finkids.app/privacy
Privacy Policy
Effective: June 28, 2026 · Last Updated: June 28, 2026
1. Introduction
FinKids ("we", "our", "the App") is a financial literacy platform for users aged 9–18, operated by Dorabase. We take the privacy of children and families seriously. This policy explains what data we collect, why we collect it, and how we protect it.
2. Data We Collect
| Data | Purpose | Source |
|---|---|---|
| Apple ID (anonymized token) | Authentication | Sign in with Apple |
| Nickname | In-app display name | User-provided |
| Avatar emoji | Profile personalization | User-selected |
| Push notification token | Task & market alerts | Device |
| In-app activity (XP, trades, modules) | Gamification & progress tracking | App interactions |
| Role (child / teen / parent) | Age-appropriate content | User-selected |
| Referral code | Friend referral program | Auto-generated |
3. Children's Privacy (COPPA & KVKK)
- ›Users under 13 must have verifiable parental consent before creating an account.
- ›All trading activity within the app uses simulated virtual currency only — no real money is involved.
- ›We do not display behavioral or targeted advertising to any user.
- ›Children's data is never sold or shared with third-party advertisers.
- ›Social features are designed to prevent real-identity exposure; only nicknames are visible.
4. How We Use Your Data
- ›Providing and personalizing the app experience
- ›Sending push notifications for tasks and market events (opt-in, cancellable)
- ›Maintaining leaderboards and social features
- ›Improving app performance and fixing bugs
- ›Processing subscription payments through Apple
5. Data Sharing
We do not sell your data. We share it only with the following parties, strictly for service delivery:
- ›Apple — Sign in with Apple authentication and StoreKit subscription processing
- ›Google Cloud Platform — App server (Europe-West1, Frankfurt, EU)
- ›Firebase — Push notifications only; analytics is disabled
6. Data Retention
Personal data is retained while your account is active. Upon a deletion request, all personal data is permanently deleted within 30 days. Anonymized aggregate statistics may be retained longer.
7. Your Rights
Under KVKK (Turkey) and GDPR (EU) you have the right to access, correct, delete, and port your data, and to object to automated processing.
8. Security
All data transmission is encrypted via TLS 1.3. Our servers are hosted on Google Cloud Platform in Frankfurt, Germany, compliant with EU data protection standards.