Privacy Policy

Last updated: October 17, 2026

WhaleTales ("we", "our", or "the app") is a comic reading app that helps children aged 9 to 11 learn English. It is made for the Kids Category of the App Store. This policy explains, for parents and guardians, what we collect, why, who else sees it, how long we keep it, and how to have it removed.

1. Who we are, and how to reach us

WhaleTales is made and run by Ahmet SIRIM, the developer the App Store names as its seller. Ahmet SIRIM is responsible for the personal data this policy describes (the data controller).

For anything about your child's data or your own, email support@flyingwhale.app.

2. The account belongs to the parent

A parent or guardian creates the account with Sign in with Apple, using their own Apple ID. Signing in, the purchase screen, links that leave the app and the feedback email sit behind a parental gate: the device owner's Face ID, Touch ID or passcode. If the device has no passcode, the app shows a notice once and then lets these steps open without the check, so we recommend setting a passcode on any device your child uses.

Signing in with your Apple ID is how you, the parent, give consent for the app to collect the information described below. You can withdraw that consent at any time by deleting the account (section 8).

3. What stays on the device

Some things never leave the device:

• Your child's nickname. It is stored on the device only and is never sent to us.
• The answers to the starting level check. Only the resulting English level is sent (section 4).
• Crash and performance summaries. The app reads Apple's on-device performance reports (MetricKit) for its own diagnostics. The app does not send them to us or to anyone else. If you chose in the device settings to share analytics with app developers, Apple may share crash reports with us.
• Translations. When a word card is translated, Apple's translation runs on the device.

4. What we collect, and why

The following is stored on our server and linked to the account. None of it is used to track anyone or to show ads.

• The parent's email address. The address Apple gives us the first time you sign in, which may be a private relay address if you chose Hide My Email. We keep it so we can reach the owner of the account. We never see your Apple ID password.
• An Apple account identifier and an Apple sign-in token. Apple's identifier for your Apple ID in this app, and a token Apple gives us at sign-in. We keep the token so that we can cancel the app's access to your Apple ID when the account is deleted.
• A random account ID. We create it to link the account to its reading progress and purchases.
• English level. The level your child reads at, from the starting level check, so the app shows stories at that level.
• Reading progress. Which chapters were finished, which words were met in the stories and which were tapped for a word card, which story characters, places and things were discovered, and which next story was voted for. We use it to show progress in the app, to follow how your child's English grows, and to decide which stories to make next.
• Purchase and credit records. The subscription status, any lifetime purchase, and credits bought earlier and used, so the account gets what was paid for.
• Sign-in sessions. A session lets the app stay signed in. We store it in a form that cannot be read back, and it ends after 30 days without use.
• Product events. A few events linked to the account ID: when the "ask a grown-up" screen or the purchase screen is shown, when the parental gate is passed, when a purchase is started or made, when your child first finishes a chapter, and, if known, how you found the app. Each event holds its name, the account ID, the time and, where it applies, the product that was bought or the way you found the app. They help us see what works.

We do not collect your child's name, birth date, photos, voice, location or contacts, and we do not collect device advertising identifiers. When the app talks to our server, our own service records which part of the service was called, the result, how long it took and the account ID, to keep the service running and to find problems. The web server in front of our service may also keep standard request logs, which can include an IP address.

5. Stories and pictures

The library's stories and pictures are made ahead of time with the help of AI tools. Each story passed a safety check and a review before it was added. Nothing your child does in the app is sent to an AI service: the app shows stories that already exist and writes nothing new while it is used.

6. Who else sees data

• Apple handles Sign in with Apple and all payments through the App Store. We never see card details.
• RevenueCat keeps the purchase records for us, so the app knows what has been bought. Before sign-in it knows the device only by a random identifier; after sign-in it receives the random account ID. It does not receive the email address or the nickname.

The app contains no advertising, no third-party analytics and no tracking. We do not sell or rent personal data, we do not share it with data brokers, and we do not track anyone across other companies' apps or websites.

7. How long we keep data

We keep the data in section 4 for as long as the account exists. A sign-in session ends after 30 days without use. We take a backup of our database every night and before each update, and keep the last seven copies, on the same server.

8. Reviewing and deleting your child's data

You can delete the account in the app, in the Me tab. The app asks you to confirm first. It warns that your child's progress, words and discoveries go with the account, that credits bought earlier and not yet spent are lost, that refunds are handled by the App Store, and that deletion cannot be undone. This step is not behind the parental gate, so a child holding the device can start it too; the confirmation is the only check.

When the account is deleted, we first cancel the app's access to your Apple ID with Apple, and then remove the account, the email address, the reading progress, the product events and the sessions from our server. Records of past purchases and credit use are kept for accounting and refunds. They no longer carry the account ID and do not say which chapters were read, but each purchase record keeps the App Store's transaction ID, which Apple and RevenueCat can link to that purchase. The app also signs out of RevenueCat and removes from the device the sign-in, your child's nickname, the starting level result, the chapters kept for reading again, and any reading progress or events not yet sent. Only the appearance setting, the notice shown when the device has no passcode, and the saved library pictures stay, because they belong to the device rather than to a reader. Signing out removes the same things from the device. A sign-in that our server has ended removes them too, except your child's nickname. Copies in our nightly backups are replaced by newer ones, so deleted data is gone from them after at most seven nights. Purchase records that RevenueCat already holds are kept under its own policy; email us if you want them removed.

An active subscription is managed by Apple, and deleting the account does not cancel it. Cancel it in your Apple ID settings.

To review the data we hold or to receive a copy, email support@flyingwhale.app from the address you use with the app, or tell us the account's relay address. To stop all collection, delete the account in the app. We answer within one month.

9. Children's privacy laws

We follow the rules of the United States Children's Online Privacy Protection Act (COPPA) and the European Union's General Data Protection Regulation (GDPR) for children. In short: the account and the consent belong to the parent; we collect only what the app needs to work; we use it only for the app; we do not show ads or let others track children; and the parent can see and delete the data at any time. In the European Union and the United Kingdom, we rely on our agreement with the parent to provide the app as the legal basis for using the data. You also have the right to complain to your local data protection authority.

10. Changes to this policy

When we change this policy, we update the date at the top of this page. If a change means we would collect new kinds of information about children, we will ask for the parent's consent again first.