Privacy Policy

Effective date: October 31, 2026

1. About this policy

PhabletApps is operated by Mihai Dumitru in Romania, who is responsible for the personal information described here. This policy covers phabletapps.ro, our apps and related support. Contact us at AppsSmartRO@gmail.com.

Features vary between services. Account, synchronization, purchase and other online features apply only where offered and used; their description does not mean every app currently provides them. We explain additional or materially different processing before it begins. This policy does not authorize future processing by itself, and using a service is not consent to optional tracking.

2. Information we use and why

  • Accounts and sign-in, where offered: name, email address, account or sign-in-provider identifier, authentication/session information and optional profile details, to create and secure your account. Information may come from you or your chosen sign-in provider. Required fields and the consequences of not supplying them are explained at collection.
  • Saved content and preferences: app progress, creations, saved items, interests and settings. Some apps keep these only on your device. Content is associated with an online account or synchronized only where that feature is offered and used. Local saving alone does not send your content to us.
  • Local age checks, where offered: an optional age, age-range or birth-date answer is processed on your device to apply age-appropriate privacy safeguards and suggest a suitable mode. The answer is not sent to us or third parties. A birth date itself is not saved; depending on the app, only the resulting age range or eligibility status is kept, either in memory for the current player session or in the app's local storage on your device so the next session opens in the suitable mode. You can change or remove a kept answer through the app's player controls, by clearing the app's data or by uninstalling. Skipping or not answering keeps optional advertising and analytics integrations disabled and leaves every educational mode available. Other age-checking arrangements, if offered, are explained before collection.
  • Support: your name, email address, subject, message and any attachments you choose to send, to answer inquiries and resolve problems. The website contact form delivers messages through Google Gmail. Avoid sending passwords, payment details or unnecessary personal information.
  • Purchases, where offered: product and transaction identifiers, purchase/subscription status and relevant account identifiers, to deliver, restore and validate entitlements. Apple App Store or Google Play processes store payments; we do not receive your full payment-card details.
  • Notifications, where offered: device push tokens and notification preferences, to send notifications you choose to enable. Manage permissions in app or device settings.
  • Recommendations, where offered: selected interests, categories, authors and relevant content may be processed by a recommendation or AI service to select content for you. We explain any additional personal information involved before collection; describing this feature does not authorize unrelated AI training on your private content.
  • Operation and security: IP addresses, requested pages, browser/device information, request times and error information, to deliver services, diagnose problems and prevent abuse. The contact form uses an IP-based request limit and a short-lived security challenge cookie, separately from optional analytics.
  • Analytics, where enabled and permitted: page or screen views, feature interactions and technical diagnostics, to understand and improve services. Optional analytics requires consent where applicable. We do not deliberately include support-message contents, names or email addresses in website analytics events.
  • Advertising, where enabled and permitted: IP-derived approximate location, cookie/device/app identifiers, ad interactions and diagnostics may be processed to deliver and measure ads, prevent fraud and personalize advertising where allowed. Non-personalized ads can still involve personal data.

Read-aloud uses your browser or operating system's speech service; voice downloads and network processing depend on the selected engine and settings. Exports and sharing send the selected file or content to your chosen destination. Device backups may include app data under your platform account's settings. Those services have their own privacy practices.

3. Website cookies and privacy choices

Consent evidence. When our consent-capture feature is enabled and the service is available, an analytics decision sends a pseudonymous receipt to our private consent service. It contains a random consent ID for this browser, the app and platform, the analytics purpose, granted or denied choice, the recorded interaction (accept, reject, close/dismiss or later withdrawal), the collecting control, the notice version and language, the analytics option, your reported choice time and the service's recording time. The same browser ID can link analytics choices across visits while its current choice remains stored for up to 180 days. Restoring a saved choice does not create another receipt.

The service can derive a country and region from your IP address and a keyed IP hash (HMAC) for proportionate consent-evidence and abuse protection. A country can be unknown when the lookup is unavailable. Your raw IP is transmitted to the private service for this derivation but is not stored in the consent ledger. A keyed hash is pseudonymous personal data, not irreversible anonymization; it does not prove that two choices came from the same person.

The receipts are evidence of consent decisions, including rejection and withdrawal. They are not used to identify or profile people across apps. Our configured retention policy is three years, managed by the private service; this is our policy rather than a universal legal minimum. You can contact us about access or erasure and provide the consent ID stored in your browser. Clearing browser storage creates a new ID on your next choice; we do not reconstruct the old one using a network hash, an analytics identifier or another app.

Google Analytics measures this website only after an analytics grant. Before that grant, its tag and measurement requests stay blocked. Our own banner covers analytics only. Its optional consent-update analytics event uses the consent ID and notice version only for an explicit grant when consent capture is enabled, after Google Analytics loads; a known receipt result is marked separately. Denials and withdrawals are not sent to Google Analytics. Granted journey analytics is a separate purpose from keeping consent evidence, and we do not share website measurements with another analytics provider.

Advertising is switched off by default. If Google's Privacy & messaging consent feature is enabled by the operator, it becomes the sole consent authority and our analytics banner is hidden; an earlier banner grant cannot override Google's message. Google's script can make requests to provide that message before a choice. Its advertising choices are stored by Google rather than by us. We do not label those choices as receipts from our own banner. If no enabled consent source grants analytics, Google Analytics stays off.

The website remembers light/dark theme in browser local storage. The security challenge cookie is HttpOnly, scoped to our API, and expires after approximately ten minutes; solved challenges can be used once. Your analytics choice, random consent ID, notice version, language and timestamp are kept in browser local storage for up to 180 days, or until a material notice change requires a new choice. Analytics may use cookies such as _ga after you accept; lifetimes depend on provider settings and browser controls.

Analytics storage starts denied in Google Consent Mode. Accepting analytics permits analytics storage and loads the tag. Rejecting or withdrawing keeps analytics denied. Use Privacy & cookie settings in the footer to reopen the active consent controls. Withdrawal stops our analytics events immediately and automatically reloads a previously loaded analytics runtime after a brief, bounded receipt attempt. Receipt delivery is best effort; a service failure does not change your local privacy choice. Browser controls can clear or block cookies and local storage. Other apps explain their own optional integrations and controls.

See how Google uses information from sites and apps, Google's Privacy Policy and Google Analytics cookie usage.

4. Legal bases

For EEA/UK users, we rely on consent for optional tracking where required; providing a requested service for account, synchronization or purchase functions where applicable; legitimate interests for proportionate operation, support, security and age-appropriate privacy safeguards, balanced against your rights and especially children's interests; and legal obligations for applicable compliance and record-keeping. You can withdraw consent without affecting earlier lawful processing. We do not make solely automated decisions producing legal or similarly significant effects.

5. Who receives information

We use technology providers for specific functions, sharing information needed for that function:

  • Hosting, database and authentication providers: connection/security information and, for online features, account details, sessions and content needed to host, secure and synchronize the service.
  • Email and support providers: contact details, messages and attachments to deliver correspondence and support.
  • App stores and purchase-management providers: transaction, product, account and entitlement information for billing, validation and restoration.
  • Notification providers: device tokens, delivery information and notification content to deliver requested notifications.
  • Analytics and diagnostic providers: permitted usage, device and error information to measure performance and investigate problems.
  • Advertising and consent providers, including Google: applicable identifiers, device/ad interactions and privacy choices to manage consent, serve/measure advertising and prevent fraud.
  • Recommendation and AI-processing providers: applicable interests and relevant content to provide a recommendation feature you use.

These providers operate in the cloud-software, communications, payments and advertising sectors and may process data within or outside the EEA as explained below. Their roles vary by service; app stores and advertising providers can also process data independently. Contact us for relevant recipient details, including specific recipients where required by law. We may disclose information when legally required or necessary to protect rights, and provide required notice if responsibility for a service changes.

We do not sell support messages or private app saves for money or provide their contents to advertising services. Advertising disclosures can nevertheless count as a “sale” or “sharing” under laws covering advertising across services. We do not claim advertising-related sharing never occurs.

6. Retention and deletion

We retain personal information for its stated purpose and applicable legal requirements. Support correspondence is kept while addressing an inquiry and for up to three years afterwards, unless a legal obligation or dispute requires longer. Security records are kept as needed to investigate abuse and protect services. Analytics and advertising retention depends on provider settings, purpose and applicable requirements, rather than a single universal period.

Local app data remains until removed through available controls, browser/device settings or uninstalling, subject to backups/restoration. Exports, shared copies and backups require separate removal. We cannot remotely erase device-only saves or another person's copies.

Where accounts are offered, applicable notices explain account/content retention, deletion controls and lawful retained exceptions before collection. We delete or anonymize information under our control when no longer needed, subject to legal requirements. Store records and independently held provider information may require requests to those providers.

7. Children and younger users

Some apps include learning areas for children and teenagers. Optional third-party advertising and analytics integrations are disabled in those child/teen learning areas. Where the local age check described above is offered, adult eligibility is assessed separately from learning-mode choice: a minor, skipped or unknown result keeps these integrations disabled in every educational mode. An adult result does not itself give consent to optional tracking. Selecting a learning mode does not establish age or verify identity. This is not a statement that every app is intended for children or that every service has age-separated modes or a local age check. Ordinary hosting requests still occur when opening a web app; the general product website has its separate analytics behavior described above.

Parents and guardians should supervise sharing, external links, messages and device services. Online features for children require age-appropriate information, safeguards and parental authorization where legally required before processing begins. Contact us if you believe a child has improperly supplied personal information, so we can investigate and delete it where appropriate.

8. Rights and requests

Depending on applicable law, you may request access, correction, deletion, restriction, portability or information about processing; object to legitimate-interest processing or direct marketing; and withdraw consent. California rights, where applicable, include opting out of sale/sharing, limiting qualifying sensitive-information uses and equal treatment when exercising rights.

Email AppsSmartRO@gmail.com with the service and request, without passwords. Authorized representatives may contact us. Proportionate verification may be needed before releasing or deleting information. We respond within applicable periods, generally one month under GDPR or 45 days under CCPA, explaining permitted extensions or exceptions.

Use the consent controls above for browser-specific choices. The website does not currently implement its own Global Privacy Control signal handler; do not assume that signal alone changes every Google service's behavior. Contact us about a sale/sharing objection or unavailable control. You may complain to your local supervisory authority, including Romania's ANSPDCP.

9. International processing, security and updates

We operate from Romania; service providers may process data elsewhere, including outside the EEA/UK. Where required, transfers need an applicable adequacy decision or suitable safeguards such as approved contractual clauses. Contact us for details and information on obtaining relevant safeguards for your service. Using a service is not itself consent to an otherwise unlawful transfer.

We use HTTPS, access controls and safeguards appropriate to the information and risks. No service or device guarantees absolute security. Material new processing will be explained before it begins where required, with updated notices, necessary permissions or consent and applicable deletion controls. Continued use does not replace required consent.

Responsible operator: Mihai Dumitru, operating as PhabletApps, Romania.
Privacy contact: AppsSmartRO@gmail.com.