Privacy Policy
Last updated: 4 November 2026 · Version 2.2
This Policy explains what data the Vabyk app and websites (the “Service”) process, why, and who receives it. In short: everything about the child stays on your device. We do not create child profiles and do not receive children's data. We receive only general statistics without names or contacts and crash reports — and, if you choose to sign in with email, your email for the subscription.
1. Who is the data controller
Taras Gordiienko, a sole proprietor (FOP) registered in Ukraine (“we”, “Vabyk”). For any data questions: support@vabyk.com.
2. What stays only on your device
- The child profile: month and year of birth (to match exercises to the age). The Service does not ask for the child's name or photo.
- Lessons and progress: which exercises the child did, with how much help, and the collected animals.
- Which surveys have already been shown, and the app settings.
This data is kept in the app's storage on the device and is not sent to our servers. If device backup (iCloud or Google) is on, it may be included in that backup — kept by Apple or Google in your account, not by us. You can delete a child's data in the app (“Delete data” on the child's profile) or by deleting the app.
3. What we receive
- Anonymous answers to short in-app surveys (for example, who you are to the child, how you heard about Vabyk), platform and app version. Each record stands alone, with no identifier at all — not yours, the child's, the device's or the installation's — so records cannot be linked to each other or to you.
- Anonymous crash reports: the technical error text and where in the code it happened. No identifiers, no child data and no lesson content.
- Email — only if you choose to sign in with email to use the subscription on several devices. We send a one-time sign-in code to it, use it for nothing else and share it with no one.
- Subscription data: status and purchase date. We do not receive payment details — payments are processed by the App Store or Google Play.
- Support correspondence, if you write to us.
We show no ads, use no third-party analytics, advertising services or trackers, do not sell data and do not profile children.
4. Why and on what basis
- Statistics and crash reports — to understand whether the Service helps and to fix bugs (legitimate interests, Art. 6(1)(f) GDPR). They are anonymous: they cannot tell us who you are.
- Email and sign-in — so the subscription works on all your devices (performance of a contract, Art. 6(1)(b) GDPR).
- Subscription — to provide paid access (performance of a contract).
- Correspondence — to answer you.
5. Children
The Service is meant for a child's practice under adult supervision. The child does not register, enter data or make purchases. Data about the child entered by the adult (month and year of birth) is processed only on the device and never reaches the server. For EU/EEA users we act in line with Art. 8 GDPR.
Notice to parents in the US (COPPA):
- We collect no personal information from children: no name, contacts, photo, voice or location, and no persistent identifiers. Statistics and crash reports are anonymous.
- The only personal information we may receive is an adult's email, when the adult chooses to sign in so the subscription works on several devices. Before the code is sent, the app says the email is for a parent or another adult and links to this Policy; the code email carries a short notice of what we keep and how to delete it.
- We use the email only for sign-in, do not disclose it to third parties (the providers in section 6 process it only on our behalf) and show no ads.
- You can review what we hold, refuse its further use or have it deleted at any time: “Delete account” in the app's settings, or email support@vabyk.com. We reply within 30 days.
- Operator: Taras Gordiienko (sole proprietor), support@vabyk.com.
6. Who processes data on our behalf
- Supabase — the database for statistics and crash reports, email sign-in.
- Resend — sending the sign-in code emails.
- RevenueCat, Inc. — subscription status (receives purchase data from the App Store / Google Play and, if you signed in, a random account identifier — not the email).
- Apple App Store and Google Play — subscription payments.
- Vercel — website hosting.
We may disclose data where required by law, a court or a competent authority. We do not sell personal data.
7. International transfers
Some providers may process data outside your country, including in the EU or the US. Where they do, we rely on appropriate transfer mechanisms — primarily the European Commission's Standard Contractual Clauses (SCCs).
8. How long we keep data
- Statistics and crash reports — up to 24 months, then deleted.
- Sign-in email — while your account exists. You can delete it in the app (Settings → “Delete account”); the email is deleted at once.
- Subscription data — as long as payment records require.
9. Security
Connections are encrypted (TLS). The app can only write statistics and crash reports, not read them; only we have access to them. Like any server on the internet, the providers' servers technically see a request's IP address in their service logs; we do not store it with the statistics and use such logs only for security and to run the Service. No method of transmission or storage is absolutely secure, but we keep working on it.
10. Your rights
You have the right to access, rectify, erase, restrict and object to the processing of your data, and to data portability. You control the child's data yourself on the device; the account is deleted in the app. Statistics and crash reports are anonymous, so we cannot find your records among them.
EU/EEA users may complain to their national data-protection authority; Ukrainian users — to the Ukrainian Parliament Commissioner for Human Rights.
11. Cookies
The app uses no cookies. The websites use only technically necessary files, without analytics or advertising.
12. Changes
We will notify you of material changes to this Policy in the app. The date and version are shown at the top of the page.