ChoreDen Privacy Policy

Effective date: June 22, 2026 Last updated: June 22, 2026

1. Who we are

ChoreDen ("ChoreDen", "we", "us", "our") is a gamified household-chores application that lets a family or household manage chores, award points, and redeem rewards.

This Privacy Policy explains what personal data we collect, why we collect it, the legal bases on which we rely (where applicable), who we share it with, and the rights you have over it.

• Data controller / operator: ChoreDen, operated by an independent developer based in the United Kingdom. You can reach us using the contact details in Section 15.
• Governing jurisdiction: England and Wales.
• Privacy contact: privacy@choreden.com
• Data Protection Officer / UK representative: Not appointed (not required for an operation of this scale).

If you do not agree with this Policy, please do not create an account or use ChoreDen.

2. Scope

This Policy applies to the ChoreDen progressive web app (PWA) and related websites, emails, and push notifications operated by us (collectively, the "Service"). It does not apply to third-party services we integrate with, which have their own privacy policies (see Section 6).

ChoreDen is designed for use by households containing adults and, optionally, child sub-profiles created and managed by an adult. Please read Section 10 (Children's Privacy) carefully.

3. The data we collect and why

We collect the categories of data below. We have grouped them by how they enter the Service.

3.1 Account data (adults who register)

Note on display names: when you register with email/password, the Service may automatically set your initial display name from the local part of your email address (the text before the "@"). You can change your display name at any time.

3.2 Profile data

Avatar storage. Avatar images are stored in a private storage bucket and served only through an authenticated proxy, so they are not publicly accessible by their URL. Images are re-encoded in your browser before upload, which removes embedded metadata (such as EXIF/GPS location), and the server enforces image content-type and size limits.

3.3 Household and activity data

When you use the Service, we process data about your household and what happens in it:

• Household details: household name, household avatar, time zone, week-start, points/currency naming, and configuration settings (e.g., verification thresholds, daily point caps, whether penalties are enabled).
• Membership: the members of your household (adults and child sub-profiles), their roles (owner, admin, member, child), and which adult manages each child sub-profile.
• Chores: chore titles, descriptions, categories, room/location labels, icons, effort/point values, recurrence schedules, and due times.
• Chore activity: assignments, completions, completion notes, completion photos (see photo notice below), verification status, and who verified what.
• Economy: points balances, an immutable points ledger (point transactions and reasons), rewards (including whether a reward represents money/allowance), reward redemptions, and approvals.
• Engagement: activity feed entries, reactions, achievements/badges, levels, battles/quests, and similar gameplay records.

Purpose: to provide the core Service — running chores, awarding and tracking points, enabling rewards and redemptions, and showing households their activity.

Chore-photo storage. Chore-completion photos are stored in a private bucket and served only through an authenticated proxy that confirms you are a member of the relevant household; they are not publicly accessible by their URL. Photos are re-encoded on upload to strip metadata (e.g., EXIF/GPS), and the server enforces image content-type and size limits. Even so, please avoid uploading images that identify a child or reveal a sensitive location.

3.4 Notifications data

You can disable push notifications in your browser/device settings or within the app; stale subscriptions are automatically removed.

3.5 Invitations and emails we send

• Invitation emails: When you invite someone to your household, we process the invitee email address you provide, the household name, and an invite code/link in order to send the invitation. Invitation emails are sent through our email provider (Resend). You are responsible for ensuring you have the right to invite the people you invite.
• Other transactional emails: account-confirmation, magic-link sign-in, password-reset, and similar emails are sent by our authentication provider (Supabase Auth).

We send transactional/service emails as part of operating the Service. We do not send marketing emails.

3.6 Sign-in with Google (optional)

If you choose Sign in with Google, Google shares with us (via OAuth) a limited set of profile information (typically your name, email address, and a profile-picture URL) so we can create or access your account. Your use of Google sign-in is also subject to Google's privacy policy. We do not receive your Google password.

3.7 Cookies, local storage, and similar technologies

We use a small number of cookies and local-storage entries that are necessary to operate the Service:

We use only strictly-necessary and functional cookies. We do not use third-party advertising cookies, and we do not set any non-essential cookies that would require consent.

3.8 Analytics

We do not use third-party product analytics or advertising trackers.

3.9 Technical and log data

Our hosting and infrastructure providers automatically process technical data needed to deliver and secure the Service, such as IP address, device/browser type, request metadata, and server logs. This is used for security, debugging, abuse prevention, and reliability.

4. Legal bases for processing (EEA/UK and similar regimes)

Where the UK GDPR or EU GDPR (or an equivalent law) applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): to create and operate your account and provide the core Service (households, chores, points, rewards, notifications you enable).
• Legitimate interests (Art. 6(1)(f)): to secure the Service, prevent fraud and abuse, maintain logs, improve reliability, and send service-related communications — balanced against your rights.
• Consent (Art. 6(1)(a)): for optional features such as push notifications. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): where we must process data to comply with applicable law.

Children: processing relating to child sub-profiles relies on the consent/authorization of the holder of parental responsibility and on data-minimization principles. See Section 10.

5. How we use the data (summary of purposes)

• Provide, maintain, and secure the Service.
• Authenticate users and manage sessions.
• Run the chore/points/rewards system and show household activity.
• Send invitations and transactional emails, and deliver push notifications you enable.
• Prevent, detect, and respond to fraud, abuse, security incidents, and violations of our terms.
• Comply with legal obligations and enforce our agreements.
• Improve and develop the Service.

We do not sell your personal data, and we do not use it for cross-context behavioral advertising.

6. Third-party processors and service providers

We share personal data with the following providers only as needed to operate the Service. Each acts as our processor/service provider (or, where noted, an independent controller) and is bound by appropriate contractual terms (e.g., a Data Processing Agreement).

We require providers to protect personal data and to use it only to provide services to us. We are not responsible for the independent practices of these providers; review their policies for details.

7. International data transfers

ChoreDen's providers may process data in countries outside your own, including the United States and other locations where our providers operate. Where we transfer personal data out of the UK or EEA, we rely on appropriate safeguards, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, adequacy decisions where available, and/or other lawful transfer mechanisms.

• Primary data-processing region(s): the United Kingdom and/or the European Economic Area (EEA), depending on our providers' configured regions, with some technical/log processing in the United States.
• You may request more information about the safeguards we use by contacting us at privacy@choreden.com.

8. Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

When data is deleted, residual copies may persist in encrypted backups for up to 30 days before being overwritten.

9. Your rights and how to exercise them

Depending on where you live, you may have some or all of the following rights:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data (much of which you can edit in-app).
• Erasure ("right to be deleted") — request deletion of your account and associated personal data, subject to legal exceptions.
• Portability — receive certain data in a structured, machine-readable format.
• Restriction / objection — restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent — where we rely on consent (e.g., push notifications), withdraw it at any time without affecting prior lawful processing.
• Lodge a complaint — with your local data protection authority (in the UK, the Information Commissioner's Office).

How to exercise your rights:

• Many actions are available in-app from your Profile: edit your profile, change your display name/avatar, manage notifications, download a copy of your data, and delete your account (Profile → Danger zone).
• For any other request, or if you need help, contact us at privacy@choreden.com with enough detail to identify your account. We may need to verify your identity before acting. We will respond within the timeframe required by applicable law (generally within one month, extendable where permitted).

Household admins and shared data: Because ChoreDen is a shared household app, some data you create (e.g., completions, activity-feed entries) is visible to other members of your household and may remain associated with the household even after you leave. Deleting your individual account does not necessarily delete the household or content created by others. We will explain any limits when you make a request.

10. Children's Privacy

ChoreDen handles children's data through a deliberately minimal, parent-controlled design. Because children's-data law (including the UK/EU GDPR age-of-consent rules and the U.S. COPPA) is strictly enforced and varies by jurisdiction, we encourage parents to read this section carefully.

No direct child accounts. ChoreDen does not allow children to register their own accounts. Only adults can create a ChoreDen account (with an email address and password, or via Google sign-in). Our Service is directed to adults managing a household.

Child sub-profiles. An adult household member may create child sub-profiles. By design, a child sub-profile:

• has no login, no email address, and no password — a child cannot sign in;
• is managed by an adult ("parent/guardian") in the household;
• is intended to store minimal information — typically only a display name and an optional avatar image chosen/uploaded by the managing adult — plus the in-app chore/points activity associated with that sub-profile.

Parental responsibility. The adult who creates a child sub-profile is responsible for:

• having the legal authority (parental responsibility) to create and manage the sub-profile;
• the information they enter about the child (please avoid entering unnecessary personal details, and do not upload photos that identify the child or a sensitive location);
• supervising the child's use of any shared household device.

Parental rights and controls. A managing adult can view and edit a child sub-profile in-app, and can request deletion of a child sub-profile and its associated data at any time by contacting privacy@choreden.com. We will honor verified parental requests to access or delete a child's information as required by law.

What we do not do. We do not use children's data for advertising or build advertising profiles of children. If you believe a child's personal data has been provided to us without proper authorization, contact us at privacy@choreden.com and we will take appropriate steps to investigate and, where required, delete it.

11. Security

We take reasonable technical and organizational measures to protect personal data, including:

• Database access controls: the database enforces default-deny row-level security, so users can generally access only data belonging to their household; sensitive economy operations are performed through controlled server-side functions.
• Private file storage: avatar and chore-completion images are kept in private storage and served only through an authenticated proxy — they are not publicly accessible by URL. Uploads are re-encoded to strip metadata, and the server enforces image content-type and size limits.
• Authentication: sessions are managed via secure, HTTP-only cookies handled by our authentication provider; we do not store plaintext passwords. Optional two-factor authentication (TOTP) is available for your account.
• Web hardening: the Service sends HTTP security headers, including a Content-Security-Policy and HTTP Strict Transport Security (HSTS), and applies rate limiting to authentication and other sensitive endpoints.
• Secrets: privileged keys are restricted to server-side use and are not exposed to browsers; the push-notification webhook uses a dedicated, least-privilege secret.
• Invitations: invite codes are generated with a cryptographically secure random source.
• Encryption in transit (HTTPS/TLS) for data moving between you and the Service.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Data breach notification

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and/or affected users as and when required by applicable law (for example, the UK/EU GDPR's 72-hour authority-notification timeline).

13. Automated decision-making

We do not use your personal data for solely automated decision-making that produces legal or similarly significant effects about you. Certain gameplay automations (such as auto-verification or auto-assignment of chores) are operational features and do not produce legal or similarly significant effects.

14. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you (e.g., in-app or by email). Your continued use of the Service after an update means you accept the revised Policy, to the extent permitted by law.

15. Contact us

• Privacy/data-protection contact: privacy@choreden.com
• Postal address: available on request by emailing privacy@choreden.com
• Supervisory authority: In the United Kingdom, you may contact the Information Commissioner's Office (ICO) — https://ico.org.uk/make-a-complaint/