Privacy Policy

1. Introduction

Softroni LLC ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our websites, mobile applications, and services (collectively, the "Services").

This policy covers all current and future Softroni applications. It is organized by data category so you can quickly understand what applies to the apps you use.

2. Offline-First Design

Our applications are designed to work offline whenever possible. Most core functionality operates entirely on your device with no internet connection required. Data is transmitted to external servers only when strictly necessary — for example, subscription verification via Apple, optional crash reporting, or features that explicitly require cloud processing (such as AI-generated content).

We minimize data collection by default. If an app does not need your data to function, we do not collect it.

3. General Data

Across all Softroni applications, we may collect the following:

• On-device preferences: Settings, session history, and user progress are stored locally on your device and are never transmitted to our servers.
• Random per-install identifier: Our apps identify an installation using a random identifier (a UUID) generated the first time you open the app and stored on your device. It is not your name, email address, Apple ID, advertising identifier, or any hardware identifier. If you delete the app and reinstall it, a new identifier is created and the old one cannot be linked to it. In GeoBlitz this identifier is the only way analytics and subscription events are grouped together. Paper Coach instead gives each learner profile on the device its own random identifier (a UUID), used only as described under Product analytics below and in Section 5; Superwall, which serves Paper Coach's paywall to learners 13 and over, keeps a random identifier of its own for the installation.
• Purchases and subscriptions: In-app purchases and subscriptions are processed by Apple. We do not receive or store your payment details (credit card, billing address, etc.) — these remain with Apple. Some apps use RevenueCat as a subscription management service to validate receipts, sync subscription status across devices, and manage entitlements; RevenueCat receives an anonymous app-generated user identifier and the purchase receipt from Apple. GeoBlitz, Paper Coach and Stretch Cat do not use RevenueCat. GeoBlitz instead uses Superwall for subscription and paywall infrastructure. Superwall receives GeoBlitz's random per-install identifier, your subscription status, purchase events, and the same app-usage attributes described under Product analytics below, which it uses to decide which paywall to show (audience targeting). Paper Coach handles purchases itself through Apple's StoreKit and uses Superwall only to show its paywall, and only to learners 13 and over (see Section 5). Paper Coach never tells Superwall who anyone is: it gives Superwall no identifier, name, age, or other attributes, only whether the installation has Premium. Superwall's install-attribution matching is turned off in Paper Coach. What Superwall does collect in Paper Coach is purchases made from its paywalls, paywall views and taps, the device's vendor identifier (IDFV), and an approximate location (country, region, and city) derived from the IP address; none of it is linked to a person or used for tracking. Stretch Cat uses Superwall to show its paywall and to make purchases through Apple's StoreKit. Stretch Cat never tells Superwall who you are: it gives Superwall no identifier, name, or attributes of its own. What Superwall collects in Stretch Cat is the moments where the app may show a paywall (such as tapping a Premium routine, with that routine's name, and finishing onboarding, with the trainer and focus you picked), paywall views and taps, purchases made from its paywalls, your subscription status, its own random identifier for the installation, the device's vendor identifier (IDFV), and an approximate location (country, region, and city) derived from the IP address; none of it is linked to a person or used for tracking, and Superwall's install attribution is turned off in Stretch Cat.
• iCloud sync and Friends in Stretch Cat: Stretch Cat keeps your breaks, goal, cat, collection, and settings on your device. If iCloud sync is on (it can be turned off in the app's Settings), the app copies them to iCloud key-value storage in your own iCloud account, so your other devices can merge them in; we cannot see that data. Friends is optional and off until you turn it on. When you start sharing, the app publishes a small profile to the app's public CloudKit database at Apple: the nickname you type, your cat's name, today's minutes, your daily goal, your streak, your last 60 days of meeting your goal, and when it was last updated, saved under a random six-character friend code. Anyone you give the code to can see that profile in the app; the app offers no way to search for or browse profiles, and there is no messaging. Apple's CloudKit records which iCloud account created the profile using an identifier made for this app alone, never your Apple ID or email address. We can see the profiles in Apple's CloudKit console but do not use them for anything else. Turning sharing off ("Stop sharing my progress") deletes the profile.
• Crash reports: Anonymous crash logs may be collected via Apple's built-in crash reporting to help us diagnose and fix bugs. These contain no personally identifiable information. Paper Coach also sends the crash and hang reports Apple's MetricKit framework gives the app to PostHog, each under a random identifier made for that report alone and linked to no learner.
• Product analytics: Some apps use PostHog to understand feature usage and improve the app. Depending on the app, events may include feature interactions, progress or funnel events, and purchase-related analytics such as the selected product or plan, displayed price and currency, purchase outcome, and a StoreKit transaction identifier. Events are associated with a randomly generated, app-specific identifier — not your name, email, or Apple ID. We do not send payment-card details or billing addresses. IP addresses are used only to infer an approximate geographic region (e.g., country or city) and are not stored long-term. We do not use PostHog for advertising or cross-app profiling. GeoBlitz uses PostHog's US cloud (us.i.posthog.com) and sends feature-usage events, onboarding progress, paywall and purchase events, and a small set of attributes about the installation: level, XP, streak, subscription status, free-tier cohort, chosen daily goal, and the skill level and motivation you select during onboarding. GeoBlitz's own game data — your progress, statistics, and settings — stays on your device and is never transmitted. Paper Coach also uses PostHog's US cloud, but without PostHog's SDK: the app sends only its own named events — which lessons are opened, finished, left, kept in the sketchbook, or wished for (by lesson identifier, never a name or a photo), onboarding and paywall steps (including whether the app is being set up by the learner or for their child), purchase outcomes, when a drawing is shared and the kind of app it was shared to (never to whom), which of the app's own notifications was tapped, and an event each time the app is opened that records four settings switches (narration, the practice reminder, saving drawings to Photos, and the evening note for grown-ups) — along with the learner's age band and the app's version. From version 2.1, a purchase event also says how many whole days ago the app was installed on the device (a number such as "12", never a date), and whether that number is an estimate for an install made before version 2.1, when the day of its earliest drawing stands in for it; the install day itself stays on the device. From version 1.2, every event also carries the Region chosen in the device's Settings (such as "US"), which is a setting you pick and not a location worked out from your connection, and the kind of device (iPhone, iPad, or Mac), never its model or any hardware identifier. It does not capture taps or screens automatically and makes no screen recordings. From October 9, 2026, for learners 13 and over only, PostHog works out an approximate location for each Paper Coach event from the IP address it arrives from: the country, the state, province, or similar region, and the city. It keeps nothing finer, such as a postal code or coordinates, and the Paper Coach PostHog project discards the IP address itself, so it is never stored. For every other learner, every crash and hang report, and every event sent before a learner gives their age, Paper Coach tells PostHog not to derive a location. For learners 13 and over, events carry the profile's random identifier and are linked to that profile's PostHog record; for learners under 13, or who do not give an age, no lasting identifier is used (see Section 5).
• Our websites: softroni.com and papercoach.app (Paper Coach's website) set no cookies and run no advertising scripts. Two things on them send PostHog anonymous counts. The short links in our social media profiles and posts (such as softroni.com/t/papercoach) count the tap before forwarding you to the App Store: one event saying which link was tapped, its social platform and, for a link in a post, which post or video. From October 27, 2026, papercoach.app counts each page viewed, and each tap on its App Store links, on a printable drawing sheet, or on a button that plays Lina's voice: one event saying which page (and, for a tap, which App Store link or which sheet). Every one of these events also says whether it opened inside a social app's built-in browser (and which app), whether the device runs iOS, Android, macOS, Windows or something else (papercoach.app; the short links say iOS, Android or other), the domain of the page you came from (never its full address), your browser's language setting (such as en-US), and whether the visit looks automated. No identifier is kept: the pages store nothing on your device, every event gets a random identifier that is never reused, so one page or tap cannot be linked to another, PostHog is told not to work out a location or keep a profile, and the PostHog project discards IP addresses. We use these counts only to learn which of our social media posts, pages and guides bring people to our apps.
• Support communications: If you contact us for support, we retain the information you provide for as long as necessary to resolve your request.

Most of our applications do not require an account, login, or any personal information to use. GeoBlitz is a native iOS app with no accounts, no login, and no backend of our own. Paper Coach has no accounts, no login, and no backend of our own either: its lessons, progress, learner profiles, and sketchbook photos stay on the device. It uses the camera only when you choose to photograph a finished drawing, and it saves that photo to your photo library only while "Also save to Photos" is on; it never reads your photo library. Nothing a learner types, such as a name, ever leaves the device. Stretch Cat has no accounts, no login, and no backend of our own either: apart from what you choose to share with friends and what iCloud sync keeps in your own iCloud account, everything stays on the device.

4. Health & Fitness Data

Some Softroni applications may collect health and fitness data to provide their core functionality. When applicable:

• Motion and sensor data: Data from device sensors, AirPods motion sensors, or Apple Watch may be used for real-time analysis (e.g., posture detection, activity tracking). All processing is performed on-device. Raw sensor data is not stored beyond the active session.
• Camera-based analysis: When camera-based features are enabled, video frames are processed on-device in real time. Frames are never recorded, stored, or transmitted to any server.
• Apple Health (HealthKit): If you grant permission, our apps may read from or write to Apple Health. This data stays within the Apple Health ecosystem and is governed by Apple's privacy policies. We never access HealthKit data without your explicit consent, and we never send HealthKit data to our servers or any third party.

Health and fitness features always require your explicit permission before accessing any sensor, camera, or HealthKit data. You can revoke these permissions at any time in your device's Settings.

Stretch Cat. If you allow it, Stretch Cat saves your breaks and guided routines to Apple Health as workouts. It reads no health data. If you allow Motion & Fitness, it reads your step count on the device to skip a reminder when you have just been walking and to let your cat's energy follow how much you move; step counts are not stored and never leave the device. Its reminders are local notifications scheduled on the device. Your minutes, goal, and streak leave the device only as described under "iCloud sync and Friends in Stretch Cat" in Section 3.

5. Children's Data (COPPA Compliance)

Certain Softroni applications may be designed for use by children under the supervision of a parent or guardian. For any such app that collects data from or about children under 13, we comply with the Children's Online Privacy Protection Act (COPPA) and take the following measures:

• Parental consent required: A parent or guardian must set up the app and consent to the collection of any child-related data before a child can use it.
• Minimal data collection: We collect only the minimum information necessary for the app to function — such as a child's first name or age range for content personalization. We do not collect email addresses, photos, precise location, or any other personal information from children.
• No advertising to children: Apps designed for children contain no advertisements of any kind. We do not serve ads, display sponsored content, or use any ad tracking in apps intended for children.
• No behavioral tracking: We do not track, profile, or build behavioral models of children. No child data is shared with third parties for any purpose.
• Parental controls: Parents can review, modify, or delete all child-related data directly within the app at any time. Parents may also request complete deletion of any data by contacting us through our Support page.
• Data deletion: All child-related data can be deleted by the parent through the app's settings. If cloud processing was used, server-side data is automatically deleted within 24 hours of processing.

Paper Coach. Paper Coach is a drawing app for all ages rather than an app designed for children, and it is not in the App Store's Kids category. Families use it together, though, so it asks for each learner's age band (during onboarding, or later in the learner's profile settings) and limits what it collects about children. A learner who is under 13, or who chooses "Prefer not to say" or never gives an age, is treated as a child:

• No lasting identifier: A child's usage events (the named events described under Product analytics in Section 3) are sent to PostHog under a random identifier that lasts only until the app is closed, and PostHog is told to keep no person profile for it. A child's activity cannot be followed from one launch of the app to the next or linked to a profile, and nothing a child types and no photo ever leaves the device. From version 2.1 a purchase event also carries how many days ago the app was installed, a number and never a date, so we can tell when families buy without following a child from one day to the next.
• No location: A child's events tell PostHog not to derive a location, and the Paper Coach PostHog project discards IP addresses. (The approximate location described in Section 3 is for learners 13 and over only.) Like every Paper Coach event from version 1.2, a child's events carry the Region chosen in the device's Settings (such as "US"), a country-level setting, never a place.
• No Superwall: Superwall never shows a child its paywall, and it does not start at all on a launch where only children draw. If a learner 13 or over already started it earlier in the same launch, it sends no events while a child draws, though it may still refresh its paywall configuration, which carries Superwall's random identifier for the installation and the device's vendor identifier.
• Purchases behind a parental check: A child who taps a Premium lesson is offered a wish list and a free lesson instead. Prices appear only behind a "For grown-ups" link and a parental check: a sum written in words, or a PIN a parent has set. There is no offer during a child's setup (since version 1.4), and from version 2.1 none at the end of the first lesson either: while free lessons are left, the app only ever suggests free ones. The PIN is stored only as a salted hash on the device.
• Evening note for grown-ups: From version 1.2, the grown-up who sets the app up for a child can choose to get a notification at 7 PM on days the child draws, naming what the child drew and any lessons they wished for, with a photo of the drawing as its picture. From version 2.1, once on each device, after a week or ten drawings, the note names the drawings made so far instead, and the page it opens shows them. The note is written and scheduled on the device, and nothing in it is sent anywhere. It never names a price. It can be turned off at any time in the app's Settings.
• No advertising: Paper Coach shows no advertisements to anyone. The Apple Ads attribution described in Section 9 describes the ad that led to the app being installed, not the learner; for a child it is sent only with the install, app-open, onboarding, and purchase events, under the per-launch identifier, and is never stored on a profile.

Learners 13 and over use Paper Coach normally: their events carry their profile's random identifier, and Superwall may show them its paywall.

6. Audio & Voice Data

Some Softroni applications may process audio or voice data. When applicable:

• Voice recordings: If an app offers voice-based features (such as voice cloning or voice input), recordings are initiated and controlled by the user (or parent, in the case of children's apps). Voice data is stored on-device by default.
• Cloud voice processing: If cloud processing is required to create a voice model, recordings are encrypted in transit, processed on our secure servers, and deleted within 24 hours. We do not retain voice data beyond what is necessary for processing.
• Audio preferences: Sound settings, playback preferences, and audio library selections are stored on-device only and are never transmitted to our servers.
• Children's voice protections: In apps designed for children, only a parent's voice is recorded (if the feature exists). A child's voice is never recorded or processed.

7. AI-Powered Features

Some Softroni applications may use artificial intelligence to generate or personalize content. When applicable:

• Content generation: Minimal input data (such as a name or preference) may be sent to our AI processing service to generate personalized content. These inputs are encrypted in transit and are not stored after content generation is complete.
• On-device AI: Where possible, AI processing is performed entirely on your device using on-device models, with no data sent to external servers.
• No training on your data: We do not use your personal data, voice recordings, or content preferences to train AI models.

8. No Third-Party Advertising or Tracking

Our apps do not display third-party advertisements, include third-party advertising SDKs, access Apple's advertising identifier (IDFA), or request App Tracking Transparency permission. We do not share app data with advertising networks, engage in cross-app tracking or retargeting, sell personal data, or participate in data brokerage programs.

This is about what happens inside our apps. We do promote some of our apps with ads on Apple's App Store, and Apple provides us with first-party measurement of how those ads perform. That measurement is described in Section 9. It does not put advertising into our apps, does not use the IDFA, and does not involve tracking you across other companies' apps or websites — every commitment above still holds.

9. Advertising and Attribution

GeoBlitz and Paper Coach display no advertisements of any kind inside the apps. We do buy Apple Ads (formerly Apple Search Ads) to promote them on the App Store, and we measure how those ads perform using Apple's own first-party attribution.

How it works in GeoBlitz: if you install GeoBlitz after tapping one of our App Store ads, the Superwall SDK requests Apple's AdServices attribution token and Superwall resolves it on its servers. The resolved data tells us the campaign, ad group, and keyword that led to the install, along with related identifiers, the country or region, and the conversion type. We copy that information into PostHog, linked to the app's random per-install identifier, and use it only to measure how our own App Store advertising performs.

How it works in Paper Coach: Paper Coach does not use Superwall for this. Once per install, the app itself asks Apple's AdServices framework for an attribution token and sends it directly to Apple's attribution service, which answers whether an Apple Ads campaign led to the install and, if so, with the campaign, ad group, keyword, and ad identifiers, the country or region, and the conversion and claim type. Once Apple has answered, the app keeps the answer on the device and does not ask again (if Apple cannot be reached, it tries again on a later launch, up to five launches in all). The app sends the answer to PostHog once as an install event and again with the events for app opens, finishing onboarding, starting a trial, and purchases. For a learner 13 or over, it is also stored on that learner's PostHog record, linked to the profile's random identifier; for a learner under 13, or who does not give an age, it never is (see Section 5). We use it only to measure how our own App Store advertising performs.

What it is not: this is Apple's first-party attribution. It does not use Apple's advertising identifier (IDFA) and does not require or trigger the App Tracking Transparency prompt — neither GeoBlitz nor Paper Coach includes App Tracking Transparency, and neither will ever show you that prompt. The attribution data is never combined with data collected from other companies' apps or websites, and is never shared with advertising networks or data brokers.

Stretch Cat shows no advertisements and does not use Apple Ads attribution: it never asks for an attribution token, and Superwall's install attribution is turned off for it.

GeoBlitz and Paper Coach do not include the TikTok Business SDK and send no data to TikTok. If we introduce any other advertising or attribution integration in the future, we will update this policy and the applicable app's privacy disclosures before collecting or sharing data.

10. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our applications and services.
• Process subscriptions and in-app purchases via Apple.
• Generate personalized content when you use AI-powered features.
• Diagnose and fix crashes and technical issues.
• Respond to your support requests.
• Measure how our own App Store advertising performs, using Apple's first-party attribution (see Section 9).
• Count taps on the short links in our social media profiles and posts, and the pages viewed on papercoach.app, to learn which profiles, posts, pages and guides bring people to our apps (see Section 3, "Our websites").

We do not use your data for targeted advertising, behavioral profiling, or any purpose unrelated to the app's core functionality.

11. Data Sharing

We do not sell your personal information. We may share limited data only in these circumstances:

• Apple: Subscription and purchase verification is handled by Apple's App Store infrastructure.
• RevenueCat (subscription management): For apps that offer subscriptions, purchase receipts and an anonymous user identifier are sent to RevenueCat to verify purchases and manage subscription entitlements. See RevenueCat's privacy policy.
• PostHog (product analytics): Product-usage and purchase-related analytics tied to a random app-generated identifier may be sent to PostHog to help us understand how an app is used and improve it. These events may include product or plan identifiers, displayed price and currency, purchase outcome, and a StoreKit transaction identifier, but not payment-card details, billing addresses, names, email addresses, or Apple IDs. IP addresses are used only to infer an approximate geographic region and are not stored long-term. PostHog also receives the anonymous counts from our websites' short links and from papercoach.app's pages (Section 3, "Our websites"). See PostHog's privacy policy.
• Superwall (subscriptions and paywalls): For apps that use Superwall for subscriptions — including GeoBlitz — the app's random per-install identifier, subscription status, purchase events, and app-usage attributes are sent to Superwall so it can manage subscriptions and decide which paywall to show. Paper Coach uses Superwall only to show its paywall: there, Superwall runs only for learners 13 and over and is told only whether the installation has Premium; it collects purchases made from its paywalls, paywall views and taps, the device's vendor identifier, and an approximate location derived from the IP address, none of it linked to a person. Stretch Cat also uses Superwall to show its paywall and handle purchases; it tells Superwall nothing about who you are, and Superwall collects the paywall moments, views, taps, purchases, subscription status, identifiers, and approximate location described in Section 3. See Sections 3 and 5.
• Apple iCloud and CloudKit (Stretch Cat): If iCloud sync is on, Stretch Cat's data is kept in your own iCloud account. If you turn on Friends, your friend profile is stored in the app's public CloudKit database at Apple, where anyone with your friend code can see it in the app, until you turn sharing off. See Section 3.
• Apple Ads attribution: For GeoBlitz, Apple's first-party App Store ad attribution data (campaign, ad group, keyword, related identifiers, country or region, and conversion type) is resolved by Superwall and copied into PostHog, linked to the random per-install identifier. For Paper Coach, the app requests the same kind of data (campaign, ad group, keyword, and ad identifiers, country or region, and conversion and claim type) directly from Apple's AdServices attribution service and sends it to PostHog, linked to a learner's random profile identifier only for learners 13 and over. It is used only to measure our own App Store advertising and is never shared with advertising networks or data brokers. See Section 9.
• Approximate location: GeoBlitz and Paper Coach do not use CoreLocation and never ask for location permission. In GeoBlitz, PostHog and Superwall infer an approximate country or region from the IP address of network requests. In Paper Coach, from October 9, 2026, PostHog infers an approximate country, region, and city from the IP address of the app's events for learners 13 and over only, and none for anyone else; Superwall, also only for learners 13 and over, infers an approximate country, region, and city. From version 1.2, Paper Coach's own events carry the Region chosen in the device's Settings (such as "US"), a country you pick in Settings rather than one worked out from your connection. Stretch Cat does not use CoreLocation either; Superwall infers an approximate country, region, and city from the IP address. Stretch Cat works out sunrise and sunset for its room from the date and your device's time zone only. We do not collect precise location.
• Cloud processing: When cloud-based features are used (e.g., AI content generation, voice processing), minimal data is sent to our processing service, encrypted in transit, and deleted after processing.
• Crash reporting: Anonymous crash data may be collected via Apple's crash reporting framework.
• Legal requirements: We may disclose data if required by law, regulation, or legal process.

12. Data Retention

Most data in our apps is stored locally on your device and persists only as long as the app is installed. For data that passes through our servers:

• AI and voice processing data is deleted within 24 hours of processing.
• Crash reports are retained for up to 90 days to diagnose issues.
• Support communications are retained for as long as necessary to resolve your request.
• Stretch Cat friend profiles are kept until you turn sharing off in the app, which deletes them. If you delete the app without turning sharing off, reinstall it (with iCloud sync on, your friend code comes back) and turn sharing off, or send us your friend code through our Support page and we will delete the profile.

When data is no longer needed, we securely delete or anonymize it.

13. Data Security

We implement industry-standard security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. This includes encryption in transit (TLS) and at rest, regular security assessments, and access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

14. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access, correct, or delete your personal information.
• Object to or restrict the processing of your data.
• Request portability of your data.
• Withdraw consent where processing is based on consent.

Because most of our apps store data only on your device, you can exercise these rights directly by managing or deleting the app. For any server-side data, please contact us through our Support page.

15. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

16. Changes to This Policy

We may update this Privacy Policy from time to time, including when we release new applications. We will notify you of any material changes by posting the updated policy on our website with a revised "Last Updated" date. Your continued use of our Services after changes are posted constitutes your acceptance of the updated policy.

17. Contact Us

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your rights regarding your personal data, please reach out through our Support page.