Effective February 20, 2026 · Last updated October 17, 2026 · Version 1.6.1
Effective Date: February 20, 2026
Last Updated: October 17, 2026
Policy Version: 1.6.1
This Privacy Policy ("Policy") is issued by Mahamane Sissoko, an individual developer registered in the United States of America ("Developer," "we," "us," or "our"), and governs the collection, use, storage, disclosure, and protection of personal information obtained through the Rulely mobile applications for Android and iOS ("Rulely," "App," or "Application") and all associated services, including the web dashboard accessible at https://app.rulely.app ("Web Dashboard").
Rulely is a family-oriented parental control application designed to help guardians manage their children's device usage and enforce app-blocking rules. Rulely is available on Android and on iOS; on iOS it uses Apple's built-in Screen Time technology to apply the rules a Guardian configures. Because Rulely is designed for use by families, including children under the age of thirteen (13), this Policy has been drafted to comply with, and shall be interpreted in accordance with, the following laws and regulations:
By downloading, installing, accessing, or using Rulely, you ("User," "you," or "your") acknowledge that you have read, understood, and agree to be bound by this Policy. If you are a guardian or parent consenting on behalf of a child, you represent and warrant that you have the legal authority to provide such consent.
If you do not agree to this Policy, you must not use Rulely.
For the purposes of this Policy, the following terms shall have the meanings ascribed below:
"Child" or "Student" means any individual under the age of eighteen (18), and where specifically referenced in the context of COPPA, any individual under the age of thirteen (13), whose device usage is managed through Rulely.
"Guardian" or "Parent" means a parent, legal guardian, tutor, mentor, counselor, or other adult who has registered an account on Rulely and has established a verified connection with a Child for purposes of supervision and management.
"Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. This includes, without limitation, persistent identifiers such as device identifiers and IP addresses, behavioral data, and inferred data, consistent with the expanded definition under COPPA as amended in 2025.
"Device" means the Android or iOS mobile device on which Rulely is installed.
"Service Provider" means a third-party entity that processes data solely on behalf of and under the instruction of the Developer, as distinguished from a third party that uses data for its own purposes.
"Processing" means any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
When a Guardian or Student creates an account or uses Rulely, we may collect the following categories of information provided voluntarily:
(a) Guardian Information:
(b) Student Information:
(c) Relationship Information:
(d) User-Generated Content:
(e) Sign in with Apple:
A Guardian can create a Rulely account, or sign in, with their Apple Account instead of an email and password. When they do, Rulely receives from Apple:
Rulely also obtains from Apple a refresh token for the Guardian's Sign in with Apple session. We store it on our server only so that we can revoke it when the account is deleted: it is kept where no Rulely app or website can read it, and it is used for nothing else. When the Guardian deletes their Rulely account, we send the token to Apple to revoke it, which ends Rulely's access through that sign-in. If Apple cannot be reached, we retry automatically, and we erase the token once Apple confirms the revocation. We keep only a record that the revocation was requested and completed, without the Guardian's name, email address, or account identifier. Rulely never receives the Guardian's Apple Account password.
When Rulely is installed on a Child's device and the Guardian has provided verifiable parental consent, the Application collects the following information automatically:
(a) Installed Application Data (Android):
This inventory is stored while the Device is paired so that the Guardian can see and manage the Child's applications, and it is deleted when the Student is removed. Records for applications that have since been uninstalled are retained in a deactivated state until the Student is removed. Protected system applications (device Settings, Phone/Dialer, Camera, Emergency, System UI, Launcher, and system package management) are excluded from collection and cannot be selected for blocking.
On iOS, Rulely does not collect a list of installed applications. The Guardian selects applications to manage using Apple's system picker, and iOS provides Rulely only with opaque tokens representing that selection — never a readable list of what is installed on the Device.
(b) Device Usage Data:
(c) Device and Messaging Identifiers:
We do not collect an Android advertising ID, an iOS advertising identifier (IDFA), the device phone number, IMEI, or hardware MAC address on either platform.
(d) Device and App Information:
(e) Enforcement, Policy, and Operational Data:
Rulely utilizes the following Android system services, each of which is described in detail in Section 10 of this Policy:
canRetrieveWindowContent capability is explicitly disabled.On iOS, Rulely does not use these Android services. Instead, it relies on Apple's Screen Time frameworks (Family Controls, Device Activity, and Managed Settings). Under this model, Apple's operating system performs enforcement on the device based on the rules the Guardian configures. Detailed usage information on iOS — including which applications were used and for how long — is processed entirely within Apple's on-device sandbox and is never transmitted to Rulely's servers or to any third party. The only information about the Child's use of the device that leaves an iOS device concerns Rulely's own rules: that a Guardian-configured time limit has been reached and when, when a scheduled block or bedtime period started and ended, and when the Child tried to open something the rules were blocking (the time and which rule applied — never which app or website). This is necessary to update the Guardian's dashboard and coordinate enforcement.
Rulely does not collect, and has never collected, the following categories of information:
The following commitments are central to how Rulely is built, and they apply on both Android and iOS:
Rulely is free to set up and runs without charge until it has demonstrably done its job in a family, after which the Guardian is offered a paid subscription ("Rulely Active"), one per family. The subscription is sold by the Developer (the merchant of record), not by Apple or Google. The Guardian starts it from the Rulely app, which opens a checkout page on rulely.app; payment is taken on a page hosted by our payment processor, Stripe, Inc. ("Stripe"). Stripe collects the payment method and the email address and billing details entered at checkout, processes every charge and renewal, and sends the receipts. Rulely never receives a payment card number or bank account.
To know whether a family's subscription is active, Rulely stores the following, linked to the Guardian's account:
Rulely also records, for its own operation, when a family completed setup, when the free period ended and on what basis, when the subscription offer was shown (including which version of the offer screen was shown and from where in the app it was opened), which plan (monthly or yearly) the Guardian tapped, whether the Guardian declined the offer ("Not now") or closed it without answering and whether they had tapped Subscribe before closing it, when a checkout was started and how far it got (opened on rulely.app, checkout page created at Stripe, completed, abandoned by going back, or expired unused), how long the Guardian was away from the app during checkout and whether Rulely was active when they returned, when the billing-management page was opened, the dates of any grace period and lapse, when enforcement stopped or resumed, and, for accounts that predate the subscription, that the family is exempt from charges. These records contain no information about the Child's activity.
We use subscription information solely to (a) determine whether Rulely Active is on for the family and keep enforcement running or stop it accordingly, (b) recognize the subscription on any device the Guardian signs in to, (c) send the Guardian the notices described in the app before and after enforcement stops, including when a renewal payment fails, (d) cancel the subscription when the Guardian deletes their account, so they are not charged again, and (e) understand, in aggregate, how the free period and subscription are working. We do not use it for advertising and do not share it with anyone other than Stripe, as described in Section 7.2.
To see where new families get stuck while setting up Rulely, the iOS app records the setup steps on a device before any account exists. These records are tied to the anonymous setup identifier described in Section 3.2(c) — a random identifier the app creates; it is not derived from any hardware or advertising identifier.
What is recorded:
What is never recorded: the content of anything typed into the app — no email address, password, name, Child's name, or commitment text (for the optional note, only its kind and length range, as described above). Apart from launches of Rulely itself, these records contain no information about the Child's use of their device.
The app is the same on every iPhone or iPad, so these records start on any device where Rulely is opened, including a Child's device before it is paired; before a Child's device is paired, they record only that the app was opened, that the welcome screen was shown, and that "a child's phone" was chosen. If an account is created or signed in to on that device, the device's earlier records are linked to that account; when a Child's device is paired, they are linked to the Child's account, and later launches of the app on that device are linked to it as well.
These records are processed only on our own infrastructure and are never shared with or made available to any third party, including the Meta component described in Section 7.3. They cannot be used to track anyone across apps, websites, or companies. All of them are automatically deleted after 180 days; records linked to an account are deleted earlier if that account is deleted. Deleting the app deletes the identifier itself; a reinstall generates a new, unrelated one.
A Child's device is paired with a short code. To stop anyone from guessing codes, when a code entered on a device is wrong or expired, or the device has been temporarily blocked for too many wrong tries, we log the network IP address the attempt came from (for IPv6 addresses, only the network prefix), the result, and the time. The code itself is never logged, and successful pairings are not logged this way. These logs are used only to limit repeated wrong tries, cannot be read by any Rulely app or website, and are deleted automatically after two days.
Rulely advertises in the App Store through Apple Ads. To learn which of our own advertisements bring families to Rulely, the iOS app, when it is first opened, asks Apple's AdServices framework — part of iOS — for an attribution token, a short-lived code that iOS generates on the device. The app sends that token to our server together with the anonymous setup identifier described in Section 3.2(c), the app version, and whether the app was installed from the App Store or is a test build. Our server sends Apple the token, and nothing else, and Apple answers whether the download followed a tap on, or a view of, one of Rulely's Apple Ads advertisements. If the app cannot reach our server, or Apple does not have an answer yet, the app tries again when it is opened, for up to fourteen (14) days. Our server does not store the token.
What we store is Apple's answer. If the download followed one of our advertisements, the answer contains campaign-level information only: the identifiers of our Apple Ads account and of the campaign, ad group, keyword, and ad; the country or region; whether the download was a first download or a re-download; whether it was attributed to a tap or to a view of the advertisement; and the date of that interaction. If it did not, we store only that the download was not attributed to Apple Ads. To show the names of our own campaigns, ad groups, and keywords in place of their numbers, our server looks those names up in our Apple Ads account; that lookup contains no information about any user or device.
The answer is stored with the anonymous setup identifier. If an account is created or signed in to on that device, the answer is linked to that account; when a Child's device is paired, it is linked to the Child's account, in the same way as the setup records described in Section 3.7. We use it only to count, for each of our advertisements, how many installations, accounts, and completed setups it led to, and the account deletion record described in Section 8.3 notes whether the account came from Apple Ads and, if so, the campaign and keyword identifiers. It is deleted when the account it is linked to is deleted; the answer for an installation on which no account is ever created or signed in to is kept, linked only to the random setup identifier.
Apple Ads attribution does not use the advertising identifier (IDFA), does not ask for App Tracking Transparency permission, and does not track anyone across other companies' apps or websites. We do not send Apple the setup identifier, account information, or any information about the Child, and we do not share Apple's answer with anyone or sell it. Because the iOS app is the same on every device, this check also runs on a Child's device the first time Rulely is opened there, before it is paired.
We process Personal Information solely for the following purposes:
We do not use Personal Information for advertising, marketing to Children, profiling for commercial purposes, or any purpose not disclosed in this Policy.
Processing of a Child's Personal Information is conducted pursuant to verifiable parental consent obtained from the Guardian prior to collection, as described in Section 6 of this Policy.
We rely on the following legal bases:
We do not sell Personal Information. We do not share Personal Information for cross-context behavioral advertising. Consumers may exercise their rights as described in Section 11 of this Policy.
Processing is based on the consent of the legal guardian (Article 14) and the necessity of processing for the performance of the service (Article 7, V).
Rulely does not collect any Personal Information from a Child's device until the Guardian has completed the parental consent verification process described in this section, with four limited exceptions, none of which includes the Child's name, contact information, or anything typed or viewed on the device: the setup records described in Section 3.7 (before pairing, only that the app was opened, that the welcome screen was shown, and that "a child's phone" was chosen, tied to a random identifier); the Apple Ads attribution answer described in Section 3.9 (whether the installation followed one of Rulely's own Apple Ads advertisements, tied to the same random identifier); the pairing-code security logs described in Section 3.8; and the anonymous install measurement performed by the Meta component described in Section 7.3. Apart from these, no data is transmitted from a Child's device prior to the completion of this process.
The parental consent process consists of the following steps:
(a) Disclosure: Before consent is requested, the Guardian is presented with a plain-language summary of all data that Rulely will collect from the Child's device, the purposes for which such data will be used, and a direct link to this Privacy Policy.
(b) Affirmative Consent: The Guardian must affirmatively indicate consent by tapping an "I Consent" button. Navigating away from the consent screen, closing the application, or failing to take action does not constitute consent.
(c) Email Verification: A verification code or link is sent to the Guardian's registered email address. The Guardian must complete email verification to finalize consent. The email address must be associated with the Guardian's authenticated account.
(d) Consent Record: Upon successful verification, Rulely stores a tamper-evident record of the consent event, including: the Guardian's user identifier, the Child's user identifier, the date and timestamp of consent, the version of the Privacy Policy in effect at the time of consent, and the method of verification.
At any time after providing consent, the Guardian may:
If this Privacy Policy is materially updated in a manner that expands the categories of data collected from Children or alters the purposes of processing, Guardians will be required to review and re-consent to the updated Policy before data collection continues under the new terms.
We do not sell, rent, lease, or trade Personal Information to any third party for monetary or other valuable consideration. This prohibition applies to all categories of data and all categories of users, including Children.
We engage the following service providers to process data on our behalf and under our instruction. Each acts only on our instructions and does not use the data for its own purposes:
Supabase, Inc.
Apple, Inc. (Apple Push Notification service)
Apple, Inc. (Sign in with Apple)
Apple, Inc. (Apple Ads attribution)
Stripe, Inc.
Resend (Resend, Inc.)
Vercel, Inc.
Meta Platforms, Inc.
Apart from the Meta component described below, Rulely integrates no third-party analytics, advertising, or tracking SDK, and none that profiles users or follows them across apps, websites, or companies. All product analytics are performed internally using our own infrastructure. This includes our measurement of the app's setup flow on iOS, which uses the first-party anonymous setup identifier described in Sections 3.2(c) and 3.7: it exists so we can see which setup steps new families reach, is processed only on our own infrastructure, and is never provided to any third party.
To learn whether an installation followed one of Rulely's own Apple Ads advertisements, the iOS app uses Apple's AdServices framework, as described in Section 3.9. AdServices is part of iOS, not a third-party SDK added to the app: it gives the app a short-lived token, which our server exchanges with Apple for a campaign-level answer. We send Apple only that token, and Apple's answer is stored only on our own infrastructure. This does not use the advertising identifier (IDFA) or App Tracking Transparency.
The iOS application contains a single third-party measurement component: Meta's software development kit, integrated solely so that Apple's SKAdNetwork framework can report — anonymously and in aggregate — whether Rulely's own app-install advertisements resulted in installations. This component is configured so that it does not request App Tracking Transparency permission, cannot access the device advertising identifier (IDFA), and receives no account information and no Child activity, usage, or enforcement data. It automatically reports app-installation and app-open events together with basic device characteristics and a random identifier scoped to the app installation, and it reports crashes of the Meta component itself in anonymous form. Because the iOS app is the same on every device, this component runs on every iPhone or iPad where Rulely is installed, including a Child's device. Apple designed SKAdNetwork so that install attribution cannot identify a specific user, device, or family. Meta Platforms, Inc. acts as our Service Provider for this purpose, as described in Section 7.2.
We may disclose Personal Information if we reasonably believe that disclosure is necessary to:
In the event of such disclosure, we will endeavor to limit the scope of information disclosed to that which is strictly necessary for the stated purpose.
In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, Personal Information may be transferred to the acquiring entity, provided that the acquiring entity agrees to be bound by the terms of this Policy with respect to all previously collected Personal Information.
We retain Personal Information only for as long as necessary to fulfill the purposes described in this Policy, subject to the following specific retention rules:
| Data Category | Retention Period |
|---|---|
| Guardian account data | Retained until the Guardian deletes their account |
| Subscription and purchase records (Section 3.6) | Retained while the Guardian account exists; deleted with the account. When an account is deleted, the subscription is cancelled at Stripe, and we keep only the Stripe customer and subscription identifiers and a record of billing notices (no name, email, or payment details) for as long as needed to confirm the cancellation and keep accurate financial records. Stripe retains its own transaction records under its terms and the law. |
| Student profile data | Deleted immediately upon Guardian-initiated student removal or account deletion |
| Installed application records | Deleted immediately upon student removal |
| App-blocking enforcement logs | Deleted immediately upon student removal |
| System diagnostic logs | Retained for ninety (90) days, then automatically and irreversibly deleted |
| Analytics events | Retained for ninety (90) days, then automatically and irreversibly deleted |
| Setup measurement records (Section 3.7) | Automatically deleted after one hundred eighty (180) days; records linked to an account are deleted earlier if the account is deleted |
| Pairing-code security logs (Section 3.8) | Automatically deleted after two (2) days |
| Apple Ads attribution answers (Section 3.9) | Deleted when the account they are linked to is deleted; the answer for an installation on which no account was ever created or signed in to is retained, linked only to the random setup identifier |
| Sign in with Apple refresh token (Section 3.1(e)) | Retained while the account exists; revoked through Apple and erased when the account is deleted |
| Device push notification tokens | Deleted when the Child is removed or the account is deleted |
| App version and device type records (Section 3.2(d)) | Deleted when the Child is removed or the account is deleted |
| Device timezone records (Section 3.2(d)) | Deleted when the Child is removed or the account is deleted |
| Background App Refresh, Low Power Mode, and last-opened report (Section 3.2(d)) | Only the most recent report is kept; deleted when the Child is removed or the account is deleted |
| Parental consent records | Retained for the duration of the Guardian-Student relationship plus three (3) years to comply with legal record-keeping obligations. When the Guardian deletes their account, these records are deleted with it. |
| Account deletion record (Section 8.3) | Retained; contains no name, email address, or account identifier |
A Guardian may request the immediate deletion of all data associated with a specific Child by:
Upon receiving a verified deletion request, we will delete or de-identify all Personal Information associated with the identified Child within thirty (30) days, except for information that we are legally required to retain (such as consent records).
When a Guardian deletes their Rulely account entirely, all associated data, including all connected Student profiles, enforcement logs, and configuration data, is permanently deleted within thirty (30) days. To delete your entire account and associated data, visit our account deletion page.
When an account is deleted, we keep a short record of the deletion so we can understand why families leave Rulely. It contains: when the account was created and when it was deleted, when the app was first opened, how far through setup the account got, whether Rulely was being used for a family or by one person on their own phone, the number of children, the platform, the reason given for leaving, if one was chosen — including any text typed into the optional "other" field (up to 500 characters) — and where the account came from: whether its installation followed one of our Apple Ads advertisements and, if so, the campaign and keyword identifiers (Section 3.9). It contains no name, email address, or account identifier, and no information about the Child's activity. A notice with the same content, apart from where the account came from, is sent to the Developer. A similar summary of the account's subscription history — the dates of setup, the free period, the subscription offer, checkout steps, any grace period and lapse, the subscription's status, and where the account came from — is kept the same way, with no name, email address, or account identifier. If the account used Sign in with Apple, the Apple token is revoked as described in Section 3.1(e); if it had a Rulely Active subscription, the subscription is cancelled as described in Section 8.1.
System diagnostic logs and analytics events are subject to an automatic ninety (90) day retention policy. Records older than ninety (90) days are permanently and irreversibly deleted through automated processes. Setup measurement records (Section 3.7) are deleted the same way after one hundred eighty (180) days, and pairing-code security logs (Section 3.8) after two (2) days.
Guardians may export a comprehensive copy of all data associated with their account and their connected Students through the "Export My Data" function available in the application and the Web Dashboard.
Exported data is provided in machine-readable JSON or CSV format and includes:
Data export requests are processed within seventy-two (72) hours of the request.
Rulely requires the following sensitive Android permissions. Each permission is essential to the core functionality of the application and is used strictly as described below. Prominent in-app disclosures are presented to the user immediately before each permission is requested.
For a visual demonstration of these permissions in action, you can watch the following videos:
Permission: Android Accessibility Service API
Purpose: To detect when the foreground application changes on the Child's device. This detection is necessary to enforce app-blocking rules configured by the Guardian. When a blocked application is detected in the foreground, Rulely triggers the blocking overlay.
What is accessed: The package name and class name of the application that has entered the foreground. This information identifies which application is active.
What is NOT accessed: Rulely does not retrieve, read, intercept, store, or transmit the content displayed within any application. The Accessibility Service configuration explicitly disables the canRetrieveWindowContent capability. Rulely does not inject input events, modify user interface elements, or perform any autonomous actions on behalf of the user.
Data handling: The detected package name is compared against the Guardian-configured blocking list in real time. If the application is not blocked, the package name is discarded immediately and is not stored or transmitted.
In-app disclosure: Before requesting this permission, Rulely displays a dedicated disclosure screen explaining: (i) that the Accessibility Service will detect which app is in the foreground; (ii) that this is necessary to block restricted apps; (iii) that no screen content is read or stored; and (iv) that the user must tap "I Understand" to proceed.
Permission: PACKAGE_USAGE_STATS (UsageStatsManager API)
Purpose: To identify which application is currently in the foreground as a secondary detection method alongside the Accessibility Service, ensuring reliable enforcement of blocking rules.
What is accessed: Usage events from the most recent ten-second window, specifically application resume and pause events, limited to identifying the currently active application.
What is NOT accessed: Historical application usage data, usage duration statistics, or any data beyond the immediate foreground application identification.
Data handling: Foreground application identification is performed in memory. The data is not persisted to local storage or transmitted to any server except when a blocking event is triggered, in which case only the blocked application's package name, the timestamp, and the enforcement action are recorded.
In-app disclosure: Before directing the user to the system settings screen to grant this permission, Rulely displays a disclosure explaining: (i) that Usage Stats access is needed to detect the active app; (ii) that only real-time foreground detection is performed; (iii) that no usage history is collected or stored.
Permission: SYSTEM_ALERT_WINDOW (Draw Over Other Apps)
Purpose: To display a full-screen blocking notification when a Child opens an application that the Guardian has restricted. The overlay prevents the Child from interacting with the blocked application until they navigate away.
What is displayed: A notification informing the Child that the application is blocked, with an indication of the Guardian-configured rules (such as "This app is locked until tomorrow").
Data handling: The overlay does not collect, store, or transmit any data from the underlying application.
In-app disclosure: Before requesting this permission, Rulely displays a disclosure explaining: (i) that the overlay is used to display a blocking screen over restricted apps; (ii) that the overlay does not interact with or collect data from any application.
Permission: FOREGROUND_SERVICE, FOREGROUND_SERVICE_SPECIAL_USE
Purpose: To maintain continuous app-blocking enforcement while the device is in use. The foreground service type is designated as specialUse under Google Play's parental control classification.
What is accessed: The system allows Rulely to display a persistent notification indicating that the parental control service is active and running.
What is NOT accessed: The foreground service does not directly collect additional personal data beyond what is already collected through the Accessibility Service and Usage Stats Access permissions. It simply keeps the enforcement mechanism active.
Data handling: The foreground service maintains the blocking engine's state in memory but does not independently transmit data. Enforcement events are logged only when a Child attempts to open a blocked application.
In-app disclosure: Before the service is enabled, Rulely displays a disclosure explaining: (i) that the foreground service ensures continuous protection; (ii) that it displays a persistent notification; (iii) that it requires device resources to remain operational.
For a detailed visual explanation of how the foreground service maintains continuous protection, watch our Foreground Service Demo Video.
Boot Completed (RECEIVE_BOOT_COMPLETED): Used to restart the enforcement service after the device reboots, ensuring continuous enforcement of Guardian-configured rules.
Notifications (POST_NOTIFICATIONS): Used to display blocking notifications and enforcement alerts.
Battery Optimization Exemption (REQUEST_IGNORE_BATTERY_OPTIMIZATIONS): Requested to prevent the operating system from terminating the enforcement service during periods of inactivity.
If your Child is under thirteen (13) years of age:
If you are located in the European Economic Area, you have the following rights:
For users under the age of sixteen (16) (or the applicable age in your member state), consent for processing must be provided by the holder of parental responsibility.
If you are a California resident, you have the following rights:
To exercise any of these rights, contact us using the information provided in Section 14.
If you are located in Brazil, you have the following rights under Articles 18 and 19 of the LGPD:
We implement the following technical measures to protect Personal Information:
In the event of a data breach that affects the security, confidentiality, or integrity of Personal Information, we will:
Personal Information collected through Rulely is stored and processed in the United States of America, specifically in data centers located in the state of Virginia. If you are accessing Rulely from outside the United States, you acknowledge that your Personal Information will be transferred to and processed in the United States.
For users in the European Economic Area, such transfers are conducted pursuant to Standard Contractual Clauses or other lawful transfer mechanisms recognized under Chapter V of the GDPR.
For users in Brazil, such transfers are conducted in compliance with Articles 33 through 36 of the LGPD.
If you have questions about this Policy, wish to exercise any of your rights, or need to report a concern, you may contact us through any of the following methods:
Developer / Data Protection Contact:
Mahamane Sissoko
Email: mahamane@rulely.app
Phone: +1 (973) 517-4706
Mailing Address: United States of America
In-App: You may also submit inquiries through the feedback function within the Rulely application.
We will respond to all privacy-related inquiries within thirty (30) days. For requests submitted under the GDPR, we will respond within thirty (30) days, with a possible extension of sixty (60) additional days for complex requests, in accordance with Article 12(3).
We reserve the right to update or modify this Privacy Policy at any time. When we do so, we will:
Your continued use of Rulely after any non-material modification constitutes acceptance of the updated Policy. For material modifications affecting Children's data, continued collection will only proceed after renewed parental consent is obtained.
The following summarizes the disclosures made in Rulely's Google Play Data Safety section, consistent with the requirements of the Google Play Developer Program Policies:
Data Collected:
| Data Type | Collected | Shared | Purpose |
|---|---|---|---|
| Name (display name) | Yes | No | App functionality, account management |
| Email address | Yes | No | Authentication, parental consent verification |
| Phone number | Optional | No | Guardian contact preference |
| User IDs | Yes | No | Account management, security |
| App interactions | Yes | No | Parental control enforcement |
| Installed apps | Yes | No | App-blocking enforcement (Android only; iOS uses Apple's on-device app picker and no list is collected) |
| Other user-generated content | Yes | No | In-app feedback |
| Device identifiers | Yes | No | Device binding, security |
| Purchase history (subscription records from Stripe) | Yes | No | Subscription status, cancellation on account deletion, enforcement-stop notices |
| Diagnostics | Yes | No | App stability, error resolution |
Data NOT Collected: Location, payment card or billing details (held by Stripe), health/fitness, photos/videos, audio, files, contacts, calendar, web browsing, advertising identifiers.
Security Practices:
Data Sharing: Data is not sold or shared with third parties for advertising, marketing, or any purpose outside the scope of Rulely's core functionality. The service providers listed in Section 7.2 (including Supabase for backend hosting, and providers used to deliver notifications, email, and the Web Dashboard) process data solely on our behalf and under our instructions.
This Policy shall be governed by and construed in accordance with the laws of the United States of America, without regard to its conflict of laws principles. To the extent that the laws of other jurisdictions (including but not limited to the GDPR, CCPA, and LGPD) apply to specific users by virtue of their location, the provisions of this Policy applicable to those jurisdictions shall be interpreted in accordance with those laws.
If any provision of this Policy is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect. The invalid or unenforceable provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving its original intent.
This Privacy Policy, together with the Rulely Terms of Service, constitutes the entire agreement between the Developer and the User with respect to the privacy practices of Rulely and supersedes all prior or contemporaneous communications, representations, or agreements, whether oral or written, relating to the subject matter hereof.
Rulely Privacy Policy v1.6.1
Copyright 2026 Mahamane Sissoko. All rights reserved.
Contact our privacy team directly. We respond to all privacy inquiries within 30 days.