Privacy Policy for TicPop

Effective date: May 20, 2026  ·  Last updated: August 24, 2026

1. Who we are

TicPop is operated by Velynq, Inc., a Delaware corporation.

• Company: Velynq, Inc.
• Registered office (Delaware, USA): 131 Continental Dr, Suite 305, Newark, DE 19713
• Mailing address: 221 W 9th Street, PMB 858, Wilmington, DE 19801, USA
• Privacy contact: privacy@ticpop.app
• General contact: support@ticpop.app

Where TicPop is available. TicPop is offered in the United States only. It is not directed to, marketed to, or offered to users in the European Union / EEA, the United Kingdom, or other regions, and we do not intend to collect personal data from people located there. If we expand to those regions in the future, we will update this policy first — including appointing any representative required under EU or UK law and describing the legal bases we rely on.

2. Who this Privacy Policy applies to

TicPop is designed to be set up and managed by parents and legal guardians for use by their children aged approximately 6–12. Only a parent or legal guardian may create a TicPop account. By creating an account, you confirm that you are the parent or legal guardian of any child profile you add. The child does not log in and cannot create or modify their own profile data — the parent dashboard is PIN-protected so kids cannot access settings.

This policy explains what information we collect from you (the parent) and about your child, how we use it, who we share it with, and your rights. TicPop is offered in the United States, and this policy is written around US children's- and consumer-privacy law, including:

• The Children's Online Privacy Protection Act (COPPA) (United States, for users under 13)
• The California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)
• The New York Child Data Protection Act, and comparable US state children's-privacy laws

3. Information we collect

3.1 Information from the parent (you)

When you create a TicPop account, we collect:

• Email address (used to log in, send important notices, and contact you)
• Password (stored only in hashed form; we never see the plaintext password)
• A 6-digit sign-in PIN (optional) — if you set one up, you can sign in with your email and PIN instead of your password. The PIN is stored only as a secure server-side hash; we never store or see the PIN itself.
• A co-parent's email address (only if you invite one) — if you invite a second parent (co-parent) to share your family, you enter their email address. That email is processed to send the invite and is visible to you (the inviting parent) in your family members list. The co-parent uses their own account; you never see their password or PIN. Once they accept the invite, they can view and help manage your family's routines, rewards, and your children's activity.
• Subscription status (if you subscribe) — processed by Apple or Google through their in-app purchase systems. We never see or store your card or bank details. We receive only a subscription status and a pseudonymous internal account identifier linked to your account from RevenueCat.
• Device information about your device — operating system, app version, device model, and a device-scoped authentication token.

3.2 Information about your child (entered by you)

When you create a child profile, you enter:

• A nickname for the child (you choose what to enter — a real first name, a nickname, or any made-up label). We do not require a real name and we do not verify it.
• A preset avatar — you choose from a library of preset illustrated avatars (animals, kids, fantasy characters). We do not allow user-uploaded photos. TicPop does not request camera or photo-library permission.
• Routine, task and reward names and descriptions — you write these yourself (for example "Morning routine", "Brush teeth", "Movie night"). This is free text you enter; the app does not check or interpret it. Please don't put a child's real name or other sensitive details in these labels — you don't need to, and the app works the same either way.

We do not collect:

• The child's date of birth or age
• The child's real name (unless you choose to enter it as the nickname)
• The child's gender
• The child's location
• The child's photo
• Any other identifying information about the child

3.3 Information generated as your child uses the app

• Routines your child completes or misses
• Stars earned, rewards chosen, certificates earned
• The time each task was completed (recorded to the second, in your device's time zone, so the app can track streaks, on-time completion and progress)
• Which paired device a task was completed on, if you use more than one device, so progress stays in sync
• Scheduled local alarm settings (so the device can remind your child at the times you choose — these alarms run entirely on the device)

How we use the device identifier. When you pair a second device (for example a child's tablet), we assign it an internal device identifier. We use this identifier only to support the internal operations of the app — keeping your family's routines and progress in sync across your devices and letting a paired device work. We do not use it to build a profile of your child, to track your child across other apps or websites, or for any advertising, and we do not disclose it to anyone except the service providers listed in Section 6 who help us run the sync.

3.4 Technical information

• IP address (used to route requests; not stored long-term)
• Crash and diagnostic data: TicPop does not use any third-party crash-reporting SDK and does not itself collect or transmit crash or error reports. Separately, if you have allowed it at the operating-system or app-store level, Apple or Google may collect basic crash and performance diagnostics for apps on your device and make aggregated reports available to us as the app's developer (for example through Google Play's Android vitals or Apple's App Store). We do not control that collection — you can manage it in your device's privacy/diagnostics settings — and any such reports are used only to diagnose crashes, never to identify your child.

3.5 Information we explicitly do NOT collect

• No precise location (we don't request GPS)
• No contacts, photos, camera, microphone, messages, or gallery access — we do not request these permissions at all
• No advertising identifiers — we explicitly block the Android AD_ID permission and the equivalent iOS flags
• No cross-app tracking — we do not use Apple's App Tracking Transparency prompt because we do not track users across apps
• No third-party analytics — we do not use Firebase Analytics, Google Analytics, Mixpanel, Amplitude, the Facebook SDK, or any similar tool
• No cloud push notifications — TicPop only schedules local on-device alarms. We do not send push tokens to Apple, Google, or any server, and we do not store any push token on our backend
• No artificial-intelligence features — TicPop does not send any data to any AI provider and does not infer or label anything about your child

4. How we use the information

We use the information listed above only for these purposes:

1. Operating the app — showing your routines, tracking your child's progress, displaying certificates and rewards, syncing data across your devices.
2. Parental controls — allowing you to manage child profiles, review progress, and mark rewards as fulfilled.
3. Subscriptions — activating premium features when you subscribe through Apple or Google, and checking subscription status at app launch.
4. Support and communication — responding when you contact us, notifying you about important changes (security incidents, policy updates).
5. Legal compliance — meeting tax, fraud-prevention, and other legal obligations.

We do not use your or your child's information for behavioral advertising, profiling, or AI training, and we never use your child's information for marketing. The one exception on the adult side is the launch waitlist described in section 4a, which a parent joins voluntarily and can leave at any time.

4a. The launch waitlist on ticpop.app

If you enter your email address in the "Notify me" box on ticpop.app, we use it for one purpose only: to email you when TicPop is released on the App Store and Google Play.

• What we store: the email address you typed and the date you joined. Nothing else. We do not ask for, and do not want, a child's email address here.
• Why we may use it: you asked to be notified — you give this email voluntarily and only to hear when TicPop launches. The waitlist is intended for people interested in TicPop in the United States.
• Who processes it: Cloudflare, Inc. (US) stores the list, and Resend (Plus Five Five, Inc.) (US) delivers the emails. Both are bound by data-processing agreements with us.
• How many emails: one confirmation when you sign up, and one announcement when the app launches.
• How to leave: click "Unsubscribe" at the bottom of either email, or write to support@ticpop.app.
• Retention: when you unsubscribe, we remove your email from the active waitlist and stop using it immediately (our email provider may keep a minimal suppression record so you are not contacted again). Otherwise we delete the whole waitlist within 90 days of sending the launch announcement.
• The waitlist is entirely separate from any TicPop account. Joining it does not create an account, and we never merge it with the data described elsewhere in this policy.

5. Children's privacy — COPPA and how parental consent works

TicPop is designed for families. Only a parent or legal guardian can create an account. The child does not create their own account. All information about a child is entered by the parent and attached to the parent's account.

How we obtain parental consent

Only a parent or legal guardian may create a TicPop account, and only a parent or legal guardian may add a child profile. Before we collect personal information from your child, we obtain your consent in the following way:

1. You create the account yourself and verify your email address.
2. You confirm that you are the parent or legal guardian of any child whose profile you add, and you agree to this Privacy Policy and our Terms of Service.
3. When a child profile is created on your account, we send a confirmation to your verified email address letting you know that a profile was set up and how to withdraw your consent.
4. If you subscribe, your payment through Apple or Google provides an additional confirmation of your identity as the account holder.

Together, these steps are how we obtain your consent, as the parent or guardian, before collecting personal information from your child, and they are designed to meet COPPA's requirements for verifiable parental consent.

You can withdraw your consent at any time by deleting the child profile (Section 10) or deleting your account (Section 11). You may also ask us to stop collecting any further information about your child, without deleting your account, by emailing privacy@ticpop.app.

In plain words (for kids and families)

TicPop is a place to do your routines and earn stars. We keep your nickname, the avatar your grown-up picks for you, and your stars and streaks so the app works. We do not know your real name, where you live, or what you look like, and we never show you ads. A grown-up in your family is always in charge of your profile.

Your rights as a parent (COPPA)

As the parent or legal guardian, at any time you can:

• Review the personal information we have collected from your child — email us at privacy@ticpop.app and we will provide it to you.
• Refuse to allow any further collection or use of your child's information — and you can do this without deleting your whole account. Email privacy@ticpop.app and we will stop collecting new information for that child (note that some features may stop working as a result).
• Delete your child's information — remove the child's profile in the app (which deletes that child's data), delete your account, or email privacy@ticpop.app.

We will never require you to provide more information about your child than is reasonably necessary for your child to use TicPop.

What we do not do with children's data

• We do not share or sell children's data with third parties for marketing.
• We do not show advertisements to children.
• We do not use children's data for profiling, behavioral targeting, or AI training.
• We do not allow children to contact other users, post content publicly, or share data outside the parent's account.

Schools and organizations

TicPop is designed for individual family use. If you are a school, therapist, or organization considering deployment, contact us at support@ticpop.app — we may require additional agreements.

6. Who we share information with

We share information only in the limited cases listed below, and only with service providers bound by data protection agreements.

We do not sell or rent personal information to any third party. We do not use children's data for third-party advertising or profiling.

7. Where your data is stored

Velynq, Inc. is based in the United States. Your account and app data are stored with Supabase on servers in Ireland; some of our other service providers (PowerSync, RevenueCat, Expo, Resend, Cloudflare) are US-based. Wherever your data is held, it is encrypted in transit and at rest, and each provider is bound by a data-processing agreement that limits them to running the service for us. We do not sell or rent your data or move it anywhere for advertising.

8. How long we keep information

This is our written data-retention policy. We keep each type of information only for as long as it is reasonably necessary for the purpose it was collected, and we delete it when that purpose no longer applies. We never keep your child's personal information indefinitely.

When you delete your account (see Section 11), all data that we are not legally required to keep is removed within 30 days.

9. How we protect information

• All data is encrypted in transit (HTTPS / TLS 1.2+) and at rest.
• Passwords and sign-in PINs are stored only as salted cryptographic hashes.
• After repeated failed PIN sign-in attempts on an account, we temporarily lock that account's PIN sign-in to protect against guessing.
• Row-level security rules in our database ensure each family's data is isolated from every other family's data.
• Access to production systems is restricted to authorized personnel with multi-factor authentication.
• We carry out security reviews of the app and our systems, and act on what we find.

No security system is perfect. If we ever learn of a security incident affecting your information, we will notify affected users and any regulators promptly, as required by applicable law.

10. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — Ask us what information we hold about you or your child.
• Correction — Ask us to correct information that is wrong.
• Deletion — Ask us to delete your account and all associated data (see Section 11).
• Portability — Ask us to send you a copy of your data in a machine-readable format.
• Restriction or objection — Ask us to stop or limit how we use certain information.
• Withdraw consent — You can withdraw your consent at any time (this will typically require deleting your account or child profile).
• Lodge a complaint — You can complain to the US Federal Trade Commission (ftc.gov) or your state attorney general.

For California residents (CCPA/CPRA): you also have the right to know what personal information we have collected, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information. We do not sell or share personal information. You may also designate an authorized agent to make these requests on your behalf.

To exercise any of these rights, email us at privacy@ticpop.app. We will respond within 30 days (or sooner if required by law).

11. How to delete your account and all your data

You have three ways to delete your account:

1. In the app — Settings → Account → Delete Account. This triggers full deletion within 30 days.
2. On our website — visit https://ticpop.app/delete-my-data and follow the instructions. Available without reinstalling the app.
3. By email — write to privacy@ticpop.app from the email address on your account.

When you delete your account, we remove:

• All child profiles (nicknames and chosen avatars)
• All routine, reward, and progress data
• Your email address and password hash
• The data our service providers hold to run the app — your records in Supabase and PowerSync, and your subscription record at RevenueCat. We do not use a third-party crash-reporting service, so there are no crash reports held by any provider to delete.

Deleting your account does not cancel your subscription. Subscriptions are billed by Apple (App Store) or Google (Google Play), not by us, so we cannot stop that billing for you — to stop being charged you must also cancel with Apple or Google. See the delete-my-data page.

What we must keep (for legal reasons):

• Tax and payment records for up to 7 years (US tax and fraud-prevention law)
• Security/audit logs in minimized form

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Notify you by email (to the address on your account), and
• Show a notice inside the app on next launch, and
• Update the "Last updated" date at the top of this page.

Where local law requires, we will obtain your renewed consent before the changes take effect. If you do not agree to the changes, you can delete your account (Section 11).

13. Contact us

For any privacy question, request, or complaint:

• Email: privacy@ticpop.app
• Postal mail: Velynq, Inc., 221 W 9th Street, PMB 858, Wilmington, DE 19801, USA

You may also contact the US Federal Trade Commission (ftc.gov) or your state attorney general with a children's-privacy concern.

14. Additional US state privacy notices

Notice at Collection (California)

At or before the point of collection, this is what TicPop collects and why:

• Identifiers (parent email; optional co-parent email) — to create and secure your account and send required notices.
• A child's nickname and chosen avatar (entered by you) — to personalize your child's routines.
• Routine-progress data (completions, stars, streaks, certificates) — to run the app's core features.
• Basic device information — to operate the app. (Crash and diagnostic data are not collected — see §3.4.)

We keep this information only as long as described in Section 8. We do not sell or share personal information, and we do not use it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 16.

California residents (CCPA/CPRA)

You have the right to know, delete, and correct your personal information, and to opt out of the sale or sharing of it. Because we do not sell or share personal information, there is nothing to opt out of. You will not be treated differently for exercising any right, and you may use an authorized agent. To exercise a right, email privacy@ticpop.app.

New York residents (NY Child Data Protection Act)

TicPop is directed to children, and we process a child's information only as necessary to provide the service you have asked us for. We do not process children's data for targeted advertising, sale, or profiling, and our service providers are bound by contract to do the same. For any child under 13, we rely on the verifiable parental consent described in Section 5.

15. Governing law

This Privacy Policy and any dispute relating to it are governed by the laws of the State of Delaware, United States, without regard to its conflict-of-law rules. This does not deprive you of the protections you are entitled to under the mandatory laws of your country of residence.

16. International users

TicPop is offered in the United States and is not directed to users in the European Union / EEA or the United Kingdom (see Section 1). Accordingly, this policy does not set out GDPR or UK GDPR lawful-basis details. If we make TicPop available in those regions in the future, we will update this policy before doing so — appointing any representative required under EU or UK law and adding the lawful-basis and international-transfer information those laws require.

The canonical version of this policy is available at https://ticpop.app/privacy.