This Privacy Policy describes how ChoreCrown ("we," "us," or "our") collects, uses, and protects information when you use our website and mobile app at chorecrown.com. ChoreCrown is a family chore management app that helps parents assign chores, track completion, and reward children through gamification (points, levels, and rewards).
1. Information We Collect
Parent/Guardian Information
- Email address: Used for login, password resets, email verification, and account notifications.
- Password: Hashed using bcrypt before storage. Never stored in plain text.
- Parent PIN: A numeric PIN used for quick authentication on kid-facing devices. Hashed using bcrypt before storage.
- Family name: A display name for your household (e.g., "The Smith Family").
- Consent records: Timestamp of when you accepted this Privacy Policy and Terms of Service.
Child Information
- Name: The name of each child as entered by the parent.
- Birthday: Optional. Used for age display and birthday features.
- Avatar and color: Visual profile customization chosen by the parent or child. Parents may optionally upload a photo of their child as an avatar. Each child's first name, avatar, and color appear on the family's login screen on devices set up for your household; points and levels are not shown there. Uploaded photos are served through signed, expiring links rather than a public listing or login page.
- Chore assignments and completion records: Which chores were assigned, completed, approved, or rejected.
- Points, levels, and XP: Gamification data earned through chore completion.
- Streak data: Consecutive chore completion streaks for motivation.
- Reward redemptions: Records of rewards redeemed by the child using accumulated points.
- Data children enter themselves: While using the app, children generate activity records (chore submissions, redemptions, achievement milestones, optional mini-game play time) and may choose avatar preferences (hair, colors, accessories). Children are never asked for contact details, photos, payment information, or free-text personal information.
Device and Usage Data
- Household ID: A unique identifier stored in your browser's local storage to associate a device with your family.
- Push notification subscription: If you enable notifications, we store a browser push subscription token.
- IP address: Processed transiently by our infrastructure providers for security and rate limiting. We do not store IP addresses in the application database.
2. How We Use Your Information
- Managing your family's chores, points, rewards, and rotation schedules.
- Authenticating parents and children on their respective devices.
- Sending password reset emails and email verification links.
- Sending push notifications for chore reminders and approval updates (if enabled).
- Managing Pro tier trials and promotional upgrades (no payment processing occurs at this time).
- Maintaining streak data, completion history, and analytics to help parents track progress.
- Preventing fraud and unauthorized access.
3. Data Sharing and Disclosure
We do NOT sell your data. Your family's information is not provided, sold, or made available to advertisers, data brokers, or any third party for marketing purposes.
We share data only with the following service providers, who process data on our behalf to operate the service:
- Cloudflare: DNS, CDN, and security (processes IP addresses and web traffic in transit).
- Google (Gmail SMTP): Sends transactional emails (password resets, verification links). Email addresses are shared with Google's SMTP service for the sole purpose of delivering these emails.
- Oracle Cloud: Server hosting for the backend application, database, uploaded images, and encrypted database backups.
- Push notification services (Google FCM, Mozilla, and your browser vendor): Delivers web push notifications you opt into. Notification content may include child first names and chore or reward names (e.g., "Aiden completed: Make your bed").
- Amazon Alexa (optional): Only if you link the ChoreCrown Alexa skill. Voice requests are processed by Amazon; Amazon receives the spoken member names, chore names, and reward names needed to answer them, and we receive the transcribed requests. We store only the account link between your Alexa user ID and your household — we never receive or store audio recordings.
We may disclose information if required by law, court order, or to protect the rights, safety, or property of our users.
4. Children's Data and Parental Consent (COPPA)
ChoreCrown is designed as a parent-managed tool. We comply with the Children's Online Privacy Protection Act (COPPA) and the following principles:
- Parental consent required: Only a parent or legal guardian can create an account and add children. At signup — and when any invited co-parent accepts their invitation — the parent must explicitly consent to the collection of their children's data.
- Children never provide contact or identity details: Children log in by tapping their profile on a family-registered device — no email, phone number, password, or other contact information is collected from them, and they cannot upload files. Activity records and cosmetic choices are generated as they use the app (see "Data children enter themselves" above).
- Parental control: Parents can view, modify, export, and delete all data associated with their family at any time through the Account Settings page.
- No behavioral advertising: We do not show advertising to children or use their data for behavioral targeting.
- No third-party sharing: Children's data is never shared with third parties for any purpose other than operating the core service.
Parents can withdraw consent and delete all family data at any time by using the "Delete Account" feature in Account Settings.
5. Your Rights (GDPR, CCPA, and State Laws)
If you are located in the European Union (GDPR), California (CCPA/CPRA), or other jurisdictions with data protection laws, you have the following rights:
- Right to access: You can request a copy of all data we hold about you and your family.
- Right to rectification: You can correct inaccurate information through the app or by contacting us.
- Right to erasure ("right to be forgotten"): You can delete your account and all associated data at any time.
- Right to data portability: You can export your family's data in JSON format.
- Right to object: You can object to certain processing of your data.
- Right to withdraw consent: You can withdraw consent for data processing by deleting your account.
To exercise any of these rights, use the Account Settings page or contact us at the email below.
6. Data Retention
We retain your family's data for as long as your account is active. If you delete your account, all data is permanently removed from our database within 30 days. We do not retain backups of deleted data beyond our standard backup rotation (backups are overwritten on a rolling basis).
If a subscription is cancelled but the account is not deleted, we retain the data so the family can resubscribe without losing their chore history.
7. Data Deletion and Export
Delete your account: Parents can delete their entire family account at any time from Account Settings. This permanently removes all parent information, child profiles, chores, rewards, completion history, uploaded images (including child avatar photos), and tokens. This action cannot be undone.
Export your data: Parents can download all family data in JSON format from Account Settings at any time.
Email request: You can also email us at [email protected] to request deletion or export.
8. Data Security
- Passwords and PINs are hashed using bcrypt before storage. We never store plain-text passwords.
- All web traffic is encrypted using HTTPS (TLS 1.2+).
- JWT tokens are used for authentication and expire after 60 minutes (access token) or 7 days (refresh token).
- The database is hosted on a private server accessible only through the application backend.
- No payment card data is collected or stored — paid subscriptions are not currently offered.
While we take reasonable measures to protect your data, no method of transmission or storage is completely secure. If a data breach occurs, we will notify affected users within 72 hours as required by GDPR Article 34.
9. Payment Processing
Paid subscriptions are not currently offered. Pro tier is granted via promotional codes or a free trial — we do not collect, store, or process any payment information.
If we introduce paid subscriptions in the future, payment processing will be handled by a PCI DSS–compliant provider and this policy will be updated before any payment data is collected.
10. Cookies and Local Storage
ChoreCrown does not use tracking cookies, advertising cookies, or third-party analytics. We use your browser's local storage to:
- Store authentication tokens (JWT) so you stay logged in.
- Store your household ID and family pairing code so kid devices remember which family they belong to.
- Remember if you've dismissed the install prompt.
Local storage data is cleared when you log out or delete your account. No tracking or cross-site advertising is performed.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify users by email and/or through the app. The effective date at the top of this policy indicates when it was last updated. Continued use of the service after changes constitutes acceptance of the updated policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us: