Privacy Policy — Little Hero

Last updated: 2026-09-22

Little Hero ("the app") is operated by Individual Entrepreneur Baudunov Rapkat (ИП Баудунов Рапкат), ИНН 22201199900599 ("we", "us"). Questions about this policy or your data: rapkat99@gmail.com.

The app is used by a parent or guardian to create and read personalised children's stories. A child never has their own account; everything about a child is entered by the adult who set up the app.

What we collect

Account (required to use the app).

• Your email address and a password. The password is stored only as a salted hash by our authentication provider — we never see or store the plain password. A login session token is kept in secure storage on your device.

Child profile (entered by you).

• The child's name, age, gender (or "unspecified"), a chosen avatar (a preset drawing — no photo upload exists), a set of interests, and the preferred language for stories.

Reading activity (per child, to make the app work).

• Which stories are marked as favourites, which are downloaded for offline reading, the page a story was left on, and a record of reading sessions (start and end time, pages read). This is what powers "continue reading", the weekly activity chart and the reading statistics.

Usage analytics (optional, off by default).

• If — and only if — you turn on "Share usage data" in the parent zone, the app sends anonymous product-usage events (for example: onboarding completed, a story opened, a story finished) to Firebase Analytics. Collection stays off until you opt in, and you can turn it back off at any time. No analytics event carries your child's name or age. We do not use this data for advertising.

Subscriptions.

• This release has nothing to buy: the story catalogue contains no paid content and no subscription is offered. The subscription mechanism is present in the app but dormant, and activates only if a build is configured with a store key. If subscriptions are enabled in a future build, purchases are processed by RevenueCat and the app store; we receive an anonymised subscriber identifier and the entitlement status, not your payment details.

What we do not collect: your precise location, contacts, photos, or device advertising identifiers. The app contains no crash-reporting SDK and no advertising SDK. If you turn on usage analytics, the analytics provider may derive an approximate (roughly city-level) location from your device's IP address; we do not receive or store precise location.

How your data is used

• To provide the service: sign-in, the child profile, the catalogue in the chosen language, offline downloads, progress and statistics.
• With your consent only: to understand which parts of the app are used, so we can improve it.

We do not sell personal data and we do not share it with third parties except the infrastructure providers that run the service on our behalf (our database and authentication provider, and — only with your consent — the analytics provider).

Where your data is stored (international use)

The app's database and authentication run on Supabase; usage analytics, if enabled, run on Google Firebase. Both process and store data outside the Russian Federation.

For users in Russia: cross-border transfer of personal data to the jurisdictions above is inherent to using the app. The operator's obligations under Federal Law No. 152-FZ regarding in-country storage and registration with Roskomnadzor are being addressed separately before distribution in Russian app stores; this draft does not by itself satisfy them.

Children's privacy

The app is directed to parents, not to children, and a child cannot create an account or enter data themselves. Consistent with the U.S. Children's Online Privacy Protection Act (COPPA) and the EU GDPR provisions on children's data (GDPR-K): we collect the minimum needed to run the app, we never show behavioural advertising, analytics are off until a parent opts in, and a parent can delete all of a child's data at any time from within the app.

Your rights

• Access and correction: child profile fields are editable in the app.
• Deletion: the parent zone offers "Delete child profile" (removes that child and all of their reading data) and "Delete account" (removes your account and every child under it). Deletion is immediate and permanent — there is no recovery window and no soft-delete.
• Withdraw analytics consent: toggle "Share usage data" off.
• EU/UK users additionally have the rights to restrict or object to processing and to lodge a complaint with a supervisory authority.

A formal data-export ("portability") flow is not offered in this release.

Legal bases (EU/UK users)

• Account data and reading activity: necessary to perform the service you asked for (contract).
• Usage analytics: your consent.

Changes

We will update this policy as the app changes and move the "Last updated" date. Material changes will be surfaced in the app.