Privacy Policy

This policy covers the Yali app for iPhone and Android and this website, yali.kids. Yali is published by Yitzchaki (“we”, “us”). Questions about anything here go to privacy@yali.kids.

Yali is a learning app for children aged 2 to 9 and up, so the privacy rules for children’s apps apply to it, and we follow them.

The short version

Topic	In short
What the app sends	What happens as your child plays — a level started, an answer given, a level finished — as events to Google Firebase, which runs our analytics.
Is it linked to your child?	Not to a person. Two indices travel with it: your child’s profile number within your installation, and one Firebase gives every installation. Neither is a name, an account, or a device identifier.
Crash and error reports	Sent to Firebase Crashlytics, with the technical state of the phone at the time.
Location	The app never asks for or reads your location. Google works out a country and region from the internet address the data arrives from.
Permissions	Internet and notifications. Never the microphone, camera, photos, contacts or location.
Sharing	None. Google processes the data on our behalf only. Nothing is sold or given to advertisers.
Your child’s first name	Typed on the phone and never transmitted to us. It stays on the phone, in your own backups and, on iPhone, in your own iCloud.
Accounts	None. Yali has no login and no user accounts.
Purchases	Through the App Store or Google Play. We never see your card, your name or your email address; Google Analytics records which plan was bought and its price.
Ads	None. No advertising SDK and no advertising identifier.
This website	No forms. Google Analytics counts visits only if you allow it; until then nothing from Google loads and no analytics cookie is set.

1. What the app collects

When your child starts a level, answers a question, taps a wrong option or finishes a level, the app sends a small record of that to Google Firebase, the analytics service we use. Each record carries what happened, when it happened, and the indices described below. When the app crashes or runs into an error, it also sends a report (section 4).

What an event carries

Things like: which subject and language, which level and activity, which item, whether the answer was correct, how much help was needed, which wrong option was tapped, how long the answer took, how far into a subject your child has reached, and whether a session was kept or discarded. About each child: the age band you chose for them — such as 2–3 or 7–8, never a birth date — and when you change it. About the household: which languages Yali teaches and which one she speaks, whether a subscription is active, whether one of the app’s notifications was shown (which kind, never what it said), whether the monthly picture was offered and opened and whether its share sheet was opened, and how a session ended — the app put in the background, or stopped unexpectedly.

That is the kind of thing an event carries, not a list of every field. What it never carries is in section 2.

The indices

We declare three indices on both app stores, and there are exactly three. Two of them travel with what the app sends; the third stays on the phone.

A profile index, on the events about a child’s play — each answer, each level, each session. It is the profile’s number within your installation — profiles are numbered 1, 2, 3 in the order they are made — and nothing more. It is not worked out from your child, your phone or the clock, and on its own it means nothing: every family’s first child is 1. It stays the same while the app is installed, because we look at whether children progress over successive weeks.
An installation index that Firebase creates. Every app that uses Firebase Analytics has one; it is how the service counts installations, and beside the profile index it is what tells one child’s events from another’s. It is part of how the service works and cannot be switched off, so we declare it on both app stores beside our own two — under Device ID on the App Store and device or other IDs on Google Play.
A household index, which stays on the phone. One per installation, generated on the device from random data. Nothing in the app sends it. It is still listed on both store declarations, because we would rather a label say one thing too many than one too few.

None of the three is a device identifier: two apps on one phone hold different values, and the app reads nothing about your hardware. None can be traced back to a person, because there are no accounts to attach them to.

What Firebase records on its own

Some of what reaches the analytics service is not something Yali chose to send. Firebase records it in every app that uses it, or Google adds it when the data arrives, and no setting in Yali prevents it:

An approximate location — a country and region — worked out from the internet address the data arrives from. The app has no location permission and never reads your device’s location.
The kind of phone, its operating system version and language setting, and the app’s version, recorded with events and crash reports.
When the app is opened and how long it is in use, as sessions, and when it is installed, updated or removed.

We declare these on the app-store forms.

2. What the app does not collect, and the permissions it asks for

The app does not collect:

your child’s name, or any name;
any voice recording;
an advertising identifier, a device fingerprint, or any cross-app tracking identifier;
your device’s location;
contacts, photos, or other content on the device;
your payment details;
an email address or phone number.

On Android, the app asks for:

internet access, and to check whether the phone is online — to send what section 1 describes and to reach the store;
Google Play billing, to sell and check the subscription;
notifications, which Android asks you to allow (section 5);
two technical permissions Android grants without asking: keeping the phone awake briefly while data is sent, and vibration for notifications.

On iPhone and iPad, the only thing the app asks you to allow is notifications.

On either, it never asks for the microphone, the camera, your photos, your contacts or your location.

3. How we use it

To operate and improve the app: to see whether children are progressing and where they get stuck, which levels are too hard, which pictures mislead, which letters get confused with which, and which subjects and languages are used. None of it is used for advertising, for profiling, or to tailor an offer to a child.

Some of this is built into the app, and some is a rule we keep:

Built in: no name and no free text is ever sent. An event holds only keys from the app’s content, numbers, and yes-or-no answers, and the app’s tests fail if anything else is added.
A rule: we look at children as a group, never at one child. The events about a child’s play carry the profile index, so our analysis can follow one profile over time — that is how we see whether children progress across weeks — but only to produce totals and averages across all children. We never look up, review or act on one child’s record, and never try to find out who a child is. This is a commitment about how we work, not a technical limit.
A rule: nothing is collected just in case. Every field answers a question we have already written down.

4. Who else handles it

Each service below does one job for Yali. None of them is an advertiser, and there is no advertising SDK in the app.

Google Firebase: analytics and crash reports

Google handles the data in section 1 on our behalf and under our instructions, and that is its only role here. They do not receive the data for their own purposes, they do not pass it onward, and none of it is sold, traded, or given to advertisers or data brokers.

When Yali crashes, the app sends the crash to Firebase Crashlytics, and errors the app recovers from go the same way: what the code was doing when it failed, and the technical state of the phone around it — the model, the operating system version, how much memory and storage were free, and whether the app was on screen. Crashlytics also keeps the last few events from section 1, to show what happened just before. We attach no name and nothing you typed to these reports. If you have turned on diagnostics sharing in your device settings, your phone’s operating system may also report crashes to Apple or Google; we see those in App Store Connect and in Google Play’s Android Vitals.

The account is configured to match:

every Google Analytics data-sharing option is off: no sharing with Google products and services, no benchmarking, no technical-support access, and no account specialists;
no advertising identifier is read: on iPhone the advertising framework is not part of the app, and on Android the advertising ID permission is removed;
ad personalization is switched off in the app;
Google Signals is off, so nothing is joined to anybody’s Google account.

Google has its own terms, security and retention practices for Firebase, and may use information about the requests themselves to run and protect its service. What we control — what is sent, how the account is configured, and how long data is kept — is what this policy promises.

Google Play and the App Store: purchases

A subscription is bought, renewed and cancelled through the App Store or Google Play, on Apple’s or Google’s terms. We never see your card, your name or your email address. The app asks the store one thing — whether a subscription is active — and that yes or no is sent with the events in section 1. Google Analytics also records the purchase itself — which plan, and its price and currency — as it does automatically in every app that uses it.

Apple iCloud: the copy on iPhone and iPad

On iOS, Yali keeps a copy of your child’s profile and learning record in your own iCloud (section 5). Apple stores it in your account, and we cannot read it.

Firebase Hosting and Google Analytics: this website

Firebase Hosting serves yali.kids, and Google Analytics counts visits to it if you allow it (section 10).

5. What stays with you

Your child’s first name. You type it when you set up a profile, and it is never transmitted to us — not in events, not to any speech or voice service, not anywhere. Yali can say many common first names because a bank of recorded names is built into the app, not because your child’s name was ever uploaded.

Your child’s learning record. What your child has and has not learned — which letters are solid, which sounds get confused — is worked out and kept on the phone, and the parent area reads it from there. The record itself is never uploaded. What we do hold is the events in section 1, which carry the profile index and Firebase’s installation index, so they are grouped by child but not tied to a person. We use them only for totals across all children (section 3).

Backups

If you have Android Auto Backup or iCloud backup switched on, your phone may include Yali’s data in its normal backups. Those backups go to your own Google or Apple account, under Google’s or Apple’s terms, and we have no access to them. This is how progress survives a new phone, and it is not a transmission of data to us. You can turn backup off in your device’s settings.

Our two indices are part of Yali’s data. If you restore a phone from a backup, both come back with your child’s progress. If you reinstall Yali on an iPhone and it restores from its iCloud copy, the household index comes back and the profiles are numbered again as they return. Whether Firebase’s own index survives a restore is up to Firebase and the phone, not to Yali.

The iCloud copy on iPhone and iPad

On iOS, your child’s profile — including their first name — and their learning record are written to your own iCloud, in a private area that belongs to the Yali app (Apple calls it CloudKit).

We do not operate any part of it. No Yali server is involved, we hold no keys or credentials, and we cannot read it.
It uses your own iCloud storage, like anything else kept there.
It is there to protect your child’s progress. Deleting an iOS app deletes everything inside it, and iOS offers no way to restore a single app from an iCloud backup. Without this copy, deleting Yali to free up space would erase your child’s whole record.

If you are not signed in to iCloud, or have turned iCloud off for Yali, there is no copy, and deleting the app deletes the record. On Android, Auto Backup does the same job, in your own Google account.

The monthly picture

The parent area can make a picture of what your child finished this month. If you share it, it goes through your phone’s own share sheet to wherever you choose, and we never receive it. It shows your child’s first name only if you switch that on; it is off until you do. The app records that the picture was opened, or that the share sheet was opened — never where it went.

Notifications

If you allow them, Yali can show two kinds of notification: one when your child has finished the free part, and one offering the month’s picture. The app writes and shows both on the phone itself; there is no push service, and no server sends them. They can include your child’s first name, so their words never leave the phone: the app records only which kind was shown.

6. Children’s privacy

We collect no personal details from anyone, and so none from a child: no name, no email address, no phone number, no voice, nothing that identifies a person — not through the app and not through this website.
The exception is the indices in section 1, which children’s privacy rules such as the US COPPA treat as personal information because they persist, and the approximate location Google works out from the internet address. We collect them only to operate, maintain and improve the app — the purpose those rules make an exception for.
We use Google’s analytics service, which is a third party. Apple’s rules for the Kids Category allow third-party analytics only in limited cases. We configure it as narrowly as it allows (section 4), and you should know that using it is a judgement we made.
There is no behavioral advertising, no profiling, and no tracking.
No social features: no chat, no content from other users, and no way for a child to contact anyone.
Everything for adults is behind a parent gate — settings, the parent area, and anything that costs money. A parent gate keeps young children out; it is not a form of parental consent.

7. How long we keep it, and deletion

What the app sends is kept for fourteen months at most, and then deleted. Fourteen months is the shortest period Google Analytics offers that still lets us compare one school year with the next. Crash and error reports are kept for a shorter period.

Deleting the app stops the collection: nothing further is sent, and what was already sent is deleted when its fourteen months are up. If there is no backup to restore from, the indices are gone with the app, and nothing connects earlier data to a new installation.

Your phone’s backups and the iCloud copy are in your own Google or Apple account, and are yours to keep or delete there.

8. Your rights

Depending on where you live — under the EU’s GDPR, for example — you may have the right to access, correct, delete, object to, restrict, or receive a copy of personal information held about you, and to complain to your data protection authority.

We hold nothing that identifies you or your child — no name, no email address, no account — so there is nothing we could look you up by, and nothing to produce, correct or erase on request. What we hold is the events in section 1, carrying indices that mean nothing outside the app and that we cannot connect to you.

If you write to us, we keep your email and what you wrote for as long as it takes to answer you, and we will delete it if you ask. Write to privacy@yali.kids; there is no charge, and we reply within 30 days.

9. Security, and where data is processed

The site is served over an encrypted connection (HTTPS), and what the app sends is sent over one. The strongest protection, though, is what we never collect: no name, no email address, no account, no voice, no photos and no contacts. Data we never collected cannot leak.

What the app sends is processed by Google under its data processing terms for Firebase. Google may process and store it anywhere it or its agents keep facilities, including the United States, so it may be processed outside your country. Your backups and the iCloud copy are kept wherever Google and Apple keep your account’s data, on their terms.

10. This website

Every page on yali.kids is static, and the site is written for parents. There are no forms and nothing to sign up for.

Analytics, only if you allow it. On your first visit, the site asks whether it may use Google Analytics to count visits. Until you choose Allow, nothing from Google loads and no analytics cookie is set. If you allow it, Google Analytics records which pages you view, how you arrived (from a search or a shared link, for example), how far you scroll and which links you follow, the kind of device and browser you use, and roughly where you are — a country and region, worked out from your internet address.

It sets two cookies, _ga and _ga_X5ZPH3RZBG, which last 13 months. The _ga cookie holds a random identifier that lets Google Analytics tell one browser’s visits from another’s; it is not your name and is not linked to any account. What it records is kept for fourteen months at most, on the same settings as the app’s analytics (section 4): no Google Signals, no ad personalization, and nothing shared with Google for its own purposes.

You can change your mind at any time with Cookie settings at the bottom of every page. Saying no stops Google Analytics and deletes its cookies. The site remembers your answer in your browser’s storage, so it does not ask on every visit; that record holds only the answer.

Our hosting provider, Firebase Hosting, keeps ordinary server request logs, as any web server must in order to serve a page. We do not use them to identify anyone.

11. Changes, and contact

If we change what we collect or how we use it, we will update this page and the date at the top, and our declarations on the App Store and Google Play with it.

Yali is published by Yitzchaki. Write to privacy@yali.kids with any privacy question, or to tell us something here is wrong. Writing to us never signs you up for anything: we will answer what you asked, and if we ever want to send news about Yali, we will ask you separately.