Privacy policy

Koby is provided by Omnibus Bilişim Arge Sanayi Ticaret Limited Şirketi, YTU Teknopark, Çifte Havuzlar Mahallesi Eski Londra Asfaltı Caddesi Kuluçka Merkezi A2 Blok No:151/1B/Z06, İstanbul / Türkiye, Türkiye (“Koby”, “we”, “us”). We decide why and how your data is used, so we are the controller under the GDPR and UK GDPR, the data controller (veri sorumlusu) under Türkiye's KVKK, and the “operator” under the US Children's Online Privacy Protection Act (COPPA).

• Privacy contact (our privacy team, which handles data protection questions and requests): privacy [at] withkoby.com.
• Koby is not offered in the European Union, the EEA or the United Kingdom yet. We will appoint representatives there (GDPR Art. 27) before it is.
• Person in charge of the protection of personal information (Québec Law 25): our managing director, reachable at the address above.

The Koby app for iPhone and iPad (parent and child mode), the Koby app for a child's Mac or Windows computer, the parent web panel at app.withkoby.com, and this website. Koby is a parental control service for families with children aged 3 to 17: a parent creates the family account and the children's profiles and pairs each child's device; the child then uses Koby on that device.

Children's information is explained in more detail, including for parents in the United States, in our children's privacy notice. What this website stores in your browser is in the cookie policy.

• We collect what is needed to apply your family's rules and show whether they work, and nothing for advertising.
• We never read messages, never use the camera or microphone, never record the screen and never track in secret. Your child always sees that Koby is on and which grown-ups can see what.
• Location is the last known position only, and only if location access is allowed on the child's device; there is no location history and it is deleted after 7 days.
• We do not sell or share personal data for advertising, and we do not profile children.
• You can download or delete your data or a child's data, and remove a device, at any time.

Retention periods are maximums; the data is deleted automatically when they end. “Until deleted” means until you delete it, the child's profile or your account (see section 11).

• Parent account: e-mail address, display name, password (stored only as a hash), optional security question (answer stored only as a hash), language, time zone; Apple or Google account identifier if you sign in with them

  Purpose

  Create and secure your account, sign you in, send service e-mails

  Legal basis (GDPR)

  Contract

  Kept for

  Until the account is deleted

• Documents you accepted at sign-up (terms, privacy, optional marketing): version, time, IP address, app or browser

  Purpose

  Prove what was agreed

  Legal basis (GDPR)

  Legal obligation; legitimate interest in defending legal claims

  Kept for

  For the life of the account; 3 years after deletion

• Security log: sign-ins, failed attempts, password and e-mail changes, account deletion requests, with IP address and device

  Purpose

  Protect accounts, detect abuse, investigate incidents

  Legal basis (GDPR)

  Legitimate interest (security)

  Kept for

  12 months; deleted with the account

• Child profile: first name or nickname (up to 40 characters), birth date, optional gender, avatar colour

  Purpose

  Show the right profile, apply age rules and the right consent step

  Legal basis (GDPR)

  Contract with the parent; parental consent

  Kept for

  Until deleted

• Parental consent records: method (declaration or e-mail confirmation), name of the parent, status, dates, and the IP address and app or browser used

  Purpose

  Get, prove and honour verifiable parental consent (COPPA, GDPR Art. 8)

  Legal basis (GDPR)

  Legal obligation

  Kept for

  Until the child's profile is deleted

• Devices: device identifier (random or vendor identifier), name, model, system and app version, time zone, push token, last seen; on iPhone the App Store installation identifier

  Purpose

  Pair devices, deliver rules and notifications, honour a parent's withdrawal of approval through the App Store

  Legal basis (GDPR)

  Contract; parental consent for children's devices

  Kept for

  Until the device is removed

• Rules and their change history (who changed what, when) and delivery status on each device

  Purpose

  Apply rules and show which version each device has

  Legal basis (GDPR)

  Contract; parental consent

  Kept for

  Until deleted

• Extra-time requests and grants: minutes, optional reason typed by the child (up to 200 characters), decision

  Purpose

  Let a child ask and a parent answer

  Legal basis (GDPR)

  Contract; parental consent

  Kept for

  90 days

• Screen time: minutes per day per device, where the operating system shares them. From an iPhone or iPad only daily totals; on a Mac or Windows PC also the name of the app in front and the minutes it is used while the computer is active

  Purpose

  Show time used and time left, apply limits

  Legal basis (GDPR)

  Contract; parental consent

  Kept for

  90 days

• Last known location: coordinates, accuracy and time (only if location access is allowed on the child's device)

  Purpose

  Show where the device last reported from

  Legal basis (GDPR)

  Parental consent

  Kept for

  Only the latest one; deleted 7 days after it was measured. No history

• Protection status: which controls are active, partial, off or can't be verified, and the setup self-test result

  Purpose

  Show whether protection really works, alert parents when it drops

  Legal basis (GDPR)

  Contract; legitimate interest in a reliable service

  Kept for

  Latest report per device, until the device is removed

• Tasks, stars, badges and rewards: tasks and rewards a parent sets, tasks a child marks done, reward requests, decisions

  Purpose

  Run the tasks and rewards feature

  Legal basis (GDPR)

  Contract; parental consent

  Kept for

  Completed tasks and reward requests: 180 days. Tasks, rewards, star balance and badges: until deleted

• Notifications: in-app inbox, your notification settings; a delivery log

  Purpose

  Tell you about requests, protection changes and your account

  Legal basis (GDPR)

  Contract

  Kept for

  Inbox 60 days; delivery log 90 days; settings until deleted

• Subscription: plan, product, status, renewal or expiry date and Apple's transaction identifier; promo codes you redeem. We never receive card details

  Purpose

  Provide the plan you chose, keep accounting records

  Legal basis (GDPR)

  Contract; legal obligation (tax, accounting)

  Kept for

  For the life of the account; 3 years after deletion

• Support and contact messages: name, e-mail, topic, message, language, app version, IP address

  Purpose

  Answer you, improve the service

  Legal basis (GDPR)

  Legitimate interest; contract

  Kept for

  Up to 24 months

• Account deletion feedback: the reason you chose and an optional note (without your name or e-mail)

  Purpose

  Understand why people leave

  Legal basis (GDPR)

  Legitimate interest

  Kept for

  Up to 24 months

• Crash and error reports: technical details of the crash, device model, system and app version. No account identifier

  Purpose

  Find and fix bugs

  Legal basis (GDPR)

  Legitimate interest

  Kept for

  90 days at the provider

• Usage analytics of the parent web panel: screens opened, app version, approximate region. Never in the apps or while a child is signed in

  Purpose

  Understand which features work and improve them

  Legal basis (GDPR)

  Consent

  Kept for

  2 months at the provider

Where the data comes from. From you, from your child's device after you pair it, from Apple or Google when you sign in with them, and from Apple when you subscribe through the App Store.

iPhone and iPad. Rules are applied on the device through Apple's Screen Time framework. Apple does not let Koby see which apps a child has; the apps you choose stay as private tokens on the device, and some usage details stay on the device too.

Mac and Windows. The Koby computer app sees only the name of the app in front and how long it is used while the computer is active. No window titles, website addresses, screenshots, keystrokes or other input.

A child's profile can only be created by a parent. For a child aged 16 or under, the child's device can only be paired after the parent gives consent. For a child under 13 (or with no birth date), the parent first declares consent in the app and then confirms it through a link sent to their verified e-mail address; a second e-mail follows with a link to withdraw consent at any time. For children aged 13 to 16 the parent's declaration is required. This covers COPPA in the United States, Article 8 of the GDPR and the UK GDPR, and similar laws.

Children have no e-mail address or password in Koby. They always see that Koby is active, why something is blocked, and which grown-ups can see their data; a reminder of who can see them arrives in their app every 30 days. If the App Store tells the child's iPhone that the account's age group does not match the birth date, Koby stops and tells the parent; the age group itself does not leave the device. If a parent withdraws approval for Koby through Apple's family features, the child's device is disconnected.

Details for parents, including what we collect from the child's device and your rights, are in the children's privacy notice. A version for children is on our page for kids.

• We do not read messages, chats or e-mails, or what a child types.
• We do not access the camera, microphone, photos or contacts, and we do not record the screen.
• We do not keep browsing history or a location history.
• We do not use advertising SDKs or advertising identifiers, and we do not sell or share personal data for advertising.
• We do not profile children, assign risk scores or make automated decisions with legal or similarly significant effects.
• We do not use children's data to train AI models.

We share personal data only with service providers that process it on our behalf under a contract, with Apple and Google for the sign-in and purchases you choose, with other parents you link to a child, and with authorities when the law requires it. We do not sell personal data.

• Turkcell, our hosting provider

  What for

  Servers, databases and backups that run the Koby service

  Data involved

  All service data described above

  Location

  Türkiye

• Google (Firebase Cloud Messaging, Crashlytics, Analytics)

  What for

  Delivering notifications; crash reports from the iPhone and iPad app; usage analytics of the web panel (no advertising features)

  Data involved

  Push tokens and notification content; crash details; analytics events without account identifiers

  Location

  United States and other countries

• Apple

  What for

  Sign in with Apple, App Store purchases and refunds, push delivery, Screen Time on the device

  Data involved

  Sign-in identifier, purchase records, push tokens

  Location

  United States and other countries

• Google (Google Sign-In)

  What for

  Signing in to the web panel with Google

  Data involved

  Sign-in identifier, e-mail

  Location

  United States and other countries

• Cloudflare

  What for

  Bot protection (Turnstile); hosting the web panel and its sign-in sessions (Workers, KV); storing images we publish (R2); backup store for website contact messages (D1)

  Data involved

  Technical browser signals, IP address, session data, contact messages

  Location

  Global network; United States

• Vercel

  What for

  Hosting this website; cookieless page analytics with your consent

  Data involved

  IP address, pages visited (aggregate)

  Location

  United States and EU

• Sentry

  What for

  Error reports from the Mac and Windows app, where enabled

  Data involved

  Scrubbed technical error details, no names or account identifiers

  Location

  United States

• Our e-mail delivery provider

  What for

  Sending sign-in codes, consent and service e-mails

  Data involved

  E-mail address, message content

  Location

  Türkiye or abroad, with the safeguards in section 8

Other parents: when you link a second parent to a child, they can see and manage that child's data as you can. Koby staff access personal data only to answer a request you made, to keep the service secure, or when the law requires it.

We are based in Türkiye, and the Koby service runs on servers in Türkiye (Turkcell). If you live in the United States or Canada, your data is stored and processed in Türkiye, where it is protected by this policy and by contract but may be accessible to authorities there. Some providers listed above operate in the United States and other countries; for data sent from Türkiye to them we use the standard contracts required by Article 9 of the KVKK. When personal data from the EEA, the UK or Switzerland is involved, for example on this website, we use the European Commission's standard contractual clauses, the UK addendum and additional safeguards where needed. You can ask for a copy of the safeguards at privacy [at] withkoby.com.

Data is encrypted in transit. Passwords and security answers are stored only as hashes. Every request is checked on the server against the family it belongs to, so one family can never see another's data. Each parent has their own sign-in, sessions can be ended from any device, and a child's device can be removed at any time. More on our security page; report vulnerabilities to security [at] withkoby.com. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

Service messages (sign-in codes, consent, security and billing) are part of the service. Product news is sent only if you opted in at sign-up or in settings, and you can switch it off at any time. Our e-mails contain no tracking pixels. The apps run no usage analytics. On the web panel, analytics run only after you allow them and never while a child is signed in.

You can download your data, or a child's data, as a file from the app (Settings › Account › Download my data) or the web panel. Deleting a device or a child's profile takes effect immediately. Deleting your account (Settings › Account and security › Delete my account) takes effect after 30 days, during which signing in cancels the deletion; then your account and the children's profiles you created are erased. A few records are kept afterwards, as listed above. Step-by-step instructions are on the account and data deletion page. Encrypted backups are overwritten within 30 days.

Wherever you live, you can ask us to tell you what we hold, give you a copy, correct it or delete it, and you can withdraw consent at any time (this does not affect processing before withdrawal). Most of this you can do yourself in the app. Otherwise write to privacy [at] withkoby.com or use the contact form. We will verify that the request comes from you (usually from your account's e-mail address) and answer within one month (45 days in US states that allow it), free of charge. A parent can make these requests for their child.

You also have the right to restrict or object to processing based on legitimate interests, and to data portability. You can complain to your local data protection authority or, in the UK, the Information Commissioner's Office. We would appreciate the chance to help first.

• In the last 12 months we collected these categories: identifiers (e-mail, device identifiers, IP address), personal records (name), commercial information (subscription status), internet or device activity (app usage minutes, protection status), precise geolocation of a child's device (last known location, only if allowed on the device), and inferences: none. Sources, purposes and retention are in section 4.
• We do not sell personal data or share it for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing data of anyone under 16. We do not use sensitive personal information (precise location, account sign-in) for anything other than providing the service, so no “limit” request is needed.
• You have the right to know, access, correct and delete your data, and not to be discriminated against for using these rights. An authorised agent can act for you with your written permission. If we refuse a request you can appeal by replying to our answer; if the appeal is refused you can contact your state attorney general.
• Our website treats a Global Privacy Control signal as a refusal of analytics.
• Parents of children under 13 have the COPPA rights described in the children's privacy notice.

Under PIPEDA and provincial laws, including Québec's Law 25, you can access and correct your data and withdraw consent, subject to legal or contractual limits. You can complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d'accès à l'information.

Under Article 11 of Law No. 6698 you can learn whether your data is processed and why, request information, learn the third parties it is transferred to, ask for correction or deletion and for those third parties to be told, object to a result against you that arises solely from automated analysis, and claim compensation for unlawful processing. Apply to us first; we answer within 30 days. If we refuse or do not answer, you can complain to the Personal Data Protection Board (KVKK).

This website and the web panel use only what they need to work, such as your language and sign-in session, and a bot check on forms. Analytics load only with your consent, and there are no advertising cookies. The apps use no cookies or advertising identifiers. Details: cookie policy.

We will tell you about material changes in the app and by e-mail before they take effect, and ask for consent again where the law requires it (for example before collecting new information from a child). The date at the top shows the latest version.