Privacy Policy

1. Who This Policy Applies To

This Privacy Policy applies to parents, guardians, and other adult account holders who create or manage an L2P account; child profiles and paired child devices managed under a parent-controlled account; people who contact us for support, privacy requests, or account questions; and people who receive Service notices from us, such as privacy or inactive-account notices.

L2P is not designed as a standalone child sign-up service. Child Mode is intended to be set up and managed by a parent or legal guardian.

2. Children and Parent-Controlled Use

L2P processes child-related information because parents use the Service to manage child profiles and paired child devices.

Parents or legal guardians are responsible for ensuring they have authority to create and manage each child profile and child device, reviewing the rules and rewards they enable, keeping Parent Mode and account access secure, and contacting us if child information should be accessed, corrected, exported, cleared, or deleted.

Children do not create their own L2P cloud account in the current product design. If a child contacts us directly, we may require parent or guardian involvement before acting on account, privacy, or deletion requests.

L2P does not use child data for third-party advertising, cross-app tracking, data-broker sharing, or child-behaviour monetisation.

3. Information We Collect

Parent account and sign-in information

We may collect parent email address and display name, account identifiers from supported sign-in providers, account/session identifiers used to keep you signed in, authentication status, selected plan or capability state, and account activity records needed for privacy, retention, support, and security.

The current parent sign-in surface supports Google sign-in and Sign in with Apple. Sign in with Apple may provide a private relay email address. We do not receive your Apple or Google password.

Child profile and family setup information

We may collect child profile name, nickname, or label entered by the parent; avatar choice and active/inactive child profile state; parent-child account relationship; family join invite status, expiry, and claim records; pairing status and unlink/relink status; and identifiers used to keep the correct parent, child, and device linked.

Child device pairing information

When a child device joins a parent account, we may collect a generated child-device identifier used for pairing validation, device name and platform, pairing status, paired time, last-seen time, unlinked time, invite and pairing metadata, and local child-device state needed to detect when a device is no longer linked.

If a child profile or account is deleted while the child device is offline, local enforcement may continue temporarily from cached rules. When the child device next comes online or validates its pairing state, it is expected to stop L2P monitoring, release L2P shields where possible, clear linked local state, and show that it is no longer linked.

Screen Time app selections, rules, and local enforcement state

Parents choose Learning Apps and Play Apps on the child device because Apple's Screen Time app picker runs on the device that has the relevant app list. Depending on the feature and device state, L2P may process Learning App and Play App selections, Apple Screen Time selection data needed to sync rules, rule version, reward ratio, feature access state, local cached rules, remaining-play balance, app shield state, and setup diagnostics.

Screen Time app-selection data can be sensitive. L2P is designed to use it for app-control functionality, not advertising or profiling. Privacy exports summarize app-rule state and do not expose underlying Screen Time selection tokens.

Learning, play, summaries, and operational records

To provide the Learn -> Earn -> Unlock -> Play -> Lock loop, L2P may collect or create daily learning minutes, daily play minutes, earned, used, bonus, and remaining play minutes, child local time zone, summary sync timestamps, limited earn/use records, play request records where applicable, records used to prevent duplicate processing and support retry, and current-day enforcement state.

The cloud model is summary-first. Detailed per-app minute breakdowns and detailed Screen Time processing records are intended to remain local on the child device by default unless a future feature clearly discloses otherwise.

Rewards, Bonus Time, Program Access, and subscriptions

Depending on the plan and features enabled, we may collect reward rule settings, daily tasks, weekly rewards, parent reward goals, points, claims, redemptions, whether Rewards are shown or hidden on the child device, Bonus Time grants, Program Access code redemption and grant state, active plan and feature access state, App Store product identifiers, and subscription entitlement state.

Apple manages App Store payments, renewals, refunds, and subscription cancellation. We do not receive your full payment-card details from Apple.

Privacy requests and export files

When a parent uses Privacy & Data controls, we may hold export, clear-history, child-deletion, and account-deletion request records; request status and timestamps; minimal audit events; export file metadata and storage details while retained; and temporary download link expiry state.

The export ZIP is designed as a parent-friendly export, not a technical data dump. It currently includes files such as family profile, children, reward rules, app-rule summary, daily activity summary, progress summary, Bonus Time, Rewards, Program Access, pairing status, and subscription status.

Support, communications, camera, and local notifications

If you contact us, we may collect contact details, support message contents, screenshots, logs, diagnostics you choose to send, and support records. We may use an email service provider to send privacy, account, and retention notices to the parent account email address on record.

L2P asks for camera permission only so a device can scan a parent-issued family join QR code. The child app may ask for local notification permission to show learning milestone reminders and play-time countdown warnings. L2P does not use camera or local notifications for advertising, third-party marketing, or cross-app tracking.

4. How We Collect and Use Information

We collect information from parents when they sign in, create child profiles, choose rules, pair devices, manage rewards, manage subscriptions, use Privacy & Data controls, or contact support; from child devices when paired and syncing or validating state; from Apple and Google when a parent uses their sign-in, billing, or platform features; from Apple's Screen Time services on the child device; and from our service systems when they create operational, audit, and retention records.

We use personal information to create and manage parent accounts and child profiles, authenticate parents, pair and validate child devices, store and sync app rules and plan capabilities, calculate play time, apply supported Screen Time restrictions, show reminders and warnings, show dashboards and Rewards, prevent duplicate processing, process Privacy & Data requests, send account or privacy notices, troubleshoot, secure, maintain, and comply with legal obligations.

L2P uses configured rules and local device state to automate product behaviour such as calculating play balance and applying or releasing Play App shields. Parents choose the relevant rules and can change supported settings. L2P does not make credit, employment, insurance, health, or legal decisions.

5. Local-First, Summary-First Design and Sharing

L2P is designed around parent-led setup and control, minimum necessary child data, local child-device enforcement where possible, summary-first cloud records, no ad-driven child data use, and privacy controls for export, clear history, child deletion, and account deletion.

Child devices may continue enforcing locally from cached rules while offline. Parent-visible summaries and cloud state may update later when a child device has network access and a safe sync opportunity.

We may disclose personal information to Supabase, Apple, Google, Resend, support/security/hosting/operational/professional/legal providers, a parent or legal guardian who manages the relevant child profile, regulators or courts where required or permitted by law, and parties involved in a business transfer subject to applicable law.

We do not sell child personal information. We do not share child data with data brokers. We do not use or disclose child data for third-party targeted advertising.

6. Overseas Disclosure and International Processing

L2P is being prepared for Australia first, but our providers may process or store information in Australia, the United States, the European Union, and other countries where they or their subprocessors operate.

Provider locations may vary depending on the live hosting region, Apple or Google account services, Resend email delivery, support tooling, and future infrastructure configuration. We take reasonable steps to use reputable providers and to disclose the provider categories that matter to user privacy.

7. Your Privacy & Data Controls

Export My Data

Export My Data generates a private ZIP file with parent-friendly files and summaries. The ZIP is retained for 7 days. Download links are signed and valid for 1 hour. While the export is retained, the app can request a fresh signed download link.

The export masks or omits system-only identifiers, generated child-device identifiers, join codes, access codes, auth/session tokens, underlying Screen Time selection tokens, and system-only API names unless there is a clear product or legal need to include them. Pairing status exports may include parent-visible device name, platform, pairing status, and relevant pairing timestamps.

Clear History

Clear History is designed to clear older, safe-to-clear history before the current child-local week. It preserves current-week and current-day enforcement state, current remaining balance, active child profile, app rules, reward rules, Program Access, subscription state, pairing state, active Rewards state, points/level, lifetime learning totals, required audit/security records, and current lock/unlock truth.

L2P also keeps clear markers so older offline child-device rows cannot be replayed later as fresh history after a clear.

Delete Child Profile

Delete Child Profile permanently removes the selected child profile and child-scoped data. It does not delete the parent account, other children, Program Access, or the Apple subscription.

Delete Account & Family

Delete Account & Family starts permanent deletion of the L2P account and family data. L2P removes retained export ZIPs and deletes the account after related account and family data is processed through a secure server path. A minimal privacy request audit record may remain for accountability, security, legal, and operational integrity.

Deleting an L2P account does not cancel an Apple App Store subscription. Parents must manage Apple subscriptions in the App Store or Apple ID subscription settings.

8. Retention

We retain personal information only for as long as reasonably necessary for the purposes in this Privacy Policy, including to provide the Service, support parents, secure the Service, meet legal obligations, resolve disputes, and maintain operational integrity.

• Privacy export ZIPs: retained for 7 days.
• Signed export download URLs: valid for 1 hour.
• Stale claimed, expired, or revoked Join Family invites: scheduled cleanup after 30 days.
• Old child activity and operational history: 90 day minimisation settings exist for old settled daily summaries, Bonus Time daily records, and legacy learning/play operational rows, but automatic deletion for these records is not currently enabled.
• Old non-active child-device pairings: a 365 day minimisation setting exists for unlinked or replaced pairings, but active pairings are preserved and automatic deletion for old pairings is not currently enabled.
• Privacy audit records and privacy notice records: 730 day minimisation settings exist, but automatic deletion for these records is not currently enabled.
• Program Access audit records: classified for a two-year audit review window. Automatic cleanup for these records is not currently enabled.
• Inactive parent account lifecycle: starts after 365 days without observed account or family activity.
• Inactive-account warning lifecycle: 30 day review period with 30, 7, and 1 day notice stages.
• Inactive-account automatic deletion: currently disabled and notice-only unless later approved and disclosed.
• Local child-device data: may remain on the device until the device is unlinked, reset, the app is removed, or local app data is cleared.

Some retention settings can be reviewed or changed later. If we materially change retention or automatic deletion practices, we will update this policy and provide appropriate notice where required.

9. Access, Correction, Deletion, and Complaints

Subject to applicable law, you may ask us to provide access to personal information, correct inaccurate or incomplete personal information, export, clear, or delete eligible account or child-profile information, explain how we handled a privacy request, or investigate a privacy complaint.

Use the in-app Privacy & Data controls where available, or contact us at privacy@learn2play.com.au. Please include enough information for us to verify your identity and locate the relevant account or child profile.

If Australian privacy law applies and you are not satisfied with our response, you may have the right to contact the Office of the Australian Information Commissioner.

10. Security and Third-Party Services

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorized access, modification, and disclosure. Measures may include authentication, role-based access controls, private storage, short-lived signed URLs, data minimization, redacted diagnostics, audit records, and provider safeguards.

No system can guarantee absolute security. Parents are responsible for protecting their own devices, Apple or Google accounts, L2P account access, and Parent Mode access.

Third-party services may handle information under their own terms and privacy policies. Relevant providers include Apple, Google, Supabase, Resend, and any support or infrastructure providers we later use.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change, we may provide notice through the app, website, email, App Store listing, or another appropriate channel. The updated version applies from the Effective Date shown at the top.

12. Contact Us

Operator Legal Name: OTEKIK PTY LTD
Brand: L2P - Learn to Play
Privacy Email: privacy@learn2play.com.au
Support Email: support@learn2play.com.au
Business Address: Melbourne, Victoria, Australia
Website: otekik.com.au

If you need this Privacy Policy in another format, contact us and we will take reasonable steps to provide it in an appropriate form.