My Regulation Buddy Privacy Policy

1. Who this policy covers

My Regulation Buddy is an app made by Bots & Pieces, the business name of Jacob Roberts, a sole trader with ABN 18 813 409 919. In this policy, “we”, “us” and “our” mean that business.

This policy covers the app on Android phones and tablets and in a web browser. It explains what the app keeps about the child who uses it, and about the adults who set it up.

When you email or call us, or use our website, our main Privacy Policy covers that instead.

2. The short version

• Everything the app records is kept on the device it is used on.
• Nothing is sent to us, and we cannot see it, unless a parent turns on sharing.
• There are no ads. The app does not track the child, use their location or read their contacts, and we never sell information.
• An adult can clear the records at any time, or remove the app to delete everything on that device.

3. What the app keeps

The app keeps only what people type, tap or add to it:

• the child’s first name and their buddy’s name;
• body check-ins: what they noticed, where they felt it, how big it felt, and any feeling word;
• which calming tools were tried, and how big the feeling was before and after;
• goals, plans, the daily schedule, notes, social stories, reflections and the break card words;
• entries an adult adds, such as the behaviour log, adjustments, notes from talking with the family, and goal ratings;
• trusted people’s names and mobile numbers, used by the I need help button;
• for schools, an optional year level, class and school ID;
• photos, voice recordings and videos that an adult chooses to add;
• how long the app is open each day, used for the usage report;
• answers to “Did you like this?”, the date consent was recorded, and the adult PIN.

Some of this is about a child’s feelings and behaviour. We treat it as health information, which is sensitive, even where the law might not require us to.

4. Where it is kept

The records are saved in the app’s own storage on the device. In a web browser, that is the browser’s storage for the app’s web address. Videos are kept in a separate store on the same device.

While sharing is off, nothing the app records leaves the device, and we have no way to see it. Anyone who can unlock the device and knows the adult PIN can see it.

5. Sharing between devices

Sharing is optional and off by default. It lets a parent share a child’s records with people they invite, such as another parent, an OT or a support worker. It is not offered in every version of the app.

If a parent turns it on:

• each person signs in with their email address and a one-time code. We keep their email address to let them in;
• a shared copy of the child’s records is kept in a database in Sydney, Australia, run for us by our hosting provider, Supabase;
• only people the parent invites can see it. The parent can see who has access and remove anyone;
• the adult PIN and videos are never shared. They stay on each device;
• the parent can delete all of the shared records at any time from Settings.

Because we run the sharing service, we could technically reach the shared copy. We only look at it to fix a problem you ask us to fix, or if the law requires it.

6. What the app asks the device for

• Microphone, only when an adult records their voice reading a tool’s steps.
• Photos and videos, only the files an adult picks to add.
• Notifications, only if an adult turns on reminders or the self-check timer.
• Bluetooth, only if an adult connects a heart-rate strap in a web browser. The heart rate is shown on screen and is not saved.

You can say no to any of these and the rest of the app still works.

7. Other services the app uses

• Read aloud uses the voice built into the phone, tablet or browser. On some devices that voice service runs online, provided by the device or browser maker under their own privacy terms.
• The web version loads its font from Google Fonts, which tells Google the device’s internet address and browser. The Android app has the font built in.
• Sharing, when it is on, loads the code it needs from a public code library (jsDelivr) and talks to the database described in section 5.

The app uses no advertising or analytics services.

8. When you report a problem

The Report a problem form opens your own email app with the message ready to send. Nothing is sent until you press send. If the box is ticked, it adds the app version and basic device details. It does not add the child’s name or their check-ins, so please leave those out of what you type, too.

Once we receive your email, our main Privacy Policy covers it.

9. Children and consent

The app is made for children to use with an adult’s help. A parent or guardian sets it up, or a school or therapist does with the family’s consent. The app asks that adult to confirm this and records the date.

The adult settings and reports sit behind a 4-digit PIN, so a child cannot change them by accident. The break card is the child’s own, and they can change its words themselves.

10. Schools, clinics and other organisations

When a school, clinic or other organisation uses the app, the records on its devices belong to it, and its own privacy policy and obligations apply. We supply the app. We do not see those records unless the organisation asks us for help and shows them to us.

We suggest using first names or initials only, and the school’s own ID rather than any government number.

11. How long it is kept

• On the device: until an adult clears it in Settings or removes the app. Clearing the browser’s data also deletes it. A backup code made in Settings is kept wherever you saved it.
• The shared copy: until the parent deletes it. Stopping sharing on one device does not delete the shared copy, so a parent who wants it gone should choose Delete all shared data.
• Sign-in email addresses: while the person has access, and deleted when you ask.

12. Seeing, changing and deleting it

An adult with the PIN can see, change and copy everything the app keeps, and can clear it. A parent who shares can delete the shared copy. If you want help with any of this, or want us to delete a sign-in email address, contact us using section 16. We will not ask for more information than we need to confirm it is you.

13. How it is kept safe

The PIN keeps the adult settings away from children. It does not encrypt the records, so keep the device itself locked with a screen lock or password. The shared copy is only reachable by people who sign in and have been invited, and it travels over an encrypted connection.

If records are lost or seen by someone who should not see them, and that could cause serious harm, we will tell the people affected. We will also tell the Office of the Australian Information Commissioner.

14. Our position under the Privacy Act

Most Australian businesses with an annual turnover of $3 million or less are not automatically covered by the Privacy Act 1988, and we are currently under that threshold. There are exceptions, and a business that holds health information can be covered.

We have chosen to follow the Australian Privacy Principles as our working standard regardless of whether we are legally required to.

15. Complaints and changes

If you think we have mishandled your information, email Jacob.Roberts@botsandpieces.com.au with enough detail for us to look into it. We will confirm receipt within 2 business days and aim to give you a written answer within 30 days. If you are not satisfied, you can go to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We update this policy when the app changes what it keeps or where it keeps it. The current version is always at botsandpieces.com.au/my-regulation-buddy-privacy.html.

16. How to contact us