Privacy Policy
Last updated: 30 October 2026
Child Reward is a family chore and reward app for iPhone, iPad and Android. It is made by Bartosz Smyk, who is the data controller for the app and this website ("we"). This policy explains what we collect, why, who processes it for us, and how to have it removed. Questions: [email protected].
In short: a parent creates the account and adds the children. We use the data to run the app. There are no ads and no advertising trackers, and we never sell your data. You can delete everything from the app at any time.
What we collect
| Data | Details | Why |
|---|---|---|
| Parent account | Email address and a hashed password, or your Apple or Google sign-in identifier and email. Guest accounts use a random identifier. | To sign you in and keep your family's data together. |
| Child profiles | Name, birth date, chosen avatar or a photo, level and avatar items. Entered by the parent. | To show each child their own tasks and progress. |
| Family activity | Tasks, routines, rewards, goals, stars, streaks, approvals, and the family feed built from them. | This is the service itself. |
| Photos | Photos you or your child choose to add: profile pictures, reward pictures and photo proof of a finished task. | To show them to the family inside the app. |
| Device data | A push notification token for each paired device. | To send reminders, approvals and the weekly recap. |
| Purchases | Subscription status and store transaction identifiers. Apple or Google handle payment; we never see your card. | To unlock Child Reward Pro. |
| Diagnostics | Crash reports and performance data: device model, OS and app version, and what the app was doing when it failed. | To find and fix bugs. |
The app uses the camera and photo library only when you choose to add a photo. We do not collect location, contacts or advertising identifiers.
Children's privacy
Child Reward is used by children, under the supervision of a parent or guardian. Children do not create accounts and never enter an email address: a parent adds them to the family and connects their device with a short code. By adding a child, you confirm that you are their parent or guardian and that you consent to this processing on their behalf.
- We collect from children only what the app needs: task activity, and photos they choose to take for a task.
- Children see no ads, and no advertising trackers run in the app.
- Children cannot contact people outside the family through the app.
- Parents can see, edit and delete everything about their child at any time, and can write to us with any request about it.
If you believe a child has given us personal information without a parent's knowledge, write to us and we will delete it.
Legal bases (EEA and UK)
- Contract: running the app you signed up for, including subscriptions.
- Consent: the parent's consent for child profiles and photos, and push notifications. You can withdraw it by removing the data or turning notifications off.
- Legitimate interests: keeping the service secure and fixing crashes.
- Legal obligation: anything the law requires us to keep.
Who processes data for us
We share data only with the providers below, only to run the app, and never for their own advertising.
| Provider | Purpose |
|---|---|
| Supabase, Railway, Heroku | Database and application hosting |
| Amazon Web Services (S3) | Storage of photos, in the United States |
| Google Firebase Cloud Messaging | Delivery of push notifications |
| Sentry | Crash and performance reports |
| Resend | Account emails, such as password resets |
| Apple and Google | Sign-in and in-app purchases |
Within a family, members see each other's activity: parents see everything, and children see their own screen. We may disclose information if the law requires it, or to protect the safety of our users.
International transfers
Some providers process data outside your country, including in the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
How long we keep data
We keep your data while your account exists. Deleting your account removes it from our live systems straight away; backups roll over within 30 days. Crash reports expire automatically on our provider's schedule. See Delete your account for the details.
Security
Data travels over encrypted connections, passwords are stored hashed, and access to production systems is limited. No system is perfectly secure, so please use a strong password and tell us about any problem you find.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, restrict or object to processing, and withdraw consent. Most of this is in the app; for anything else, email [email protected] from your account's address. You can also complain to your local data protection authority.
This website
This site sets no cookies and runs no analytics. Fonts load from Google Fonts, so your browser's IP address reaches Google. Our host keeps ordinary server logs.
Changes
If we change this policy we will update the date at the top, and tell you in the app if the change is significant.
Contact: Bartosz Smyk, [email protected]