SILKBYTE

Pimu: Coloring for Kids

Privacy Policy

Effective date: 21 October 2026 · Last updated: 21 October 2026

1. Who we are

Pimu: Coloring for Kids (the “App”) and the Pimu pages of our website (the “Site”) are provided by SILKBYTE LLC, a company registered in the Republic of Uzbekistan under number 3385405 (taxpayer identification number 313425436), registered address 32 Oqibat Street, Ipakchi Mahalla, Tashkent, Uzbekistan (“we”, “us”, “our”).

We are the controller (in Uzbekistan, the “owner and operator”) of the limited personal data described in this Policy.

  • Privacy questions and requests: [email protected]
  • Postal address: 32 Oqibat Street, Ipakchi Mahalla, Tashkent, Uzbekistan

2. Summary

  • The App is made for children aged 2–7 and is built to work without collecting personal information from children.
  • There are no accounts, no names, no photos of the child, no location, no contacts, and no access to the camera or microphone.
  • There are no ads, no advertising identifiers, no tracking across apps or websites, and no third-party analytics.
  • Colored pictures and progress stay on the device.
  • Purchases are processed by Apple or Google. We use RevenueCat to confirm purchases. It receives a random installation ID and purchase details, never the parent’s name or payment details.
  • We never sell personal information and never use it for advertising.
  • Parents can contact us at any time to ask questions or have data deleted.

3. Scope

This Policy covers the App on iPhone, iPad and Android devices, and the Pimu pages of the Site. It does not cover:

  • the App Store, Google Play or other services of Apple and Google, which have their own privacy policies;
  • third-party websites that a parent opens from the App’s parents’ section.

4. Children’s privacy

  • The App is directed to children. We design it to comply with the U.S. Children’s Online Privacy Protection Act (COPPA), the EU General Data Protection Regulation (GDPR) including its rules on children, the UK GDPR and the UK Age Appropriate Design Code, and other applicable laws.
  • The child’s side of the App has no chat, no user profiles, no sharing with other users, no social features and no way to send information to us.
  • Purchases, settings, purchase restoration and links that lead outside the App are behind a parental gate: a task that a young child cannot easily solve.
  • The only identifier the App uses is a random installation ID created by RevenueCat (see section 5.5). We use it, together with the technical data sent with every internet request, solely to support the internal operations of the App: to validate and restore purchases, prevent fraud and keep the service secure. We never use it to contact a child, to build a profile or to show ads (COPPA, 16 C.F.R. § 312.5(c)(7)).
  • If we learn that we have received personal information from a child in any other way, for example a child sends us an email, we delete it promptly.
  • We will not start collecting personal information from children without first obtaining verifiable parental consent where the law requires it, and without updating this Policy.

5. Information we process and why

5.1 Information stored only on the device

The App keeps colored pictures, coloring progress, thumbnails and settings (language, sounds, music, voice, hints) on the device. This information is never sent to us and is deleted when the App is deleted.

Your device’s own backup service, such as iCloud Backup or Android/Google backup, may include the App’s local data. Such backups are made under your account with Apple or Google, under their terms. We have no access to them.

5.2 Saving pictures to the gallery

When the user taps “Save”, the App asks for permission to add images to Photos or the Gallery. On iOS the App requests add-only access. On Android 10 and later no permission is needed; on older Android versions the system asks for storage permission. The App does not read, scan or upload existing photos. Saved images are then controlled by you and your device’s services, for example cloud photo sync. You can withdraw the permission at any time in the device settings.

5.3 Spoken color names

The App can say color names aloud using the device’s built-in text-to-speech engine, provided by Apple or by the engine installed on your Android device (for example Google’s). The App passes only fixed words such as the name of a color, never information about the child. Some engines may use online voices depending on their provider’s settings and policies. Parents can turn the voice off in the parents’ section.

5.4 Purchases through Apple and Google

Payments are handled entirely by the Apple App Store or Google Play. We never receive the name, email address, card details or billing address of the person who pays. The store tells us, through RevenueCat, the purchase status: product, transaction identifiers, dates, price and currency, store country, trial status, and renewal, cancellation or refund status.

5.5 RevenueCat

We use RevenueCat, Inc. (USA) as our service provider and processor for purchase management.

What it receives:

  • a random App User ID created when the App is installed. It is not linked to a name, email address or advertising identifier;
  • purchase data from the store: receipts or purchase tokens, product IDs, transaction IDs, dates, status, price, currency and store country;
  • technical data needed to talk to its servers: IP address (part of any internet connection; it may be used to estimate the country and for security), App version, platform and operating system version, SDK version, and device language.

We have not enabled RevenueCat features that collect advertising identifiers or device identifiers, or that send data to attribution or analytics partners.

Why: to unlock the paid content you bought, restore purchases on another device, prevent fraud, handle refunds and support requests, and see aggregate statistics such as the number of trials, subscriptions and revenue.

Legal bases (GDPR): performance of a contract (Art. 6(1)(b)) to provide the content you bought, and our legitimate interests (Art. 6(1)(f)) in fraud prevention, security and aggregate business reporting.

RevenueCat privacy policy: revenuecat.com/privacy

5.6 Downloadable content (if enabled in the future)

Today all pictures are included in the App and no content is downloaded. If a future update adds downloadable packs, the App will request plain files from our content server or content delivery network (Cloudflare, Inc. (USA)). Such requests will contain no identifiers. Like any web server, it will receive the IP address and standard technical information (time, requested file, device type) in its logs, used only to deliver files and protect the service. We will update this Policy before enabling downloads.

5.7 Information parents send us

If you email us, we receive your email address, your name if you include it, your message and any attachments. We use them only to answer you, handle your request and keep a record of privacy requests. Legal bases: our legitimate interest in answering you and, for privacy requests, our legal obligations. Please do not send us information about your child. Email is provided by Namecheap, Inc. (Private Email).

5.8 The Site

The Pimu pages of the Site are hosted by Cloudflare, Inc. (USA). The Site uses no cookies, no analytics and no tracking pixels, and its fonts are hosted on our own server. The hosting provider automatically logs technical data (IP address, time, requested page, browser type, referring page) to deliver the pages and protect them from abuse.

5.9 Statistics and crash reports from Apple and Google

Apple and Google may give us aggregated statistics, such as downloads, sales, countries and device types. If the user has agreed in the device settings to share diagnostics with app developers, they may also give us crash and performance reports. These reports are produced by Apple and Google under their own policies and do not contain names or contact details. We use them only to fix errors and improve stability.

6. What we do not do

  • We do not sell personal information and do not “share” it for cross-context behavioral advertising.
  • We do not show ads of any kind, and do not use advertising identifiers (IDFA, Android Advertising ID).
  • We do not track users across other companies’ apps or websites, so the App never shows Apple’s tracking permission prompt.
  • We do not use third-party analytics or advertising SDKs.
  • We do not collect location, contacts, photos, camera or microphone data, health or biometric data.
  • We do not send push notifications.
  • We do not profile users or make automated decisions that have legal or similarly significant effects.

7. Who receives information

  • RevenueCat, Inc. (USA) — purchase management, as our processor.
  • Apple Inc. and Google — as independent controllers, for downloads, payments, subscriptions, refunds and platform services.
  • Cloudflare, Inc. (USA) — hosting of the Site and, if enabled, content delivery.
  • Namecheap, Inc. (Private Email) — our support email.
  • Professional advisers, such as lawyers and accountants, under a duty of confidentiality, when needed.
  • Authorities, when the law requires it, or to protect rights, safety and property.
  • A successor, if our business or the App is transferred, reorganized, merged or sold. The successor must respect this Policy, and we will notify you of any change in who is responsible for your data.

We do not disclose personal information to anyone else.

8. International transfers

We are based in the Republic of Uzbekistan. RevenueCat is based in the USA, and our other providers may process data in other countries.

When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to countries without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or certifications such as the EU-U.S. Data Privacy Framework where the recipient participates in it, together with supplementary measures where needed. You can ask us for a copy of the relevant safeguards.

9. How long we keep information (data retention policy)

  • On-device data: until you delete it or the App. We have no copy.
  • Purchase records at RevenueCat: for as long as the App is offered, so that you can restore purchases. After that, for up to 12 months to handle refunds, disputes and accounting. Records of installations that made no purchase and have been inactive for 24 months are deleted. We delete a record earlier at your request, unless we must keep it by law.
  • Emails from parents: up to 24 months after your question is resolved.
  • Records of privacy requests: 3 years, to show that we handled them correctly.
  • Server logs of the Site and content delivery: up to 30 days, or as set by the hosting provider for security.
  • Statistics and crash reports from Apple and Google: as set by Apple and Google.

When information is no longer needed, we delete it or make it anonymous.

10. Security

We maintain a written information security program appropriate to our size and to the sensitivity of the data:

  • access to our accounts with Apple, Google, RevenueCat, hosting and email is limited to people who need it and protected with two-factor authentication;
  • all connections between the App and our providers use encryption (HTTPS/TLS);
  • we use providers that offer appropriate security commitments, and we review our practices regularly.

No system is perfectly secure. If a security incident affects personal data, we will notify the competent authorities and affected people as required by law.

11. Your rights and choices

Rights everyone has

You can ask us what information we hold about you, and ask us to correct or delete it. We answer within 30 days, or within the time the law sets for you.

How we find your records

We do not know who you are, so to find your purchase records please send us the order or transaction number of your purchase:

  • Apple: from the purchase receipt email or reportaproblem.apple.com;
  • Google: the order number starting with “GPA.”.

We may ask for reasonable information to verify the request, and we will not ask for more than we need.

Deletion

  • Deleting the App removes all data stored on the device.
  • At your request we delete your purchase record at RevenueCat. Your purchase stays with Apple or Google, so you can still restore it later; restoring creates a new record.

Other choices

  • Cancel a subscription in your App Store or Google Play account settings. Deleting the App does not cancel it.
  • Turn off the voice, sounds and music in the parents’ section.
  • Withdraw gallery permission in the device settings.

Parents (COPPA)

Parents can review, delete and refuse further collection of their child’s personal information. Since the App does not collect children’s personal information beyond the installation ID described above, deleting the App or asking us to delete the purchase record is enough.

EEA, UK and Switzerland

You have the right of access, rectification, erasure, restriction, data portability, the right to object to processing based on legitimate interests, and the right to withdraw consent where processing is based on consent. You can complain to the data protection authority in your country. We do not make decisions based solely on automated processing.

California and other U.S. states

  • Rights: to know and access, to delete, to correct, to opt out of sale, sharing and targeted advertising, to limit the use of sensitive information, and not to be discriminated against for using these rights. You may use an authorized agent.
  • What we collected in the last 12 months:
    • identifiers (a random installation ID, IP address);
    • commercial information (purchase records);
    • limited technical information in server logs.
  • Sources: your device, Apple and Google.
  • Purposes: as described in section 5.
  • Disclosures: only to the service providers listed in section 7, for business purposes.
  • We do not: sell or share personal information, including that of consumers under 16. We do not process sensitive personal information.
  • Opt-out signals: we honor Global Privacy Control signals, although there is nothing to opt out of.
  • Appeals: if we decline your request, you can appeal by replying to our answer with the word “Appeal”. If you are not satisfied with the outcome, you can contact your state Attorney General.

Uzbekistan

Under the Law “On Personal Data”, you have the right to know about and access the processing of your personal data, to require its update, blocking or destruction, to withdraw consent, and to appeal to the authorized state body or a court.

Other countries

If you live elsewhere, for example in Brazil, Turkey, Japan or Saudi Arabia, you may have similar rights under local law. We honor privacy requests wherever you live.

12. Do Not Track

We do not track users, so Do Not Track signals do not change how the App or the Site work.

13. Links

The parents’ section has links to this Policy, the Terms of Use and app store pages. They open outside the App only after the parental gate. Other websites have their own privacy policies.

14. Changes to this Policy

We publish changes on this page and update the date at the top. We announce material changes in advance in the App’s parents’ section or in the store release notes. If a change would involve collecting personal information from children, we will first obtain verifiable parental consent where required.

15. Contact

SILKBYTE LLC, 32 Oqibat Street, Ipakchi Mahalla, Tashkent, Uzbekistan, [email protected].

If this Policy is translated, the English version prevails unless the law requires otherwise.