APP PRIVACY POLICY

This Policy applies to data processed through the HeoCoin App, including Kid View and the HeoCoin Mosaic page that parents share with relatives.

If you visit our website or submit information through website forms, that data will be governed by our separate Website Privacy Policy.

Depending on the features available at a given time, we may collect the following types of information:

a. Account and user profile information

• Full name
• Email address
• Phone number
• Login credentials or account identifiers, if applicable

b. Family and child-related profile information within the App

Depending on how the App is used, we may process certain information related to family or child profiles within the same household account, such as:

• display name, nickname, or profile identifier
• information about activities, tasks, progress, or completion status
• coin balance, coin history, or redemption history
• settings or content created by a parent or user while using the App

c. Information related to use of the App

• data about how users interact with App features
• information about use of screens or features such as kid view, task tracking, or coin redemption
• technical usage data related to operation of the App

d. Device and technical information

• device type
• operating system
• App version
• IP address
• error logs, crash data, and basic diagnostic information

IP addresses are processed by our hosting and authentication providers when the App connects, as part of operational and security logs. We store an IP address in our own database only when you submit an account-deletion request through the web form, to prevent abuse. For Mosaic, we use only a one-way hashed form of the IP address, for a short time, to limit how often content can be sent. Country detection is described separately in item j.

e. Notifications and reminders

If you enable notifications, we may process the information necessary to send notifications, reminders, or updates related to App usage.

f. User-submitted content

Depending on specific features, we may process content that users choose to enter or upload in the App, such as text, notes, photos, feedback, or similar content.

g. Parents' notes about a child's activity

Parents may choose to add context about a child's activity ("Anything you'd like to add?" on the "Looking back together" screen) by typing or speaking. Speech is converted to text by the device's speech recognition, and we receive only the text.

h. Signing in with Google or Apple

You can create or access your HeoCoin account with Google or Apple. We then receive from that provider your account identifier, your email address and — if the provider shares it — your name. If you use Apple's "Hide My Email", we receive only the private relay address Apple creates. We never receive your password. We use this information only to sign you in and to link sign-in methods that share the same email address.

i. Family Plus subscriptions

Family Plus is an auto-renewable subscription paid through Apple. We never receive your card or payment details. Our subscription processor, RevenueCat, receives your family's internal identifier and the product, purchase, renewal and expiry dates, so that we can unlock Family Plus. You manage or cancel the subscription in your Apple ID settings.

j. Country and regional offers

When a family is created — or, for an existing family, the first time the App checks its plan — our hosting provider derives a country from the IP address of that request, and we store only the country code (for example "VN"), not the IP address. We use it to decide eligibility for regional offers (for example, Family Plus is free for families in Vietnam). We do not track your location. If your country was recorded incorrectly, contact us and we will review and correct it.

k. HeoCoin Mosaic

Parents can create a Mosaic link to invite relatives (for example grandparents, aunts or uncles) to send moments about a child. Relatives using the link do not create an account. When sending, a relative may provide a display name, their relationship to the child, an optional avatar, notes and photos. The parent reviews each moment and decides whether to add it to HeoCoin. If the parent sends a thank-you note, it is shown to the relative through their own Mosaic link. Parents can revoke a link at any time; relatives can contact us to request deletion of what they sent.

We may use information to:

• provide, operate, and maintain the App;
• create and manage user accounts, including sign-in with email, Google or Apple;
• support App features, including task management, progress tracking, kid view display, coin earning, coin deduction, or coin redemption, and HeoCoin Mosaic;
• provide Family Plus and determine regional offers;
• personalize the user experience to the extent relevant to the App's functions;
• improve user experience, performance, and App stability;
• analyze errors, detect technical issues, and enhance security;
• send service notifications, reminders, or important operational updates related to the App;
• generate AI suggestions in the App, such as topics for activities and moments, questions for parents' own reflection and "Looking back together", as described in Section 5;
• comply with legal obligations, resolve disputes, or protect our legitimate rights and interests.

HeoCoin is not currently a standalone app designed exclusively for children. At this stage, the App is primarily used by parents or caregivers, but may include child-related features or data within the same family experience.

We encourage use of the App with appropriate parental or guardian involvement, especially where required by law.

Where applicable, we will make reasonable efforts to design and operate the App in a manner consistent with legal obligations relating to children's data. If you believe child-related information has been provided or processed inappropriately, please contact us so we can review, correct, or delete the relevant information where appropriate.

We do not sell, rent, or trade users' personal information to third parties for commercial purposes.

We may share information only when necessary, including:

• with service providers that support App operations: data storage and authentication (Supabase, servers in Singapore), application hosting (Vercel), notifications and app updates (Expo), authentication email delivery, sign-in (Google, Apple) and subscription management (RevenueCat, Apple);
• with an AI provider (currently OpenAI) to generate the suggestions described in Section 3, only to the extent that feature requires;
• when required by law, or when disclosure is necessary to protect our rights, property, safety, users, or the public;
• in connection with a restructuring, merger, acquisition, or transfer of business or assets, if applicable.

Service providers are only permitted to process information as necessary to support our operations.

AI features

To generate suggestions, we send the AI provider what the feature needs: the activity's name and description, practice records, notes and context entered by parents or invited family members (including notes sent through Mosaic), and the child's age. We do not send the child's profile name, relatives' names, email addresses, phone numbers, payment information or photos. Free text that users enter is sent as written, so we encourage not including full names or other identifying details in it.

Storage and training on the AI provider's side:

• Model training: we have not enabled OpenAI's data-sharing options for App data, so content sent from the App is not shared with OpenAI to improve or train its models.
• Retention for abuse monitoring: OpenAI may retain data sent through its API for a limited period under its own policies, for example to detect and prevent abuse. That retention period is set by OpenAI.
• Response storage: we ask OpenAI not to store the responses it generates for later retrieval.

AI-generated content is a suggestion for the family to consider, not an assessment or diagnosis of the child. A parent's notes are treated as the parent's own view and are not presented as facts about the child.

We retain information for as long as necessary to:

• operate and improve the App;
• fulfill the purposes described in this Policy;
• comply with legal obligations, if any;
• resolve disputes;
• or protect our legitimate rights and interests.

We use reasonable technical and organizational measures to protect data against loss, unauthorized access, disclosure, alteration, or destruction. However, no system is completely secure.

Notes parents add on the "Looking back together" screen are visible only to the parents in the family account (never on the child's screens). They are kept until the parent deletes them, or until the activity, the child's profile or the family account is deleted; a deleted note is not used in later look-backs.

Depending on applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate data;
• request deletion of data;
• withdraw consent for certain processing activities;
• request support regarding data used within a family account or related profile.

Delete your account in the App: go to Settings → Account → Delete account. This deletes your account, family data, children's profiles and related history; if you signed in with Apple, the Sign in with Apple connection is also revoked. Deleting your account does not cancel an Apple subscription — please cancel it in your Apple ID settings.

To exercise your other rights, please contact: hello@heocoinfamily.com

The App may integrate with or link to certain third-party services, content, or platforms. We do not control those third parties and are not responsible for their policies or data handling practices. We encourage you to review their policies before using them.

We may update this Policy from time to time to reflect changes in the App, our operations, or legal requirements. When we do, we will revise the "Effective date" at the top of this page.

Your continued use of the App after any update means you accept the revised Policy.