Privacy Policy — NurStory
The German version of this document is the binding one. This translation is provided for information only.
Scope
This policy applies to the Android and the iOS app, and to this website insofar as it concerns that app.
What data is collected
Order data from Google Play
When you take out a subscription, Google provides us with order data for billing and tax purposes: order number, product, amount, date and the buyer’s country. Region (canton or state) and postcode are added only where Google is not the seller of the order. We do not receive names, full addresses or payment details. The source of this data is Google Play, not your device.
Sales reports from the App Store
When you buy something in the app through the App Store, Apple provides us with sales reports for billing and tax purposes: product, price and currency, date, the store’s country, the device type and whether a purchase was refunded. For subscriptions, an identifier is added that Apple generates at random and that applies only in relation to us; if you end all your subscriptions with us and do not take out a new one within 180 days, Apple deletes it. These reports do not contain your name, email address, postal address or payment details. The source of this data is the App Store, not your device.
Apple processes your purchase and account data itself, under Apple’s own privacy policy: apple.com/privacy
Purpose and legal basis
- Order data serves billing and bookkeeping only.
- Sales reports from the App Store serve bookkeeping and the evaluation of sales only.
For order data the legal basis is compliance with statutory retention obligations (Art. 6(1)(c) GDPR in conjunction with Art. 958f CO) and our legitimate interest in proper billing (Art. 6(1)(f)).
For sales reports from the App Store the legal basis is compliance with the statutory bookkeeping obligation (Art. 6(1)(c) GDPR in conjunction with Art. 958f CO) and our legitimate interest in evaluating sales (Art. 6(1)(f)).
Retention period
- Order data is kept for the duration of the statutory retention obligation — in Switzerland ten years from the end of the financial year (Art. 958f CO).
- Sales reports from the App Store are the basis of our bookkeeping and are therefore kept for the duration of the statutory retention obligation — in Switzerland ten years from the end of the financial year (Art. 958f CO).
Media from the internet
The app downloads new content — such as voices for the games and new audio stories — from the internet when needed. The files are stored on Cloudflare R2, a storage service of Cloudflare, Inc., and are fetched over an encrypted connection (HTTPS) from cdn.nurharun.com.
Each download technically requires the transfer of the following: the device’s IP address and the path of the requested file (for example, which story in which language). Nothing more: the app sends no account, no name, no device identifier, no advertising ID and no information about the child; there is no analytics, no tracking and no advertising. We do not analyse the downloads and build no profiles from them.
Cloudflare processes this information as a service provider on our behalf, solely to deliver the file and to protect the service against abuse. This processing may take place outside Switzerland and the EU, in particular in the United States. More about Cloudflare: https://www.cloudflare.com/privacypolicy/
Downloaded content stays on the device. Parents can delete it at any time in the parents’ area. Parents also decide there whether audio stories may download over mobile data; this is off by default. The short voices for the games download over any network. For this the app only reads whether the device is currently on Wi-Fi or mobile data — not the name of the Wi-Fi network and not the location.
The legal basis is our legitimate interest in delivering the requested content and protecting the service against abuse (Art. 6(1)(f) GDPR).
Subscription
The app offers a subscription. Purchase, payment and proof of purchase run through the store you installed the app from: on Android through Google Play, on iOS through Apple’s App Store. We operate no server of our own for this. On the device the app records only whether access is active and when it was last confirmed; it does not store order numbers, receipts or payment details. Which data we receive from Google and from Apple is described above under “Order data from Google Play” and “Sales reports from the App Store”. The terms of the respective store apply.
Children
This app is made for children aged about four to seven. It is built so that a child can use it alone without ending up anywhere they do not belong:
- No data about the child is collected, and none is transmitted to us or to third parties.
- There is no advertising — neither displayed nor disguised as content.
- The app contains a subscription. It is built so that a child does not come across it: the purchase sits in the parents’ area behind the arithmetic task, and a locked item shows neither a price nor a buy button, nor any prompt to ask a parent. Because the app is aimed at children, Google Play also requires confirmation for every purchase — that cannot be switched off in the Play settings.
- No tracking takes place: no usage profile, no recognition across sessions, no advertising identifier.
- No link leads out of the children’s area. There are no browser windows and no references to social networks there.
Profiles are stored on the device only. A nickname is enough — a full name is not needed.
If you enter your child’s full first name there, that is personal data. It stays on the device, is not transmitted, and is never visible to us.
The settings live in the parents’ area, which only opens after a small arithmetic task — one a child of this age does not solve. Language, subtitles and the link to this policy are behind it.
Device permissions
The app requests no permission you would have to decide on — no dialog appears, neither on Android nor on iOS.
On Android you can check this in your device’s app info. The six technical entries there — internet access, network state, keep screen awake, playback in the foreground, media playback in the foreground and in-app purchases — trigger no prompt: you do not decide about them, you only see them.
On Android the app has the internet permission and uses it solely to download content — what is transferred in doing so is described above. The purchase runs through the Play Store app, on iOS through Apple’s App Store.
Account
The app creates no account and requires no sign-in.
Device backup
Android may include the app’s data in the backup of your Google account if you have device backup turned on. Google manages this backup for you; we have no access to it.
Depending on your settings, iOS includes the app’s data in the iCloud or device backup. Apple or your computer manages this backup; we have no access to it.
How to delete your data
You delete the data on the device yourself, and immediately. On Android in the settings under “Apps” via “Storage” and “Clear data” — the app stays installed and starts as it did the first time — or by uninstalling the app; Android removes the data along with it. On iOS via “Settings” → “General” → “iPhone Storage” → select the app → “Delete App”, or by holding the app icon and choosing “Remove App” → “Delete App”. “Offload App” is not enough: it keeps the data.
You cannot delete the order data from Google Play or the sales reports from the App Store yourself. For the order data, you have the rights of access and erasure, insofar as no statutory retention obligation precludes this. The identifier in the sales reports from the App Store cannot be attributed to any person by us; access or erasure is possible there only if you provide us with information that allows attribution (Art. 11 GDPR). An informal message to privacy@nurharun.com is enough.
Deleting your data in detail →
Your rights
You have the rights of access, rectification, erasure, restriction of processing, data portability and objection. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or with a data protection supervisory authority in the EU.
An informal message to the following address is sufficient for any request: privacy@nurharun.com
Controller
Harun Mustafa
Lindenpark 41
3427 Utzenstorf
Switzerland
We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). Insofar as the EU General Data Protection Regulation (GDPR) applies, the legal bases stated here are those under the GDPR.