1. Introduction
RoutineBuddies ("we", "us", "our") is a routine app for children aged 5–13, built on 40+ years of ADHD research. We take your family's privacy seriously — especially because our users include children.
This policy explains what data we collect, why, and how we protect it.
2. Data stored on your device
All routine data, profile information (nickname, avatar choice), points, levels, streaks and session history are stored locally on the device. This data never leaves the device unless you opt into iCloud backup (see below).
3. iCloud backup (optional)
If the device has iCloud enabled, RoutineBuddies can back up your child's profile, routines and session history to Apple's CloudKit private database. This data is:
- Tied to the device's iCloud account
- Stored in Apple's infrastructure, not ours
- Not accessible to us in any way
- Restorable when reinstalling the app or switching devices
You can delete iCloud data at any time from Settings → iCloud sync in the app.
4. Anonymous analytics (opt-in only)
We use PostHog (EU cloud, hosted in Frankfurt, Germany) for anonymous usage analytics. Analytics are:
- Completely opt-in — only enabled when a parent explicitly consents during onboarding or in Settings
- Protected by a parent gate (math problem) that prevents children from enabling or disabling it
- Never enabled automatically for children who set up the app themselves
- Fully anonymous — we never collect nicknames, routine names, task names, or any personally identifiable information
You can opt out at any time from Settings → Anonymous data in the app.
Exactly what anonymous data we collect (when opted in)
Every event below is anonymous. No names, no text content, no identifiers that can be traced to your child.
- Anonymous onboarding events — which step was completed, parent or child path (not names or text entered)
- Anonymous routine events — that a routine was created, edited, started or completed, with anonymous counts (e.g. "4 tasks, 2 pauses") — never the routine name or task names
- Anonymous task events — that a task was completed or skipped, whether time was added, whether the timer ran out — never the task name
- Anonymous progression events — level-up (e.g. "from level 3 to 4"), anonymous avatar purchase (e.g. "cost 10000"), anonymous bonus claimed
- Anonymous settings events — language changed, clock format changed, notification sound slot changed — never the actual values of names or content
- Anonymous consent events — that analytics was enabled or disabled
5. Data we do NOT collect
We do not collect personal information from children or parents. Specifically:
- No names, nicknames, or any text your child enters
- No routine names or task names
- No location data
- No photos, contacts or other device data
- No advertising identifiers
- No third-party tracking or advertising
- No data is sold, shared with advertisers, or used for profiling
6. Children's privacy (COPPA & GDPR-K)
RoutineBuddies is designed for use by children. We do not collect personal information from anyone — not children, not parents, not anyone. We comply with COPPA (Children's Online Privacy Protection Act) and GDPR requirements for children's data:
- We do not collect personal information from anyone — not even with parental consent
- The only data we can receive is anonymous, opt-in analytics (see section 4 above)
- Anonymous analytics require explicit parental consent via a parent gate
- There are no social features, chat, user-generated content, or friend lists
- There are no advertisements of any kind
- There are no in-app purchases — BuddyBux is a virtual currency earned through routines only
7. Subscriptions & payment
Subscriptions are handled entirely by Apple through the App Store. We use RevenueCat to manage subscription status. Neither we nor RevenueCat have access to your payment details — all payment processing is handled by Apple. No credit card numbers, bank details, or billing addresses are stored by us.
8. Third-party services
- Apple CloudKit — optional iCloud backup. Data stays in Apple's infrastructure under Apple's privacy policy.
- Apple StoreKit / RevenueCat — subscription management. Processes only purchase-related data through Apple's App Store. RevenueCat's privacy policy applies.
- PostHog (EU) — opt-in anonymous analytics only. Data is processed in the EU (Frankfurt). We have a Data Processing Agreement in place.
9. Data retention
- Local data — persists until the app is uninstalled or reset via Settings
- iCloud data — persists in your CloudKit account until you delete it via the app or iCloud settings
- Analytics data — retained for 12 months, then automatically deleted
- Subscription data — managed by Apple and RevenueCat according to their retention policies
10. Your rights & data control
We don't have your data. You do. All routines, profiles, points and session history live on your device and your family's private iCloud account. We have no server, no database, no way to access it. You are in full control.
Deleting your data
Go to Settings → iCloud Sync and tap "Parental data controls" at the bottom. After verifying you're a parent (math problem), you'll see two options:
- Step 1: Delete device data — permanently removes all routines, points, avatars and history from the device
- Step 2: Delete iCloud data — permanently removes all backed up data from your family's iCloud account
Each step requires a separate confirmation. To remove everything, complete both steps in order.
- Subscription — cancel at any time through your Apple ID settings
Anonymous analytics data (the only data we can see)
If you opted in to anonymous analytics, we hold anonymous usage events processed in the EU. Since the data is fully anonymous, it cannot be traced back to you or your child. You can:
- Opt out at any time via the parent-gated toggle in the app (Settings → Anonymous data) — this immediately stops all data collection
- Rest assured that anonymous analytics data is automatically deleted after 12 months
Because the data is anonymous by design, we cannot look up, retrieve, or connect it to any individual. This is intentional — it's the strongest form of privacy protection. These principles apply under GDPR (EU/EEA), COPPA (US, children under 13), and equivalent regulations worldwide.
Your rights under GDPR (EU/EEA)
We do not collect personal data, so most GDPR data rights (access, rectification, portability) do not apply — there is no personal data to access or correct. However:
- Right to withdraw consent — opt out of anonymous analytics at any time via the parent-gated toggle in the app
- Right to erasure — you own all your data. It lives on your device and in your family's private iCloud. You delete it yourself, whenever you want, via Parental data controls in the app
- Right to information — this privacy policy describes exactly what anonymous data we collect and how it is processed
- Data processor — PostHog (EU, Frankfurt) processes anonymous analytics under a Data Processing Agreement
Parents' rights under COPPA (US)
As a parent, you can review, delete, or refuse further collection of any data related to your child at any time. We do not collect personal information from anyone. The only data we can receive is anonymous, opt-in analytics — which requires parental consent via a parent gate to enable.
11. Contact
Questions about privacy? We're happy to help.
hello@routinebuddies.com