Privacy Policy — Tola

Last updated: 12 November 2026 Version: 1.1

1. Introduction

1.1. Our commitment to privacy

Tola is a colouring app for young children. We want parents to feel safe handing it to their child, so we collect as little information as possible. The App works without accounts, does not ask a child for any personal information, shows no ads and contains no behavioural analytics. We follow the EU General Data Protection Regulation (GDPR) and the US Children's Online Privacy Protection Act (COPPA).

1.2. Who we are

The "Tola" app (the "App") is provided by KS Kamil Szubski (sole proprietorship), tax ID (NIP) 5242708550, ul. Jasińskiego 8b/2, 05-270 Marki, Poland ("we", "us"). We are the controller of the personal data described in this policy.

Contact: kszubski@gmail.com. We have not appointed a data protection officer; please send any privacy question or request to this address.

1.3. Scope of this policy

This policy covers the App and the parent-facing pages at playtola.com (privacy, terms and help).

1.4. How to read this policy

The App is meant for children, but this policy is written for parents and guardians. It explains what information is involved, why, who else handles it, how long it is kept and what rights you have. We will post any material change on this page and mention it in the App's parent area.

2. Information we collect and process

2.1. Our principles

We collect only what is needed to run the App and to handle Premium purchases. We never ask a child for a name, age, email address, photo, voice recording or location.

2.2. Information that stays on the device

We never receive this information. It is deleted when the App is deleted. If you have enabled device backups, your backup may include App data; that is a device setting you control.

Photos, camera and microphone. The App can only add a picture to your Photos library when asked to. It cannot read your other photos and does not use the camera or microphone.

2.3. Information processed when a parent makes a purchase

Premium is bought by a parent, behind a parental gate. To confirm the purchase and unlock Premium, limited information is processed:

• a random, anonymous app identifier that is not linked to a name, email address or store account;
• purchase and subscription information (product, transaction identifiers, dates, subscription status);
• basic technical information (device model, operating system and App version, store country or language) and the IP address, which is visible in any internet connection.

We use this information only to process and verify purchases, unlock and restore Premium, prevent fraud and keep basic sales statistics. We do not use it for advertising or to profile anyone.

2.4. Purchases and payment information

Payments are processed by the app store (Apple App Store). We never receive your card number, other payment details, name or address. The store's own privacy policy applies to the payment. We receive only the limited transaction information described in section 2.3, with help from a service provider that verifies purchases on our behalf.

2.5. When you contact us

If you email us, we use your email address and message only to reply and to handle your request.

2.6. What we do not do

• No advertising and no advertising identifiers.
• No analytics or tracking tools, and no tracking across other apps or websites.
• No user accounts, social features or chat.
• No sale of personal information.

2.7. Legal bases (GDPR)

• Performance of a contract (Art. 6(1)(b)): processing a purchase, unlocking and restoring Premium.
• Legitimate interests (Art. 6(1)(f)): preventing fraud and abuse, keeping the App secure and working, answering messages and defending legal claims.
• Legal obligation (Art. 6(1)(c)): accounting and tax duties.

We do not rely on consent for any processing.

3. Who we share information with

3.1. Our sharing practices

We do not sell personal information and do not share it for advertising. We disclose information only where needed to run the App:

• App stores (Apple), which sell the App and process payments as separate controllers under their own privacy policies;
• service providers who act on our behalf and under our instructions: a provider that verifies purchases and manages subscriptions, and providers of website hosting and email;
• professional advisers and public authorities, where the law requires it.

3.2. Data protection measures

We choose reputable providers, sign data processing agreements with them and give them access only to the information they need. Connections are encrypted (HTTPS), and drawings stay in the App's private storage protected by the device's operating system.

3.3. International transfers

Some of our service providers are based in, or process information in, the United States. Such transfers are protected by Standard Contractual Clauses approved by the European Commission or another lawful mechanism. You can request a copy of these safeguards by emailing us.

4. How long we keep information

• On the device: until the App or the drawing is deleted.
• Purchase information: for as long as needed to provide Premium, handle disputes and meet legal obligations, after which it is deleted or anonymised.
• Emails: up to 12 months after the matter is closed, longer if needed to defend legal claims.
• Accounting records: for the period required by law (generally 5 years from the end of the tax year).

5. Your privacy rights

5.1. Your rights

Depending on where you live, you have the right to:

• access the information we hold about you;
• correct inaccurate information;
• delete your information;
• restrict or object to processing based on our legitimate interests;
• data portability;
• non-discrimination for exercising your rights.

We do not sell or share personal information, so there is nothing to opt out of.

5.2. How to exercise your rights

Email kszubski@gmail.com. Because purchase information is linked only to an anonymous identifier, we may ask for details that help us find it (for example the order number from your App Store receipt). We will reply within the time required by law. Drawings are never sent to us; you can delete them by deleting the App or choosing "Start over" on a picture.

5.3. Complaints

You can lodge a complaint with a data protection authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl. You can also contact the authority in your own country. We would be glad to try to resolve any concern first, if you email us.

5.4. Automated decisions

We make no decisions based solely on automated processing, and we do no profiling.

6. Children's privacy

6.1. Our commitment

The App is designed for children aged 3–6. We do not knowingly collect personal information from children, as defined by COPPA and the GDPR.

6.2. Information from children

The App does not ask children for any personal information and has no way for a child to share information publicly or with other users. A picture saved to Photos is saved locally on the device and is not sent to us. The App contains no ads, no social features and no links or purchases that a child can reach without passing the parental gate.

6.3. Parental rights

If you believe information about your child has reached us, email kszubski@gmail.com. We will check and delete it promptly. You can also review or delete anything stored in the App on the device at any time by deleting the App.

6.4. Security of children's information

Drawings and progress are kept only in the App's private storage on the device and are never uploaded.

7. Tracking and "Do Not Track"

The App does not track users across apps or websites, so no tracking permission prompt is shown. Our website pages use no cookies, analytics or third-party scripts.

8. Changes and contact

We may update this policy. We will post the new version on this page and announce material changes in the App's parent area. The current version is always available at https://playtola.com/en/coloring/privacy.

Questions: kszubski@gmail.com.