Privacy Policy

Last updated: 29 September 2026 · Nederlandse versie

In short

  • Dibero is an app that teaches children about money. All money in the app is pretend money. We never hold, move or see your real money, and we don't connect to your bank.
  • A parent or guardian creates the family account and stays in control of their children's profiles.
  • We collect what the app needs to work, plus privacy-friendly usage statistics and crash reports.
  • We don't show ads, we don't sell data, and we never use the advertising ID.
  • You can view, correct, export or delete your family's data at any time. Deleting your family account in the app deletes all of it, including your login.

1. Who we are

Dibero is a product of SmartID Technologies B.V., Leliegracht 32, 1015 DG Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 74371908 ("we", "us"). We are the controller of the personal data described in this policy. You can reach us at hello@smartidtechnologies.com.

This policy covers the Dibero apps for iOS and Android and the website dibero.app.

2. How a Dibero family account works

  • A parent or guardian aged 18 or over creates the family account by signing in with Apple, Google or a link sent to their email address. This person is the account holder.
  • The family shares this one login. Inside the app, every parent and child has their own profile. Parent profiles are protected by a parent PIN; a child profile can have its own PIN.
  • A child's own phone or tablet is connected by a parent: the child's device shows a QR code, and the parent scans it with their Dibero app. Children don't need an email address or password.
  • Parents can see and manage everything in the family. Children see their own jars, transactions and lessons.

3. What we collect

Account holder

Email address, name (as provided by Apple or Google, or as entered by you), the sign-in method you used and a technical user ID.

Family and profiles

Family name; the names or nicknames you give parents and children; each child's date of birth (used to show their age and to offer age-appropriate content); chosen colours and sound settings; and the family's language, currency, country and number format.

PINs

The parent PIN is checked on our servers against a protected (salted and peppered) hash, with a limit on wrong attempts. Each device also keeps a protected check value in its secure storage so the app can be unlocked offline. Child PINs are stored with the child's profile, so a parent can look them up in the app.

Pretend money

Jars (name, category, savings goal, balance), transactions (amount, who and which jar it was between, the names shown on it and an optional note), recurring allowances and deposits, and interest settings.

Lessons

Which lessons a child has completed, whether each answer was right or wrong, and when they last played. We use this only to show progress and to continue where the child left off.

Notifications

If you allow notifications: a push token for the device, the platform (iOS or Android), the app language and which family members should receive notifications on that device. Notifications can contain names and amounts, for example "Hi Sam, you received €2 from Mum!".

Subscriptions

If you buy Dibero Ultra: which plan you have, when it started and ends, and transaction references from the app store. Payment is handled by Apple or Google; we never see your card details.

Invite-a-family programme

Your family's invitation code, which family invited which (by internal ID only), relevant dates, whether an invited family has qualified, and the rewards earned. To decide whether an invited family qualifies, our systems automatically check that the family still exists after 3 days and has really used the app (a transaction made by a person at least 24 hours after sign-up, or a completed lesson). We never tell the inviting family who joined or what they did, only that "a family" used their code.

Device and usage data

  • Usage statistics (Google Analytics for Firebase): events such as opening the app, screens used and session length, linked to a random app-installation ID, together with device model, operating system, app version, language and approximate region.
  • Crash and performance reports (Firebase Crashlytics and Performance Monitoring): device model, operating system, app version and technical details of the error or slow screen.
  • Country at first launch: the first time the app is opened, before any account exists, it sends the device's IP address to ipapi.co to estimate your country, so it can suggest a language and currency. We keep only the resulting country code.
  • App integrity (Firebase App Check): checks, through Apple App Attest or Google Play Integrity, that requests come from a genuine copy of our app.
  • IP address: every connection to our servers involves your IP address, which is processed in Google's technical logs.

Support and feedback

What you send us by email or through our feedback board.

What we don't collect

We don't collect precise location, contacts, photos, bank details or the advertising ID. We don't ask children for an email address, phone number or photo. The camera is used only to scan the sign-in QR code; no images are stored.

4. Why we use it (legal bases)

  • Providing Dibero (accounts, profiles, pretend money, allowances, interest, lessons, syncing between devices): necessary to perform our contract with you (GDPR art. 6(1)(b)).
  • Security (PINs, device sign-in by QR code, App Check, preventing fraud and misuse, including of the invite programme): our legitimate interest in a safe service (art. 6(1)(f)).
  • Notifications you asked for: our contract with you. You can switch them off in the app or in your device settings.
  • Subscriptions and rewards: our contract with you, and our legal obligation to keep accounting records (art. 6(1)(c)).
  • Usage statistics, crash and performance reports: our legitimate interest in keeping the app working and improving it. We have set these up to be privacy-friendly: no advertising ID, ad-personalisation signals switched off, never used for advertising and never combined with other data about you. You can object at any time (see section 9).
  • Country check at first launch: our legitimate interest in presetting the right language and currency.
  • Support: our contract with you and our legitimate interest in helping you.
  • Voice help (once available): the parent's consent (art. 6(1)(a)), which can be withdrawn at any time.

Children's data is entered and managed by the parent and is processed under the parent's contract with us, only to provide Dibero to the family. We do not rely on a child's own consent.

We don't use any data for advertising, we don't sell or rent data, and we don't make automated decisions that have legal or similarly significant effects on you. The invite-programme check is automated; if you disagree with its outcome, contact us and a person will review it.

5. AI in Dibero

  • Lesson content. Questions, hints and spoken feedback are written with the help of Google's Gemini AI models and are reviewed by our team before they are published. The voice of the lesson characters is a computer-generated voice, recorded in advance. No personal data about you or your children is used to create lessons or voice clips.
  • Voice help (planned, not yet available). We plan to let a child talk to the lesson character when they need help. This is why the app asks for microphone permission. If we release it:
    • it stays off until a parent switches it on in the app;
    • the microphone is only used while the child is actively using voice help;
    • the audio is streamed live to Google's Gemini AI through Google Cloud, which acts as our processor, to understand the question and speak an answer. We don't store recordings or transcripts;
    • the child is told that they are talking to an AI;
    • we will update this policy and the information in the app before release.

6. Who we share data with

We don't sell data. We use the service providers below. They act as our processors: they may use the data only on our instructions and under a data processing agreement.

  • Google (Google Ireland Ltd. and Google LLC), through Firebase and Google Cloud: sign-in (Firebase Authentication), the database (Cloud Firestore, located in the Netherlands), server functions (Cloud Functions, located in the United States), storage of lesson audio, push notifications (Firebase Cloud Messaging), Analytics, Crashlytics, Performance Monitoring, Remote Config, App Check and Gemini AI.
  • RevenueCat, Inc. (United States): manages subscriptions and rewards. It receives your technical user ID and your purchase information from the app store.
  • ipapi.co (Kloudend, Inc., United States): the one-time country check at first launch.
  • Featurebase: our feedback board, only if you use it.
  • Webflow, Inc. (United States): hosting of our website.

Apple and Google also process data as independent controllers, under their own privacy policies, when they act as app store and payment provider, and as sign-in provider if you choose Sign in with Apple or Google.

We may disclose data if the law requires it, or where necessary to protect the rights and safety of our users or ourselves.

7. Transfers outside the EU

Your family's data is stored in the Netherlands. Some providers process data outside the European Economic Area, mainly in the United States (our server functions, RevenueCat, ipapi.co and Webflow). For these transfers we rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses, together with safeguards such as encryption. You can ask us for more information.

8. How long we keep data

  • Family account data (profiles, pretend money, lessons, invitation data): for as long as the family account exists. Everything is deleted when you delete the family account.
  • Your login and your subscription record at RevenueCat: deleted when you delete the family account. Deleting your account does not cancel an App Store or Google Play subscription; you cancel that in your store settings.
  • Removing a child profile deletes that child's jars, recurring allowances, lesson progress and notification settings. Transactions the child took part in stay in the family's history, showing the name used at the time, until the family account is deleted.
  • Device sign-in sessions (QR code): deleted within minutes. Temporary sign-ins that never become a family account: deleted after 24 hours.
  • Details entered during sign-up are stored only on your device until your family account is created, and are then removed from the device.
  • Usage statistics: data linked to an app-installation ID is deleted after 14 months; after that only aggregated figures remain.
  • Crash reports: 90 days.
  • Support messages: until your question is resolved, plus one year.
  • Accounting records: 7 years, as required by Dutch law. These don't contain children's data.

Deleted data can remain in Google's secure backup systems for a limited time (up to about six months) before it is permanently overwritten.

9. Your rights

Under the GDPR you have the right to:

  • access the data we hold about you and your family;
  • correct it;
  • have it deleted;
  • restrict how we use it;
  • receive it in a machine-readable format (portability);
  • object to processing based on our legitimate interest, including usage statistics;
  • withdraw consent you have given, at any time.

Many of these you can do yourself in the app: change names, remove a child profile, or delete the whole family account under Settings > Account management. For anything else, email hello@smartidtechnologies.com. We respond within one month and may ask you to confirm that the account is yours. Parents exercise these rights on behalf of their children.

You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your country. We'd appreciate the chance to help you first.

10. Children

Dibero is made for families with children and is meant to be used under a parent's supervision. A parent creates the account and the child profiles; children cannot create an account themselves.

From children we collect only what the app needs: what they type in the app (such as a jar name or a note on a transaction), their lesson answers and the technical device data needed to run the app (push token, crash reports and usage statistics). Please tell your children not to type personal details such as addresses or phone numbers into jar names or notes.

Notice to parents in the United States (COPPA)

This section is our direct notice to parents under the Children's Online Privacy Protection Act. We collect the information from children described above, and use it only to provide and support the app. We do not disclose it to third parties other than the service providers listed in section 6, and we do not use it for advertising. You can review your child's information, have it deleted, or stop further collection at any time by removing the child's profile in the app or by emailing us. Operator: SmartID Technologies B.V., Leliegracht 32, 1015 DG Amsterdam, the Netherlands, hello@smartidtechnologies.com.

11. Security

  • Data is encrypted in transit (HTTPS/TLS) and at rest.
  • Each family can access only its own data, enforced by database security rules and checks on our servers.
  • The parent PIN is checked on our servers against a salted and peppered hash, with a limit on wrong attempts.
  • App Check blocks requests that don't come from a genuine copy of our app.
  • Within our team, access to production data is limited to people who need it.

No system is completely secure. If a data breach puts your rights at risk, we will inform the Autoriteit Persoonsgegevens and you, as the law requires.

12. Data stored on your device

The app stores your settings (such as language and currency), a copy of your family's data for offline use, sign-up details until your account is created, and the parent PIN check value in the device's secure storage (Keychain or Keystore). This is removed when you delete the app.

13. Our website

Our website dibero.app is hosted by Webflow. We don't use analytics or advertising cookies on the website. Like any web server, Webflow processes your IP address in order to deliver the pages.

14. Changes to this policy

We update this policy when Dibero changes. The date at the top shows when it was last changed. If we make important changes, we'll tell you in the app or by email before they take effect.

15. Contact

SmartID Technologies B.V.
Leliegracht 32, 1015 DG Amsterdam, the Netherlands
KvK 74371908
hello@smartidtechnologies.com