Privacy Notice

Version 5

This notice explains how we process personal data about you and your child when you use the Moli mobile app (the "App") and Moli's web pages. It is provided under Article 10 of Türkiye's Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It is also the App's privacy policy.

1. Data controller

Moli ("we", "us") is the data controller for your personal data. For KVKK requests and any questions, contact us at support@playmoli.com.

2. At a glance

The account is created by the parent. Your child does not need to use their real name; a nickname is enough.
We do not collect health information about your child. We do not ask for or keep details such as diagnoses, medication or co-occurring conditions.
The App has no ads. We do not use third-party analytics, advertising or tracking tools, and we never sell or rent your data.
To improve the App and fix bugs, brief usage and error records (for example, which screen was opened or whether a step was skipped) are sent only to our own server. They never include names, nicknames or anything you type, and you can turn them off at any time in Settings → Usage and error data.
Our servers and backups are located in Türkiye.
The microphone is used only to detect whether there is sound during voice tasks. Nothing is recorded or sent.
Photos you add stay only on your phone; they are never sent to us.
Our AI assistant, Moli AI, is optional. It works only with your separate explicit consent, and your messages are shared with a service provider outside Türkiye (see section 8).
The first 3 program days are free. Moli Family membership is purchased through the App Store or Google Play; the store handles payment, and your card details never reach us.
You can delete your account at any time from within the App.

3. What personal data do we process?

3.1 Data about the parent (the account holder)

Identity: your first and last name.
Contact details: your email address.
Account security: your password and parent PIN (both stored only as irreversible hashes, so even we cannot see them); the names of the devices you are signed in on and when each session was started and last used; and the one-time codes sent for password resets and email changes.
Transaction security: IP address and timestamps (in consent records, in rate limits that prevent misuse, and in server logs).
Preferences: notification types and times, language, and how long Moli AI conversations are kept.
Legal records: which documents you read or accepted, which version, and when (document type, version, date and IP address).
If you use Moli AI: the messages you write and the assistant's replies (encrypted in our database).
Usage and error records: a random install number the App assigns to this phone the first time it is opened (it is not an advertising ID or a device identifier, and it disappears when the App is deleted); the App version, the type of phone (iOS/Android) and the operating system version; and moments from a fixed list, with their times, such as which key screens were opened, how long the App stayed open, where the payment screen was opened from, which plan was chosen and the outcome of the purchase, and whether the home tour was completed. If the App hits an unexpected error, we also receive the error's type, message and technical stack trace (email addresses and long numbers such as phone and ID numbers are removed before sending). Records made before an account is created are linked only to the install number; once you sign in, they are linked to your account.
Moli Family membership: your plan (monthly or yearly), the store you purchased from, trial and billing period start and end dates, renewal and payment status, and the store's purchase IDs. The stores and RevenueCat know you only by a random billing ID; your name and email address are not shared for this purpose. Your card and bank details never reach us.

3.2 Data about your child

You enter this data as the parent, or it is created as your child uses the App:

Profile: nickname; month and year of birth (we do not ask for the day) and the age group calculated from it; the skills you want to focus on (for example, calming down, attention or routines); optional interests; and the daily screen time setting.
Usage records (child mode): when child mode was opened; when the day's session started, finished or was closed early (and at which step); the type of warm-up and whether it was skipped; and when screen time ran out. These records are kept with a profile number, not your child's nickname, and are sent only if "Usage and error data" is turned on.
Program and activity records: program days opened, tasks completed, the feeling chosen in feeling tasks (encrypted in our database), treats earned and fed to the pet, the pet's species, color, name, growth and accessories, game levels played, scores, stars and game measurements (such as accuracy and reaction time), and daily screen time.
Your program records: the parent activities you complete and the Parent Academy lessons you read.

We use this information only to tailor the program to your child's age and progress and to show you how they are doing. It is never used to diagnose, to assess health or to compare your child with other children.

3.3 Data we do not collect

Your child's real name, photos, voice, location or contacts.
Health information (diagnoses, medication, co-occurring conditions and similar). We also ask you not to share this kind of information with Moli AI.
Advertising IDs, device fingerprints or cross-app tracking information.

3.4 Information that stays only on your phone

The following is never sent to us; it stays on your phone, in the App's own storage:

Profile photos you add for yourself and your children (they are not shown in child mode). They are also deleted from the phone when you sign out or delete your account.
An irreversible hash of your PIN, for checking the PIN offline (in the phone's secure storage), and your face/fingerprint setting.
Settings such as sounds, music and night mode, and downloaded narration audio.
The answers you gave in the introduction before creating an account, and the pet your child picked in the try-out. They are carried over to the profile when you create your account and are deleted from the phone when you sign out.

Microphone: in voice tasks and some breathing games, the App measures only how loud the sound is at that moment. Nothing is recorded, stored or sent anywhere.

Face or fingerprint recognition: verification is handled by your phone's operating system. Your biometric data never reaches us.

3.5 Before you create an account (the introduction)

To prepare a plan for your child during the introduction, only the month and year of birth, the skills matching the challenges you selected, and interests are sent to our server. The nickname is not sent, and this request is not stored. Your IP address is used only for a short-lived rate limit that prevents misuse.

4. Why do we process personal data?

To create and manage your account and keep your sessions secure.
To create the child profile and provide the age-appropriate program, warm-ups, games, tasks and game levels.
To run the pet, treats and progress system.
To show you the daily flow, weekly summaries and progress charts.
To apply the daily screen time limit and to run child mode and the parent lock.
To provide Parent Academy lessons and track your progress.
To schedule the reminders you allow.
To verify your Moli Family membership with the store, unlock the features that come with membership, and remind you before a free trial ends.
To send password reset and email change codes.
If you give explicit consent, to let Moli AI answer your questions.
To keep accounts and systems secure and to prevent unauthorized access and misuse.
To respond to your requests, questions and complaints, including requests under the KVKK.
To comply with legal obligations and respond to requests from competent authorities.
To improve the service, using only aggregate statistics on our own servers that do not single anyone out (for example, whether a game's levels are too hard, on which program day families tend to stop, or which screen is confusing).
To find and fix bugs in the App and to understand the problem you ran into when you contact support.

Marketing: we do not send you commercial electronic messages (promotional emails or texts). If we ever want to, we will ask for your permission separately and explicitly.

5. Legal bases

We process your personal data on the following legal bases under Article 5 of the KVKK:

Entering into and performing a contract (Art. 5/2-c): your account, the child profile, program, tasks, games, progress and summaries, screen time, reminders, password resets, and verifying your Moli Family membership.
Compliance with a legal obligation (Art. 5/2-ç): keeping consent records, retention required by law, and requests from competent authorities.
Establishing, exercising or defending a right (Art. 5/2-e): consent and transaction records.
Legitimate interests (Art. 5/2-f): account and system security, preventing misuse, IP-based rate limits, improving the service with aggregate statistics, and finding and fixing bugs using usage and error records. This processing is carried out in a way that does not harm your fundamental rights and freedoms, and you can turn off usage and error records at any time.
Explicit consent (Art. 5/1 and Art. 9): for Moli AI only. We ask for your consent to process your messages and transfer them abroad separately, with a separate document. Choosing not to use Moli AI does not affect any other part of the App.

The App does not ask for special categories of personal data (such as health information). If you choose to share such information with Moli AI, it is processed only under your Moli AI explicit consent.

6. How do we collect personal data?

We collect your personal data electronically through the App and our web pages, by fully or partly automated means:

from the information you enter (sign-up, child profile, settings, Moli AI messages);
from records created automatically as you and your child use the App (such as a completed task, a level played or screen time);
from the usage and error records the App sends to our own server (unless you have turned them off);
from server logs kept for security and operations.

7. Who do we share personal data with?

We share your personal data only with the following recipients, only for the stated purpose and only to the extent necessary:

Hosting and backup provider: the App's data is hosted and backed up on servers in Türkiye. This provider processes the data only on our behalf and on our instructions.
Email delivery provider: only your email address and the code, to deliver password reset and email change codes to you.
OpenAI, L.L.C. (USA): only if you use Moli AI and give your explicit consent; see section 8 and the Moli AI Consent.
RevenueCat, Inc. (USA): only when you purchase Moli Family or restore your purchases, to verify App Store and Google Play purchases and tell us your membership status. Your random billing ID and the store's purchase records are processed; your name, email address and information about your child are not sent.
Competent public authorities and courts: only where the law requires it, and limited to what is requested.

Please also note:

The narration for the games and Moli's voice are created by a text-to-speech service. Only the App's own content (such as "Put the cards in order.") is sent to this service; no information about you or your child is ever sent.
The App is distributed through the Apple App Store and Google Play. Any data these stores collect for their own services (including payment and billing information) is governed by their privacy policies. The store handles payment for Moli Family; your card details never reach us.
We never sell or rent your data or share it for advertising.

8. Transfers outside Türkiye

The App's database and backups are located in Türkiye. Data is transferred abroad in these two cases only:

Moli AI (optional): if you choose to use Moli AI, the messages you write and limited program information are shared with OpenAI, L.L.C. (United States of America) to generate replies and check content for safety. This transfer relies on the appropriate safeguards provided for in Article 9 of the KVKK (the standard contract published by the Personal Data Protection Board), and we also ask for your explicit consent. Your name, email address, phone number and your child's nickname are not sent. Email addresses, phone numbers and 11-digit numbers in your messages are automatically removed before sending.
Moli Family membership: when you make a purchase, your random billing ID and the store's purchase records are shared with RevenueCat, Inc. (United States of America) to verify the purchase. This transfer relies on the appropriate safeguards provided for in Article 9 of the KVKK (the standard contract).

9. How long do we keep data?

Account and child data: for as long as your account is open. When you delete your account, it is closed immediately, and all data linked to it, including child profiles, program and game records, Moli AI conversations and consent records, is permanently deleted shortly afterwards.
Child profiles: when you delete a child profile, all records belonging to that child are permanently deleted.
Moli AI conversations: deleted automatically and permanently at the end of the period you choose in Settings (1, 30 or 90 days; 30 days by default). They are deleted immediately if you withdraw your consent or choose "Delete all conversations".
Membership records: for as long as your account is open; when you delete your account, the membership records we hold are deleted too. Payment and billing records are kept by the store that made the sale (Apple or Google) under its own rules.
One-time codes: expire within 15 minutes.
Technical and security logs: up to 90 days.
Usage records: 13 months; error records: 90 days. When you delete your account, these records are disconnected from you and your child (the parent, child and install number are removed), leaving only figures that cannot be linked to anyone.
Records we are legally required to keep (for example, billing information if we take payments directly in the future): for the period required by law, and not used for any other purpose.

When a retention period ends, the data is deleted, destroyed or anonymized in line with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.

10. Security

The main measures we take to protect your data:

All communication between the App and our server is encrypted (HTTPS).
Passwords and parent PINs are stored only as irreversible hashes.
Moli AI messages and the results of feeling tasks are encrypted in our database.
Each parent can access only their own children's data, and access to our servers is limited to authorized staff.
Leaving child mode for the parent area requires the parent PIN or face/fingerprint verification.
Sign-in, password and PIN attempts are limited, and repeated incorrect attempts are temporarily locked.
In the event of a data breach, the Personal Data Protection Board and the people affected are notified as required by Article 12 of the KVKK.

11. Children's privacy

The App is designed for parents of children aged 3–13. Only a parent or legal guardian aged 18 or over may create an account.
As the parent, you enter the information about your child and exercise your child's rights under the KVKK on their behalf.
Child mode has no ads, purchases, external links, chat or contact with other users. Getting to settings and the parent area requires the parent PIN.
Your child cannot use Moli AI; it is available only in the parent area.

12. Your rights

Under Article 11 of the KVKK, you have the right to contact the data controller to:

find out whether your personal data is being processed;
request information about it if it has been processed;
find out why it is processed and whether it is used for that purpose;
know the third parties in Türkiye or abroad to whom it has been transferred;
ask for it to be corrected if it is incomplete or inaccurate;
ask for it to be deleted or destroyed under the conditions set out in Article 7 of the KVKK;
ask for any correction, deletion or destruction to be passed on to the third parties to whom the data was transferred;
object to an outcome that is unfavorable to you and results solely from automated analysis of your data;
claim compensation if you suffer damage because your data was processed unlawfully.

You can also exercise some of these rights directly in the App: correct profile details from the child profile and Account details; delete a child profile from the bottom of the profile page; delete your account and all your data in Settings → Delete account; manage Moli AI conversations and consent in Settings → Moli AI; see your consent history in Settings → Agreements and your consents; and turn off usage and error records in Settings → Usage and error data.

13. How to make a request

You can submit requests about your rights, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, by email to support@playmoli.com from the email address registered to your account.

We will respond to your request free of charge within 30 days at the latest. If handling the request involves an additional cost, the fee schedule set by the Personal Data Protection Board may apply. If your request is refused, you find our answer insufficient, or we do not respond in time, you may file a complaint with the Personal Data Protection Board.

14. Changes to this notice

When we update this notice, the version number goes up and the new version is shown to you the next time you open the App. You can always find the current version in the App under Settings → Agreements and your consents and at https://playmoli.com/legal/privacy.

Version 5 · October 3, 2026