Who we are
TONKO (the app and tonko.app) is made and provided by Jakša Tomović, Croatia, under his studio name Boiled Eggs Studio (boiledeggs.studio). He is the controller of the personal data described here, which under the EU General Data Protection Regulation (GDPR) means he decides how and why it is used.
For anything about privacy, write to hello@tonko.app. You will hear back from a person, usually within a few days and always within one month.
What we collect
Parents
- Sign-in: when you sign in with Google, we receive your name, your email address and a Google account identifier. We never see your Google password.
- Profile: the name shown to your family and the illustrated avatar you choose.
- Sessions: a secure sign-in token (stored only as a scrambled hash), when it expires and which app and phone it belongs to, so you can stay signed in and sign out other phones.
Your family
- Family settings: the family name, currency, time zone, week start, parental controls and pocket-money rules.
- Family PIN: stored only as a secure hash, never as the PIN itself.
- Family activity: jobs, rewards, notes, the pocket-money ledger, goals, grow plans, notifications and a history of important actions (for example who approved a job), so every parent can see what happened and when.
Children
- A nickname, an age range (6–8, 9–11 or 12–14), an illustrated avatar and the outfit your child picks for Tonko.
- Their jobs, jars, goals, lesson stars and learning streaks.
- Children don't create accounts and never give us an email address, a phone number, a birth date, a real photo of themselves or their location.
Job photos (optional)
A child can add a photo to show a finished job. The photo is taken with the phone's own camera app, made smaller and stripped of its metadata (including location) on the phone, and then sent to our server only so the family's parents can see it. It is deleted as soon as a parent approves or declines the job, and after 14 days at the latest.
Phones
- A device name, the platform and app version, a random installation identifier and when the phone was last seen, so you can see and remove connected phones.
- A push token from Firebase Cloud Messaging, so we can send the notifications you turned on.
Purchases
Your plan, whether a trial is running, the product you bought, when the current period ends and a scrambled (hashed) copy of the Google Play purchase token, so we can confirm the purchase with Google. Payments are handled entirely by Google Play: we never see your card or bank details.
When you contact us
Your email address and whatever you choose to write to us.
What we don't collect
- No location, contacts, microphone, calendar or files. The app does not ask for those permissions.
- No advertising ID, no analytics, no crash-reporting or tracking tools.
- No fingerprint or face data: unlocking with biometrics happens in Android, and TONKO only learns whether it worked.
- QR codes are read by Google Play services on your phone. TONKO itself has no camera permission.
Our server sees your IP address while it answers a request and uses it briefly to protect against abuse (rate limiting). We don't store IP addresses in our database.
Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing TONKO: accounts, the family, children's spaces, jobs, pocket money, goals, lessons and syncing between phones | Performing our contract with you (Art. 6(1)(b)) |
| Children's profiles and activity, which a parent adds and manages | Our contract with the parent, and the parent's consent on behalf of the child (Art. 6(1)(a) and (b), Art. 8) |
| Notifications you have turned on | Your consent, which you can withdraw in TONKO or Android settings at any time (Art. 6(1)(a)) |
| Subscriptions and packs: confirming purchases with Google Play and unlocking what you paid for | Performing our contract with you (Art. 6(1)(b)) |
| Keeping TONKO safe: sign-in security, the family PIN, preventing abuse, fixing faults | Our legitimate interest in a secure service (Art. 6(1)(f)) |
| Answering your messages | Our legitimate interest in helping you (Art. 6(1)(f)) |
| Meeting legal duties, such as answering an authority's lawful request | Legal obligation (Art. 6(1)(c)) |
We don't use your data for advertising, don't build profiles of you or your children, don't make automated decisions about you and never sell or rent your data.
Children
TONKO is for families: parents manage it and children use it with them. We follow the Google Play Families Policy and the GDPR's rules for children's data.
- Only a parent or legal guardian aged 18 or over can create a family. Children join through a pairing code from a parent or on a parent's own phone.
- We ask only for what a child's space needs: a nickname, an age range and an avatar.
- Children see no ads, no links out of the app, no chat and no public profiles, and nothing they do is visible to anyone outside their family.
- Grown-up settings stay behind a parent's approval, biometrics or the family PIN.
- A parent can see, change, export or delete their children's data at any time.
If you believe a child's data reached us without a parent's permission, write to hello@tonko.app and we will delete it.
Where your data is
Our database is in the European Union. Some providers (Google, Vercel, DigitalOcean, Cloudflare) are US companies and may process data outside the EU. Where that happens, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.
How long we keep it
| Data | Kept for |
|---|---|
| Your parent account (name, e-mail, sign-in) | Until you delete your account; where your name appears in a family's history, it is then replaced by “A parent” |
| The family, children's profiles and activity | Until the family's owner deletes the family |
| Job photos | Until a parent decides, and 14 days at the most |
| Sign-in sessions | Up to 60 days of inactivity, then deleted |
| Pairing codes, parent invitations and requests to open the parent area | Until they expire (pairing codes after 10 minutes, requests after 2 minutes, invitations after 7 days), then deleted a day later |
| Technical request records (to avoid double actions) | 7 days |
| Backups | Deleted data disappears from backups within 30 days |
| Emails you send us | As long as needed to help you, and no longer than 2 years |
How we protect it
- All traffic between the app and our server is encrypted (HTTPS).
- The family PIN, sign-in tokens and purchase tokens are stored only as secure hashes.
- Sign-in details on the phone are kept in encrypted storage.
- A child's phone can't open the parent area without a parent's approval, biometrics or the family PIN, and wrong PIN guesses slow down.
- Only the people who run TONKO can reach the servers, and only when needed.
No system is perfectly secure. If a breach ever puts your data at risk, we will tell you and the supervisory authority as the law requires.
Your rights and choices
Under the GDPR you can ask to access, correct, delete, restrict or receive a copy of your personal data, and object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time.
- Correct: change names, avatars and settings in the app.
- Export: Settings → Safety & privacy → Export family data gives you a copy of everything we store about your family.
- Delete: Settings → Safety & privacy → Delete family or Delete my account, or see Delete your account.
- Notifications: turn them off in Settings → Notifications.
For anything else, write to hello@tonko.app. We may ask you to confirm it's you, for example by writing from the email address you use with TONKO.
You can also complain to a data protection authority. In Croatia that is the Agencija za zaštitu osobnih podataka (AZOP); you can also contact the authority where you live.
This website
tonko.app has no advertising and no tracking cookies. To see how many people visit and which pages they read, we use Vercel Web Analytics: it counts page views without cookies, does not store your IP address and cannot follow you to other websites. If you switch the language, we save that choice in one small cookie (NEXT_LOCALE) for a year so the site opens in your language next time. Vercel, our website host, keeps short-term technical logs, including IP addresses, to deliver the site and keep it secure.
Changes to this policy
When TONKO changes what it collects or how it uses data, we update this page and the date at the top. If a change matters, we will tell you in the app before it takes effect.