Privacy Policy
Last updated 25 September 2026
DRAFT — pending legal review. This text describes how Falah works today, but it has not been reviewed by a lawyer and contains placeholders in square brackets that must be completed before it is relied on.
Last updated: 25 Sep 2026.
1. Summary
Falah is used by families, which means we hold information about adults and about children. We collect the minimum the app needs, we do not sell it, we do not use it for advertising, and we do not build advertising profiles of children. This policy explains what we hold, why, and how you remove it.
The data controller is Falah family, 0469747002 , registered at Sydney, NSW. Contact accounts@falahfamily.com.au. [Our data protection officer / EU representative / UK representative is: ...].
2. What we collect
From the parent or guardian
Name, email address, country dialling code and phone number.
A password, stored only as a cryptographic hash — we never see or store the password itself. An optional app-lock PIN is stored the same way.
Account settings: currency, sound, notification and task-approval preferences.
An optional profile photo, if you add one.
About each child, entered by the parent
First name (or nickname) and age.
An optional avatar or photo, if the parent adds one.
In-app activity: task completions, simulated balances, allocation choices, practice investments, lesson progress, XP, streaks and badges earned.
We ask for a child's first name and age only. Please do not enter a surname, school, address or any other detail the app has not asked for.
Collected automatically
Basic technical data needed to run and secure the service: IP address, device and app version, and server logs of requests.
We do not use third-party advertising or tracking SDKs in the app.
3. Why we use it, and our legal basis
To provide the account and the app — performance of our contract with the parent.
To hold and display a child's profile and progress — the parent's consent, given when the profile is created, and withdrawable at any time.
To keep the service secure and working, including diagnosing faults and preventing abuse — our legitimate interests.
To send service messages such as approval requests and account notices — performance of our contract.
To meet legal obligations where they apply.
4. Children's privacy
Falah is designed to be used by a child under a parent's account and a parent's supervision. A child cannot register, and cannot make a profile public, message anyone, or share anything outside the family account. There is no user-to-user contact in the app.
The parent can see everything held about their child, correct it, or delete the profile — which deletes that child's data — from the app at any time.
[Confirm before launch which children's-privacy regimes apply and how consent is verified: COPPA (US), GDPR-K (EU), the UK Age Appropriate Design Code, and the Australian Privacy Principles each impose different requirements. See the open questions in the project brief.]
5. Who we share it with
We do not sell personal information and we do not share it for advertising. We share it only with:
Service providers who host and run the app on our behalf — [hosting provider], [database provider], [email provider] — under contracts that limit them to our instructions.
Professional advisers, or authorities where the law requires it.
A buyer or successor, if the business is transferred — in which case this policy continues to apply to the data transferred.
[List the actual sub-processors and their locations before publishing.]
6. Where it is held
Data is stored in [region]. Where information is transferred outside your region we rely on [transfer mechanism, e.g. Standard Contractual Clauses] to protect it.
7. How long we keep it
We keep account and child data for as long as the account is open. When you delete your account we remove it within [30] days, apart from anything we must retain for legal or accounting reasons, and backups which are overwritten on our normal cycle of [backup retention period].
8. Your rights
Depending on where you live you may have the right to access, correct, delete, restrict or object to our use of your information, to receive a copy in a portable format, and to withdraw consent. Exercise any of these by writing to accounts@falahfamily.com.au; we respond within [30] days.
If you are unhappy with our response you may complain to your local data protection authority [insert the relevant authority].
9. Security
Passwords and PINs are hashed, traffic is encrypted in transit, and access to production data is limited to staff who need it. No system is perfectly secure, but we will notify you and the relevant authority of a breach affecting your data where the law requires it.
10. Changes
We will post any update here and change the date above. If a change is significant we will tell you in the app or by email before it takes effect.
11. Contact
Falah family, registered at Sydney, NSW. Email accounts@falahfamily.com.au.