This Privacy Policy explains what data Mova collects, why, and how a parent can control or delete it. It applies to the Mova iOS app, the website and the parent cabinet.
1. Who we are
Mova is operated by FOP Shkabko R.A. (sole proprietor, Ukraine). For anything about this policy or your data write to [email protected].
2. What Mova is
Mova is a service for families: a child passes a short daily English lesson and earns screen-time minutes; the app on the child's iPhone limits chosen categories of apps and unlocks them for the earned time. A parent creates the account, sets up the child's profile, decides how many minutes each test is worth and connects the child's phone. A child never registers on their own.
3. Data about the parent
To create and run the parent account we store:
- email address and name;
- a password hash, or the identifier your Google account returns when you sign in with Google (we receive your email and name from Google and nothing else);
- the time and IP address of your sign-ins, to protect the account;
- the settings you choose in the cabinet (rewards, minute carry-over, notifications).
4. Data about the child
A child's profile is created by the parent and contains only what the parent enters: a first name (a nickname is fine) and the year of birth, which sets the starting level. We do not ask a child for an email address, phone number, photo, location or any other personal data. A child signs in to the app with a one-time code the parent shows on the screen.
While the child studies, the service records the learning progress itself: which lessons and words were shown, the answers given, scores, the vocabulary boxes of the spaced-repetition method, the level and the earned minutes. This is the data the parent sees in the cabinet as "knows N words, learning M" and the results of the week.
A voice answer is turned into text by the speech recognition built into iOS. We receive only the recognised text, never the recording. Speech recognition may be processed by Apple under Apple's own privacy policy.
5. Data from the child's device
For every connected phone we store the device name and platform, a push-notification token, the time of the last request, and the screen-time sessions: when a session started, when it ended and how many seconds it used. That is all we need to keep one minute balance across all of the child's devices.
6. Screen Time data stays on the phone
To limit apps, Mova uses Apple's Screen Time technology (Family Controls, Managed Settings and Device Activity). The choice of app categories, the list of apps on the phone and how much each app is used never leave the device: this data is processed by iOS on the phone itself and is not sent to our servers or to anyone else. We use Screen Time only to lock and unlock the chosen categories for the earned time. We do not use it for advertising, analytics or any other purpose and do not share it with third parties.
7. What we do not do
- no advertising in the app or on the website;
- no third-party analytics or tracking SDKs in the app;
- we do not sell, rent or trade data and do not build profiles for marketing;
- no marketing notifications to the child: push notifications are only about learning (a word to repeat, minutes waiting) and are switched on by the parent;
- no chat, comments, public profiles or any way for a child to contact strangers or be contacted by them.
8. Why we use the data
We use the data listed above to provide the service the parent asked for: to run the account and the child's profile, to build the lesson of the day, to grade answers, to count minutes, to show progress in the cabinet, to send the notifications the parent enabled and to keep the service secure. The legal basis is the agreement with the parent and, for notifications, the parent's consent, which can be withdrawn in the cabinet at any time.
9. Who else processes the data
We share data only with providers that are needed to run the service, only as much as they need, and under agreements that protect it at least as well as this policy does:
- Apple — delivers push notifications (Apple Push Notification service) and distributes the app through the App Store;
- Google — only if the parent chooses to sign in with Google;
- Google Analytics — visit statistics for the public pages of the website (see section 13); not used in the cabinet or the app;
- hosting and content delivery providers — our servers, database backups and the network that serves lesson audio and images. The lesson files themselves contain no personal data.
We may also disclose data when the law requires it.
10. How long we keep the data and how to delete it
- A child's profile and everything recorded about it is deleted by the parent in the cabinet ("Delete child"). Deletion is immediate and cannot be undone.
- A connected phone is removed in the cabinet ("Unlink"); its token and push token are revoked at once. Phones that have not connected for a long time are removed automatically.
- To delete the parent account with all children and all data, write to [email protected] from the account's email address. We delete the account within 30 days and confirm by email.
- One-time link codes live for 15 minutes. Sign-in logs are kept for a limited time and then removed automatically.
- Backups are overwritten on a rolling basis, so deleted data disappears from them within a short period after deletion.
11. Parents' rights
A parent can at any time see all data about themselves and their child (most of it directly in the cabinet), correct it, ask for a copy, restrict or object to processing, withdraw consent to notifications, and delete the child's profile or the whole account. To exercise any of these rights write to [email protected]; we answer within 30 days. If you think we handle data unlawfully, you may also complain to your data-protection authority.
12. Security
Data travels over encrypted connections (HTTPS). Passwords are stored only as hashes. The child's phone authenticates with a token that is valid only for the child's own data and only for the app's own methods. Access to the servers is limited to the people who run the service.
13. Cookies on the website
The website and the parent cabinet use the cookies needed to keep you signed in, protect forms and remember the interface language.
The public pages of the website (not the cabinet and not the app) also use Google Analytics: its cookies (_ga) count visits and page views so we can see which pages are useful. Google receives the IP address, browser details and the pages viewed. We do not link this data to a parent's or child's account and do not use it for advertising. You can opt out by deleting cookies in your browser or by installing the Google Analytics Opt-out add-on. There are no advertising cookies.
14. Children's privacy in short
Mova is made for children of school age and is used under a parent's supervision. We collect from a child only the name and year of birth the parent entered and the learning progress, never any contact details, and we never share this data for advertising or any purpose other than the lesson and the minutes. The parent can see and delete all of it at any time.
15. Changes to this policy
When we change this policy we update the date at the top and, if the change matters for you, tell parents by email or in the cabinet before it takes effect.
16. Contact
FOP Shkabko R.A.
[email protected]
This policy is published in Ukrainian, English and Russian. If the versions differ, the Ukrainian version prevails.