Privacy Policy

1.Definitions

In short:"we" = Itzik Lugassy; "the information" = the little the App needs in order to work.

In this Policy the following terms have the meaning next to them. Terms not defined here are interpreted according to the Israeli Protection of Privacy Law, 5741-1981, as amended (including Amendment 13), and, where they apply, the GDPR, the UK GDPR, the U.S. Children's Online Privacy Protection Act (COPPA) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

"App"

The "Cozy Bedtime Stories" application (Hebrew: סיפורי שינה מרגיעים; bundle identifier com.sleepstories.app), currently distributed on the Apple App Store for iOS devices.

"Operator", "we", "us", "our"

Itzik Lugassy, sole trader, as described in Section 2.

"User", "you"

A parent, legal guardian or other adult aged 18 or older who installed the App and uses it, including to read stories to a child.

"Child"

The child to whom the stories are read. The Child does not use the App and does not provide any information to it.

"Personal information" / "personal data"

Data relating to an identified person or to a person who can reasonably be identified, directly or indirectly.

"Specially sensitive information"

As defined in the Israeli Protection of Privacy Law, including information about a person's physical or mental health; in GDPR terms, "special categories of personal data" (Article 9), including health data; and in CCPA/CPRA terms, "sensitive personal information".

"Processing"

Any operation on information, including collecting, receiving, storing, transferring, accessing, using, disclosing and deleting.

"Service provider" / "processor"

An external party that processes information on our behalf in order to operate the App, as described in Section 8.

"Anonymous ID"

A random string generated on the device to manage the subscription (see Section 4), shown to you in the App on the "Our Story" screen under the heading "Anonymous device ID". It contains no name, email, phone number or advertising identifier, and it does not let us know who you are.

"Device"

The phone or tablet on which the App is installed.

2.Who we are

The App is operated by Itzik Lugassy (איציק לוגאסי), a sole trader registered in Israel. The Operator decides the purposes and means of processing - the "database owner" under Israeli law, the "controller" under the GDPR and UK GDPR, and the "business" under the CCPA/CPRA - with respect to the limited information described in this Policy.

3.Scope of this Policy

This Policy applies to your use of the App, to the support site, and to messages you send us. It serves as the notice required by Section 11 of the Israeli Protection of Privacy Law, as the information to be provided under Articles 13 and 14 of the GDPR, and as the "notice at collection" and privacy policy required by the CCPA/CPRA, in each case to the extent those laws apply.

You are not legally required to provide us with any information. Using the App does not require providing any identifying details. The technical information described in Section 4 is needed for the App to work (for example to load stories and verify the subscription); without it, parts of the Service cannot be provided.

This Policy does not apply to processing that Apple performs itself, as an independent controller, in the App Store, your Apple ID and payment. That processing is governed by Apple's privacy policy (see Section 8). This Policy supplements the App's Terms of Use and Apple's Licensed Application End User License Agreement (Apple Standard EULA).

4.Information we process

In short:Favorites and opened stories - only on your device; subscription data - at Apple and RevenueCat; emails - with us.

The table below lists every category of information the App processes, the purpose, where the information is stored and for how long.

No crash-reporting or analytics tools. The App contains no crash-reporting or analytics component (such as Sentry, Crashlytics or Firebase Analytics). If we start using such a tool, we will update this Policy in advance. Crash reports that you choose to share with developers through iOS settings are collected by Apple and passed to us without identifying details.

5.Information we do not collect

The App requests no iOS permissions - not location, camera, microphone, photos, contacts or notifications.

6.Sensitive information and category selection

The stories are organized in 6 categories: Tourette syndrome, attention and focus (ADHD), worries and fears, trouble falling asleep, sensory sensitivity, and autism spectrum. We are aware that some category names refer to health or developmental conditions. Therefore:

• Choosing a category is not a collection of health information about the Child. It is a content choice, like choosing a shelf in a library. It does not indicate that the Child has any diagnosis, and we draw no such inference from it.
• The choice is not linked to your identity by us, and we keep no record of it. When you open a category, the App sends Firebase a query by category name only, with no user identifier, without the RevenueCat Anonymous ID and without authentication. The hosting provider (Google) receives, as with any network request, technical data such as an IP address.
• The choice is not sent to RevenueCat, is not used for advertising or profiling, and is not sold or shared.
• The list of opened stories (used to track the free story) is stored on the device only.

Because we do not process health information about an identified or identifiable person, we do not process "specially sensitive information" under Israeli law, "health data" under Article 9 of the GDPR, or "sensitive personal information" under the CCPA/CPRA, and we do not ask for consent to do so. If this changes, we will update this Policy and act in accordance with the law, including obtaining explicit consent where required.

7.Purposes and legal bases

In short:We use information only so that the App and the subscription work, and never for advertising or profiling.

We process information only for the purposes listed here. Under Israeli law, processing is carried out to provide the service you requested and in accordance with this notice. Under the GDPR and UK GDPR (where they apply), the legal bases are:

We do not use information for advertising, targeted marketing, profiling, automated decisions with legal effect, or training artificial-intelligence models.

8.Third parties

We do not sell, rent or trade information. We use only the following providers, and each receives only the information needed for its role:

Our service providers are bound, under their terms with us and their data-processing agreements (DPAs), to process the information only to provide the service and to protect it. For CCPA/CPRA purposes they act as our "service providers" and are contractually prohibited from selling or sharing the information or using it for their own purposes.

Disclosure required by law: We may disclose information if required to do so by law, a court order or a demand from a competent authority, or if needed to protect our rights. Because we hold so little information, any such disclosure is limited by nature.

Business transfer: If the App is transferred to another party (for example in a sale or merger), the limited information described here may be transferred to that party, subject to this Policy and to the law.

9.International transfers

In short:Our providers are mainly in the United States, and they are contractually bound to protect the information.

The service providers listed in Section 8 operate mainly in the United States. The Operator is located in Israel. The information described in Section 4 (other than information stored on the device only) is therefore processed in the United States and in Israel, and may be transferred between those countries and the country where you live.

Transfers from Israel are made in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001, on the basis of the providers' written commitments in their data-processing agreements (DPAs), which include standard contractual clauses and/or reliance on the EU-U.S. Data Privacy Framework, as applicable.

If you are in the EU, the EEA or the United Kingdom, your data may be transferred to the United States and to Israel. Israel benefits from an adequacy decision of the European Commission and from UK adequacy regulations. Transfers to U.S. providers rely on the EU-U.S. Data Privacy Framework (and its UK Extension) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) included in the providers' DPAs. You may contact us for more information about the safeguards that apply to these transfers.

If you are in the United States, note that the Operator is located in Israel and that information you send us by email is processed there. The anonymous subscription data stays with U.S. providers (Apple and RevenueCat).

10.Data retention and deletion

We keep information only for as long as it is needed for the purpose for which it was collected, or as required by law. The retention period for each type of information is listed in the table in Section 4.

Data on the device

Deleting the App from your device deletes the local data: favorites, opened stories, the local subscription status and the local Anonymous ID. We have no copy of them and no way to restore them. Note: a backup of your device (for example iCloud) may include this data, depending on your backup settings.

Deleting the App does not cancel the subscription

The subscription is managed by Apple and renews automatically until cancelled. To cancel: Settings → [your name] → Subscriptions, at least 24 hours before the renewal date. After reinstalling, you can restore the subscription with the "Restore purchase" button.

Deleting data at RevenueCat

RevenueCat stores the Anonymous ID and purchase data on our behalf. To delete them, send a request to bestoftbest.service@gmail.com. Because we do not know who you are, include a detail that lets us locate the record: the Anonymous ID, shown in the App on the "Our Story" screen under "Anonymous device ID" (you can copy it before deleting the App), or the Order ID from the purchase receipt Apple emailed you. We will delete the record through the RevenueCat dashboard and confirm the deletion to you.

After deletion, purchase records may be re-created if you tap "Restore purchase". Apple continues to keep your purchase history under its own policy, over which we have no control. Aggregate transaction reports (with no identifying details) are kept for up to 7 years as required by tax law.

Messages

Correspondence with us is kept for 24 months after the matter is closed and then deleted, unless we need to keep it for legal defense or as required by law. You may request earlier deletion.

11.Data security

The best way to protect information is not to collect it, so the App is built on data minimization. In addition:

• All communication between the App and the service providers is encrypted with HTTPS/TLS.
• Local data is kept in the App's private storage on the device and protected by iOS security mechanisms (sandbox).
• Access to the Apple, RevenueCat, Firebase, Expo, Gmail and GitHub dashboards is limited to the Operator and protected by two-factor authentication.
• The Firestore database is configured as read-only for the App: story content can be read from it, not written to it.
• We take reasonable measures in line with the Israeli Protection of Privacy Regulations (Data Security), 5777-2017, to the extent they apply, and at a security level appropriate to the nature of the information.

No security method is completely immune, so we cannot guarantee absolute security. However, because of the very limited scope of the information, the risk to your privacy is low.

12.Security incidents

If a security incident occurs that could affect personal information, at our end or at one of our service providers:

• We will act immediately to contain the incident and assess its consequences.
• We will report to the Israeli Privacy Protection Authority where the law requires it (including a serious security incident under the Data Security Regulations), to a European supervisory authority within 72 hours where the GDPR applies and requires it, and to affected individuals and authorities in the United States where a state data-breach notification law applies and requires it.
• We will notify users who may be affected, where the law requires it or an authority directs it, through the App, the support site or any other reasonable means. Because we do not hold contact details, the notice will usually be published generally.
• We will document the incident and the steps taken.

If you discover a security vulnerability in the App, please report it to us: bestoftbest.service@gmail.com.

13.Children's privacy (COPPA)

In short:The App is for parents, not for children. We do not knowingly collect personal information from anyone under 13, and there is no way for a child to enter information in the App.

The App is directed to adult parents and guardians (18+) who read the stories to a Child. The Child does not use the App, is not required to operate it and does not provide any information to it. The App has no chat, no content upload, no child profile, no account, no data-entry fields and no means by which a child could provide personal information. The App is not listed in the Kids category of the App Store and is not directed to children.

COPPA (United States)

• We do not knowingly collect, use or disclose personal information from children under 13. The App does not ask for a name, age, date of birth, photo, voice, location or any other personal information, from anyone.
• The only persistent identifier the App uses - the RevenueCat Anonymous ID - is generated on the device, is tied to the adult's Apple ID purchase, and is used solely for internal operations (verifying the subscription and restoring purchases), as permitted by COPPA's "support for internal operations" exception. It is never used for behavioral advertising, profiling, or contacting anyone. The Expo update-request identifier is likewise used only to deliver software updates.
• We do not use any third-party advertising, analytics or social-media SDK.
• What a parent can do: if you believe a child under 13 has provided us with personal information (for example by emailing us from a child's account), contact us at bestoftbest.service@gmail.com and we will delete it promptly. You can also delete all local data at any time by deleting the App, and ask us to delete the Anonymous ID record at RevenueCat (Section 10). We will not condition any part of the service on a child providing information.

GDPR and UK GDPR (Article 8)

The Service is not offered directly to children and we do not rely on a child's consent. The User is the parent.

Israeli law

We do not collect information about minors.

We recommend that the parent operate the App personally and not leave the device in the Child's hands unsupervised. We also recommend enabling Screen Time and "Ask to Buy" on Apple devices used near children.

14.Your rights

In short:You can ask to see, correct or delete your information - write to us and we will reply within 14 business days.

Under the Israeli Protection of Privacy Law, and under the GDPR and UK GDPR to the extent they apply to you, you have the following rights (rights of U.S. residents are described in Section 15):

How to exercise your rights

• Local data is entirely under your control. You can view it in the App and delete it at any time by deleting the App.
• For any other request, write to bestoftbest.service@gmail.com and include the "Anonymous device ID" from the "Our Story" screen or the Order ID from your Apple receipt (see Section 10). We will not ask for more than is needed.
• We reply within 14 business days; to an access request under the Israeli Protection of Privacy Law, no later than 21 days. Under the GDPR, within one month at most, with the possibility of extension where the law allows.
• Exercising your rights is free of charge, unless a request is manifestly unfounded or excessively repetitive, to the extent the law allows.

Complaint to an authority

If you are not satisfied with how we handled your request, you may contact the Israeli Privacy Protection Authority at the Ministry of Justice. Residents of the European Union, the European Economic Area or the United Kingdom may also contact the data-protection supervisory authority in their country (in the UK, the Information Commissioner's Office). We would appreciate the chance to resolve the matter with you first.

15.California (CCPA/CPRA) and other U.S. states

In short:We do not sell personal information, to anyone, and we never have.

Categories of personal information collected (preceding 12 months)

Sources, purposes and recipients are described in detail in Sections 4, 7 and 8. We retain each category for the period stated in Section 4. We do not use personal information for any purpose that is incompatible with those stated here.

Your rights as a California resident

• Right to know - to request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom it was disclosed.
• Right to delete - to request deletion of personal information we collected from you, subject to legal exceptions (for example, aggregate tax records).
• Right to correct - to request correction of inaccurate personal information.
• Right to opt out of sale or sharing - not applicable, because we do not sell or share personal information.
• Right to limit use of sensitive personal information - not applicable, because we do not collect it.
• Right to non-discrimination - we will not deny you the service, charge a different price or provide a different level of service because you exercised your rights.

How to exercise these rights

• Email bestoftbest.service@gmail.com with the subject line "Privacy request" and include your "Anonymous device ID" (from the "Our Story" screen) or the Order ID from your Apple receipt. Because we hold no account or contact information, these are the only ways we can locate a record, and we will use them solely to verify and fulfil your request.
• You may also write to the mailing address in Section 19. We do not operate a toll-free number; given the nature of the service (an app with no account), email and mail are our designated request methods.
• We will confirm receipt within 10 business days and respond within 45 days, which we may extend once by a further 45 days where reasonably necessary, with notice to you.
• Authorized agent: you may designate an authorized agent to make a request on your behalf. We may ask for written proof of the authorization and may ask you to confirm your identity directly.
• Local data (favorites, opened stories) never leaves your device; you can view and delete it yourself at any time.

Other U.S. states

Residents of other U.S. states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others) have similar rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sales and profiling. We do not engage in targeted advertising, sales or profiling. You may exercise your rights using the methods above. If we decline a request, you may appeal by replying to our response with the word "Appeal"; we will answer the appeal within 45 days, and if it is denied you may contact your state attorney general.

The App does not respond to "Do Not Track" or Global Privacy Control signals, because it performs no tracking and there is nothing to opt out of.

16.Cookies, tracking and advertising

• The App does not use cookies, pixels or similar tracking technologies.
• No advertising and no SDKs of ad networks or social networks.
• No analytics or crash-reporting tools (such as Google Analytics, Firebase Analytics, Crashlytics or Sentry).
• No "tracking" as Apple defines it: we do not link information from the App with information from third-party apps or websites, and we do not access the IDFA. For that reason the App does not display an App Tracking Transparency prompt.
• The support site sets no cookies of our own. The hosting provider (GitHub Pages) may process technical browsing data under its own policy.

17.App Store privacy label

In short:This is what is declared on the App's App Store page, and it matches this Policy.

The App's App Store page shows a privacy label (App Privacy). Here is the declaration, so you can compare it with this Policy:

Favorites and opened stories are not considered "collected" under Apple's definitions, because they never leave the device. If you find a discrepancy between the label and this Policy, please let us know - and this Policy governs.

18.Changes to this Policy

We may update this Policy, for example when we add a feature, a provider or a platform (such as Android). The current version is always published on the support site and at the link inside the App, with an update date and a version number.

• A material change (for example collecting a new type of information, or using information for a new purpose) will be published 14 days before it takes effect, with a prominent notice in the App and on the support site.
• Where the law requires consent to a change (for example processing sensitive information), we will not apply it to you without first obtaining your consent. Continued use of the App on its own will not be treated as such consent.
• Previous versions of this Policy are kept and provided on request.

Version 2.0 (September 29, 2026): Sign in with Apple and Google, email-address collection and the user account were removed. The provider list, the retention and deletion mechanism and the privacy label were updated.

Version 2.0, English edition (October 1, 2026): English edition published for the U.S. and worldwide launch. Added an expanded COPPA section (13), a full CCPA/CPRA notice with other U.S. state rights (15), GDPR/UK transfer details (9) and U.S. breach-notification wording (12). No change to what is collected or how it is used.

Version 2.1 (October 11, 2026): Updated for the new subscription model: one free story in total, and a yearly plan (sleep_stories_annual) alongside the monthly plan. No change to what is collected or how it is used.

19.Contact and governing law

For any privacy question, request or complaint:

This Policy is governed by Israeli law, as set out in Section 26 of the Terms of Use (the competent courts of Tel Aviv-Yafo, subject to your rights as a consumer and to the protections granted by the mandatory law of the country or state where you live, including your data-protection rights under the GDPR, the UK GDPR, COPPA and U.S. state privacy laws, which apply regardless of this choice of law).

This Policy was written in Hebrew. In the event of a conflict between this English edition and the Hebrew version, the Hebrew version prevails, subject to applicable law.