Privacy Policy for Oppi

1. Data Controller

Middle Milk Studio AB is the data controller responsible for the processing of personal data described in this Privacy Policy.

Middle Milk Studio AB

Email: info@oppi.me

2. Privacy by Design

Oppi has been built to function without requiring us to know who you are.

Unlike many other applications, Oppi does not require you to create an account using your name, email address, or password.

As a result, we generally do not know the identity of our users.

Our goal is to collect only the information that is strictly necessary to provide and improve the service.

3. Information We Do NOT Collect

As a general rule, Oppi does not collect or have access to:

• Your email address
• Your password
• Your phone number
• Your mailing address
• Your Apple ID
• Your payment information
• Your exact GPS location
• Your contacts
• Your calendar
• Your browsing history
• Messages from other apps
• Content from other apps
• Keystrokes
• Notifications from other apps
• Your photo library
• Which specific apps you or your child use
• Which apps are blocked through Oppi

Screen Time API

Oppi uses Apple's Screen Time framework.

Apple does not reveal the identity of selected applications to Oppi.

Instead, Apple provides encrypted, opaque tokens that only Apple's operating system can interpret.

Neither Oppi nor Middle Milk Studio AB can determine which specific applications have been selected or blocked.

4. Information We Process

To provide the service, Oppi processes a limited amount of information.

Child Profile

A parent or legal guardian may choose to provide:

• Child's first name or nickname
• School grade or birth year
• Optional profile picture

Providing a nickname instead of a full legal name is encouraged.

Device Information

Oppi may process:

• Anonymous installation identifiers (UUIDs)
• Push notification token
• Device type
• Operating system version
• Language settings

These identifiers are used solely for operating the service and cannot, by themselves, identify a natural person.

App Configuration

Oppi stores information required for the app to function, including:

• Screen time schedules
• Daily time allowances
• Quiz configuration
• Subscription status

Most of this information is stored locally on the user's device.

Quiz Activity

When a child completes a quiz, a summary of the results is sent to our servers. Quizzes created with the AI feature are also generated and stored on our servers. These are described in "Quiz results we receive" and "AI-Generated Quizzes" below.

Analytics & Diagnostics

To improve Oppi, we use trusted third-party services, including:

• AppsFlyer (attribution)
• Mixpanel (product analytics)
• Sentry (crash reporting)

These services help us understand app performance, measure feature usage, diagnose technical issues, and improve stability.

Where possible, analytics data is pseudonymized or aggregated.

5. Information Stored Locally

Most information generated while using Oppi remains on your own device. This includes, for example:

• Quiz history
• Screen time schedules
• Daily progress
• Selected Screen Time tokens
• Child profile information
• App settings

Middle Milk Studio AB does not have access to this locally stored information. The one exception is the quiz-results summary described in 'Quiz results we receive' below.

Quiz results we receive

When a child completes a quiz, the app sends a summary of that quiz to our servers. This summary contains only:

• a pseudonymous identifier for the child's profile (a random ID, not the child's name);
• the date of the quiz and an identifier for the quiz; and
• for each question: a random identifier for the answer, whether it was answered correctly, and the topic of the question (for example, "addition").

It does not include the child's name, the text of the questions or answers, any images, screen-time schedules, or which apps the child uses. We use this summary to support and track learning progress. We keep it only as long as necessary to provide the service, and a parent or guardian can request its deletion at any time by contacting info@oppi.me.

6. AI-Generated Quizzes

Oppi includes an optional AI feature that allows parents or legal guardians to create educational quizzes from homework, worksheets, or other educational material. Children do not interact directly with the AI service.

Images and AI processing

When using the AI feature, parents may choose one or more images using Apple's system photo picker. Oppi only receives access to the specific images the parent explicitly selects, and never to the user's entire photo library.

To create the quiz, the selected image is sent to our servers and to a third-party AI provider (Anthropic), which reads the image to generate quiz questions. The image is used only for this purpose and is not stored by Middle Milk Studio AB after the questions are generated.

The generated questions (the question text, the answer options, and the correct answer) are stored on our servers to operate the service. In most cases they are stored without any user or child identifier. When questions are prepared for delivery to a child's device, they are linked to a pseudonymous per-child key and kept only until they are delivered or expire. We do not store the child's original homework or the image itself.

Temporary Processing

Selected images are transmitted securely through Oppi's servers to our AI provider solely for the purpose of generating quiz questions.

Images are processed only for as long as necessary to generate the quiz.

They are not permanently stored by Middle Milk Studio AB and are deleted after processing.

AI Provider

Oppi currently uses Anthropic to provide AI-powered quiz generation.

When you use the AI feature, the educational material you choose to upload is securely transmitted to Anthropic solely for the purpose of generating the requested quiz.

According to Anthropic's API policies, customer-submitted content is not used to train Anthropic's generative AI models.

Middle Milk Studio AB does not permanently store uploaded images. Images are transmitted securely to Anthropic solely for the purpose of generating the requested quiz. Once processing is complete, the images are deleted from our systems.

We may replace or add AI service providers in the future if necessary for technical, operational, legal, or commercial reasons. Any such changes will be reflected in this Privacy Policy.

Please Avoid Uploading Personal Information

Parents should avoid uploading documents containing unnecessary personal or sensitive information, including:

• Full names
• Personal identity numbers
• Addresses
• Medical information
• Financial information

Only educational material necessary to generate quiz questions should be uploaded.

AI Limitations

Artificial intelligence may occasionally generate inaccurate or incomplete content. Parents remain responsible for reviewing generated quizzes before children use them. Oppi does not use AI to evaluate, profile, or make automated decisions about children. AI is used solely to generate educational content at the request of a parent or legal guardian.

7. Why We Process Personal Data

We process personal data only where necessary to:

• Provide the Oppi service
• Synchronize parent and child devices
• Deliver push notifications
• Enable subscriptions
• Generate AI quizzes
• Improve product quality
• Diagnose crashes
• Maintain security
• Comply with legal obligations

8. Legal Bases

Depending on the processing activity, we rely on one or more of the following legal bases under the GDPR:

• Performance of a contract
• Legitimate interests
• Legal obligation
• Consent (where applicable)

9. Sharing Personal Data

We do not sell personal data.

We do not rent personal data.

We do not share personal data for third-party advertising.

Personal data may be shared only with trusted service providers acting on our behalf, including providers of:

• Cloud infrastructure
• Analytics
• Crash reporting
• Attribution
• Push notifications
• AI services

These providers process personal data only under our instructions and subject to appropriate contractual safeguards.

Subscription management (RevenueCat)

We use RevenueCat, a third-party service, to manage subscriptions and validate purchases. When you subscribe, RevenueCat processes a pseudonymous user identifier (a random ID that does not include your name) together with your purchase and subscription details, so that your subscription works across your devices and to help prevent fraud. RevenueCat processes this data on our behalf and does not use it to track you across other apps or for advertising.

10. International Transfers

Some service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms.

11. Data Retention

We retain personal data only for as long as necessary to provide the service or comply with legal obligations.

Images uploaded for AI-generated quizzes are not permanently stored and are deleted after processing.

Support correspondence is retained only as long as reasonably necessary to handle the request.

Accounting records are retained for the period required by applicable law.

Where possible, data is anonymized or deleted when no longer needed.

12. Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encrypted communication (TLS)
• Access controls
• Authentication
• Security monitoring
• Regular software updates
• Least-privilege access principles

While we work continuously to protect personal information, no internet-based service can guarantee absolute security.

13. Children's Privacy

Protecting children's privacy is central to Oppi.

Children cannot independently create Oppi profiles.

Child profiles are created and managed by a parent or legal guardian.

We collect only the minimum information necessary for the service to function. We do not use children's data for:

• Behavioral profiling
• Targeted advertising
• Selling personal data
• Automated decision-making
• Marketing directed at children

14. Your Rights

Subject to applicable law, you may have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion
• Restrict processing
• Object to certain processing
• Receive your data in a portable format
• Withdraw consent where processing is based on consent

Because Oppi intentionally collects very little personally identifiable information, we may in some cases be unable to associate a request with a specific individual. This is a direct consequence of our Privacy by Design approach.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When significant changes are made, we will update the "Last updated" date and, where appropriate, notify users within the app.

16. Contact

If you have questions about this Privacy Policy or our privacy practices, please contact:

Middle Milk Studio AB

Email: info@oppi.me