Privacy Policy

Effective: 7 August 2026Updated: 28 October 2026

Eesti keeles →

Who processes the data

The data controller is:

Martti answers data protection questions — the same person who makes the app.

We have no Data Protection Officer and the law does not require one: we are not a public authority, data processing is neither our core activity nor large-scale, and we process no special categories of personal data.

What the app does not collect

These are not promises about the future. They describe what the app does today:

• A child's name is never sent anywhere. If a parent enters a first name,

it stays on that device only.

• We never ask for or collect email, location, photos, contacts or date of birth.
• No microphone, camera or location access.
• **There is not a single advertising-network or analytics-company SDK in the

app.** No ads, no third-party analytics, no tracking. (The website is a different story — see "This website" below.)

• No advertising identifier (IDFA, Android Advertising ID) or other persistent

device identifier is read or sent.

• There is no user account. You cannot sign in, because there is nothing to

sign in to.

Learning data to improve the algorithm — only with a parent's permission

On first launch we ask the parent. The question sits behind a parental gate whose solution requires a skill a 3–7-year-old does not yet have. Permission is off by default and nothing is sent without explicit consent.

If the parent agrees, we send three things:

We use this only to make the learning algorithm better for every child — for example to decide whether an exercise is too hard, or whether difficulty rises too slowly. We do not use it for advertising and we do not sell it to anyone.

Why we no longer call that code "anonymous"

An earlier version of this text said "anonymous code". That was not accurate and we have corrected it.

The code is pseudonymous: it is not tied to a name, an email or a device number, but it does distinguish one device's data from another's. In data protection law such a code is personal data. If it were truly anonymous we would have no right to promise you that we will delete your data on request — we would not be able to find it. We do promise that, so the code is not anonymous, and we say so plainly.

Legal basis

The legal basis is the parent's consent. In Estonia a child can give consent for information society services from the age of 13; a Tähetark user is always younger, so the parent always gives it.

That means three things:

1. you do not have to give it. It is neither a statutory nor a contractual

requirement, and withholding it does not reduce the app by a single feature;

1. you can withdraw it at any time in the parents' area, as easily as giving

it, without a reason and without consequences;

1. withdrawal stops further sending. Processing already carried out stays lawful,

but we will delete what was already sent if you ask.

Does the app make automated decisions about the child

The app adapts exercise difficulty to how quickly and accurately the child answers. That is profiling in the technical sense, but it only affects which exercise comes next. We make no automated decisions that would have a legal or similarly significant effect on the child.

Optional cloud backup

The parents' area has a separate button that backs up learning progress so it can be restored on a new device. The backup sends the same pseudonymous code and the learning progress. It never happens automatically — only when a parent presses the button. The legal basis is consent here too.

How long we keep data

Anything on the server can also be deleted sooner — just write to us.

Who else sees the data

We do not sell or pass data to third parties. No app data goes to advertising networks, data brokers or analytics companies.

Our server runs on Cloudflare infrastructure (Cloudflare, Inc. — Workers, KV). Cloudflare is our processor: it stores and transmits data on our instructions under a data processing agreement, may not use it for its own purposes, and is contractually bound to provide equivalent protection. There are no other recipients.

Because the server is our own, sending learning data is not a transfer to a third party — it moves from the child's device to Rasta MTÜ's own server and nowhere else.

The app is bought through the Apple App Store or Google Play. We never see the transaction: we do not receive your name, email, address or payment details. What the store collects about you is the store's decision and is described in the store's own privacy policy.

Where the data is

Data is held in the European Union. Cloudflare is a US-origin company, so in individual cases — for instance during technical support — access from outside the European Economic Area can occur. In that case we rely on the EU–U.S. Data Privacy Framework (European Commission adequacy decision 2023/1795) and on the European Commission's standard contractual clauses in Cloudflare's data processing agreement. Ask us and we will send you a copy of those safeguards.

A child's data and the parent's role

Tähetark is made for a 3–7-year-old who cannot give consent themselves. Every choice is therefore built for the parent:

• consent is requested from the parent, not from the child;
• the consent and settings screens sit behind a parental gate, which is our

reasonable effort to confirm that an adult is answering;

• no identifier is collected that would allow the child to be recognised by

name, device or account.

A parental gate is also a store requirement that keeps children out of adult areas. The gate itself is not the legal mechanism of consent — the first-launch question to the parent is.

Your rights

You have the right to:

• know what data we hold and receive a copy of it (access);
• have it corrected if it is wrong;
• have it deleted;
• restrict processing;
• object to processing;
• port your data in a machine-readable form;
• withdraw consent at any time, as easily as you gave it.

How to do it. Write to martti@rahanetis.ee and say what you want. We answer within one month. Handling your request is free of charge.

🔴 One honest limitation. The code is not tied to your name or your email. That means we cannot work out from your message alone which rows on the server belong to your child — unless you tell us the code. You can see the code in the parents' area; ask us and we will tell you exactly where. This is a weakness in answering you and a strength in privacy, and we deliberately chose the second.

Lodging a complaint

If you believe we are breaking data protection rules, you may contact the supervisory authority:

You are welcome to contact us first — often it is a misunderstanding that one email can settle.

This website

From here on this is not about the app. It is about this website. The two are separate things and we keep them apart: none of the measurement tools below exists in the app.

The website loads three third-party measurement tools:

These send Google, Meta and TikTok your IP address, browser details and what you did on the page. We do not see your name or email, and we never join website statistics to any app user — app data and website data do not meet anywhere.

If you would rather not, you can block cookies in your browser settings or use Google's opt-out add-on. The website works perfectly well either way — no feature depends on these tools.

The website also uses Cloudflare for security and speed, which means your request passes through a Cloudflare server.

Leaving an email on the waiting list was an earlier feature and we no longer send email. If your address is still there and you want it deleted, write to us.

Changes to this policy

If the app starts processing a new kind of data, we change this text first and the app second — not the other way round. Every version carries its update date at the top.

Notable changes:

• 28.10.2026 — added the controller's details (Rasta MTÜ, registry code,

address), the legal basis, the full list of your rights, retention periods per category, the naming of our processor (Cloudflare), where data is held, the supervisory authority's contacts and a separate section on website measurement. We also corrected "anonymous" to "pseudonymous". No processing itself changed — only how fully and accurately we describe it.

• 07.08.2026 — version 1.4: learning statistics sent with a parent's

permission was added. Before that, the app sent nothing off the device at all.

Contact

martti@rahanetis.ee — Rasta MTÜ, registry code 80662732, Kesk tn 39, Puka alevik, Otepää vald, 67217 Valga maakond, Estonia.

See also the Terms of Service.