Privacy policy

This policy explains how ISA Studio handles data in EarnTime JP.

Scope and purposes

EarnTime JP helps families manage tasks and screen time set by a parent or guardian. Guest families do not require email/password sign-in. Clerk handles account-based authentication in existing supported flows, including an email address where supplied. The service handles household names, profile names and roles, child age ranges, device registrations and protection status, counts of selected apps, tasks, reports and approvals, available time and usage records to display family information, synchronize it and provide protection features. Feedback text, an optional reply email, a technical account reference and receipt time are sent to the email delivery service Resend. An adult parent or legal guardian creates the family; children use child profiles with that adult's consent and supervision.

Access on the device

iOS protection uses Apple's Screen Time / Family Controls authorization. Android protection uses access to detect usage and foreground activity of selected apps, including accessibility service permissions. In the current Android implementation, selected package names, foreground-app events and aggregated usage are designed to be processed on the child's device. It is not intended to collect screen text, entered content, keystrokes, screenshots or browsing URLs. Parents should review required permissions and OS settings. Complete, continuous blocking or monitoring is not guaranteed.

Optional family measurement

A parent who sees the measurement disclosure explicitly chooses either “Allow ATT” or “Don’t allow ATT.” Either choice enables the full disclosed measurement scope; this is not a choice between measurement and no measurement. There is no separate payment-sharing checkbox, PIN, or extra consent screen. A new app version presents the current family-attribution-v3 disclosure and confirmation; an older v2 choice is not silently treated as consent to the expanded scope. The Allow choice requests iOS ATT only when the OS can still determine it. If the OS has already authorized, denied, or restricted ATT, the system prompt is not shown again.

On a confirmed parent installation, measurement includes Singular’s standard install/app attribution and these limited family events: server-recorded task creation, assignment and cancellation; report submission, resubmission, receipt and rejection; task approval with or without a report; minute ranges for credits, bonuses, adjustments, actual usage, usage start and depleted balance; selected child-profile, device-session and pairing actions; confirmed app-selection counts; observed protection/device-state changes; and coarse parent-screen views, actions and outcomes. Screen, action, outcome and error categories come from closed lists; free-text values are not sent.

Billing measurement distinguishes purchase attempts actually started in the parent app, cancellation/failure/pending outcomes, store completion/access confirmation, and restore started/succeeded/pending/not-found/failed. A button tap alone is not a confirmed purchase or revenue. Separately, RevenueCat-verified production-store Pro purchase, renewal and subscription-lifecycle events are processed, along with verified purchase/renewal/refund/refund-reversal revenue events. An ordinary unsubscribe is not a refund. Revenue events use the actual RevenueCat-reported USD amount, product and store-transaction references, and event time; a receipt is not sent. Missing prices and zero amounts are not invented. These events are routed through the Singular SDK-issued identifier for one consented parent installation and include its actual platform/app ID and exact iOS ATT status.

Family-event parameters use only the shared strict v3 allowlist and closed values. Counts are bucketed as none/one/few/many; minutes use ranges such as none, under 5, 5–14, 15–29, 30–59 and 60+. Singular receives no selected-app names/package names or hashes, usage history, task/report titles or notes, names, family/child/account IDs, email, PIN, receipts, raw error text or free-form custom parameters. No Singular SDK runs on a child device; no raw child clickstream or child install attribution is sent. Eligible family events derived from child actions are generated server-side and attributed through the parent installation.

Standard install attribution may use app/device/network signals permitted by Singular and the OS, which can include IP address. Denying ATT does not turn off this baseline or the disclosed family/payment measurement; ATT controls iOS advertising-identifier access, and IDFA is not used when ATT is denied. RevenueCat’s customer ID is used only for server-side routing and is not sent to Singular. No pre-consent history is backfilled. Turning measurement off withdraws baseline attribution, family events and billing measurement, discards pending events and device bindings, and other parent installations stop when they observe the withdrawal or their short lease expires. In-flight requests and data already sent cannot be recalled, and stopping does not delete historical vendor-held data.

Billing and deletion

Pro purchases and entitlement verification involve Apple / Google stores and RevenueCat. Also review each service's terms for how purchase information is handled. See the account deletion page for deletion scope and procedures. Deleting an account does not cancel store subscriptions.

Google Analytics (Firebase) on iOS

On a verified parent iPhone after acknowledgement of the updated disclosure, Google Analytics (Firebase) measures permitted screens, actions, outcomes and coarse family events. Google also processes an app-instance identifier and app/device/network information. No advertising ID, IDFV, names, email, entered text or selected-app names are sent; advertising personalization is disabled. Firebase does not start on child devices. “Stop all measurement” in settings stops collection, but does not delete previously transmitted data. See Google's privacy policy.

Service providers and international processing

ISA Studio is the operator in Thailand. Replit provides server/database infrastructure and App Storage (Google Cloud Storage); Clerk supports existing account-based authentication; RevenueCat and Apple / Google support purchases and entitlement verification; Singular and Google Analytics (Firebase) process disclosed measurement; Expo Push Service and Apple APNs (Google FCM for configured Android releases) support notifications; Resend delivers feedback emails. Support correspondence uses Gmail. Depending on these providers' processing and storage locations, data may be processed outside your country of residence. Storage exclusively in Thailand or Japan is not guaranteed. Contact ISA Studio with questions or requests to exercise your rights.

Retention

Service data, including household and profile data, tasks, reports and time history, is retained to provide the service while the account exists. Successful full account deletion removes the associated data from the active service database. Deleting an individual profile is not the same as deleting the whole account.

Support emails and inquiries are retained for as long as necessary to handle the inquiry, resolve the issue and meet mandatory legal requirements. Operational logs and backups follow the infrastructure providers' actual retention periods, settings and recovery windows. Immediate removal of every copy is not guaranteed. Store and external-provider purchase records and previously delivered measurement data are subject to those providers' retention rules and applicable law.

Inquiries and your rights

To the extent provided by applicable law, you may request access to or a copy of your data, correction, deletion, restriction of or objection to processing, and withdrawal of consent from ISA Studio. A parent or legal guardian should make requests about a child's data. Following necessary identity verification, requests are handled within the deadlines required by applicable law; no additional uniform deadline is promised. Do not email passwords, verification codes or unnecessary child information. See the account deletion page for scope and procedures.

Guest families, invitations and recovery

The current app lets an adult create a guest family without an email address or password. Family and profile identifiers, installation credentials and saved profiles provide access. Invitation QR codes and manual codes grant access to the indicated family/profile; a parent recovery code can restore family access. Keep these codes private. The server stores credential/code hashes. Removing a saved profile from one device, signing out or uninstalling does not delete the server-side family. Losing all access credentials may make family history inaccessible; recovering a store subscription alone does not recover family access or history.

Subscriptions and trial access

RevenueCat and the store process product, customer and transaction identifiers and purchase/entitlement history. The service associates access with the family billing identity, which is not permission to enter its profiles. The family trial is service-controlled and is separate from any store purchase offer. A restore uses the purchasing Apple/Google account and applicable store/RevenueCat rules; it does not guarantee recovery of a deleted family. Deleting family data does not cancel store renewal or erase records held independently by these providers.

Notifications and reminders

If notifications are enabled, the service stores a push token, installation/profile link, platform, language, notification preferences, reminder settings and delivery/application records. Expo Push Service and Apple APNs (or Google FCM for a configured Android release) process delivery information. Messages use generic text and an event identifier, not report photos, task titles or child names. Opening a notification requires current family access before showing the corresponding task. Delivery and device application are not guaranteed. You can turn notifications off in app settings and OS settings; account/family deletion revokes associated subscriptions. Turning notifications off is not the same as deleting family history.

Protection synchronization and technical records

Selected application identities and native selection tokens remain in the device protection configuration. The service also receives selection counts, a technical selection checksum/version, protection status and aggregated usage/time synchronization records; these records are not a list of selected application names. Analytics receives only the separately disclosed allowlisted aggregates, not the selection checksum. Network requests expose IP and technical request information to the hosting infrastructure. Hashed abuse-prevention, trial and retry/deletion-receipt records can remain after a family is removed to prevent repeated trials or recreation after a lost response. These are distinct from active family history; no fixed erasure period for such security records, infrastructure logs, backups or external-provider copies is promised here.

Optional report photos

A child may choose up to four photos per report using the camera or system photo picker. Photos and text are optional. Original uploads reach the server for temporary processing. Photos are compressed and re-encoded without EXIF metadata, including GPS location; only processed copies are kept in persistent storage, not originals. Processed photos are stored privately in Replit App Storage (Google Cloud Storage) and served only to authenticated parents in the family and the child who submitted them. They are not public and are not used for advertising or AI recognition.

Photos stay with their original report attempt; a new report does not replace them. They are retained with family report data until the family, author profile or associated report is deleted. Existing history visibility rules still apply. Abandoned uploads become eligible for cleanup after 24 hours. Deletion revokes access immediately and queues file removal; temporary storage failures are retried automatically. Technical limits are four photos, 8 MB per source image and 1 MB per processed image, not subscription limits.