Rimu app privacy policy

The controller under the GDPR is Galeja Online, Inhaber Antonie Prinsloo, Kollwitzstr. 76, 10435 Berlin, Germany. Email: support@rimumath.com. Full provider details are in the Impressum.

To use Rimu, a parent creates an account with an email address and a password. We use the email address to sign you in, to keep your family’s data in sync across your devices, and to send the emails the account needs, such as a password reset. We do not use it for marketing.

Passwords are stored only as a secure hash by our database provider, Supabase. We never see or store your password in readable form.

Legal basis: Art. 6(1)(b) GDPR, providing the service you signed up for.

For each child, a parent can enter: a first name or nickname for the profile, the birth month and age or school year, the country and learning region, the app language, a chosen avatar, the starting multiplication table, the daily practice goal and timer settings, and rewards the family defines. We recommend a first name or nickname rather than a full name.

The parent PIN is stored as a hash, never in readable form.

We use this information to set up age-appropriate practice and the right table order, and to show the family its own progress. Legal basis: Art. 6(1)(b) GDPR. Where it concerns a child, we process it on behalf of and on the instruction of the parent who holds the account.

As a child practises, Rimu records the learning data it needs to work: answers given, accuracy and response times, completed sessions and daily goals, Test results, Levels and unlocked tables, Quest progress and earned stars.

This is what lets Rimu adapt practice to what a child is currently learning and show parents concrete progress. It is stored with the family’s account so it is not lost when you change device. Legal basis: Art. 6(1)(b) GDPR.

The World leaderboard is switched off by default. A child’s results only appear on it after a parent explicitly turns it on in the Parent Area. We record when that consent was given, and only results recorded after that moment are published.

Other users see only a nickname the parent chooses (3 to 14 letters or numbers) and the child’s Test results: score, accuracy, time, Level and practised tables. They never see the child’s profile name, birth month, country, email address or any other account detail. Results are compared within the same age and Level.

The leaderboard may also show reference entries we create so that early results have something to compare against. These are clearly labelled and do not belong to real children.

A parent can switch the leaderboard off at any time, after which the nickname no longer appears. Legal basis: Art. 6(1)(a) GDPR, the parent’s consent, which can be withdrawn at any time with effect for the future.

Subscriptions are bought through Apple’s App Store using StoreKit. Apple processes the payment; we never receive your card or payment details. Apple’s own privacy policy applies to the purchase.

We use RevenueCat to confirm which subscription is active and to unlock the app accordingly. RevenueCat receives a random identifier for your account (not your email address or name), your purchase and subscription status and transaction information from Apple, and basic technical information such as app version, platform, operating system and the device’s IP address.

Legal basis: Art. 6(1)(b) GDPR, providing the subscription you purchased.

If you send us feedback from within the app, we store your message together with your account so we can read it and, where needed, follow up. Legal basis: Art. 6(1)(b) and (f) GDPR.

If the app crashes or runs into an error, it can send a technical report to Sentry so we can find and fix the problem. A report contains details of the error, the app version, and the device model and operating system.

We have configured this to leave out personal data: reports do not include names, email addresses, screenshots or recordings of the screen, and every report is filtered before it leaves the device. Sending a report over the internet technically involves the device’s IP address. Crash reports are processed in the EU (Germany).

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a stable and secure app.

When it starts, the app checks for small updates through Expo’s update service and downloads them if available. That request contains the app version, the platform and, necessarily, the device’s IP address. It contains no account, profile or progress data.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in delivering fixes quickly.

The app stores some information on the device itself: the chosen language, a local copy of your family’s data so the app works offline, and the parent PIN, which is kept in the device’s secure storage (the iOS Keychain). This is removed when you delete the app or your account.

Supabase: our database and sign-in provider. Stores the account, learner profiles, settings, progress, leaderboard entries and feedback. Hosted in the EU (Frankfurt, Germany).

RevenueCat, Inc. (USA): subscription management, as described above.

Sentry (Functional Software, Inc.): crash and error reports, processed in the EU (Germany).

Expo (650 Industries, Inc., USA): delivery of app updates.

Apple: App Store distribution and payment through StoreKit. Apple acts independently under its own privacy policy.

Supabase, RevenueCat, Sentry and Expo process data only on our behalf, under a data processing agreement. Where data is transferred to the USA, this is based on the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

Account data, learner profiles, settings, progress, leaderboard entries and feedback are kept for as long as the account exists, and are deleted when the account is deleted.

Crash reports are kept by Sentry for a limited period and then deleted automatically. Apple and RevenueCat keep purchase and transaction records for as long as they are legally required to, for example for tax and accounting purposes.

You can delete your account at any time in the app: open the Parent Area (protected by your PIN) and choose to delete the account. This permanently deletes the account and all of its data, including every learner profile, progress, rewards, Test results, leaderboard entries and feedback. It cannot be undone.

Deleting your account does not cancel an active subscription. Please cancel it in your Apple ID settings (Settings → your name → Subscriptions) so you are not charged again.

You can also ask us to delete your account by emailing support@rimumath.com from the address you signed up with.

Rimu is made for children, and we treat their data with that in mind. The account is always held by a parent, and only the parent can make purchases, change settings or turn on the leaderboard. We collect only what the app needs to work, show no advertising, and never use children’s data for marketing or for profiling beyond adapting practice to their learning.

Parents can review, correct or delete their children’s data at any time in the Parent Area, or by contacting us.

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

To exercise any of these rights, email support@rimumath.com.

We will update this policy whenever the app changes how it handles data. The date at the top shows when it was last changed.