Privacy Policy

Effective date: 19 May 2026 · Last updated: 19 May 2026

This Privacy Policy explains how OUTSOURCED CTO (PTY) LTD ("we", "us", "our"), the publisher of the Tooth Tycoon mobile application and the toothtycoon.com website (together, the "Service"), collects, uses, and shares information. By using the Service you agree to this policy.

1. Information we collect

Information you provide

• Parent account: when you create an account, we collect your email address and an authentication credential (or social-sign-in token from Apple or Facebook).
• Child profiles: the names, ages, and optional photos of the children you choose to track. This data is created and managed by you, the parent.
• Tooth pull history: dates, tooth types, optional photos of teeth/smiles, and reward amounts you record.
• Financial preferences: currency, per-tooth budget, and any savings/investment goals you configure inside the app. We do not collect bank or card data — purchases run through Apple App Store, Google Play, or Paystack.

Information collected automatically

• Device and app analytics: via Firebase Analytics, we record anonymised events such as which screens you visit and when you complete major actions (sign in, add child, record tooth, set budget). Ad-related signals (ad_storage, ad_user_data, ad_personalization, advertising_id / IDFV) are denied at every layer — we do not enable Google Signals, ad personalisation, or any advertising profile on this Service.
• Diagnostics: crash logs and performance traces via Firebase Crashlytics.
• Standard server logs: our backend logs IP address and basic request metadata for security, abuse prevention, and debugging. These logs are retained for a maximum of 90 days.

Website cookies & analytics (toothtycoon.com)

• Google Analytics 4 (loaded via Google Tag Manager) measures anonymous, aggregated traffic on this website — such as pages viewed, referrer, approximate region, and device/browser type. It sets first-party cookies (for example _ga and _ga_<id>) to tell visitors apart.
• Consent first. Analytics and its cookies do not load until you accept them in the cookie banner. Before you choose, and if you select "Reject," no analytics cookies are set. Ad storage, ad personalisation, advertising identifiers and Google Signals are permanently denied — we never use website data for advertising or profiling.
• Your choice, any time. You can withdraw consent by clearing this site's cookies/site data, or by installing the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). Only the essential cookies needed for the site to function are used without consent.

What we do not collect

• We do not knowingly collect precise location data.
• We do not collect contacts, microphone, or health data.
• Children's photos and tooth-pull history are stored locally on your device by default. They are not transmitted to our servers unless you explicitly choose to back them up or share them.

2. How we use information

• To create and manage your parent account.
• To deliver the core app features (child profiles, tooth tracking, badges, savings, Tooth Fairy letters, milestone sharing).
• To process in-app purchases (via Apple, Google, or Paystack — we do not handle card data ourselves).
• To understand which features are used and to improve the Service.
• To respond to support requests.
• To detect, prevent, and address fraud, abuse, or security incidents.

3. How we share information

We share limited information with the service providers listed below, only as needed to operate the Service:

• Apple — App Store distribution, in-app purchases, sign-in with Apple.
• Google (Firebase) — authentication, analytics (with ad signals denied), crash reporting.
• Facebook — only if you choose Facebook login.
• Paystack — for web-based purchases of additional child slots (PWA only).
• Amazon Web Services — backend hosting.

We do not sell personal information and we do not share information for cross-context behavioural advertising.

4. Children's privacy

Tooth Tycoon is designed for parents to use alongside their children and is listed in Apple's "Kids" category and Google Play's "Designed for Families" programme.

• We do not require children to create their own accounts. Only a parent or guardian creates an account; the parent's email is the contact of record.
• Children's information (name, age, photo, tooth history) is created by the parent and stored locally on the device by default.
• We disable all advertising signals and we do not allow third-party advertising in the app.
• We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and equivalent global child-data laws. Where verifiable parental consent is required to collect a child's data, we will not collect that data without it.
• If you believe we have inadvertently collected personal information from a child without verifiable parental consent, contact us at [email protected] and we will delete it.

5. Data retention

We retain your parent account and any data you choose to back up to our servers for as long as your account remains active. You may request deletion at any time by emailing [email protected]. Server logs are retained for up to 90 days. Local-only data (children's photos, tooth history) is erased when you delete the app or sign out.

6. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and associated data
• Object to or restrict certain processing
• Port your data to another service
• Withdraw consent

To exercise any of these rights, contact [email protected]. We respond within 30 days.

7. Security

We use industry-standard safeguards — TLS in transit, encryption at rest where applicable, and least-privilege access controls — to protect the data we hold. No system is perfectly secure, and we cannot guarantee absolute security.

8. International transfers

We are based in South Africa. Our backend, analytics, and authentication providers may process data in the United States, the European Union, or elsewhere. Where required by law we rely on Standard Contractual Clauses or equivalent transfer mechanisms.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be highlighted in the app or by email. The "Last updated" date above reflects the most recent revision.

10. Contact us

Questions or requests? Reach us at:

• Email: [email protected]
• Support: [email protected]
• Mailing address: OUTSOURCED CTO (PTY) LTD, 72 Chobe Sands, Douglasdale, Johannesburg, Gauteng 2021, South Africa