Privacy Policy

DinoMinds (Héctor Ullate) ("we," "our," or "us") makes apps for young children and their families. This policy explains what information we collect when you use our apps on iOS and Android, our website dinominds.com and our web sign-ups at get.dinominds.com; why we collect it; who helps us handle it; and the choices you have. Our apps are set up and managed by parents and guardians, and children use them under their supervision.

This policy covers these apps:

• Readino: learning to read, for children aged 3 to 8.
• DinoPlay (coming soon): a playroom of toys, for children aged 2 to 7.

Sections 1 to 9 apply to all of them; where something applies to only one app, we name it. Section 10 adds what is particular to each app. Before we release a new app, we add it to this list and give it its own part of section 10.

1. Who is responsible

DinoMinds (Héctor Ullate), the publisher of our apps, based in Spain, is responsible for your information (the "controller" under the EU General Data Protection Regulation) in every app and website this policy covers. You can reach us at the address at the end of this policy.

2. What we collect and why

In our apps, without an account

When you set up one of our apps, you may enter a few details about your child, such as a name or nickname and age, and answer a few questions so the app suits them. Section 10 lists what each app asks. The app stores this, your child's progress and your settings on your device only. It is used to personalize the app and is not sent to us.

With an account (optional)

You can create an account in our apps with your email address, so what you set up for your child follows you to your other devices and a subscription works on each of them. Each app has its own accounts: a Readino account and a DinoPlay account are separate, even with the same email address. With an account we keep:

• Your email address, to log you in with a one-time link or code and to send you account emails, such as login codes.
• Your child's profile and what the app saves for them, as section 10 lists for each app.
• The devices logged in: a random identifier the app creates for each installation, the kind of device (for example "iPhone"), its platform and app version, and when it was last used, so you can see your devices and log them out.
• Store purchases: if you subscribed in the App Store or Google Play and log in, the app sends us the store's record of that purchase so we can confirm it with Apple or Google and unlock your other devices.

Readino also keeps security information about each login (section 10). We use this information only to provide the service you asked for.

Web sign-up and purchases

Today only Readino has a web sign-up, at get.dinominds.com/readino. When you sign up there we collect your answers (such as your child's name, age and reading level, and your preferences), your email address, and the campaign that brought you to us (for example, which ad). We use them to recommend and set up your plan and, if you subscribe, to set up your child in the app. When you pay on our website, the payment is processed by Stripe and Link (see section 5). We receive your email address, the plan you chose, the payment status and Stripe's identifiers for the payment, never your full card number.

Emails and messages you send us

When you write to us (for example to support@dinominds.com, privacy@dinominds.com or press@dinominds.com), we receive your email address, the message and anything you include, and use them to answer you.

Technical information

Like any online service, our servers and hosting provider process technical information such as IP addresses, browser or app details and the time of each request, to deliver the service, keep it secure and prevent abuse.

3. Advertising and measurement

We advertise our apps to parents, and some of our apps include tools that measure whether those ads work. We never use your child's name, age, profile or progress for this, and our apps show children no ads. Each app uses only the tools listed for it here:

• Readino: the Meta (Facebook) SDK in the iOS and Android apps, the TikTok SDK in the Android app, and the Meta Pixel and Meta's Conversions API on its web sign-up. Section 10 explains what each one sends and the choices you have, including Apple's "Allow Tracking" prompt and Global Privacy Control.
• DinoPlay: none. It includes no advertising, attribution or analytics tools and does not ask to track you.

Before an app starts using a tool like these, we add it to this list.

4. Children's privacy

• Our apps are directed at young children (Readino at children aged 3 to 8, DinoPlay at children aged 2 to 7) and meant to be used with a parent or guardian. Accounts, purchases and web sign-ups are for adults only.
• Information about a child (such as a name or nickname, age and avatar, and in Readino their reading progress) is provided by the parent and limited to what the app needs. Section 10 lists it for each app. We don't ask children for contact details.
• In our apps, settings (including the account) and the ways to contact us are behind a grown-up check, so children can't reach them on their own, and purchases go through Apple's or Google's own payment screen. The first-time setup, where you can also log in to an account, is meant to be completed by a parent. Section 10 says what else each app does.
• We do not knowingly collect personal information directly from children. If we learn that we have, we delete it.
• Parents can review, change or delete their child's information at any time: in the app's settings, by deleting the account, or by writing to us. We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and the EU General Data Protection Regulation (GDPR).

5. Who helps us

We do not sell your personal information. We share it only with service providers that handle it on our behalf, under our instructions:

• Cloudflare: hosting, our databases (Readino's is stored in the European Union), and sending and receiving our email.
• Apple and Google: the app stores, in-app purchases and confirming subscriptions.
• Stripe and Link: payments on Readino's web sign-up. For those purchases, Link (a Stripe company) is the seller of record and handles the payment, taxes and refunds under its own terms and privacy policy.
• Google (Gmail): our support inbox.
• Meta: measuring our ads for Readino, as described in section 10.
• TikTok: measuring our ads in Readino's Android app, as described in section 10.

We may also disclose information when the law requires it, or to protect the rights and safety of our users or others.

6. Where your information is stored

Each app has its own database, hosted by Cloudflare. Readino's holds everything our server keeps for Readino, including accounts, web sign-ups, login requests and payment records, and is stored in the European Union. DinoPlay's isn't set up yet; we will say here where it is stored before DinoPlay is released. Some of our providers may process information in the United States or other countries. When they do, they rely on legal safeguards such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework.

7. How long we keep it

• On your device: until you reset or delete it in the app, or delete the app.
• Account information: until you delete your account. It is then removed from our database; copies in our backups are gone within 30 days.
• Login requests (email address, time and device identifier; codes and links are stored only in scrambled form): 30 days, to protect against abuse. The codes and links themselves stop working after a quarter of an hour in Readino, and after half an hour in DinoPlay.
• Web sign-up answers (Readino): as long as needed to set up and follow up on your sign-up and account, or until you ask us to delete them.
• Payment records: for Readino, as long as tax and accounting law requires. After an account is deleted they are no longer linked to it. DinoPlay deletes its records of store purchases with the account. Apple, Google and Stripe keep their own records under their own policies.
• Emails with us: as long as needed to help you.

8. Your rights and choices

You can ask to access, correct, delete or receive a copy of your information, object to or restrict how we use it, and withdraw any consent you have given. You can:

• Edit your child's profile or reset their progress in the app's settings (in Readino, Settings; in DinoPlay, the grown-ups area).
• Delete your account in the app (in Readino, Settings → Account → Delete account; in DinoPlay, the grown-ups area, then Account → Delete account) or at dinominds.com/delete-account, which also works without the app.
• Delete everything kept on a device by deleting the app.
• In Readino, change your tracking choice in your device settings, or opt out of tracking on our website with Global Privacy Control, as described in section 10.
• Write to us for anything else. We answer within one month.

If you are in the EU, you can also complain to a data protection authority, such as the Spanish Agencia Española de Protección de Datos (aepd.es) or the authority where you live.

9. Security

We use encrypted connections (HTTPS) everywhere, store login codes and links only in scrambled form, make them work once and expire quickly, and limit the number of devices per account. No system is completely secure, but we work to protect your information.

10. App by app

What is particular to each app. Each new app gets its own part here before it is released.

11. Changes to this policy

We may update this policy as our apps change, and we add each new app to it before the app is released. We will post the new version on this page with a new date and, for significant changes, tell you in the app or by email.

12. Contact us

For questions about this policy, your information or your child's, write to:

privacy@dinominds.com