Privacy

Privacy Policy

Last updated August 24, 2026

This Privacy Policy explains how Batuhan Bayır collects, uses, shares, stores, and protects information when you use the DinoLock app, website, and related services.

Privacy at a glance

DinoLock uses account and learning information to synchronize your setup and question bank. Screen Time selections stay on the device as Apple privacy preserving tokens. Source material is sent to Google AI only when you request question creation. We do not sell personal information or use it for third party advertising.

1. Scope and who is responsible

This Policy applies to the DinoLock iOS application, dinolock.web.app, and support communications related to DinoLock. In this Policy, “DinoLock,” “we,” “us,” and “our” refer to Batuhan Bayır, the developer and data controller responsible for DinoLock.

This Policy does not control Apple, Google, RevenueCat, or websites and services operated by other organizations. Their own policies apply when they process information for their independent purposes.

By using DinoLock, you acknowledge the practices explained here. Where consent is the legal basis, you may withdraw it as described below.

2. Information we collect

Account and identity information

When you sign in with Apple or Google, we receive an account identifier and information the provider makes available, which may include your display name, email address, profile photo link, and sign in provider. If you choose Hide My Email with Apple, we receive Apple’s private relay address instead of your personal address. We do not receive your Apple or Google password.

Profile and onboarding information

We collect choices you make during setup and in Profile. These may include parent or student mode, a child or profile name, school grade or learning journey, app category preferences, approximate daily phone use, preferred difficulty, daily question goal, reward minutes, daily earn limit, sleep schedule, and lock settings.

Learning support preferences

You may choose to provide learning support preferences, including attention, reading, or other learning needs. This information can be sensitive in some regions. We use it only to personalize the experience and synchronize your chosen setup. Do not provide diagnostic or health information that is not needed for the App.

Question bank and progress information

We store question set titles, subjects, source type, question format, difficulty, reward setting, prompts, choices, answer keys, explanations, answer history, solved status, correctness, creation dates, and update dates. This lets DinoLock synchronize your question bank and show progress.

Source material and AI instructions

When you ask DinoLock to create or extract questions, you may submit a topic, instructions, typed text, a camera image, a photo library image, or a selected document such as a PDF. DinoLock accesses this material only after you choose it or capture it for that request. The App does not scan your photo library or files in the background.

Screen Time configuration

With your authorization, DinoLock stores Apple generated tokens representing selected apps, categories, or websites, plus local state needed to apply shields and earned access. These tokens are designed by Apple to avoid revealing ordinary readable app identifiers to us.

Subscription information

Apple and RevenueCat provide purchase and entitlement information such as product identifier, plan, active status, renewal status, transaction events, storefront information, and an app specific customer identifier. We do not receive your complete payment card number or Apple account password.

Device, security, and technical information

Firebase, Apple, RevenueCat, and our infrastructure may process technical information needed to deliver and protect DinoLock. This may include device and operating system details, app version, language, region, network address, timestamps, authentication events, request status, security signals, App Check or App Attest results, error details, and service logs.

Notifications

If you allow notifications, iOS gives the App permission to schedule or receive alerts, sounds, and badges. Notification settings and local reminder choices may be stored on your device. Apple may process a device token when remote notification delivery is used.

Support and correspondence

If you contact us, we receive the information you send, such as your email address, message, screenshots, device details, and attachments. Please remove confidential school material, passwords, authentication codes, and unnecessary personal information before sending a support request.

Website request information

When you visit the DinoLock website, hosting and font providers may receive standard request information such as network address, browser type, device type, requested page, referring page, and request time. We do not use the website to build advertising profiles.

3. Where information comes from

We receive information from:

You, when you complete onboarding, change settings, create questions, upload source material, purchase a plan, or contact support.
Your device and iOS, when you grant permissions or use Screen Time, camera, file, photo, and notification features.
Apple or Google, when you choose their sign in service.
Apple and RevenueCat, when a purchase or subscription status changes.
Firebase and Google Cloud, when they provide authentication, storage, security, and AI services.
Our website hosting systems, when your browser requests a page.

4. Screen Time and selected app privacy

Apple privacy preserving tokens

DinoLock uses Apple’s Family Controls, Managed Settings, and Device Activity frameworks after authorization. When you select apps, categories, or websites, Apple provides opaque tokens. DinoLock uses these tokens to apply your selected shields without receiving a normal readable list of app names from Apple.

Local protected storage

Your Screen Time selection, shield configuration, and access balance are stored in a protected app group on the device so DinoLock and its Screen Time extensions can work together. This state is not part of your cloud question bank.

What we do not collect

DinoLock does not upload raw browsing history or a detailed history of every app you use to our servers. We do not sell Screen Time data or use it for advertising. Apple controls the underlying authorization and may limit what DinoLock can access.

Changing permission

You can change selected apps in DinoLock or revoke Screen Time authorization in iOS Settings. Revoking access prevents DinoLock from operating related shield features and may require you to configure them again later.

5. AI processing and uploaded materials

What is sent

When you start an AI request, DinoLock sends the topic, instructions, and selected source material needed for that request to Google Firebase AI Logic and Google Cloud Vertex AI. The service analyzes the request and returns question content to DinoLock.

Purpose

We process this material to generate or extract questions, answer choices, answer keys, explanations, and related structured content that you requested. We do not use your learning material to show third party advertising.

Your responsibility

Do not submit sensitive personal data, confidential records, or material you do not have permission to process. A parent, guardian, or educator should review source material before a child uploads it.

Output and provider handling

Generated output is saved to your question bank when you choose to keep it. Google may retain service requests, abuse prevention logs, or other technical data under the applicable Firebase and Google Cloud terms, settings, and legal requirements. AI output can be wrong, so it should be reviewed before use.

6. How we use information

We use information to:

Create, authenticate, maintain, and secure your account.
Save and synchronize your profile, onboarding choices, settings, and question bank.
Provide educational challenges, progress, rewards, limits, and app shielding.
Personalize difficulty, goals, schedules, and learning support options.
Generate or extract questions from material you submit.
Confirm purchases, restore entitlements, and control access to paid features.
Send notifications you request and important service communications.
Respond to questions, privacy requests, feedback, and bug reports.
Detect abuse, prevent fraud, protect accounts, and troubleshoot failures.
Maintain, test, improve, and understand the reliability of DinoLock.
Comply with law, enforce our Terms, and protect users and our rights.

7. Legal bases for processing

The legal basis depends on the information, feature, and your location. We may rely on:

Contract: processing needed to create your account, synchronize content, provide features, and manage a purchase.
Consent: permissions for Screen Time, camera, photos, files, notifications, optional learning support information, or other processing where consent is required.
Legitimate interests: operating, securing, troubleshooting, and improving DinoLock in ways that do not override your rights.
Legal obligations: retaining or disclosing information when law requires it and responding to valid legal requests.
Protection of rights and safety: addressing fraud, misuse, security incidents, and credible threats where allowed by law.

Where a parent or guardian’s authorization is required, we rely on that authorization for the child’s use. You can withdraw consent at any time, but withdrawal does not make earlier lawful processing unlawful.

We do not sell or rent personal information. We may disclose limited information in these situations:

To service providers that operate authentication, cloud storage, AI, purchases, hosting, security, and support functions for us.
To Apple or Google when you use their sign in, device, platform, or purchase services.
When you direct us to share information or give clear permission.
When required by a valid legal process or needed to comply with applicable law.
When reasonably necessary to prevent fraud, investigate abuse, protect safety, enforce our Terms, or defend legal rights.
During a merger, financing, acquisition, reorganization, or transfer of DinoLock, subject to appropriate confidentiality and notice where required.

Service providers are permitted to process information only for contracted services and their own legally permitted compliance and security purposes.

9. Service providers and data categories

Provider	Purpose	Information involved
Apple	App distribution, iOS permissions, Screen Time, Sign in with Apple, purchases, and refunds	Platform identifiers, permission state, privacy preserving selection tokens, transaction information, and data you choose to share
Google Firebase	Authentication, Firestore database, App Check, and service infrastructure	Account identifier, profile, synchronized settings, question bank, security signals, and technical logs
Google Cloud Vertex AI and Firebase AI Logic	Question generation and extraction	Your prompt, selected source material, request configuration, generated output, and technical request information
Google Sign In	Optional account authentication	Account identifier and profile information you authorize Google to share
RevenueCat	Subscription entitlement and purchase status management	App specific customer identifier, product and transaction events, entitlement status, storefront, and technical information
Firebase Hosting and Google Fonts	Website delivery and typography	Standard web request information such as network address, browser, requested resource, and timestamp

If you choose a social sign in option, Apple or Google authenticates you and sends DinoLock the information you authorize. You can review connected apps and permissions in your Apple or Google account settings.

Revoking a provider connection may prevent future sign in but does not automatically delete an existing DinoLock account or cloud content. Use Delete Account in DinoLock or contact us to request deletion.

11. International data transfers

DinoLock is operated from Türkiye, and providers may process information in Türkiye, the United States, the European Economic Area, or other countries where they maintain facilities. Privacy laws in those countries may differ from those in your country.

Where required, we use recognized safeguards such as contractual protections, adequacy decisions, provider data protection terms, and security measures. You can contact us for more information about safeguards relevant to your information.

12. How long we keep information

We keep information only for as long as reasonably needed for the purposes described in this Policy, including providing the Services, maintaining security, resolving disputes, and meeting legal duties.

Information	Typical retention approach
Account, profile, onboarding choices, and synchronized settings	Kept while your account is active, then deleted or deidentified when no longer needed, subject to backups and legal duties
Question sets and progress	Kept until you delete the question set or delete your account
Screen Time selections and access state	Stored locally until you change settings, reset the App, or remove the App and related device data
AI prompts and selected source material	Processed for the request; provider logs or temporary copies may remain according to provider settings, contracts, security needs, and law
Subscription records	Kept as needed to confirm entitlements, address billing issues, prevent fraud, and comply with financial or legal requirements
Support messages	Kept while needed to answer the request, maintain support history, protect rights, and meet legal duties
Security and technical logs	Kept for a limited period appropriate to troubleshooting, abuse prevention, and system security

Deletion from active systems may not remove information immediately from encrypted backups. Backup copies are isolated and removed or overwritten through normal retention cycles unless law requires longer storage.

13. How we protect information

We use reasonable technical and organizational measures designed to protect information. These include encrypted network transport, Apple platform protections, authenticated access, per user database controls, Firebase App Check, App Attest, protected app group storage, and restricted service access.

No transmission or storage method is completely secure. We cannot guarantee that unauthorized access, loss, or misuse will never occur. Keep your Apple or Google account secure, use device protection, install security updates, and contact us if you believe your DinoLock account has been compromised.

14. Children and student information

DinoLock is designed to support students and families. A child who cannot legally consent on their own should use DinoLock only with the authorization and supervision of a parent or guardian.

Parents and guardians should review the child’s profile information, learning support choices, uploaded source material, question sets, and Screen Time configuration. Do not enter more information about a child than is needed to use the Services.

We do not knowingly sell children’s personal information or use it for targeted advertising. If you believe a child used DinoLock without required authorization, email us. We will investigate and delete or restrict information where appropriate and legally required.

15. Your privacy choices

Profile: update your display name and available settings in DinoLock.
Question bank: delete individual question sets in the App.
Account: use Delete Account in Profile to remove your DinoLock cloud account and associated profile and question bank data.
Screen Time: change selections in DinoLock or revoke authorization in iOS Settings.
Camera, photos, and files: manage access in iOS Settings and choose what you submit for each request.
Notifications: change alert permissions in iOS Settings and reminder choices in DinoLock.
Social sign in: review or revoke DinoLock access in your Apple or Google account.
Subscription: manage or cancel through Apple Subscriptions. Account deletion does not cancel billing.

16. Your privacy rights

Depending on where you live, you may have the right to:

Confirm whether we process your personal information and obtain a copy.
Correct inaccurate or incomplete information.
Request deletion of information.
Restrict or object to certain processing.
Receive certain information in a portable format.
Withdraw consent for future processing.
Opt out of a sale, targeted advertising, or certain profiling where applicable. DinoLock does not currently conduct these activities.
Appeal a decision on a privacy request where local law provides that right.
Complain to a data protection authority.

Rights are not absolute. We may need to verify identity, protect another person’s rights, retain information required by law, or deny a request where an exemption applies. We will not discriminate against you for exercising a privacy right.

17. Regional privacy disclosures

Türkiye

If Türkiye’s Personal Data Protection Law applies, you may ask whether personal data is processed, request information about processing, learn the purpose and recipients, request correction or deletion, object to certain automated results, and request compensation where the law permits. You may also apply to the Personal Data Protection Authority after following required procedures.

European Economic Area, United Kingdom, and Switzerland

You may have rights of access, correction, deletion, restriction, objection, portability, withdrawal of consent, and complaint to your local supervisory authority. Our legal bases are explained in Section 7 and international transfers in Section 11.

United States

State law may provide rights to know, access, correct, delete, or obtain a copy of personal information and to opt out of certain sales, targeted advertising, or profiling. During the preceding twelve months, DinoLock may have collected the categories described in Section 2 and disclosed them to the provider categories in Section 9 for business purposes. We do not sell personal information or share it for cross context behavioral advertising.

Canada and other regions

You may have rights to access and correct information, withdraw consent, challenge compliance, and complain to a privacy regulator. We process information with consent, to provide requested services, and for other purposes permitted by applicable law.

18. Accessing, correcting, or deleting your data

In the App

Open Profile to update available account details and settings. To delete your account, choose Delete Account and complete the confirmation and sign in verification. DinoLock deletes the Firebase authentication account, cloud profile, synchronized settings, and cloud question sets managed by DinoLock.

What account deletion does not do

Account deletion does not cancel an Apple subscription, remove records Apple or other providers must keep for their own legal purposes, or immediately erase isolated backups. Local device data may remain until you reset settings or delete the App and its data.

Email requests

You may email pixo.helpdesk@gmail.com to request access, correction, deletion, or another applicable right. Describe the request and the sign in method used. Do not send a password or authentication code. We may request reasonable information to verify identity and authority.

19. Website privacy and Do Not Track

The DinoLock marketing site is hosted using Firebase Hosting and loads fonts from Google Fonts. These services may receive ordinary network request data. The site does not intentionally use advertising cookies or third party behavioral advertising trackers.

Some browsers offer a Do Not Track signal, but there is no single universally accepted response standard. Because the DinoLock site does not build advertising profiles, it does not change advertising behavior in response to that signal. We honor legally required opt out signals if and when they apply to our processing.

20. Changes to this Privacy Policy

We may update this Policy when DinoLock features, providers, or legal requirements change. The date at the top shows the latest revision. If a change materially affects how we use personal information, we will provide additional notice when required.

21. Contact us

DinoLock is operated by Batuhan Bayır in Türkiye. For privacy questions, requests, or concerns, email pixo.helpdesk@gmail.com.

If you are not satisfied with our response, you may have the right to contact the data protection or consumer authority where you live.