Your family’s privacy

On-device family data, parent-controlled transfers, Android access and your choices.

Who this service is for

Palitha Detox is provided under the Redorbe developer profile. Parents and legal guardians create and manage accounts and family routines. Children use parent-configured activities without separate child accounts, public profiles, chat or public content sharing. The adult-parent acknowledgement and parent password confirm an account choice; they do not verify someone’s age or legal parental responsibility.

Privacy contact: paalithadev@gmail.com. The app provides routine and activity tools. It does not diagnose or treat a medical condition.

Account information

Supabase Auth processes the parent’s name, email address, password and account identifier to provide sign-in, verification and recovery. Passwords go to the authentication service over HTTPS, rather than family records. Email confirmation and reset links use a verifier kept on the requesting device. Account information remains until the parent deletes the account, subject to provider security and recovery records. Never email us a password or parent PIN.

Family information stays on your device

Child profiles, age, optional name, gender and interests; routines and current-habit answers; custom tasks, rewards and activity progress are saved on the device. Task photos, parent recordings, the parent PIN and live session deadlines also stay there. Session records describe planned screen periods and child-reported activities, rather than measured use of other apps. The updated app does not upload these family records or automatically restore them through account sign-in. Android automatic app-data backup is disabled.

Parent-controlled device transfer

In build 29, Settings → Privacy & device transfer lets a parent confirm the device PIN and create a password-encrypted family file. Copy it to another Android device using a cable, local sharing or another method you choose, then import it with the backup password. The file includes profiles, routines, progress, task photos and recordings. It excludes account credentials, the parent PIN, purchase entitlements and running timers. The receiving device uses its own account and PIN and needs its own Android permissions. The copies do not sync afterward.

The app does not upload the transfer file to our server. Android’s file picker can offer cloud drives: choosing one sends your encrypted file to that provider under its terms. Anyone with both the file and password can open the family data. Keep the password separately, choose the recipient carefully and delete exported files when no longer needed. We cannot recover forgotten backup passwords. Import replaces the current family only after file/password validation and saving a temporary local recovery copy.

Earlier cloud family copies

Previous versions could upload family profiles, settings, custom task text and progress to Supabase in Sydney after the account’s backup choice. New uploads are now blocked, including from earlier versions. Existing copies remain available to their authenticated account for explicit recovery/removal, subject to the inactivity limit below. In build 29, recover a needed copy with your parent password, then separately confirm removal. This does not remove the device family or cancel Google Play renewal. Contact support from your parent account email if updated controls are not available. Previous acknowledgements and password checks did not verify parental identity.

Storage and retention

• Cloud family records and their current backup-choice record expire after 365 days without a successful family save before retirement or an authenticated privacy check. A daily server cleanup removes expired records. Existing cloud families receive a new inactivity period when these controls are introduced.
• Updated builds remove local conflict-recovery copies after 30 days, when the app next opens or creates a recovery copy. The main device family copy remains until you clear it, replace it through import or delete the account on that device. Parent-exported files remain in the chosen destination until you delete them.
• Account deletion removes the live Auth account, cloud family record, backup-choice record and associated access/trial records. Deletion inside the updated app also clears that account’s current-device cache and unshared local task media.
• Other devices can hold offline copies until cleared there. Uninstalling the app or clearing its storage can remove those copies. A deletion request cannot remotely erase an offline device.
• Supabase and Google may maintain infrastructure logs and recovery copies under their own terms. Live-record deletion does not establish immediate erasure from every provider recovery system. Contact us for requests concerning those copies.

Billing and minimal purchase-security records

The family monthly plan uses Google Play billing. The eligible seven-day parent trial ends automatically without a charge. A monthly purchase is a separate choice and renews until cancelled in Google Play. Older auto-renewing Google Play trial offers show their terms at checkout.

Purchase tokens are sent over HTTPS to our Supabase verifier, which checks Google Play’s subscription state and acknowledges confirmed purchases. A hash of the parent account ID binds new purchases to that account. Private billing records contain the token, token hash, owner account ID, subscription state, expiry and verification time. Raw tokens for transactions known to be expired, cancelled while pending, or unavailable are removed after 365 days using the daily cleanup.

When an account is deleted, the service removes its billing account ID, raw purchase token, original subscription state and expiry. An account-unlinked token hash, deletion marker and verification/deletion timestamps remain solely to block reuse of that token by another account. The marker does not grant access and is retained while needed to prevent token replay. Google maintains its own transaction records.

Deleting an account or uninstalling the app does not cancel Google Play billing. Cancel renewal in Google Play before deleting your account. We do not receive full payment-card details.

Android access and narration

Sessions require timer notifications, display-over-other-apps access and connected Accessibility access. Parents grant each setting in Android Settings and can revoke it there. Battery changes are optional if reminders are late. Device, Android and manufacturer restrictions affect reliability.

During a parent-started break, Accessibility receives app-window changes and checks app identifiers to return to Pip. With the separate in-app agreement, it also uses Android window-content access to find floating-player controls and try to dismiss picture-in-picture videos, including over Pip. This service does not inspect screen text or images, record screens, or upload window data. Calls, permission screens and Android Settings remain accessible.

Microphone and camera access are requested when a parent chooses to record an instruction or take a task photo. Photo selection uses the installed image picker. Built-in English narration and parent recordings play locally. Build 29 uses custom-task speech only with an installed Android voice marked as not requiring a network connection; there is no online fallback. This relies on the installed engine honoring its offline-voice contract. Earlier builds can pass task text to their configured device speech engine, whose network settings determine remote processing; use a parent recording to avoid that path until updating. No SMS, contacts, location or call-log permission is requested.

Providers and international processing

Supabase provides authentication, database and function infrastructure, with earlier cloud family records hosted in Sydney, Australia. New child-family uploads are blocked. Google provides subscription processing. Your Android device, speech engine and email provider operate under their own terms. Family and account requests use HTTPS. This app has no advertising or analytics SDKs and does not sell family data. Provider contracts, recovery systems and any safeguards needed for international transfers require separate assessment for the markets where the app is offered.

Your controls and requests

Build 29 offers encrypted file export/import and password-confirmed recovery/removal of earlier cloud copies in Settings → Privacy & device transfer. You can review family profiles, tasks and progress locally. For a readable account-data export or records not included in the family transfer file, contact support from your parent email; do not send us your encrypted family file or its password.

Parents can also correct profile information, revoke Android access, manage Google Play renewal, or delete the account. For access to other account/billing records, correction, deletion, withdrawal or other privacy-rights requests, email us from the parent account address. We verify ownership before releasing or removing information. See the deletion instructions.

Website tools

The screen-time survey and wellbeing check-in calculate their responses in your browser. They do not submit your answers to the app’s family database. Hosting providers still process ordinary web requests under their own policies. These tools do not provide a diagnosis.