Privacy Policy

1. Who we are

Rewardy Ltd (“Rewardy”, “we”, “us”, or “our”) operates the Rewardy family chores & rewards application (the “Service”). We are the data controller for personal data processed through the Service.

For the purposes of UK GDPR, our contact details are set out in Section 13.

2. Data we collect

2.1 Account data (parent / guardian)

• ›Email address — used to create and manage your account, send transactional messages (e.g. password resets), and, if you opt in, product updates.
• ›Hashed PIN — your 4-digit admin PIN is stored as a one-way bcrypt hash. We cannot read your PIN.
• ›Account preferences — settings such as animation preferences saved against your account.

2.2 Children's profile data

• ›First name (or any name you choose — we recommend using nicknames rather than full legal names).
• ›Emoji avatar & colour theme — chosen by you or the child from a fixed set of options.
• ›Chore & task data — chore names, point values, difficulty ratings, and completion status.
• ›Points & rewards data — current points balance, lifetime points, reward redemption history.
• ›Badge & achievement data — earned badges and streak information.

2.3 Technical & usage data

• ›Log data — our hosting infrastructure (Supabase / Vercel) automatically records standard server logs including IP addresses, browser type, and pages accessed. These are retained for up to 30 days for security and debugging purposes only.
• ›We do not use third-party analytics, advertising trackers, or behavioural profiling tools.

3. How we use your data

• ›To create and manage your account.
• ›To provide the core features of the Service: chore tracking, points management, leaderboards, badges, and reward redemptions.
• ›To send transactional emails (account verification, password resets). We will only send marketing emails if you have explicitly opted in, and you can unsubscribe at any time.
• ›To investigate and resolve security incidents or abuse reports.
• ›To comply with legal obligations.

We do notuse your data or your children's data for advertising, profiling, or automated decision-making that produces legal or similarly significant effects.

4. Legal basis for processing

Under UK GDPR we rely on the following legal bases:

5. Children's data

5.1 Age of the account holder

The Service is intended for use by parents and guardians who are aged 18 or over. By creating an account you confirm that you are at least 18 years old. We do not knowingly allow children to create parent accounts.

5.2 Children's profiles (UK GDPR Article 8)

Under UK GDPR, special rules apply to processing the personal data of children under 13. By adding a child profile you, as the parent or guardian, are providing consent on behalf of that child for the data described in Section 2.2 to be processed for the sole purpose of operating the Service.

We recommend using a nickname or first name only — not a full legal name — for child profiles.

If you believe we have inadvertently collected personal information from a child without verifiable parental consent, please contact us immediately at info@rewardy-io.com and we will delete it promptly.

5.3 What children can and cannot see

The child-facing view of the app shows only that child's own points, tasks, and badges. The parent dashboard (protected by a PIN) contains account settings, approval controls, and reward management. Children do not have access to parent account information or the email address on the account.

6. Who we share data with

We do not sell, rent, or trade your personal data. We share data only with the following processors, under contractual data-processing agreements:

We may also disclose data if required to do so by law, court order, or regulatory authority, or to protect the rights, property, or safety of Rewardy Ltd, our users, or the public.

7. How long we keep data

• ›Active account data — retained for as long as your account is active.
• ›After account deletion — all personal data and child profiles are permanently deleted within 30 days of a deletion request, except where we are required by law to retain it longer.
• ›Security logs — retained for up to 30 days then automatically purged.
• ›Backup copies — may persist for up to 90 days in encrypted automated backups before being overwritten.

8. Security

We take reasonable technical and organisational measures to protect your data, including:

• ›All data transmitted over TLS/HTTPS.
• ›Parent PIN stored as a bcrypt hash — we cannot recover or read your PIN.
• ›Database access restricted via Supabase Row-Level Security (RLS) policies.
• ›Production credentials stored as environment variables, never in code.

No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it responsibly to info@rewardy-io.com.

9. Cookies & tracking

Rewardy uses only the following cookies and local storage:

• ›Authentication session cookie — set by Supabase SSR to keep you logged in. This is strictly necessary for the Service to function.
• ›Browser localStorage / sessionStorage — used to store UI state (e.g. selected child, animation preference) locally on your device. This data never leaves your browser.

We do not use advertising cookies, third-party tracking pixels, or analytics cookies (e.g. Google Analytics).

10. Your rights

Under UK GDPR you have the right to:

• ›Access — request a copy of the personal data we hold about you.
• ›Rectification — ask us to correct inaccurate data.
• ›Erasure — ask us to delete your data (“right to be forgotten”).
• ›Restriction — ask us to pause processing in certain circumstances.
• ›Portability — receive your data in a structured, machine-readable format.
• ›Objection — object to processing based on legitimate interests.
• ›Withdraw consent — where processing is based on consent (e.g. marketing emails), you can withdraw at any time without affecting prior processing.

To exercise any of these rights, email info@rewardy-io.com with “Privacy Request” in the subject line. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. International data transfers

Our service providers (Supabase, Vercel, and Stripe) may process data outside the UK. Where this occurs, we rely on the UK International Data Transfer Agreement (IDTA) and adequacy decisions made by the UK Government to ensure your data receives an equivalent level of protection to that afforded under UK GDPR.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the “Effective” date at the top of this page and, where appropriate, notify you by email. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

13. Contact us