subject line “Ras Kids — Account Deletion Request” and the phone number used in the app. We aim to process requests within 30 days. Completed payment/transaction records may be retained longer where required by applicable Ethiopian tax or financial recordkeeping law, even after the rest of an account is deleted.

10.3 Crashlytics Data

Crash diagnostic data is retained by Google according to Firebase Crashlytics and Google's own data retention policies. If you need assistance requesting deletion from Google's systems, contact us at hello@rasinnovate.com.

11. Network Use

After your first successful account sync, core parental control features — app blocking, whitelist enforcement, screen time display, bedtime rules, and PIN protection — work offline using cached entitlement timestamps.

Internet is required for:

• Welcome screen login (phone-session account creation or sign-in)
• First-time entitlement and remote config sync after onboarding
• Starting your free trial (start-trial)
• Background entitlement refresh when online (approximately every 15 minutes when stale)
• Opening hosted legal pages in a browser
• Loading optional mini-app web content if allowed by the parent
• Sending crash diagnostic reports to Google Firebase Crashlytics
• The Telegram bot subscription flow and tapping your activation link, if you choose to subscribe

Whitelist, PIN, child profile, and usage statistics are not transmitted over the network in this release.

12. Future Features

Multi-device policy sync and a parent web portal are planned for later phases and are not active in this release. If we introduce them, or any other feature that changes what data we collect, we will update this Privacy Policy and the Google Play Data Safety form before that feature goes live.

13. Your Rights (Ethiopian and International Users)

Consistent with Ethiopia's Personal Data Protection Proclamation (Draft) and international data protection principles, you have the right to:

• Access the personal data held about you (all data is viewable within the app)
• Correct inaccurate personal data (editable in parent settings)
• Delete your personal data (see Section 10 above)
• Withdraw consent for data processing at any time by disabling permissions in Android settings or uninstalling the app

To exercise any of these rights or to raise a concern, contact hello@rasinnovate.com.

14. Security

We take reasonable measures to protect locally stored data:

• The parent PIN is stored as a cryptographic hash — never in plain text
• Account, entitlement, and payment-status API traffic uses HTTPS (TLS) to Supabase
• Crash diagnostic data is transmitted to Firebase Crashlytics over HTTPS
• Server-side database functions that touch payment or entitlement records require an authenticated server role — they are not directly callable by an anonymous client
• We recommend enabling Android screen lock on the device to prevent unauthorized physical access

As noted in Section 3, local data is not encrypted with a separate database cipher in v1. We plan to add at-rest encryption in a future release.

15. Changes to This Policy

We may update this Privacy Policy when the app or legal requirements change. The effective date at the top of this document will be revised. Material changes will be communicated via the Play Store listing update notes or an in-app notice where appropriate.

Continued use of the app after an update constitutes acceptance of the revised policy.

16. Contact

We aim to respond to all privacy-related inquiries within 30 days.