Tunas Privacy Policy

Who is responsible

runupbiz, a small studio run by a solo founder in Malaysia, runs Tunas and its servers. Contact: [email protected].

Who uses Tunas

Tunas is a learning app for children aged 3 to 6. Children never create an account or sign in. A parent or guardian creates the account, sets up the child profiles and agrees to this policy. Settings, sign-in and deletion sit behind a parent gate.

What we store

• Parent account: the parent’s email address and a hashed password (email sign-in). If the parent chooses Google sign-in, we receive the Google account’s email address and a Google identifier. Google sign-in is optional; email sign-in is always available.
• Child profile: a nickname the parent types (we ask parents to use a nickname, not the real name), one preset animal avatar, an age band (3-4, 4-5 or 5-6), learning progress with activity history (which questions were answered and which lessons were finished, with timestamps), and the synced app settings (for example the daily goal and time limit).
• Sign-in sessions: each sign-in session records the device type, IP address and country it came from. These records are kept while the session is active and for up to about two days after it ends, and are used only to run and secure the account.
• Profiles, progress and activity history are stored encrypted on our servers only when a parent is signed in and has turned on cloud backup in the app’s Settings, so the parent can restore them on a new phone. Without signing in, or while cloud backup is off, nothing is uploaded: Tunas works fully and keeps everything on the device.

What we do not collect

• No photos, voice recordings, location, contacts, date of birth or free text from children.
• No advertising and no advertising identifier. No analytics, tracking or attribution SDKs.
• We do not sell, rent or share children’s data with third parties.

Why we store it

Only to run the app: to sign the parent in, to show each child’s profile, and to restore progress on another device.

Consent

After signing in or creating an account, the app shows the parent what is stored, why, for how long and how to delete it, and asks the parent to confirm they are the parent or guardian and agree. Until the parent agrees, cloud backup stays off and nothing is uploaded or downloaded. Consent is stored on the phone where the parent gave it. To withdraw, sign out on each phone; to remove what is already stored, use Delete cloud data in the app. We do not send a separate consent email.

How long we keep it

• The account is removed 30 days after the deletion request is confirmed (the cleanup runs daily, so allow one more day); cloud data deleted in the app is removed at once. A phone that is still signed in elsewhere may upload a backup again until it signs out; that copy is then removed by the 24-month rule.
• Cloud backup data (child profiles and progress) that no device has saved or loaded for 24 months is deleted automatically.
• Server backup copies are deleted on a rolling basis, normally within 15 days and at most within 90 days. The child profile data in them is encrypted by the app before it is stored; account data such as the parent’s email address is protected by folder permissions on our own server.

Deleting data

Inside the app, behind the parent gate, a parent can delete one child’s profile (in Switch child), delete all cloud data, or delete the whole account (both in Settings). Deleting cloud data removes the cloud copy at once; deleting the account removes it 30 days later. A phone that is still signed in to the same account can upload again until it signs out, so sign other phones out first. Without the app, ask for deletion on Delete your account.

Purchases

Purchases, if any, are handled by Google Play, and refunds follow Google Play’s policy.

Where data is kept and your rights

Data is stored on our own servers. Parents can ask to see, correct or delete their data at any time by emailing [email protected]. We aim to follow Malaysia’s Personal Data Protection Act 2010 and, for children, ask for a parent’s consent before storing a child’s profile. This page is not a legal certification. If personal data is ever exposed by mistake, we will tell the affected parents and the authorities as the law requires.

Changes

If this policy changes in a material way, we tell parents in the app before the change applies.