AskTime Privacy Policy

Our privacy promise (short version)

Last updated: November 2, 2026

AskTime helps parents set clear screen-time limits for their kids. Our promise is simple: healthy limits, no snooping. AskTime never reads your kid's messages, never sees their photos, never records the websites they visit, and never asks for their location. On iPhone and iPad, Apple's Screen Time system gives AskTime anonymous tokens instead of app names, so AskTime itself cannot tell which apps your kid uses. Your rules are stored as numbers and times, like "90 minutes a day" and "bedtime 9:30 PM to 7:00 AM".

This policy explains what we collect, why, who helps us run the service, how long we keep data, and the choices and rights you have.

1. Who we are and what this policy covers

AskTime is operated by Nguyen Hoang ("AskTime", "we", "us"), Nguyen Minh Van, Hoa Khanh, Da Nang 550000, Vietnam. You can reach us at privacy@asktime.app or +84 703 865 568.

There is one AskTime app with two modes:

• Parent mode, which a parent or legal guardian uses on their own phone to create a family, add children, set rules and answer requests for more time.
• Child mode, which runs on the child's iPhone, iPad or Android phone or tablet. It applies the rules that the parent sets, shows the child which rules apply, and lets the child ask for more time. The child does not have an AskTime account, email address or password.

This policy covers both modes and our servers. Our website (asktime.app) only describes AskTime and links to the app stores. It has no forms, cookies or analytics and collects no personal information.

AskTime is offered in the United States only. Both modes run on iPhone, iPad and Android phones and tablets. Where the two systems work differently, this policy says so.

2. Notice to parents about children's information (COPPA)

This section is our notice to parents under the Children's Online Privacy Protection Act (COPPA). It applies to every child who uses a device in AskTime Child mode. We apply the same protections to teens.

2.1 How AskTime works on a child's device

1. A parent signs in to Parent mode and gives consent as described in Section 2.6.
2. The parent sets a 6-digit Parent PIN.
3. On the child's device, the parent chooses "This is my kid's device". The child's device shows a QR code and a 6-digit code.
4. The parent scans the code with Parent mode (or types it in) and chooses which child the device belongs to. The child's device sends nothing to our servers about the child until this step is done, apart from the technical details needed to show the pairing code (see the table below).
5. The child's device shows the parent's display name ("Connected to Sarah's family") so the family can check that the right parent linked it. If it is wrong, the kid can undo a pairing made with a typed code for a short time.
6. On iPhone and iPad, the parent approves AskTime in Apple's Screen Time dialog on the child's device, using the parent's own Apple Account password. On Android, the parent turns on AskTime's Accessibility service (so AskTime can see which app is open and show the time's-up screen) and its device admin setting (so AskTime cannot be removed without the Parent PIN).
7. The parent picks the apps and categories to limit. On iPhone and iPad this uses Apple's app picker; on Android it is a list on the child's device, behind the Parent PIN. That choice stays on the child's device. Our servers only learn how many apps, categories and websites were chosen, never which ones.

2.2 What we collect from a child's device

Planned features that are not live yet, and that we will describe here before launch:

• A choice of reasons for a request, picked from a fixed list such as "homework" (no free text).

AskTime does not send crash reports or diagnostic reports from a child's device.

2.2a Words a kid writes inside AskTime (notes and family chat)

AskTime has two features that let a kid type their own words. Both are switched off on our servers at launch. We will turn them on only after an independent security audit and a legal review. Before we do, we will update this policy, tell parents, and ask parents of kids under 13 for consent again with a stronger method than the one in Section 2.6. While they are off, the app hides them and our servers refuse new notes and messages.

• Notes on a request for more time, a chore or a star trade (up to 500 characters). The kid's parents can read them. We store them encrypted on our servers with a key that we hold, so our systems can unlock them to show them to the family. They are deleted after 30 days.
• Family chat: a chat with the whole family, a chat between one parent and the kid, and a chat between two siblings. Messages are end-to-end encrypted on the devices: our servers keep only the locked message, and we hold no key that can unlock it. Parents can read the family chat and their own chat with the kid. Parents cannot read a chat between two siblings, which is on by default for families with two or more kids and which a parent can turn off. A kid can choose "Show a parent" to send a copy of messages to a parent. Messages have no photos, videos or voice, and links do not open.
  • What our servers do see: who is in each chat, who sent a message and when, its size (rounded), whether it was a "Show a parent" copy, read and mute state, safety reports with a preset reason, and each device's public chat key and locked copies of the chat keys.
  • Chat history on a new phone: another family device can re-send the locked keys of old chats to the new device. A parent's account also has a chat backup key that only the parent's own devices know. It is kept in the parent's iCloud Keychain (Apple) or Android Block Store (Google), which those companies sync end-to-end encrypted, or the parent can write down a recovery key. Our servers keep the old chat keys only locked with that backup key, plus a short code that identifies it, and a record of who was in each key period. Kids' devices never have a backup key.
  • Known limits: within one key period, someone who gets a device's key can read that period's messages; there is no way yet to compare keys between devices, so a server that was taken over could try to swap keys. We describe these limits so families can decide.
  • Messages are deleted after 30 days by default (a parent can choose 7, 30 or 90 days). A kid can delete their own messages at any time.

2.3 What a parent tells us about a child

In Parent mode, the parent gives us:

• the child's first name or nickname (up to 30 characters; we ask for a nickname, not a full name);
• an age band (under 8, 8–10, 11–13, 14–15 or 16–17). We never ask for a birthday;
• a picture choice from our built-in set. A parent can instead pick a real photo on their own phone. That photo is cropped, has its hidden details (such as location) removed, and stays only on that parent's phone: it is never uploaded to our servers or sent to the kid's device or another parent. It is deleted when the parent removes the kid, signs out or deletes the account;
• the child's rules: daily limit, bedtime, pause, app limits and schedules;
• chores, rewards and star prices: a chore name or reward name the parent writes (stored encrypted), stars per chore, an allowance amount for a reward, and a short "not yet" reason on a chore (up to 60 characters, deleted after 30 days).

The child's device shows the child their own nickname, picture choice, rules, chores and stars. It also shows the display name of the parent who linked it (to confirm the right family), and, when notes or chat are on, the name of the parent who wrote.

2.4 What AskTime never collects

AskTime never collects, from either mode:

• messages, chats or emails in other apps, photos, videos, contacts or call history (words a kid types inside AskTime itself are described in Section 2.2a);
• websites, URLs, search terms or browsing history;
• names or IDs of the apps your kid uses, or how long they use each app;
• GPS or other precise location;
• the advertising identifier (IDFA) or the vendor identifier (IDFV);
• the child's phone number, email address or birthday;
• camera or microphone access in Child mode.

Your kid's app choices and per-app usage stay on the child's device. On iPhone and iPad they stay inside Apple's Screen Time system. On Android, AskTime's Accessibility service sees which app is open on the device so it can count limited time and show the time's-up screen; it keeps per-app counts only on the device and never sends app names or per-app use to our servers.

2.5 Persistent identifiers used for internal operations

COPPA treats the random device ID and the push token (from Apple, or from Google Firebase Cloud Messaging on Android) as "persistent identifiers". We use them only to support the internal operation of AskTime: signing the device in, delivering rule updates and answers to requests, removing a device, keeping the service secure, and meeting legal requirements. We never use them to build a profile of a child, to show ads, or to contact a child for any other reason. The push token is never shown to parents and is only used by our server to send AskTime's own notifications. For these identifiers we rely on COPPA's exception for "support for the internal operations" of the service. We also collect them only after a parent has given consent (Section 2.6), with one exception: a child's device that starts pairing gets a random device ID so it can show the pairing code. If the device is not linked, we delete that ID after 24 hours.

2.6 How we get a parent's consent

We use a method the FTC calls "email plus". The FTC allows it when a company does not disclose children's information to third parties other than its service providers. AskTime does not. Before any information about a child is collected:

1. The parent signs in with Apple or Google. Apple or Google has already checked the email address on that account.
2. The next screen shows this notice. The parent ticks a box: "I'm a parent or legal guardian, and I agree to the Terms and Privacy Policy." Our server records the date, the version of this policy and the method.
3. We send this notice to the parent's account email right away.
4. At least 24 hours later, we send a second email. It confirms the consent and explains how to take it back.
5. Until our server has recorded the consent, AskTime cannot add a child or link a child's device.
6. On iPhone and iPad, a parent also approves AskTime in Apple's Screen Time dialog on the child's device, with their own Apple Account password. This is an extra check.

To take back consent, remove your kid (Settings › Kids), delete your account (Settings › Delete account), or email privacy@asktime.app. We then stop collecting information from your kid's devices and delete it as described in Section 8.

A parent can agree to us collecting their child's information without agreeing to us sharing it with anyone else for their own purposes. We do not share children's information with anyone except the service providers in Section 6, who process it only to run AskTime for us.

2.7 How we use children's information

We use it only to:

• apply the rules the parent set and show them to the child;
• send and answer requests for more time;
• run chores, stars and trades, and (only if the parent turns it on) show daily screen-time totals;
• deliver notes and family chat, when those features are on;
• tell the parent when protection stops working, when a device has not checked in for 24 hours, or when a device was removed;
• keep AskTime secure and prevent abuse (for example, limiting how many requests a device can send in an hour);
• provide support the parent asks for;
• meet legal obligations.

We do not use children's information for advertising, for marketing to the child, for profiling, or to train AI models. Child mode sends no analytics events and contains no third-party analytics, advertising or crash-reporting code. On Android, the only third-party code started in Child mode is Google Firebase Cloud Messaging, used only to receive AskTime's own notifications.

2.8 A parent's rights and how to use them

A parent can at any time:

If you cannot use the app, email us at privacy@asktime.app from the email linked to your AskTime account, or write to Nguyen Minh Van, Hoa Khanh, Da Nang 550000, Vietnam. Before we act, we check that you are a parent on the account: the request must come from that email address, or you must confirm it from that address when we reply. We respond within 30 days.

If a parent stops collection or deletes data, AskTime can no longer apply limits on that device.

What the download file includes. Your family's kids, rules and rule history; each kid's devices, with each device's random ID, status, push service (Apple or Google) and push token; requests for more time; alerts; daily totals; chores, stars, rewards, trades and notes; the parents in the family; the sign-in email and name of the parent who asks for the file; your usage events; and a Premium summary (whether you have it, when it ends or renews, the plan, the store, and the last subscription event we received). The file does not include our internal sign-in IDs or app store receipts (Apple and Google keep your receipts for you). It does not include chat details while family chat is off.

2.9 Teens

AskTime is designed for kids about 8 to 15, and parents can choose age bands up to 16–17. We give teens the same protections as younger children: the same limited data, no ads, no selling, and no sharing for targeted advertising.

3. Information about parents

Device and network information. Like any online service, our hosting and sign-in provider (Supabase) receives the IP address and basic device information (such as the app and system version) of every device that connects, including your kid's device. Our own database tables do not store IP addresses. Supabase's sign-in records can hold an IP address: sign-in sessions are deleted with the account, and sign-in audit records are kept for at most 30 days. Supabase's system logs are kept for about 7 days.

Crash reports. AskTime's own code does not send crash or performance reports, from either mode. If the owner of a device has turned on "Share With App Developers" in the device's settings, Apple may give us crash reports through App Store Connect. These come from Apple, not from AskTime's code, and do not include messages, photos or app names. We use them only to fix crashes.

4. How we use information

We use the information above to:

• provide AskTime: create your family, apply and sync rules, handle requests for more time, show status;
• send notifications you and your kid need (Section 5);
• send protection alerts. These are always free, including on the free plan;
• keep AskTime safe: stop abuse, protect the Parent PIN, detect when protection is turned off;
• provide support when you ask;
• understand and improve Parent mode setup using first-party, aggregated usage events;
• process subscriptions (planned paid plan);
• comply with law and enforce our Terms.

We do not make decisions about you or your kid that produce legal or similarly significant effects by automated means.

5. Notifications

• To parents (requests, protection alerts): sent through Google Firebase Cloud Messaging. On iPhone, Google passes them to Apple's push service.
• To a child's iPhone or iPad (answers to requests, rule updates, device removed): sent by our server directly to Apple's push service. Child mode on iPhone and iPad does not contain Google Firebase.
• To a child's Android device: sent through Google Firebase Cloud Messaging as a silent signal that tells AskTime to fetch the latest rules from our server. It carries no text and no names.

Notification text that passes through Apple or Google never contains your kid's name, app names or content. It says things like "Your kid is asking for 15 more minutes" and carries only random IDs. On iPhone, your phone fills in your kid's nickname locally after the notification arrives.

6. Service providers we use

We share information only with service providers who process it on our behalf to run AskTime. Each one is bound by written terms that require it to keep the information confidential and secure and to use it only for our purposes. We have these terms in place before any family's information reaches the provider.

We may also disclose information if the law requires it (for example, a valid court order), to protect the safety of a child or others, or as part of a merger or sale of our business. In a sale, the buyer must follow this policy for information collected under it, and we will notify parents before children's information is used in a materially different way.

7. No ads, no selling, no sharing for targeted advertising

• AskTime has no ads, in either mode.
• We do not sell personal information, and we have not sold it in the past 12 months.
• We do not share personal information for cross-context behavioral advertising or targeted advertising, and we have not done so in the past 12 months.
• We do not use data brokers, and we do not profile kids.
• Child mode contains no advertising, analytics or attribution code and never shows Apple's prompt that asks permission to share data across apps. (On Android, Firebase Cloud Messaging is used only for notifications, with Firebase analytics and the advertising ID turned off.)

8. How long we keep information

We keep information only as long as we need it for the purposes in this policy. Section 8 is our written data retention policy for children's information. We keep each kind of information only for the reasons in Section 2.7 and Section 4, and we delete it on the schedule below. In summary:

When you delete your account (Settings › Delete account): your family, parent profile, children, rules, PIN, requests, alerts, rule history, chores, stars, notes, chats and usage events are deleted from our database immediately, and your sign-in account is deleted right after. If the family owner deletes the family, other parents are removed from it and keep their own sign-in account, which they can delete in the app. Your kid's devices keep only a random device ID and a "removed" marker for up to 30 days so that they can learn they were removed and take away all limits; then those are deleted too. On the planned paid plan, we also ask RevenueCat to delete your subscriber record. If you signed in with Apple, we ask Apple to revoke AskTime's access. To have your support emails deleted too, email privacy@asktime.app.

Backups and logs. Our database provider makes an encrypted backup every day and keeps each one for 7 days. Deleted data stays in backups until they expire, so it is gone from backups within 7 days, and always within 30 days. Our providers' system logs are kept for about 7 days, and sign-in audit records for at most 30 days. We never restore deleted data from backups except to recover from a disaster, and if we do, we delete it again.

9. How we protect information

We maintain a written information security program. Our safeguards include:

• encryption in transit (TLS 1.2 or higher) for all connections, and encryption at rest (AES-256) by our database provider, which holds a SOC 2 Type 2 report;
• database rules (row-level security) on every table, so a parent can only see their own family and a child's device can only see its own rules. A child's device can never create or change rules, families or PINs; this is enforced on the server, not just in the app;
• the Parent PIN stored only as a one-way scrambled value, with lockouts after wrong tries;
• pairing codes that expire after 15 minutes and can be used once, with limits on wrong attempts; the QR code's secret is stored only as a one-way scrambled value;
• keys and secrets kept in secure server storage, never in the app;
• no third-party SDKs started in Child mode, except Google Firebase Cloud Messaging on Android child devices, used only to receive notifications;
• family chat (when on) end-to-end encrypted on the devices; notes and the names parents write for chores and rewards encrypted on our servers;
• logs that never contain names, app names, push tokens, PINs or message content;
• limited staff access to production data, with multi-factor sign-in. We look at a family's data only to answer a support request from a parent or to handle a security incident, and we record each time we do;
• written commitments from our service providers.

No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.

10. Your choices and controls

• Edit or remove a child: Settings › Kids.
• Remove a device: Settings › Devices, or enter the Parent PIN on the child's device and choose "Unpair this device".
• Pause all rules: from the child's screen in Parent mode.
• Download your data: Settings › Download my data.
• Delete your account: Settings › Delete account. If you have a subscription, cancel it in the App Store first; deleting your account does not cancel it.
• Notifications: turn them off in your phone's settings. Protection alerts are an important safety feature, so we recommend keeping them on.
• Sign out: removes your phone's push token from our servers.

11. US state privacy rights

Depending on where you live, state law (for example the California Consumer Privacy Act as amended by the CPRA, and the privacy laws of Virginia, Colorado, Connecticut, Texas, Oregon and other states) may give you the right to:

• know what personal information we collect, use and disclose, and get a copy in a portable format;
• correct inaccurate information;
• delete your information;
• opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling. We do none of these, so there is nothing to opt out of;
• limit the use of sensitive personal information. We use it only as needed to provide the service;
• appeal our decision on your request;
• use an authorized agent;
• not be treated differently for using these rights.

We give these rights to every parent in the United States, whether or not your state's law applies to us yet. To use them, use the in-app tools in Section 10 or email privacy@asktime.app. We will verify your request by matching it to your signed-in account, and we respond within 30 days. If we deny a request, you can appeal by replying to our answer with "Appeal"; if you are not satisfied with the result, you may contact your state attorney general.

Our website has no cookies and no third-party scripts, and we do not sell or share personal information. So a Global Privacy Control signal from your browser is always respected: there is nothing for it to turn off.

Categories of personal information (California notice at collection)

We do not collect audio, photos (a photo a parent picks stays on their phone), biometric data, precise location, health data, or financial account numbers.

12. Age-verification laws and Apple's Declared Age Range

Some states, including Texas (SB 2420, the App Store Accountability Act), have passed laws that require app stores and app developers to use age information and parental consent provided by the app store. The Texas law is in effect. Similar laws in Utah, Louisiana, Alabama and California (AB 1043) take effect in 2027.

Before our public launch, AskTime will use the app stores' age signals: Apple's Declared Age Range and PermissionKit on iPhones and iPads that support them, and Google Play's Age Signals on Android. We follow these rules:

• The answer stays on the child's device. We do not send it to our servers. The only age information on our servers is the age band the parent chose.
• If the app store tells AskTime that a parent has withdrawn consent, the child's device stops sending any information about the child. It sends only a signal, with no other details, that consent was withdrawn.
• The limits already on the device stay in place, and AskTime collects nothing more. Parent mode tells the parent how to finish: unpair the device with the Parent PIN, or remove the kid.
• While consent is withdrawn, protection alerts from that device stop, because they need the device to send information. Parent mode says so.
• We use age signals only to meet these laws and to respect parental consent, not for advertising or profiling.

13. Where data is stored

AskTime is intended for users in the United States. We store data with our providers in the United States. Our main database is in a US East region, and our email providers store data in the United States.

14. Changes to this policy

If we change this policy, we will update the "Last updated" date and post the new version in the app and on our website. If a change is material, we will tell parents in the app or by email before it takes effect. If we want to collect, use or disclose children's information in a materially different way, we will ask for the parent's consent first.

15. Contact us

Nguyen Hoang Nguyen Minh Van, Hoa Khanh, Da Nang 550000, Vietnam Email: privacy@asktime.app Phone: +84 703 865 568

Parents can contact us with any question about their child's information.