Privacy Policy

Ellie Holdings Pty Ltd (ABN 11 672 103 310), doing business as InnerSteps

This privacy policy describes how Ellie Holdings Pty Ltd (doing business as InnerSteps) ("we", "us", or "our") collects, stores, uses, and shares ("processes") your information when you use our services ("Services"), such as when you:

• download and use our mobile application (InnerSteps), or any other application of ours that links to this privacy policy;
• visit our website at innersteps.org, including our blog at innersteps.org/blog, or any website of ours that links to this privacy policy; or
• engage with us in other related ways, including any sales, marketing, or events.

InnerSteps is designed for families. Accounts are created and managed by a parent or guardian, and children use the app under their parent or guardian's supervision and consent. We take our responsibilities around children's information seriously, and we deliberately collect as little information about children as possible.

Questions or concerns? Reading this privacy policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have any questions, contact us at info@innersteps.org.

SUMMARY OF KEY POINTS

What personal information do we process? We collect account information from the parent or guardian (such as your name, email address and login details), your child's first name, the setup preferences you choose for your child, your time zone, purchase records, and technical and usage information about how the app is used. We explain this in detail below.

Do we collect sensitive information? We do not ask for or collect medical, diagnostic, or health-record information about you or your child. During setup we do ask the parent or guardian to tell us which everyday situations their child finds difficult (for example, school mornings, or being apart from a parent), so that we can tailor the program. We treat these responses carefully, we do not use them for advertising, and we never share them with advertising partners.

Do we collect information about children? Only the minimum needed to run the app: a first name (so stories and the app can address your child) and in-app activity (such as which stories and games have been completed). We do not collect a child's surname, birthday, gender, contact details, photos, or precise location. Parents can review or delete their child's information at any time by contacting us.

How do we process your information? To provide and improve the Services, manage accounts and purchases, communicate with you, keep the Services secure, and comply with law.

Do we use analytics and tracking tools? Yes. On our website (including the blog) we use PostHog for analytics and session recording, the Meta Pixel to measure our advertising, and cookies and similar technologies to make these work. In the app we use Humblytics for usage analytics and Sentry for crash and error reporting. The app contains no advertising software, and we do not use information collected in the app for advertising, link it with third-party data for advertising purposes, or share it with data brokers. Section 4 explains each tool.

Do we sell personal information? No. We do not sell personal information, and we never sell or share children's personal information for advertising purposes.

In what situations do we share personal information? With service providers who help us run the Services (such as our hosting and backend providers), with the app stores in connection with purchases, and in connection with a business transfer. Details are below.

How do you exercise your rights? Email us at info@innersteps.org. We will consider and act upon any request in accordance with applicable data protection laws.

TABLE OF CONTENTS

• WHAT INFORMATION DO WE COLLECT?
• CHILDREN'S INFORMATION
• HOW DO WE PROCESS YOUR INFORMATION?
• WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
• HOW LONG DO WE KEEP YOUR INFORMATION?
• HOW DO WE KEEP YOUR INFORMATION SAFE?
• MARKETING COMMUNICATIONS
• WHAT ARE YOUR PRIVACY RIGHTS?
• CONTROLS FOR DO-NOT-TRACK FEATURES
• INTERNATIONAL USERS
• DO WE MAKE UPDATES TO THIS POLICY?
• HOW CAN YOU CONTACT US ABOUT THIS POLICY?
• HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Information you provide to us

We collect personal information that you voluntarily provide to us when you register on the Services, make a purchase, express an interest in obtaining information about us or our products, or otherwise contact us. This may include:

• your name;
• your email address;
• your account login details (such as a password, or authentication tokens where you register using Sign in with Apple or Google sign-in);
• your child's first name (or a nickname you choose for them);
• the setup preferences you choose for your child, such as which everyday situations they find difficult, which skills you would like to focus on, and the time of day that suits your family;
• your contact preferences; and
• the contents of any messages or feedback you send us.

If we introduce features in the future that require additional information, we will explain what is collected and why at the point of collection, and update this policy.

Purchase information

In-app purchases are processed by the Apple App Store or Google Play. We receive confirmation of your purchase (such as the product purchased, purchase receipt, and entitlement status) so we can unlock your content on your account, but we do not collect or store your credit card or payment details.

Information collected automatically

We automatically collect certain information when you use the Services. This information does not directly identify you by name, but may include:

• device and technical information, such as device type, operating system, app version, language preferences, IP address, and general region derived from it;
• your time zone;
• usage information, such as features used, stories and games started and completed, in-app check-ins and activity responses, session times, and progress within the app; and
• diagnostic information, such as error reports and performance data, used to keep the app working properly.

We do not collect precise (GPS) location data.

Push notifications

With your permission, we may send push notifications regarding your account or features of the app. You can turn these off at any time in your device settings.

2. CHILDREN'S INFORMATION

InnerSteps is made for children aged 5-9 to use with the consent and involvement of their parent or guardian. We design our data practices around collecting as little information about children as possible:

• The only information we ask for about a child is a first name (or nickname), which is used so the app and stories can address your child, the setup preferences chosen by their parent or guardian, plus the in-app activity described above (such as progress through stories and games).
• We do not ask children for, or knowingly collect from children, contact details, surnames, birthdays, gender, photos, audio recordings, or precise location.
• We do not serve advertising in the app, and we do not use children's personal information for advertising or marketing of any kind.
• The app contains no advertising software and sends no information to advertising partners. The app does use two service providers that receive technical and usage information: Humblytics (usage analytics) and Sentry (crash and error reporting). They process that information on our behalf to help us understand and fix the app, and not for advertising. We do not send a child's name to either provider.
• We do not make children's personal information publicly available, and the app has no public sharing, chat, or messaging features.
• We do not condition a child's participation in any activity on the disclosure of more personal information than is reasonably necessary for that activity.

Parents and guardians can review, update, or delete their child's information, or withdraw consent to its collection, at any time by contacting us at info@innersteps.org. If we learn we have collected personal information from a child without appropriate parental consent, we will delete it.

We handle all personal information, including children's information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. For users located in the United States, our practices in relation to children under 13 are intended to be consistent with the principles of the Children's Online Privacy Protection Act (COPPA).

3. HOW DO WE PROCESS YOUR INFORMATION?

We process your personal information for the following purposes:

• To provide the Services. To create and manage your account, personalise the in-app experience with your child's first name and your setup preferences, save progress, and deliver the stories, games and features you use.
• To manage purchases. To confirm and unlock in-app purchases made through the Apple App Store or Google Play.
• To communicate with you. To send administrative information such as account confirmations, changes to our terms and policies, support responses, and service updates.
• To send marketing communications. With your consent or as otherwise permitted by law, to send you emails about our products, features, and updates we think may interest you. You can unsubscribe at any time (see Section 7).
• To improve the Services. To understand how the Services are used, identify usage trends, diagnose problems, and evaluate and improve our products and your experience.
• To keep the Services safe. To maintain security, prevent fraud, and protect our users.
• To comply with our legal obligations. To comply with applicable law, respond to legal requests, and establish or defend legal claims.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We do not sell personal information. We share personal information only in the following situations:

• Service providers. We use trusted third-party providers to operate the Services. These currently include: Supabase (database, authentication and backend infrastructure); RevenueCat (managing purchase receipts and entitlement status); Resend (sending transactional and service emails); Apple and Google (sign-in authentication); Cloudflare (delivering app content; no personal information is stored there); PostHog (website analytics and session recording); Humblytics (app usage analytics); and Sentry (app crash and error reporting). These providers process information on our behalf and are not permitted to use it for their own purposes. We may change or add providers from time to time; where we do, this policy continues to apply to how your information is handled.
• App stores. The Apple App Store and Google Play process your purchases under their own privacy policies.
• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company, provided the recipient agrees to handle your information consistently with this policy.
• Legal requirements. We may disclose information where required by law, regulation, legal process, or enforceable governmental request, or where necessary to protect our rights, our users, or the public.

Our website and blog

When you visit innersteps.org, including the blog, we use the following tools:

• PostHog analytics. Records which pages you visit, the buttons and links you click, the page you came from, any campaign tags in the link (such as utm_source), your browser and device type, and your general location derived from your IP address. We use this to understand how people find and use the website.
• PostHog session recording. Records how you move through the website, including scrolling, mouse movements, taps and clicks, so we can see where the site is confusing or broken. Text you type into form fields is masked and not recorded.
• Meta Pixel. Provided by Meta Platforms. Tells Meta when someone who saw one of our ads visits the website, taps a download button or is sent to an app store, so we can measure and improve our advertising to parents. Meta receives your IP address, browser information and the pages and events involved, and may link this with your Facebook or Instagram account under Meta's own privacy policy.
• Cookies and similar technologies. PostHog and Meta store small identifiers in cookies and your browser's local storage so they can recognise a return visit. We also keep the campaign tags from your first page in your browser for the length of your visit, so they carry through to the download page.

These tools only run on our live website. You can block or delete cookies in your browser settings, and you can manage how Meta uses information for ads in your Facebook or Instagram ad settings. Blocking these tools will not stop the website from working.

The InnerSteps app

The app uses the service providers listed above, including:

• Humblytics. Receives usage information, such as which screens are opened and which features are used, along with device and app version information, so we can understand how the app is used and improve it.
• Sentry. Receives crash reports and error details, such as the device model, operating system, app version and the technical details of what went wrong, so we can find and fix problems.

The app does not contain the Meta Pixel or any other advertising software, and no information about your child is used for advertising of any kind.

5. HOW LONG DO WE KEEP YOUR INFORMATION?

We keep your personal information only for as long as necessary to fulfil the purposes set out in this policy, unless a longer retention period is required or permitted by law (such as for tax, accounting, or other legal requirements). When you delete your account, we will delete or de-identify your personal information, including your child's information, within a reasonable period, except where we are required to retain certain records by law. When we have no ongoing legitimate business need to process your personal information, we will delete or anonymise it, or, if this is not possible, securely store it and isolate it from further processing until deletion is possible.

6. HOW DO WE KEEP YOUR INFORMATION SAFE?

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of the personal information we process. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security. We will comply with our obligations under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth) if an eligible data breach occurs.

7. MARKETING COMMUNICATIONS

If you have opted in, or where otherwise permitted under the Spam Act 2003 (Cth), we may send you marketing emails about InnerSteps products, features, offers, and updates. Every marketing email we send includes a working unsubscribe link, and you can also opt out at any time by emailing info@innersteps.org. We do not send marketing communications to children.

8. WHAT ARE YOUR PRIVACY RIGHTS?

We collect and process your personal information under the obligations and conditions set by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy satisfies the notice requirements of the Privacy Act, including what personal information we collect, from which sources, for which purposes, and the recipients of your personal information.

At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us using the details in Section 12.

If you choose not to provide the personal information necessary for a particular purpose, it may affect our ability to provide the Services, for example our ability to create your account, respond to your requests, or confirm your identity.

Withdrawing your consent. Where we rely on your consent to process your personal information, you may withdraw your consent at any time by contacting us. This will not affect the lawfulness of processing before the withdrawal.

Account information. You can review or change your account information at any time by logging in to your account settings, or by contacting us. Upon a request to delete your account, we will deactivate or delete your account and information from our active databases as described in Section 5.

If you believe we are unlawfully processing your personal information, you have the right to complain to us at info@innersteps.org. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting. No uniform technology standard for recognising and implementing DNT signals has been finalised, and we do not currently respond to DNT browser signals. If a standard is adopted that we must follow in the future, we will inform you in a revised version of this policy.

10. INTERNATIONAL USERS

Our Services are operated from Australia and are intended for users in Australia. However, your information is stored and processed on infrastructure operated by our service providers overseas. In particular, our primary database and authentication provider stores information in Japan (Asia-Pacific region), and some of our other service providers (including our email, purchase management, analytics, session recording, error reporting and advertising measurement providers, such as PostHog, Humblytics, Sentry and Meta) process information in the United States and other locations where they operate. Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

11. DO WE MAKE UPDATES TO THIS POLICY?

Yes, we will update this policy as necessary to stay compliant with relevant laws and to reflect changes to our practices. The updated version will be indicated by an updated "Last updated" date. If we make material changes, including any material change to how we handle children's personal information, we will notify you by prominently posting a notice or by sending you a notification, and where required by law we will seek consent before applying new practices to previously collected information.

12. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions or comments about this policy, you may email us at info@innersteps.org or contact us by post at:

Ellie Holdings Pty Ltd (ABN 11 672 103 310)
8 Byrne Avenue
South Coogee, New South Wales 2034
Australia

13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you (or from your child), change that information, or delete it. To make a request, email us at info@innersteps.org and we will respond in accordance with applicable data protection laws.